Privacy and data protection policy

1. General Term.

1.1 The Chili Personal Data Processing Policy (hereinafter, the “Policy”) defines the basic principles, objectives, conditions, and methods of personal data processing, lists of subjects and personal data processed by “Chili”, functions of “Chili” in processing personal data, rights of subjects of personal data, as well as requirements to the protection of personal data implemented by “Chili”.

1.2 The Policy is developed taking into account requirements of the Constitution of the Russian Federation, legislative and other normative legal acts of the Russian Federation in the field of personal data.

1.3 The provisions of the Policy shall serve as the basis for the development of local regulations governing the processing of personal data of Chilean employees and other subjects of personal data.

1.4 The provisions of the Policy shall apply to all information that “Chili” online shop, located at www.interchili.ru, can receive about the User during the use of the latter’s online shop site, programs, and products of the online shop.

1.5. Usage by User of the online shop website means consent to the provisions of this policy and the terms of processing of personal data of the User.

1.6. In case of disagreement with the terms of the Policy, the User must stop using the online shop.

1.7. The Policy only applies to the site of “Chili” online shop, “Chili” has no control over and is not responsible for the websites of third parties to which the User can go through the links available on the website of the online shop.

1.8. “Chili” does not check the accuracy of personal data provided by the User of the online shop website.

1.9. This Policy sets out the obligations of “Chili” not to disclose and ensure the protection of personal data that the User provides at the request of “Chili” and/or during registration on the online shop’s website or when placing an order for the purchase of goods.

2. Laws and other regulatory legal acts of the Russian Federation, which define the Personal Data Processing Policy in “Chili”

2.1 The “Chili” Personal Data Processing Policy shall be determined by the following laws and regulations:

The Labor Code of the Russian Federation;

Federal Law of 27 July 2006 No. 152-FZ “On personal data”;

Decree of the President of the Russian Federation dated March 6, 1997, No. 188 “On Approval of the List of Information of Confidential Nature”;

Decree of the Government of the Russian Federation dated September 15, 2008, No. 687 “On Approval of the Regulations on the specifics of the processing of personal data carried out without the use of automation equipment”;

Decree of the Government of the Russian Federation of July 6, 2008, No. 512 “Decision of the Government of the Russian Federation on the approval of the requirements for the material carriers of biometric personal data and the technologies of storing such data outside the personal data information systems”;

Decree of the Government of the Russian Federation of 1 November 2012 No. 1119 Decree of the Government of the Russian Federation No. 1119 of November 1, 2012 “On approval of requirements for personal data protection during their processing in personal data information systems”;

Order of the Federal Service for Technical and Export Control of Russia No. 55, the Federal Security Service of Russia No. 86, the Ministry of Communications of Russia No. 20 of February 13, 2008. “On Approval of the Procedure for Classification of Personal Data Information Systems”;

Order of FSTEC of Russia No. 21 of February 18, 2013 “On Approval of the Composition the Order of FSTEC of Russia No. 21 “On approval of composition and content of organizational and technical measures to ensure the security of personal data during its processing in personal data information systems” dated February 18, 2013;

Order of Roskomnadzor No. 996 dated September 05, 2013 “On Approval of Requirements the order of Ros Nadzor No. 996 “On Approval of Requirements and Methods for Depersonalization of Personal Data”, September 05, 2013;

Other regulatory legal acts of the Russian Federation and regulatory documents of authorized state authorities.

2.2 To implement the provisions of the Policy, “Chili” shall develop relevant local regulations and other documents.

3. Basic terms used in local regulations “Chili”, regulating issues of personal data processing

Personal data – any information related to a directly or indirectly identified or identifiable individual (personal data subject).

Information – information (messages, data) regardless of the form in which it is presented.

Operator – state body, municipal authority, legal entity or individual, independently, or together with other persons, arranging and (or) performing processing of personal data, as well as determining the purpose of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data.

Processing of personal data – any action (operation) or set of actions (operations), performed with or without the use of automation of personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, removal, destruction of personal data.

Automated processing of personal data – processing of personal data by computer equipment.

Provision of personal data – actions aimed at disclosure of personal data to a certain person or a certain range of persons.

Dissemination of personal data – actions aimed at disclosure of personal data to an unspecified circle of persons.

Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual, or a foreign legal entity.

Blocking of personal data – temporary termination of personal data processing (except for cases when processing is necessary for clarification of personal data).

Destruction of personal data – actions, because of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which tangible carriers of personal data are destroyed.

De-identification of personal data – actions because of which it becomes impossible, without the use of additional information, to determine the attribution of personal data to a specific personal data subject.

Information system of personal data – a set of personal data contained in databases of personal data and information technologies and technical means ensuring its processing.

Privacy of personal data – binding on the operator or other person accessing personal data to prevent their dissemination without the consent of the subject of personal data or the existence of any other legal basis.

Online shop website – a collection of web pages, representing an array of linked data with a unique address (www.interchili.ru) and perceived by the user as a whole and used by “Chili” for business activities.

A user of the Online Shop website (hereinafter referred to as User) – a person accessing the website via the Internet and using the Online Shop website.

Cookie – is a small piece of data sent by the webserver and stored on the user’s computer, which the web client or web browser sends to the web server in HTTP-request each time it tries to open the page of the corresponding site.

IP (Internet Protocol) address is the unique network address of a host on an IP-based computer network.

4. Principles and objectives of personal data processing

4.1”Chili”, as a personal data controller, shall process personal data of Chili employees and other subjects of personal data not in an employment relationship with “Chili”.

4.2 Processing of personal data in “Chili” shall take into account the need to protect the rights and freedoms of “Chili” employees and other subjects of personal data, including protection of the right to privacy, personal and family secrets, based on the following principles the processing of personal data shall be carried out in “Chili” on a lawful and fair basis;

processing of personal data is limited to achieving specific, predetermined, and legitimate purposes;

Processing of personal data that is incompatible with the purposes for which it is collected shall not be permitted;

databases containing personal data, the processing of which is incompatible with one another, shall not be merged;

Only personal data that meet the purposes for which it is being processed shall be processed;

The content and scope of the processed personal data correspond to the stated processing purposes. The processing of personal data shall not be excessive in relation to the stated processing purposes;

When processing personal data, the accuracy of personal data, its sufficiency, and if necessary, relevance in relation to the purpose of personal data processing shall be ensured. “Chili” shall take the necessary measures, or shall ensure that such measures are taken, to delete or clarify incomplete or inaccurate personal data;

Personal data shall be stored in a form, allowing identification of the personal data subject, for no longer than required by the purposes of personal data processing, unless the period of storage of personal data is established by the federal law, the contract, which party, beneficiary or guarantor under which the personal data subject is a party, beneficiary or guarantor

Processed personal data shall be destroyed or depersonalized upon attainment of the processing objectives or upon loss of necessity for attainment of such objectives unless otherwise provided by federal law.

4.3 Personal data shall be processed in “Chili” in order to:

to ensure compliance with the Constitution of the Russian Federation, legislative and other regulatory legal acts of the Russian Federation, local regulations of “Chili”;

implementation of functions, powers, and duties imposed on “Chili” by the legislation of the Russian Federation, including the provision of personal data to public authorities, the Pension Fund of the Russian Federation, the Social Insurance Fund of the Russian Federation, the Federal Compulsory Medical Insurance Fund, as well as to other public authorities;

regulating labor relations with Chili employees (assistance in employment, training and career advancement ensuring personal safety, controlling the quantity and quality of work performed, and ensuring the safety of property) protection of life, health, or other vital interests of personal data subjects preparation, conclusion, execution, and termination of contracts with counterparties formation of reference materials for internal information support of Chili’s activities;

Execution of judicial acts, acts of other authorities or officials subject to execution in accordance with the legislation of the Russian Federation enforcement proceedings;

exercise of rights and lawful interests of “Chili” in the framework of the activities provided by the Charter and other local regulations of “Chili” or third parties, or to achieve socially important objectives;

identification of the user, registered on the website, for placing an order and (or) signing a contract for the purchase and sale of goods by remote method with “Chili”;

providing the user with access to personalized resources of the site;

establishing feedback with the user, including sending notices, requests regarding the use of the site, service provision, processing of requests and applications from the user;

locating the user for security purposes, fraud prevention;

creating an account for making purchases if the user has consented to the creation of an account;

notifying the user of the site about the status of their order;

processing and receiving payments, confirming tax or tax benefits, disputing payment, determining the eligibility of the user for a credit line;

providing the user with effective customer and technical support in the event of problems associated with the use of the online shop;

providing the user, with his consent, with product updates, special offers, price information, newsletters, and other information on behalf of “Chili” or on behalf of partners of “Chili”;

carrying out advertising activities with the consent of the user;

providing the user with access to sites or services of Chili’s partners online shop to obtain products, updates, and services;

for other lawful purposes.

5. List of subjects whose personal data is processed in “Chili”.

5.1 The personal data of the following categories of subjects shall be processed in “Chili

“Chili’s” employees;

“Chili’s” counterparties with whom it is planned to conclude an agreement or with whom such an agreement has already been concluded;

users of the site;

Other subjects of personal data (in order to ensure that the purposes of processing specified in section 4 of the Policy are fulfilled).

6. List of personal data processed by “Chili

6.1 The list of personal data processed by “Chili” shall be determined in accordance with Russian legislation and local regulations of “Chili”, taking into account the purposes of personal data processing stated in Section 4 of the Policy.

6.2 Processing of special categories of personal data concerning race, ethnicity, political views, religious or philosophical beliefs, intimate life shall not be performed in “Chili”.

6.3. Personal data, allowed for processing within the framework of this Privacy Policy, is provided by the User by filling the registration form on the website of “Chili” Internet shop and includes the following information (but not limited to)

6.3.1. surname, first name, patronymic of the User;

6.3.2. contact phone number of the User;

6.3.3. the User’s email address (e-mail);

6.3.4. the delivery address of the Order;

6.3.5. the User’s place of residence.

6.4 “Chili” also protects the data automatically transmitted when viewing ad units and when visiting pages where the system’s statistical script (“pixel”) is installed: IP address; cookie information; browser (or another program that accesses the ad display) information; access time; address of the page where the ad unit is located; referrer (address of the previous page).

6.4.1 Disabling cookies may prevent access to the parts of the online shop website requiring authorization.

6.4.2 “Chili” collects statistics on the IP addresses of its visitors. This information is used for the purpose of identifying and solving technical problems, to control the legality of financial payments being made.

7. Functions of “Chili” when processing personal data

7.1 In the course of personal data processing “Chili” shall: take measures necessary and sufficient to ensure compliance with the requirements of the legislation of the Russian Federation and local statutory acts of “Chili” in the field of personal data;

Take legal, organizational, and technical measures for the protection of personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data appoints the person, responsible for the organization of personal data processing at Chili;

issue local regulations, determining the policy and issues related to processing and protection of personal data in “Chili”;

introduces employees of “Chili”, its branches and representative offices directly engaged in personal data processing, with provisions of laws of the Russian Federation and local regulations of “Chili” in the field of personal data, including requirements for the protection of personal data, and training of such employees;

Publish or otherwise provide unrestricted access to this Policy;

Inform in the prescribed manner to subjects of personal data or their representatives about availability of personal data related to relevant subjects, provide the possibility to get acquainted with such personal data when they apply, and (or) receive requests from such subjects of personal data or their representatives, unless otherwise provided by the legislation of the Russian Federation; 

cease processing and destroy personal data in cases envisaged by Russian Federation laws in the field of personal data;

Performs other actions provided for by the legislation of the Russian Federation in the field of personal data.

8. Conditions for processing of personal data in “Chili

8.1 Processing of personal data in “Chili” shall be carried out with the consent of the subject of personal data to the processing of his/her personal data, unless otherwise provided by the legislation of the Russian Federation in the field of personal data.

8.2 “Chili” shall not disclose or distribute personal data to third parties without the consent of the subject of personal data unless otherwise provided by federal law.

8.3 “Chili” shall be entitled to assign processing of personal data to another person with the consent of the personal data subject on the basis of an agreement concluded with that person. The contract shall contain a list of actions (operations) with personal data to be performed by the person processing personal data, processing objectives, the obligation of such person to maintain the confidentiality of personal data and ensure the security of personal data during its processing, as well as requirements for the protection of processed personal data in accordance with Article 19 of the Federal Law “On Personal Data”.

8.4 For the purpose of internal information support, “Chili” may create internal reference materials in which, with the written consent of the subject of personal data, unless otherwise provided by the legislation of the Russian Federation, his/her surname, name, patronymic, place of work, position, year and place of birth, address, subscriber number, e-mail address, other personal data provided by the subject of personal data may be included.

8.5 Processing of personal data of the user shall be carried out without limitation of time, in any lawful manner, including in personal data information systems with or without the use of automation means.

9. List of actions with personal data and methods of their processing

9.1 “Chili” collects, records, systematizes, accumulates, stores, clarifies (updates, changes), extracts, uses, transfers (distribution, provision, access), anonymizes, blocks, deletes, and destroys personal data.

9.2 Processing of personal data in “Chili” shall be carried out by the following methods:

non-automated processing of personal data;

automatic processing of personal data with the transfer of received information via information and telecommunication networks or without it;

mixed processing of personal data.

10. Rights of subjects of personal data

10.1 Personal data subjects have the right to:

full information on their personal data processed by at “Chili”;

access to their personal data, including the right to obtain a copy of any record containing their personal data, except in the cases provided for by federal law, as well as access to medical data relating to them with the assistance of a medical professional of their choice;

clarifying their data, blocking or destroying them if the personal data are incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of the processing;

withdrawal of consent to the processing of personal data;

taking measures provided by law to protect their rights;

appealing against “Chili”’s actions or omissions carried out in violation of the requirements of the legislation of the Russian Federation with violation of requirements of the legislation of the Russian Federation in the field of personal data, to the authorized body on protection of rights of subjects of personal data or to court;

exercise of other rights stipulated by the legislation of the Russian Federation.

11. Measures taken by “Chili” to ensure the fulfillment of the operator’s obligations when processing personal data

11.1 The measures necessary and sufficient to ensure that “Chili”‘s obligations as operator under the legislation of the Russian Federation in the field of personal data include:

The appointment of persons responsible for organizing the processing of personal data in “Chili”;

Adoption of local regulations and other documents in the field of processing and protection of personal data;

Organization of training and methodological work with employees of Chili, its branches and representative offices, occupying positions, for which personal data processing is carried out;

Obtaining the consent of subjects of personal data to process their personal data, except as provided by the laws of the Russian Federation;

Separation of personal data, processed without the use of automation means, from other information, in particular by fixing them on separate tangible media of personal data, in special sections;

Ensuring separate storage of personal data and its material media, which are processed for different purposes and contain different categories of personal data, prohibit the transfer of personal data via open communication channels, computer networks outside the “Chili” controlled area, and the Internet without applying “Chili” measures to ensure the security of personal data (except for publicly accessible and (or) depersonalized personal data);

Storage of tangible carriers of personal data in compliance with conditions ensuring the safety of personal data and excluding unauthorized access to such data;

Internal control over compliance of personal data processing with the Federal Law “On Personal Data” and legal acts adopted in accordance therewith, requirements to the protection of personal data, this Policy, local regulatory acts of “Chili”;

Other measures stipulated by the legislation of the Russian Federation in the sphere of personal data.

11.2. measures to ensure the security of personal data at their processing personal data in personal data information systems shall be established in accordance with local regulations of “Chili”, regulating the issues of ensuring the security of personal data at their processing in personal data information systems of “Chili”.

12. Control over compliance with the Russian Federation legislation and local regulations of “Chili” in the field of personal data, including requirements for the protection of personal data.

12.1 Control over compliance with Russian Federation legislation by “Chili” structural units, its branches, and representative offices and local regulations of “Chili” in the sphere of personal data, including requirements to the protection of personal data, shall be performed to check compliance of personal data processing within structural subdivisions of “Chili” administration, its branches, and representative offices with the Russian Federation legislation and local regulations of “Chili” in the sphere of personal data, including requirements to the protection of personal data, and measures are taken to prevent and detect violation of the Russian Federation legislation

12.2 Internal control over compliance with personal data protection laws by “Chili” structural units and its branches “Chili”, its branches and representative offices shall exercise control over compliance with the legislation of the Russian Federation and local regulations of “Chili” in the field of personal data, including requirements for the protection of personal data, by a person responsible for the organization of processing of personal data in “Chili”.

12.3 Personal responsibility for compliance with the requirements of the legislation of the Russian Federation and local regulations of “Chili” in the field of personal data in the structural subdivision of “Chili”, its branch and representative office, as well as for ensuring confidentiality and security of personal data in the specified subdivisions of “Chili” shall be the responsibility of their managers.

13. Additional terms and conditions

13.1 “Chili” may amend this Policy without the consent of the User.

13.2 Before filing a claim with the court for disputes arising out of the relationship between the User of the Website and “Chili”, it is mandatory to file a claim.

13.3 Within 30 (thirty) calendar days after receipt of the claim, the recipient of the claim shall notify the claimant of the outcome of the claim in writing.

13.4 In the event of failure to reach an agreement, the dispute shall be resolved judicially by the applicable laws of the Russian Federation.

13.5. The new version of the Policy shall take effect from the moment of its posting on the website of the online shop unless otherwise provided by the new version of the Policy.

13.6. Any suggestions or questions regarding this Privacy Policy shall be communicated by e-mail to info@interchili.ru.  

13.7. The current Privacy Policy is available at www.interchili.ru/policy