ERSONAL DATA PRIVACY POLICY
(hereinafter referred to as the “Policy”)
Last Updated: April 21, 2025
GENERAL PROVISIONS
1.1. This Personal Data Privacy Policy is an official document of Kirill Viktorovich Tungusov, an individual entrepreneur, OGRNIP 320508100396632 (hereinafter referred to as the “Operator”), and establishes the procedure for processing personal data and measures to ensure the security of personal data of individuals (hereinafter referred to as the “Personal Data Subject” or “Subject”) using the services, information, products, or programs of the Operator on the website located at the domain name http://eu.bodylabstudios.ru (hereinafter referred to as the “Website”) and the Operator’s official social media pages.
1.2. This Policy applies to all personal data that the Operator may obtain from individuals during their registration on the Website.
1.3. This Policy is applied by the Operator in accordance with Federal Law No. 152-FZ of July 27, 2006, “On Personal Data,” Federal Law No. 38-FZ of March 13, 2006, “On Advertising,” and other regulatory acts in the field of personal data protection in force in the Russian Federation. It aims to prevent violations of Russian Federation legislation and address the consequences of such violations related to the processing of personal data.
1.4. The Operator’s goal and condition for conducting its activities is to respect the rights and freedoms of individuals during the processing of their personal data, including the protection of rights to privacy, personal, and family secrets from unauthorized access and disclosure.
1.5. The processing of personal data is carried out on a lawful and fair basis, acting reasonably and in good faith, and based on the following principles:
– Lawfulness of the purposes and methods of personal data processing;
– Good faith;
– Compliance of the purposes of personal data processing with the purposes predefined and declared during the collection of personal data, as well as with the Operator’s authority;
– Compliance of the volume and nature of processed personal data and the methods of processing with the purposes of personal data processing.
1.6. The Operator may process the following personal data:
– Surname, name;
– Date of birth;
– Phone number;
– Email address;
– Data on services provided or being provided to the Personal Data Subject, including the history of the Subject’s requests;
– History of the Personal Data Subject’s requests, including messages and documents sent by the Subject to the Operator;
– Delivery address for the Operator’s goods.
1.7. When using the Website’s services, the Operator also processes other anonymized data automatically transmitted during the use of the Website through software installed on the user’s computer:
– Information about the browser used (or other program used to access the Website);
– IP address;
– Cookie data.
1.8. The Operator guarantees that external organizations do not have access to such data that may be used by the Operator, except in cases explicitly stipulated by the current legislation of the Russian Federation, this Policy, or as specified in Section 3.7 of this Policy. Upon receipt of personal data not listed in this section, such data is subject to immediate destruction.
1.9. The Operator processes personal data of Personal Data Subjects by maintaining databases using automated, mechanical, or manual methods for the following purposes:
1.9.1. Processing orders, requests, or other actions of the Personal Data Subject related to visiting the Website or ordering services, including but not limited to requests for prices of goods listed in catalogs;
1.9.2. With the explicit consent of the Personal Data Subject, for the purpose of promoting the Operator’s goods, works, and services, notifying about promotions, events, discounts, and conducting the Operator’s marketing campaigns;
1.9.3. For other purposes, provided such actions of the Operator do not contradict current legislation, the Operator’s activities, and the Personal Data Subject’s consent has been obtained for such processing;
1.9.4. The data specified in Section 1.6 of this Policy is processed for the purposes of Website analytics, tracking and understanding the principles of Website use by visitors, improving Website functionality, resolving technical issues, developing new products, expanding services, identifying the popularity of goods, determining the effectiveness of advertising campaigns, ensuring security, preventing fraud, and providing effective customer support (e.g., displaying nearby boutiques).
1.10. The Operator processes personal data through any action (operation) or set of actions (operations), including:
– Collection;
– Recording;
– Systematization;
– Accumulation;
– Storage;
– Updating (modification, change);
– Extraction;
– Use;
– Transfer (distribution, provision, access);
– Anonymization;
– Blocking;
– Deletion;
– Destruction.
1.11. During payment processing, personal information provided by the Subject (name, address, phone, email, bank card number) is not stored on the Operator’s web server and is provided only to the partner bank. No payment information, except for payment confirmation, is transmitted by the partner bank to the Operator. The security of payment processing, including online payments, is guaranteed by partner banks. All resources of partner banks comply with PCI DSS security standards and hold all necessary permits and certificates.
OBTAINING, USING, AND DISCLOSING PERSONAL DATA
2.1. The Operator obtains and begins processing personal data of the Subject upon receiving their consent. Consent to the processing of personal data may be provided by the Personal Data Subject in any form that confirms the fact of obtaining consent, unless otherwise stipulated by federal law: in written, oral, or other forms provided by current legislation, including through conclusive actions by the Personal Data Subject. In the absence of the Personal Data Subject’s consent to the processing of their personal data, such processing is not carried out.
2.2. Personal data of Personal Data Subjects is obtained by the Operator:
– Through personal submission by the Subject when entering information into electronic forms on the Website;
– Through personal submission by the Subject during oral communication by phone during the ordering process;
– Through personal submission by the Subject when entering information electronically on the Website;
– By other means that do not contradict the legislation of the Russian Federation and the requirements of international personal data protection legislation.
2.3. Consent to the processing of personal data is deemed provided through any action or combination of the following actions by the Personal Data Subject:
– Registration on the Operator’s Website;
– Marking consent to the processing of personal data in the relevant form on the Website, in the scope, for the purposes, and in the manner specified in the text provided for review before obtaining consent;
– Providing personal data orally during phone communication in the process of ordering services;
– Providing personal data in writing during the ordering process.
2.4. Consent is deemed obtained in the established manner and remains valid until the Personal Data Subject submits a corresponding request to cease processing personal data to the Operator’s location.
2.5. The Personal Data Subject may withdraw their consent to the processing of personal data at any time, provided such a procedure does not violate the requirements of Russian Federation legislation. To withdraw consent, the Subject must send a message to the administrator of the official social media page of the Online Store. Upon withdrawal of consent, the Operator must cease processing personal data or ensure the cessation of such processing (if performed by another party acting on the Operator’s behalf) and, if the retention of personal data is no longer required for the purposes of processing, destroy the personal data or ensure their destruction (if processed by another party acting on the Operator’s behalf) within thirty (30) days from the date of receipt of the withdrawal, unless otherwise stipulated by the contract in which the Personal Data Subject is a party, beneficiary, or guarantor, another agreement between the Operator and the Subject, or if the Operator is not entitled to process personal data without the Subject’s consent under Federal Law No. 152-FZ of July 27, 2006, “On Personal Data,” or other federal laws.
2.6. In case of inaccuracies in personal data, the User may update them by sending a message to the administrator of the official social media page of the Online Store.
INFORMATION ON IMPLEMENTED PERSONAL DATA PROTECTION REQUIREMENTS
3.1. The Operator’s activities in processing personal data are inseparably linked to protecting the confidentiality of the information received.
3.2. The Operator requires other parties that gain access to personal data not to disclose or distribute personal data to third parties without the consent of the Personal Data Subject, unless otherwise provided by federal law.
3.3. All employees of the Operator are obliged to ensure the confidentiality of personal data and other information established by the Operator, unless this contradicts the current legislation of the Russian Federation.
3.4. To ensure the security of personal data during processing, the Operator takes necessary and sufficient legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, or other unlawful actions. The Operator ensures that all implemented organizational and technical measures for personal data protection are carried out lawfully, including in accordance with the requirements of Russian Federation legislation on personal data processing.
3.5. The Operator applies necessary and sufficient legal, organizational, and technical measures to ensure the security of personal data, including:
– Identifying threats to personal data security during their processing in personal data information systems;
– Applying organizational and technical measures to ensure personal data security during their processing in information systems, necessary to meet personal data protection requirements, the implementation of which ensures the levels of personal data security established by the Government of the Russian Federation;
– Using information protection tools that have passed the compliance assessment procedure in the established manner;
– Evaluating the effectiveness of measures taken to ensure personal data security before commissioning the personal data information system;
– Accounting for machine-readable personal data carriers;
– Detecting unauthorized access to personal data and taking measures;
– Restoring personal data modified or destroyed due to unauthorized access;
– Conducting measures to prevent unauthorized access to personal data and/or their transfer to persons not entitled to access such information;
– Timely detection of unauthorized access to personal data and taking necessary measures;
– Preventing impacts on technical means of automated personal data processing that could disrupt their functioning;
– Establishing rules for access to personal data processed in the information system and ensuring the registration and accounting of all actions performed with personal data in the information system;
– Monitoring the measures taken to ensure personal data security and the level of security of personal data information systems.
3.6. To ensure compliance with the personal data protection requirements of Federal Law No. 152-FZ of July 27, 2006, “On Personal Data,” and Federal Law No. 149-FZ of July 27, 2006, “On Information, Information Technologies, and Information Protection,” the Operator does not disclose information about specific tools and measures used to ensure the information security of personal data.
3.7. The Operator undertakes not to disclose information received from the Personal Data Subject. It is not considered a violation for the Operator to provide information to agents and third parties acting under a contract with the Operator to fulfill obligations to the Personal Data Subject. Disclosure of information in accordance with justified and applicable legal requirements is not considered a violation of obligations.
CONSENT TO RECEIVE ADVERTISING INFORMATION VIA TELECOMMUNICATION NETWORKS
4.1. By placing an order on the Operator’s Website, the Subject automatically agrees to receive newsletters/advertising information.
4.2. By providing the consent specified in Section 4.1 of this Policy, the Personal Data Subject confirms that they act of their own free will and in their own interest and that the provided personal data is accurate.
4.3. The Subject understands that the Operator may use pixel-based retargeting on social media for the following purposes:
– To remind the Subject of their interest in the Operator’s brand/product (e.g., reminding about a special contest);
– To offer to complete an unfinished action on the Website (e.g., paying for items in the cart);
– To exclude existing customers from the target audience of future advertising campaigns;
– For researching the audience visiting the Website.
CROSS-BORDER TRANSFER OF PERSONAL DATA
5.1. Before initiating the cross-border transfer of personal data, the Operator must ensure that the foreign state to whose territory the personal data is to be transferred provides reliable protection of the rights of personal data subjects.
5.2. Cross-border transfer of personal data to the territories of foreign states that do not meet the above requirements may only occur with the written consent of the Personal Data Subject for the cross-border transfer of their personal data and/or to fulfill a contract to which the Personal Data Subject is a party.
FINAL PROVISIONS
6.1. Users may obtain clarifications on any questions regarding the processing of their personal data by sending a message to the administrator of the official social media page of the Online Store. Any changes to the personal data processing policy will be reflected in this document. The Policy remains in effect indefinitely until replaced by a new version. The current version of the Policy is freely available on the Website.
CONTACT US
For questions or concerns, reach out via direct messages to the administrator of the official social media page of the Online Store.