Personal data processing policy

Personal data processing policy

1. General Provisions.

1.1. The personal data processing policy of the individual entrepreneur M. E. Rozdukhov, hereinafter referred to as the Policy, defines the basic principles, goals, conditions and methods of processing personal data, lists of subjects and personal data processed by the individual entrepreneur Maksim Rozdukhov (TIN: 352500101378, OGRNIP: 304352521100085, address: 160009, Vologda, Zosimovskaya st., 91/72), (hereinafter referred to as the Operator), functions of the Operator in the personal data processing, the rights of the personal data subjects, as well as the requirements for personal data protection implemented by the Operator.

1.2. The terms and definitions are used in the Policy in accordance with their meanings as they are defined in the Federal Law No. FZ-152 "On Personal Data".

1.3. The policy has been developed in accordance with the requirements of the Constitution of the Russian Federation as well as the legislative and other regulatory acts of the Russian Federation relating to personal data.

1.4. The Policy applies to personal data received both before and after the approval of this Policy.


2. Principles of personal data processing.

2.1. The Operator shall process personal data on legitimate and equitable basis.

2.2. When processing personal data, the Operator ensures their accuracy, sufficiency, and, if necessary, relevancy with regard to the declared purposes of processing personal data.

2.3. The operator shall not disclose to any third parties and shall not distribute personal data without the consent of the personal data subject, unless otherwise provided for by the federal law.

2.4. Personal data processing by the Operator is limited to achievement of specific predefined legitimate objectives. No personal data processing shall be allowed, which is inconsistent with objectives of personal data collection.

2.5. Content and volume of personal data processed by the Operator shall meet the declared purposes of processing. Personal data processed shall not be redundant in relation to the declared purposes of processing.

2.6. The Operator shall not process personal data relating to race, nationality, political views, religious or philosophical beliefs and private life. The Operator is allowed to process personal data relating to health and nationality of the personal data subject when such personal data is processed in accordance with the Russian legislation.

The Operator shall not take decisions on the basis of exclusively automated processing of personal data that produce legal consequences in relation to the personal data subject or otherwise affect rights and legitimate interests of the personal data subject.


2.7. The Operator shall not carry out cross-border transmission of personal data.


2.8. For the purpose of information provision, the Operator may create publicly available sources of personal data. The operator may include personal data in public sources of personal data with the written consent of the personal data subjects.

2.9. When collecting personal data, including through the use of the information and telecommunication Internet network, the Operator ensures recording, systematization, accumulation, storage, validation (updating, modification), extraction of personal data of citizens of the Russian Federation with the use of the databases located on the territory of the Russian Federation.

3. Personal data processing conditions.

3.1. Personal data shall be processed by the Operator in the following cases:

3.1.1. Personal data shall be processed with consent of the personal data subject;

3.1.2. Personal data processing is necessary for achievement of purposes provided for by international treaties or the legislation of the Russian Federation, for exercise and fulfilment of functions, authorities and responsibilities imposed on the Operator by legislation of the Russian Federation;

3.1.3. Personal data processing is necessary for performance of an agreement a party, a beneficiary or a surety to which the personal data subject is, and for execution of an agreement at the initiative of the personal data subject or an agreement under which the personal data subject shall be a beneficiary or a surety;


3.1.4. Personal data processing is necessary to implement rights and legitimate interests of the operator or third parties, including in cases provided for by the Federal Law "On protection of rights and legitimate interests of individuals in the activities aimed at overdue payment collection and on Amendments to the Federal Law "On Microfinance activities and microfinance organizations", or to achieve socially significant objectives, provided that no rights or freedoms of the personal data subject are violated;

3.1.5. Personal data shall be processed, which is subject to publication or compelling disclosure in accordance with the federal law;

3.1.6. Personal data shall be processed in other cases prescribed by the law, including the federal law No. 152-FZ of July 27, 2006 "On Personal Data".

3.2. The Operator is entitled to delegate the processing of personal data of subjects to third parties, provided that the requirements of the Federal Law No. 152-FZ of July 27, 2006  "On Personal Data" are met.

3.2.1. The Operator shall define a list of actions (operations) relating to personal data that will be performed by the person processing personal data and the Operator shall define the purposes of processing. The third party that processes the data shall maintain the confidentiality of personal data and ensure the security of personal data during the processing, as well as meet the requirements for protection of processed personal data in accordance with the law.

3.3. The Operator is not obligated to verify the personal data provided by the personal data subject. When collecting and processing personal data, the Operator shall assume that the personal data subject provides reliable and sufficient personal data to achieve the objectives of processing.

4. Volume and categories of processed personal data, categories of personal data subjects. Purposes of personal data processing.

4.1. The Operator shall process the personal data of the personal data subjects in order to fulfill functions, authorities and responsibilities imposed on the operator by the Constitution of the Russian Federation, federal laws, including but not limited to: the Civil Code of the Russian Federation, the Tax Code of the Russian Federation, the Labor Code of the Russian Federation, the Domestic Relations Code of the Russian Federation, Federal Law No. 27-FZ dated April 1st, 1996 “On individual (personalized) accounting in the system of mandatory pension onsurance”, Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”, Federal Law dated March 28, 1998 No. 53-FZ “On military duty and military service”, Federal Law No. 31-FZ dated February 26, 1997 “On mobilization training and mobilization in the Russian Federation”, Federal Law No. 14-FZ dated February 8, 1998 “On Limited Liability Companies”, Federal Law No. 2300-1 dated February 7, 1992 “On Protection of Consumer Rights”, Federal Law No. 129-FZ dated November 21, 1996 “On Accounting”, Federal Law No. 2 dated November 9, 2010 No. 326-FZ "On Mandatory Medical Insurance in the Russian Federation", as well as in accordance with the local regulations of the Operator.

- Employees currently or formerly maintaining labor relations with the Operator (hereinafter referred to as Employees) with the purpose of regulating labor relations with Employees in order to to fulfill functions, authorities and responsibilities imposed on the Operator by the Russian legislation (in particular, labor, tax, pension legislation) including , for the provision of personal data to state authorities, to the Pension Fund of the Russian Federation, to the Social Insurance Fund of the Russian Federation, to the Federal Compulsory Medical Insurance Fund and to other government authorities.

- Job applicants for the company of the Operator considered for an employment contract with the subject of personal data, for the purpose of verifying the accuracy of the submitted personal data.

- Talent pool members, for the purpose of working with the talent pool, providing such persons with the rights and opportunities provided for by the Regulations on the Operator's personnel reserve.

- Relatives of the Operator's employees in order to exercise and fulfill the functions, powers and obligations assigned to the Operator by the legislation of the Russian Federation, including for providing the Operator's employees and their family members with additional guarantees and compensations, as well as for exercising rights and legal interests of the Operator.

- Counterparties of the Operator (individual entrepreneurs) for the purposes of preparing, concluding, executing and terminating civil law contracts in the course of business activities, for the purposes of verifying the accuracy of the submitted personal data and considering opportunities for further cooperation.

- Representatives of individuals and legal entities for the purposes of preparing, concluding, executing and terminating civil law contracts in the course of carrying out business activities, as well as for purposes, similar to the purposes of processing personal data of the persons whose interests they represent, taking into account the powers vested in them.

- Individuals who applied to the Operator with applications, appeals, complaints (applicants) for the purpose of considering citizens' appeals in accordance with applicable law.

- Individuals undergoing internship with the Operator for the purpose of ensuring the conditions for internship and compliance with the legislation of the Russian Federation in the organization of their internship with the Operator.

- Foreign citizens for the purposes of exercising and fulfilling the functions, powers and obligations assigned by the legislation of the Russian Federation to the Operator, to assist the indicated persons in issuing invitations, visas and for migration registration, obtaining a work permit. The processing of personal data of foreign citizens who are employees of the Operator is also carried out to achieve goals similar to the purposes of processing personal data of employees of the Operator.


- Individuals whose personal data is processed in the interests of third parties on the basis of an agreement (order of third parties), in order to fulfill the relevant agreements.

 - Loyalty card holders who are members of Maxi Loyalty Bonus Program for the purpose of achievement of goals of the aforementioned program and for the purpose of meeting the requirements of the current Russian legislation.


 - Maxi store visitors and customers who are not members of Maxi Loyalty Bonus Program for the purpose of meeting the requirements of the current Russian legislation.  


 - Visitors of Maxi business center located ar the address: 25 Molodezhnaya Street, Vologda, for the purpose of granting access to the territory of the aforementioned business center. 


- The Operator may process personal data of other catergories of personal data subjects for achievement of other legitimate purposes.


5. Consent to personal data processing.

5.1. The consent given to the Operator by the personal data subject to processing of his personal data in accordance with this Policy signifies that the personal data subject gives the Operator consent to perform any actions with personal data with or without use of automation tools, including collection, systematization, accumulation, storage, validation (updating, modification), extraction of personal data, their use, depersonalization, blocking, deletng, annihilation and transfer of personal data to third parties (including distribution, providing, access), assignment of personal data processing to third parties for whom this consent has been given.

5.2. Personal data provided by the subject by mail (including documents, resumes, application forms, etc.) at the address of the Operator, including by mail, e-mail and other channels communication. Providing of data to the representatives of the Operator signifies that the subject of personal data gives the Operator consent to processing of his personal data in accordance with the present Policy for the purposes fixed for the corresponding category of subjects of personal data from the list specified in Paragraph 4.1. of the present Policy.

5.3. In the process of interaction of the personal data subject with websites owned by the Operator, correspondence by e-mail, etc., the Operator may automatically receive certain types of information. 

5.4. In cases specified by the legislation of the Russian Federation, the Operator may transfer personal data to third parties, including the Federal Tax Service, the Pension Fund of the Russian Federation, the Social Insurance Fund, and the Federal Fund for Mandatory Medical Insurance. In addition, the Operator transfers the personal data of the personal data subjects necessary for the state and municipal entities to exercise their powers, subject to legitimate requests from the corresponding entities. The consent of the subject of personal data to the transmission of personal data in this case is not required.

5.5. The personal data processed by the Operator for the purposes of promotion of goods and services on the market by direct contacts with a potential customer using means of communication is only allowed with the prior consent of the personal data subject.

5.6. The personal data processing time is based on the achievement of other legitimate objectives of processing described in the present Policy. 


5.7. Subjects whose personal data are processed by the Operator are entitled to withdraw their consent to the processing of personal data by sending a written application to the Operator at the address: 25 Molodezhnaya Street, Vologda. Upon receipt of the relevant written application, the processing of the personal data of the subject will be terminated, except in cases where the processing can be continued in accordance with the applicable law of the Russian Federation.

6. Personal data processing on the websites of the Operator.

6.1. The Operator is the owner of the following websites (hereinafter referred to as the Website, Websites):

 - maxi-cre.ru; 

 - maxi-retail.ru;

 - maxi-shopping; 

 - vologzhanka.com;  

 - maxi-opt.ru; 

 - ешки-матрешки.рф;

 - cытыйбоярин.рф.

- maxi-company.ru;

- макси-ритейл.рф;

- maxi-trade.ru; 

- maxi-park.ru;

- максиклуб.рф;

- old.maxi-retail.ru; 

- максиденьзнаний.рф.


The personal data collected through these resources are processed in accordance with the present Policy and requirements of the current Russian legislation in the field of personal data.


6.2. The Websites and the mobile application provide forms that allow the collection of personal data of the subjects. Personal data obtained through the Websites and the mobile application are provided by the subjects on a voluntary basis and are processed by the Operator with the consent of the personal data subjects.

6.3. For the purposes of obtaining consent to the processing of personal data of the subject, the Websites of the Operator shall provide the following possible options for the personal data subjects: 

- when providing personal data, the personal data subject shall click on the button that confirms that he agrees to the personal data processing in accordance with the present Policy (the notification about the 

personal data subject giving consent to the processing of his personal data is placed on the Website next to the button);


- the subject shall check off the box with the consent to the personal data processing in the appropriate field of the form on the Website. After that he will have the opportunity to send personal data to the Operator. Both options for obtaining consent entail the same legal consequences. The use of various options for obtaining consent is solely based on the special aspects of the implementation of the mechanism for obtaining consent on each of these Websites.

6.4. In accordance with the requirements of the Federal Law No. 152-FZ of July 27, 2006  "On Personal Data", the Operator shall publish the presnet Personal Data Processing Policy on the Websites and the mobile application.


7. Rights of personal data subjects.


7.1. The personal data subject is entitled to obtain information related to the processing of his personal data (if the right is not limited in accordance with Federal Law dated July 27th, 2006 No. 152-FZ "On Personal Data"), including information that contains:

- confirmation of the fact of personal data processing;

- legal grounds and purposes of personal data processing;

- applied methods of personal data processing;

- name and location of the Operator, information about parties (except the employees of the Operator) who have access to the personal data of the personal data subject or to whom personal data may be disclosed on the basis of the contract with the Operator or on the basis of the Federal Law;

 - processed personal data related to the corresponding personal data subject and source of their obtention, unless otherwise specified by the Federal Law; 

- terms of processing, including the period of storage of personal data;


- information about the performed or planned cross-border data transmission;

- full name and address of the person processing the personal data on behalf of the Operator, if case the processing is or will be entrusted to such a person.

7.2. The personal data subject is entitled to the access to their personal data, including the right to obtain a copy of any record containing their personal data, except when otherwise provided by Federal Law.

7.3. The personal data subject is entitled to clarify, block or destroy the personal data if they are incomplete, outdated, inaccurate, illegally obtained or not required for the determined purpose of processing.

7.4. The personal data subject is entitled to withdraw consent to the personal data processing.

7.5. The personal data subject is entitled to appeal to an authorized entity ot the court against an action or inaction of the Operator that could be considered a violation of the requirements of the legislation of the Russian Federation on personal data, for the purpose of protection of the rights of personal data subjects. 

7.6. The personal data subject is entitled to exercise other rights provided by the legislation of the Russian Federation.

8. Information on the implemented requirements for personal data protection.


The Operator shall protect the processed personal data in accordance with the requirements of the law, including:

8.1. Appointment of a person in charge for organizing the personal data processing.

8.2. Publishing of local acts on personal data processing and protection, as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation and eliminating the consequences of such violations.

8.3. Implementation of legal, organizational and technical measures to ensure personal data protection during their processing in personal data information systems.

8.4. Implementation of internal control over the compliance of the personal data processing with the Federal Law No. 152-FZ of July 27, 2006  "On Personal Data" and the regulatory legal acts adopted in accordance with the federal law.

8.5. Informing the Employees of the company of the Operator who are directly involved in the personal data processing with on the provisions of the legislation of the Russian Federation on personal data, including the requirements for personal data protection, documents determining the policy of the Operator regarding personal data processing, local acts on personal data processing, and/or training of the aforementioned Employees.

8.6. Storage of physical media devices that contain personal data in compliance with the conditions that ensure the personal data protection against unauthorized access.

8.7. Other measures provided by the legislation of the Russian Federation on personal data



Up