NEUROTECHNOLOGY LLC
(internal document to comply with the requirements of Federal Law-152 and Roskomnadzor)
1. General provisions1.1. The Policy regulates the internal procedures for processing and storing personal data (hereinafter referred to as PD) received from Users as part of the activities of the online stores WWW.SACRUS.RU, CORDUS.RU, mobile application and Telegram bot (hereinafter referred to as the Services).
1.2. The policy complies with the requirements of Federal Law-152, Roskomnadzor Order No. 21 of 06/01/2021 and legislative changes for 2023-2025.
1.3. An employee of the IT security department (hereinafter referred to as the Operator) is appointed responsible for the implementation of the Policy.
1.4. Employees and involved persons (contractors) who have access to personal data are required to undergo training on data protection and sign confidentiality agreements.
2. Categories and purposes of personal data processed2.1.
Categories of data subjects: users, buyers, subscribers, website visitors.
2.2.
Categories of processed personal data:- Full name, email, telephone, delivery address;
- Data about the user's device (IP, OS);
- Information about orders, payment, delivery;
- Technical logs of the application and Telegram bot;
- Voluntarily provided information (for example, about health).
- 2.3. Purposes of processing:
- Execution of purchase and sale agreements;
- Delivery of goods;
- Providing customer service and support;
- Marketing notices (subject to separate consent);
- Analytics and improvement of services;
- Compliance with the requirements of the legislation of the Russian Federation.
3. Legal basis for processing3.1. Processing is carried out on the basis of:
- User consent;
- execution of the contract;
- legal requirements (including invoices, checks);
- legitimate interests of the Company, subject to maintaining a balance of interests.
4. Procedure for collecting, storing and using data4.1. Data collection is carried out through registration forms, order forms, Telegram bot, application.
4.2. Personal data is stored on a server located in the Russian Federation, in certified data centers.
4.3. Access to data is provided on the basis of least rights. Passwords and access are issued strictly upon signature.
4.4. All employee actions are logged (time, user, IP).
4.5. Periodic check of data relevance (X-ray reports) - at least once a year.
5. Terms of storage and destruction of data5.1. The storage period is determined by the purposes of processing and legal deadlines:
- order and payment data - no less 5 years;
- contact details of buyers and users - before withdrawing consent or deleting your account;
- log files and technical data - up to 1 year or longer if necessary to investigate incidents.
- 5.2. At the end of the storage period, the data is subject to deletion or anonymization (internal procedure - deletion from the database and archiving "by mask").
- 5.3. If the User withdraws consent, PD may be deleted, with the exception of information necessary to fulfill obligations before the law (for example, tax accounting).
6. Transfer of data to third parties6.1. PD can be transferred to third parties only if there is:
- a written agreement on confidentiality and personal data processing;
- strictly limiting the volumes and purposes of use.
- 6.2. Contractors: courier services, payment systems, hosting and IT support.
7. Information security measures7.1. Certified cryptographic protection means (CIPF) are used when transferring and storing critical personal data.
7.2. Access to data is limited: two-factor authentication for administrators, encryption of backup copies.
7.3. Regular internal and external IS audits (at least once every 12 months).
7.4. A response plan for personal data leakage has been developed: notification of Roskomnadzor within
24 hours, notification of subjects.
8. Accounting for consents and notices8.1. All user consents are recorded indicating the date, purpose and validity period.
8.2. Notification of Roskomnadzor about the start of data processing is carried out by you as an Operator - within the time limits established by law.
8.3. The user has the right to send a request to delete, correct or access his personal data.
9. Employee training9.1. All employees undergo mandatory training on personal data protection upon admission and then at least once a year.
9.2. Responsibility for violation of internal procedures is imposed with disciplinary sanctions up to and including dismissal.
10. Responsibility and control10.1. Violation of the Policy or legislation entails administrative measures in accordance with Federal Law 152 and 420 Federal Law (fines up to millions of rubles).
10.2. The designated Operator is responsible for the implementation of this Policy.