Information on Implemented Personal Data Protection Requirements
When processing personal data, Aida Rushanovna Gubaidullina, Individual Entrepreneur (INN 165507103300, OGRNIP 317169000078342), hereinafter the "Operator", takes the following measures provided for by Articles 18.1 and 19 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Personal Data Law").
Legal and organisational measures
1. The Personal Data Processing Policy is published on the website.
2. The duties of the person responsible for organising the processing of personal data and of the person responsible for ensuring the security of personal data in personal data information systems are performed by Aida Rushanovna Gubaidullina, Individual Entrepreneur.
3. Local regulations on the processing and protection of personal data have been approved; employees and other persons admitted to the processing of personal data have been familiarised, against signature, with the legislation of the Russian Federation on personal data, the Personal Data Processing Policy and the Operator's local regulations.
4. An assessment of the harm that may be caused to data subjects has been carried out; the type of relevant threats to the security of personal data and the levels of protection of personal data in the information systems have been determined (Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012).
5. Access to personal data is granted to persons according to the list of job positions approved by the Operator, to the extent necessary to perform their duties.
6. Paper documents containing personal data are kept in lockable cabinets.
7. If it is established that personal data have been unlawfully or accidentally transferred (provided, disseminated or accessed), resulting in a violation of the rights of data subjects, the Operator notifies Roskomnadzor within 24 hours, and of the results of the internal investigation within 72 hours (Article 21(3.1) of the Personal Data Law).
Technical measures
8. The CRM and the accounting system are accessed through password-protected accounts.
9. The website transmits data over HTTPS; requests made over HTTP are redirected to HTTPS.
10. Anti-virus software is used on computers.
Questions about personal data protection: hello@letoflowers.ru.
