1.1. This Privacy Policy (hereinafter referred to as the "Policy") has been prepared in pursuance of the requirements of clause 2 of part 1 of Article 18.1 of the Federal Law of 27.07.2006 No. 152-FZ in order to ensure the protection of the rights and freedoms of man and citizen in the processing of his personal data and regulates the procedure for processing personal data by the Limited Liability Company "Nova Creative Group" (9701291097/1247700465968) (hereinafter referred to as the "Operator"). This Privacy Policy explains how Nova Creative Group LLC (“we”, “our”, “us”) collects, uses, stores, shares, and protects your personal data when you interact with us through https://novacreative.ru (“Website”/ “Site”), in accordance with the General Data Protection Regulation (GDPR) and applicable national laws.

1.2. The legal grounds for the processing of personal data by the Operator are:

• GDPR;
• Civil Code of the Russian Federation of November 30, 1994 No. 51-FZ;
• Law of the Russian Federation of 07.02.1992 No. 2300-1;
• Law of the Russian Federation of 27.07.2006 No. 152-FZ
• other applicable regulatory legal acts of the Russian Federation;
• civil law contracts;
• consent to the processing of personal data;
• user agreement governing the use of the Site;
• Charter of the Operator.

1.3. The Policy applies to all personal data received by the Operator through the Site, including data processed at all domain levels in effect at the time of adoption of the Policy, as well as those appearing in the future.

1.4. The Policy applies to relations on the processing of personal data that arose with the Operator both before and after the approval of this Policy.

1.5. In pursuance of the requirements of Part 2 of Article 18.1 of the Law No. 152-FZ, this Policy is published in free access on the Internet information and telecommunication network on the website.

1.6. For the purposes of this Policy, the following basic concepts are used:

1.6.1. personal data - any information relating directly or indirectly to a specific or determinable natural person (subject of personal data);

1.6.2. processing of personal data - any action (operation) or set of actions (operations) with personal data, performed with or without the use of automation tools. The processing of personal data includes, inter alia: collection; record; systematization; accumulation; storage; clarification (updating, changing); extraction; use; transfer (provision, access, distribution); anonymization; blocking; deletion; destruction of personal data.

1.6.3. site - a set of computer programs and other information contained in the information system, access to which is provided through the information and telecommunications network "Internet" by the domain name https://novacreative.ru and used by the Operator to inform about its activities. site user - a person who has access to the site (regardless of the fact of registration on the site) and uses the site.

1.6.4. customer - a citizen who intends to order or purchase service/product Operator.

1.6.5. personal data operator - a legal entity, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data

1.6.6. Other terms not disclosed in the Policy are used in the meaning defined in the legislation of the Russian Federation.

1.7. Control over the implementation of the requirements of this Policy is carried out by an authorized person responsible for organizing the processing of personal data at the Operator.

1.8. Your data is transferred outside the EEA, we ensure equivalent protection, by using Standard Contractual Clauses or adequacy decisions (information available upon request).

2.1. The operator has the right to:

• independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law No. 152-FZ;
• if the subject of personal data withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law No. 152-FZ.

2.2. The operator is obliged to:

• organize the processing of personal data in accordance with the requirements of the Law No. 152-FZ;
• respond to requests and inquiries from subjects of personal data and their legal representatives in accordance with the requirements of the Law No. 152-FZ;
• report to the authorized body for the protection of the rights of subjects of personal data (Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) upon request of this body the necessary information within 10 days from the date of receipt of such request.

2.3. The subject of personal data has the right to:

• receive information regarding the processing of his personal data, except in cases provided for by federal laws. The information is provided to the subject of personal data by the Operator in an accessible form, and it should not contain personal data relating to other subjects of personal data, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it is established by the Law No. 152-FZ;
• require the operator to clarify his personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also take legal measures to protect their rights;
• appeal to Roskomnadzor or in court against illegal actions or omissions of the Operator in the processing of his personal data.

2.4. Other rights and obligations of the Operator and subjects of personal data are determined by the legislation of the Russian Federation.

3.1 The processing of personal data is strictly limited to achieving the purposes of processing personal data. The processing of personal data for purposes other than those specified in Appendix No. 1 to this Policy is not allowed.

3.2. The content of the processed personal data is determined by the purposes of processing personal data. The processing of personal data that is excessive in relation to the established processing goals is not allowed.

4.1. Information on the categories of personal data and subjects is indicated in Appendix No. 1.

4.2. Processing of biometric personal data is not carried out.

4.3. Special categories of personal data are not processed.

4.4. Cross-border transfer of personal data is not carried out.

5.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation. The operator ensures compliance with the requirements of confidentiality of personal data established by Art. 7 of the Law No. 152-FZ. The operator does not disclose or disseminate personal data to third parties without the consent of the subject of personal data.

5.2. The operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution and other unauthorized actions. Legal measures include:

• development of local regulations and other documents governing relations in the field of processing and protection of personal data;
• compliance with the principles of personal data processing and rejection of methods of personal data processing that do not correspond to the processing goals. Organizational measures include:
• appointment of a person responsible for organizing the processing of personal data in the structural divisions and information systems of the Operator;
• regulation of personal data processing processes;
• creating the necessary conditions for working with personal data;
• organization of accounting for documents containing personal data;
• organization of work with information systems in which personal data are processed;
• identification of threats to the security of personal data during their processing, the formation of a threat model based on this. Technical measures include:
• ensuring the security of personal data in information systems;
• storage of personal data on paper media in conditions under which their safety is ensured and unauthorized access to them is excluded;
• storage of personal data in information systems in conditions under which their safety is ensured and unauthorized access to them is excluded (ensuring the security of premises where information systems with personal data are stored, ensuring the safety of media with personal data, protecting information using means that have passed the conformity assessment procedure).
• preventing leakage of personal data through technical communication channels and other means;
• preventing unauthorized access to personal data, special effects on such information (information carriers) in order to extract, destroy, distort and block access to it;
• protection against malicious programs, detection of intrusions and computer attacks;
• application of measures to identify, investigate and eliminate the consequences of incidents related to the facts of unlawful or accidental transfer (provision, distribution, access) of personal data, resulting in violation of the rights of subjects of personal data, in the manner prescribed by Part 3.1 of Art. 21 of the Law No. 152-FZ.

5.4. The processing of personal data is carried out by the Operator using the following actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, distribution, access), blocking, deletion, destruction of personal data. The operator does not disclose personal (personal) information about site users to third parties, except in cases prescribed by Federal Law No. 152-FZ of July 27, 2006, or when the site user voluntarily agrees to the transfer of information.

5.5. The Operator carries out both automated and non-automated processing of personal data, and also applies mixed forms of processing.

5.6. The processing of personal data by the Operator is terminated in the following cases: achieving the goals of such processing; withdrawal of consent to the processing of personal data; detection of unlawful processing of personal data. Upon the occurrence of the circumstances specified in this paragraph, personal data shall be destroyed, unless otherwise provided by federal law.

5.7. When collecting personal data, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation. The operator does not carry out cross-border transfer of personal data.

5.8. The transfer (provision, access) of personal data will be terminated at any time at the request of the subject of personal data. This requirement must include the last name, first name, patronymic (if any), contact information (phone number, email address or postal address) of the subject of personal data, as well as a list of personal data, the processing of which is subject to termination. The personal data specified in this request may be processed only by the Operator to whom it is sent. Sending by the subject of personal data to the Operator of the requirement termination of the transfer of his personal data entails the termination of the processing of personal data by the Operator, in respect of which the subject declares a requirement to terminate the transfer.

6.1. If the fact of inaccuracy of personal data is confirmed, the personal data shall be clarified.

6.2. The operator is obliged to inform the subject of personal data about the processing of personal data of such subject carried out by him at the request of the latter. Confirmation of the fact of processing personal data by the Operator, the legal grounds and purposes of processing personal data, as well as other information specified in Part 7 of Art. 14 of the Law No. 152-FZ, shall be provided by the Operator to the subject of personal data or his representative upon request or upon receipt of a request from the subject of personal data or his representative. The information provided does not include personal data relating to other subjects of personal data, except when there are legal grounds for disclosing such personal data. The request must contain:

• the number of the main document proving the identity of the subject of personal data or his representative, information on the date of issue of the specified document and the authority that issued it;
• information confirming the participation of the subject of personal data in relations with the Operator or information otherwise confirming the fact of processing personal data by the Operator;
• the signature of the subject of personal data or his representative. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation. If the appeal (request) of the subject of personal data does not reflect all the necessary information in accordance with the requirements of the Law No. 152-FZ or the subject does not have the right to access the requested information, then a reasoned refusal is sent to him. The right of the subject of personal data to access his personal data may be limited in accordance with Part 8 of Art. 14 of the Law No. 152-FZ, including if the access of the subject of personal data to his personal data violates the rights and legitimate interests of third parties.

6.3. In case of detection of inaccurate personal data upon application of the subject of personal data or his representative or at their request or at the request of Roskomnadzor, the Operator blocks personal data relating to this subject of personal data from the moment of such application or receipt of the specified request for the period of verification, if the blocking of personal data does not violate the rights and legitimate interests of the subject of personal data or third parties. In case of confirmation of the fact of inaccuracy of personal data, the Operator, based on the information provided by the subject of personal data or his representative or Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of personal data.

6.4. In case of detection of unlawful processing of personal data upon application (request) of the subject of personal data or his representative or Roskomnadzor, the Operator shall destruction of illegally processed personal data relating to this subject of personal data, from the moment of such application or receipt of the request.

6.5. Upon achievement of the purposes of processing personal data, as well as in case of withdrawal by the subject of personal data of consent to their processing, the occurrence of other grounds provided for in paragraph 5.6 of this Policy, personal data shall be destroyed, if:

• The Operator is not entitled to process without the consent of the subject of personal data on the grounds provided for by the Law No. 152-FZ or other federal laws;
• unless otherwise provided by an agreement between the Operator and the subject of personal data.

7.1. The subject of personal data can get any clarification on questions concerning the processing of his personal data by contacting the Operator by e-mail info@novacreative.ru

7.2. The provisions of this Policy may be revised by the Operator as necessary. The new version of the Policy is posted on the website indicating the date of the last update of the Policy.

LIST OF PURPOSES, TERMS, METHODS OF PROCESSING PERSONAL DATA, CATEGORIES OF SUBJECTS AND PROCESSED PERSONAL DATA.