Privacy Policy

PERSONAL DATA PROCESSING POLICY1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) establishes the procedures and conditions for the processing of personal data by Individual Entrepreneur Ekaterina Vladimirovna Shmykova (Taxpayer Identification Number (INN): 741207122107; address: 25B, SNT Geolog-2, Zavyalovsky District, Udmurt Republic, 427000, Russian Federation) in relation to users of https://bloomroom-school.ru.
1.2. The terms used in this Policy shall have the meanings established by the legislation of the Russian Federation on personal data.
1.3. The Operator processes personal data in accordance with the principles of lawfulness and fairness, limitation of processing to specific, predetermined and lawful purposes, and prevention of the processing of personal data that are excessive in relation to the stated purposes.
1.4. The Operator ensures the confidentiality of personal data and implements the necessary legal, organizational and technical measures to protect them in accordance with the legislation of the Russian Federation.
1.5. Contact details for inquiries from personal data subjects:

Email: omsk.worklab@yandex.ru
Telephone: +7 (983) 520-98-88
Postal address: 25B, SNT Geolog-2, Zavyalovsky District, Udmurt Republic, 427000, Russian Federation.

This Policy is effective as of September 21, 2026, and is publicly available on the Operator's website.
2. KEY TERMS USED IN THIS POLICY
2.1. Automated processing of personal data means the processing of personal data using computer technology.
2.2. Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify or correct the personal data.
2.3. Website means the collection of graphic and informational materials, computer programs and databases that make such materials available on the Internet at https://bloomroom-school.ru.
2.4. Personal data information system means a collection of personal data contained in databases, together with the information technologies and technical means used to process such data.
2.5. Depersonalization of personal data means actions that make it impossible to identify the personal data subject without the use of additional information.
2.6. Processing of personal data means any operation or set of operations performed on personal data, with or without automated means, including collection, recording, organization, accumulation, storage, updating, retrieval, use, transfer, depersonalization, blocking, deletion and destruction.
2.7. Personal data operator means a person who, independently or jointly with other persons, organizes and/or carries out the processing of personal data and determines the purposes of processing, the categories of personal data and the operations performed on such data. For the purposes of this Policy, the Operator is Individual Entrepreneur Ekaterina Vladimirovna Shmykova.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable natural person.
2.9. Personal data authorized by the personal data subject for dissemination means personal data to which the subject has granted access to an unlimited number of persons in accordance with the procedure established by the legislation of the Russian Federation.
2.10. User means any visitor to https://bloomroom-school.ru.
2.11. Provision of personal data means actions intended to disclose personal data to a specific person or a specific group of persons.
2.12. Dissemination of personal data means actions intended to disclose personal data to an indefinite group of persons.
2.13. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state to a foreign state authority, foreign natural person or foreign legal entity.
2.14. Destruction of personal data means actions that irreversibly destroy personal data so that their content can no longer be recovered.
3. PRINCIPAL RIGHTS AND OBLIGATIONS OF THE OPERATOR
3.1. The Operator has the right to:

obtain accurate information and/or documents containing personal data from the personal data subject;
continue processing personal data after the subject withdraws consent or requests that processing cease, where the legislation of the Russian Federation permits such processing without the subject's consent;
independently determine the nature and scope of measures necessary and sufficient to fulfill the obligations established by the legislation of the Russian Federation on personal data.

3.2. The Operator is obliged to:

provide the personal data subject, upon request, with information concerning the processing of their personal data;
organize personal data processing in accordance with the legislation of the Russian Federation;
respond to requests and inquiries from personal data subjects and their representatives within the legally prescribed time limits;
provide the competent authority responsible for protecting the rights of personal data subjects with the necessary information in cases prescribed by law;
ensure unrestricted access to this Policy;
implement legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision and dissemination;
cease processing and destroy personal data in the circumstances and manner established by the legislation of the Russian Federation;
fulfill other obligations established by the legislation of the Russian Federation.

4. PRINCIPAL RIGHTS AND OBLIGATIONS OF PERSONAL DATA SUBJECTS
4.1. A personal data subject has the right to:

receive information concerning the processing of their personal data;
request the correction, blocking or destruction of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing;
withdraw consent to personal data processing where the processing is based on consent;
submit a request to cease the processing of personal data;
appeal against the Operator's actions or omissions to the competent authority responsible for protecting the rights of personal data subjects or through the courts;
exercise other rights provided for by the legislation of the Russian Federation.

4.2. The personal data subject must provide accurate information about themselves and, where necessary, report any changes or corrections to that information.
4.3. Persons who provide the Operator with inaccurate information or information about another person without the necessary legal grounds shall be liable in accordance with the legislation of the Russian Federation.
5. PURPOSES OF COLLECTION AND PROCESSING OF PERSONAL DATA
5.1. To ensure the operation and security of the website.
5.2. To provide user support and handle inquiries.
5.3. To process payment transactions and billing.
5.4. To prepare, enter into and perform a civil-law contract, including a public offer agreement.
6. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
6.1. To ensure the operation and security of the website, personal data are processed in pursuit of the Operator's rights and legitimate interests, provided that the rights and freedoms of personal data subjects are not infringed, and on the basis of the subject's consent where such consent is required by law.
6.2. For user support and handling inquiries, the legal grounds for processing are the user's inquiry, performance of a contract or public offer agreement, and the personal data subject's consent where required.
6.3. For payment transactions and billing, the legal grounds are the conclusion and performance of a contract; Federal Law No. 54-FZ “On the Use of Cash Register Equipment in Settlements in the Russian Federation”; Federal Law No. 161-FZ “On the National Payment System,” where applicable; and other requirements of the legislation of the Russian Federation.
6.4. For preparing, entering into and performing a civil-law contract, the legal grounds are the legislation of the Russian Federation, including the Civil Code of the Russian Federation, and the concluded contract or public offer agreement.
6.5. In circumstances prescribed by law, personal data may also be processed on the basis of the personal data subject's consent or to fulfill legal obligations imposed on the Operator.
7. SCOPE AND CATEGORIES OF PERSONAL DATA PROCESSED; CATEGORIES OF DATA SUBJECTS
7.1. To ensure the operation and security of the website, the following may be processed:

IP address;
date and time of visit;
address of the requested page (URL);
technical identifiers;
cookies;
browser and device information;
technical event, error and access logs.

7.2. For user support and handling inquiries, the following may be processed:

surname, first name and patronymic, if provided by the user;
email address;
telephone number;
contents of the inquiry;
other information voluntarily provided by the user in the inquiry and necessary to handle it.

7.3. For payment transactions and billing, the following may be processed:

surname, first name and patronymic to the extent necessary to place an order and process payment;
telephone number and/or email address;
payment amount and status;
order and/or payment identifier;
cash register receipt information;
other payment information to the extent transmitted by the payment provider.

The Operator does not request or store full bank card details where the user enters such details directly on the payment provider's page.
7.4. For preparing, entering into and performing a civil-law contract, the following may be processed:

surname, first name and patronymic;
email address;
telephone number;
information about the order and the service purchased;
information about payments and settlements made;
history of contract performance to the extent necessary for its conclusion and performance.

7.5. The categories of personal data subjects covered by this Policy are:

website visitors;
website users;
the Operator's purchasers and clients;
persons submitting inquiries to the Operator.

8. PROCEDURES AND CONDITIONS FOR PROCESSING PERSONAL DATA
8.1. Personal data are processed where one or more lawful grounds exist, including:

the personal data subject's consent;
the need to enter into or perform a contract to which the personal data subject is a party;
the need to fulfill obligations imposed on the Operator by the legislation of the Russian Federation;
the need to exercise the Operator's rights and legitimate interests, provided that the rights and freedoms of the personal data subject are not infringed.

8.2. Where the law requires the user's consent, such consent may be given by completing the relevant form on the website, providing the necessary data and ticking the checkbox indicating consent to personal data processing.
8.3. The personal data subject may withdraw consent to personal data processing by sending a corresponding request to omsk.worklab@yandex.ru.
Upon receipt of the withdrawal, the Operator shall cease processing personal data on the basis of consent unless other legal grounds for continuing such processing exist.
8.4. To ensure the operation and security of the website, the following operations may be performed on personal data: collection, recording, organization, accumulation, storage, updating, retrieval, use, provision of access where necessary, depersonalization, blocking, deletion and destruction.
8.5. For user support and handling inquiries, the following operations may be performed on personal data: collection, recording, organization, accumulation, storage, updating, retrieval, use, provision where necessary, blocking, deletion and destruction.
8.6. For payment transactions and billing, the following operations may be performed on personal data: collection, recording, organization, accumulation, storage, retrieval, use, provision to payment services and other services involved in settlements, blocking, deletion and destruction.
8.7. For preparing, entering into and performing a civil-law contract, the following operations may be performed on personal data: collection, recording, organization, accumulation, storage, updating, retrieval, use, provision where necessary, blocking, deletion and destruction.
8.8. Personal data may be processed both with and without automated means.
8.9. To ensure the operation of the website, accept payments and perform the contract, personal data may, to the extent necessary, be transferred or made available to the following persons and services:

Tilda Publishing (the Tilda platform);
Robokassa (payment processing service).

Such transfer shall be limited to the extent necessary to provide the relevant services and shall be carried out on the basis of contracts and other grounds prescribed by law.
8.10. The following infrastructure is used to host information systems and ensure website operation:

Selectel JSC;
Yandex.Cloud LLC.

8.11. When collecting personal data of citizens of the Russian Federation via the Internet, the Operator ensures that the recording, organization, accumulation, storage, updating and retrieval of such personal data are performed using databases located within the territory of the Russian Federation where required by the legislation of the Russian Federation.
8.12. Personal data are stored until the purposes of their processing have been achieved.
Where processing is based on consent, the data are processed until the purpose has been achieved or consent is withdrawn, unless another lawful ground exists for continued processing.
Where the legislation of the Russian Federation or a contract prescribes other mandatory retention periods for specific information or documents, such periods shall apply.
8.13. The website uses cookies necessary for its proper operation, security and retention of user preferences.
Other types of cookies and similar technologies may be used in accordance with the legislation of the Russian Federation and, where necessary, after obtaining the user's relevant consent.
8.14. The website may collect technical statistics and maintain technical logs necessary to ensure operability and security and to analyze website performance.
Only the minimum amount of technical information necessary for these purposes is processed.
8.15. The Operator may provide personal data to government authorities and other authorized persons in the cases and manner prescribed by the legislation of the Russian Federation.
9. PERSONAL DATA PROTECTION MEASURES
9.1. The Operator implements the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.
9.2. Such measures may include:

appointing a person responsible for organizing personal data processing, where necessary;
adopting internal documents concerning personal data processing and protection;
restricting the number of persons with access to personal data;
using technical information security measures;
using secure communication channels and access controls;
ensuring the safekeeping of personal data;
monitoring compliance with the legislation of the Russian Federation and this Policy;
adopting other necessary measures depending on the nature and volume of personal data processed.

10. UPDATING, CORRECTING, DELETING AND DESTROYING PERSONAL DATA; REQUESTS FROM DATA SUBJECTS
10.1. Where personal data are found to be inaccurate, the Operator shall correct them.
Where unlawful processing of personal data is identified, the Operator shall take measures to cease such processing in accordance with the legislation of the Russian Federation.
10.2. Personal data shall be deleted or destroyed when the purposes of processing have been achieved, when further processing is no longer necessary, when consent has been withdrawn and there are no other legal grounds for continued processing, and in other cases established by the legislation of the Russian Federation.
10.3. A personal data subject may submit to the Operator a request concerning the processing of their personal data or a demand for their correction, blocking, deletion, destruction or cessation of processing.
Requests may be sent:

by email to: omsk.worklab@yandex.ru; or
by post to: 25B, SNT Geolog-2, Zavyalovsky District, Udmurt Republic, 427000, Russian Federation.

10.4. Information requested by a personal data subject shall be provided within no more than 10 business days from the date on which the request is received.
This period may be extended by no more than 5 business days if the personal data subject is sent a reasoned notice stating the grounds for the extension.
10.5. Grounds for ceasing the processing of personal data include:

achievement of the purposes of processing;
expiration of a contract or fulfillment of the obligations under it, where no other grounds for processing exist;
withdrawal of consent by the personal data subject where processing is based on consent and no other lawful grounds exist;
a request from the subject to cease processing in circumstances prescribed by law;
identification of unlawful processing;
other grounds established by the legislation of the Russian Federation.

11. UPDATES TO THE POLICY
11.1. This Policy may be reviewed and updated following changes in the legislation of the Russian Federation, applicable requirements, personal data processing procedures or services used by the Operator.
11.2. The current version of the Policy is publicly available at https://bloomroom-school.ru.
11.3. A new version of the Policy enters into force upon publication on the website unless that version specifies another effective date.