Personal Data Processing Policy

This document sets out our principles and rules regarding the processing of personal data on the Site.

Read this policy before you start using the Site.

If you have any questions, please email us at 999@upster.ru.

Terms

1. General Provisions
   1. Operator has developed the Policy in order to:
      1. protect the rights and freedoms of the Subjects in the processing of his/her Personal Data;
      2. clearly and strictly comply with the requirements of the legislation of the Russian Federation in the field of personal data, including the requirements of the Federal Law dated 27.07. 2007 №152-FZ «On Personal Data»
      3. exclude unauthorized actions of any third parties on Processing;
      4. prevent possible threat to the Subjects' security.
   2. Operator has the right to amend the Policy. The new version of the Policy comes into force from the moment of its publication.
   3. If the Subject continues to use the Website after the new version of the Policy comes into force, it will mean that he/she has accepted the terms of the new version.
2. Purposes of Processing
   1. Operator processes Personal Data for the purposes of:

      Purpose	Category of personal data subjects	Personal data	Processing period	Destruction procedure
      Discussion of the project	Contact person	name, first name, patronymic place of work city email address phone number	At the moment of termination of the agreement or revocation of consent	Deletion from the database without possibility of restoration
      Registration and creation of an account	Site User	name email address phone number phone delivery address	Until consent is withdrawn or the Site is terminated	Deletion from the database without possibility of restoration
      Collection of requests for delivery or pickup from the restaurant	User of the Site	name email address phone number delivery address loyalty card number	Till revocation of consent or termination of the Site	Deletion from the database without possibility of recovery
      Collection of applications for table reserve in the restaurant	Site user	name phone number	Till withdrawal of consent or termination of the Site	Deletion from the database without possibility of restoration
      Processing job seekers' requests	Job seekers	First name E-mail address phone number position education information foreign language skills employment information (including work experience) photo other personal data, which the Applicant will indicate in the resume	Till revocation of consent or termination of the Site	Deletion from the database without the possibility of restoration
      Collection of feedback	User Site	name phone number email address	Before withdrawal of consent or termination of the Site	Deletion from the database without possibility of restoration
      Creation of an electronic loyalty card	User of the Site	name phone number email address date of birth sex	Before withdrawal of consent or termination of the Site	Deletion from the database without possibility of restoration
      Sending advertising and informational mailings	Contact person	First name Phone number Email address	Before withdrawal of consent or termination of the Website	Deletion from the database without possibility of restoration
      Analytical study of the behavior of Site Users	Site User	metadata (ip, browser user agent, fingerprint) cookies	Till the Site is discontinued	Deleted from the database without the possibility of recovery

   2. The Site user has the right to change the settings of his Internet browser and refuse to save cookies ( Google Chrome , Yandex.Browser, Mozilla Firefox, Safari).
   3. For the purpose of analytical research of the website Users' behavior, the Operator processes the specified Personal Data using metric services Yandex.Metrica and UIS.
   4. Yandex.Metrica service:
      1. Available at https://metrika.yandex.ru/
      2. Owned by «Yandex» LLC, registered at 16, Lev Tolstoy str., Moscow, 119021 (hereinafter – Yandex).
   5. UIS service:
      1. Available at https://www.uiscom.ru/
      2. Related to «Novosistem» LLC, registered at 117638, Moscow, Odessa str, 2, k/e/p s/17/21n (hereinafter – Novosystem).
   6. Information stored in such cookies is transmitted and stored on Yandex servers. The User of the Website gives consent to the Operator to process and transfer the data to Yandex and Novosystem.
   7. The User has the right to block the Yandex.Metrics service. To do this, you can download and install the add-on at link.
   8. When Yandex.Metrica is blocked, some functions of the Site may become unavailable.
3. Principles of Processing
   1. Operator processes Personal Data on the basis of the following principles:
      1. legal and fair basis for Processing;
      2. processing in accordance with specific, predetermined and legitimate purposes;
      3. non-unification of databases containing Personal Data processed for incompatible purposes;
      4. compliance of the content and scope of Personal Data with the stated purposes of Processing;
      5. accuracy, sufficiency, relevance and reliability of Personal Data;
      6. lawfulness of technical measures aimed at the Processing;
      7. reasonableness and expediency of the Processing;
      8. storage of Personal Data for no longer than required by the purposes of the Processing, unless the period of storage is prescribed by law, contract to which the subject is a party;
      9. destruction of Personal Data upon achievement of the purposes of the Processing or in case of loss of necessity to achieve them, unless otherwise provided by the Law.
4. Processing of Personal Data
   1. Processing includes collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, dissemination, transfer (provision, access), blocking, deletion, destruction.

      Collection of Personal Data

   2. Operator collects Personal Data:
      1. through forms filled out by the Subject;
      2. by receiving messages by e-mail and/or messengers;
      3. by means of technologies, web protocols, «cookies» files, web marks.

      Storage of Personal Data

   3. Operator stores Personal Data:
      1. exclusively on properly protected electronic media;
      2. using databases located on the territory of the Russian Federation;
      3. on the Website using automated processing;
      4. until the end of the processing period.

      Transfer of Personal Data to third parties, assignment for processing of Personal Data

   4. The Operator has the right to transfer Personal Data and entrust the processing of Personal Data to third parties in order to achieve the specified purposes.
   5. The list of third parties to whom the Operator transfers Personal Data or entrusts the processing of Personal Data is contained on page.
   6. The Operator does not provide Personal Data to third parties without the Subject's consent, except for the following cases:
      1. transfer to separate, independently functioning, but included in the Website, applications and databases;
      2. prevention of suppression of illegal actions of the Subjects and protection of the legitimate interests of the Operator and third parties, as well as in cases established by the legislation of the Russian Federation;
      3. sending a motivated request to judicial bodies, state security bodies, prosecutor's offices, police, investigative bodies, other bodies and organizations in cases established by regulatory legal acts, which are mandatory for execution.

      Actualization and destruction of Personal Data

   7. Operator updates Personal Data if it is confirmed that it is inaccurate.
   8. Operator destroys Personal Data in the following cases:
      1. the existence of a security threat to the Website;
      2. expiration of the period of processing of Personal Data;
      3. when the purposes of Processing have been achieved;
      4. at the Subject's request, if further Processing is not required by law.
   9. Operator destroys Personal Data by erasing or formatting the media without the possibility of data recovery.
5. Rights and guarantees of the Subject
   1. The Subject has the following rights:

      Right of the Subject	Description of the Subject's right
      Right of access to Personal Data	The Subject may request a copy of the Personal Data, which the Operator has
      Right to clarify Personal Data	The Subject may request the Operator to correct inaccurate or incomplete Personal Data
      Right to withdraw consent to Processing	At any time the Subject may withdraw his/her consent to Processing
      Right to erasure of Personal Data	The Subject may request the erasure of his/her which the Operator holds, except in cases where the Operator is obliged to process this data in accordance with Russian law
      Right to appeal	Subject may appeal against actions or omissions of the Operator
      Right to request	The Subject has the right to send a request to the Operator for information about the Processing. All requests shall be sent in the manner provided for in the Policy.
      Cookies	Fragments of text that are automatically stored in the memory of the user's Internet browser. This allows the Site to access and retrieve the stored information on the user's computer when necessary

   2. The Subject guarantees:
      1. that the Personal Data provided are true, up-to-date and do not violate the laws of the Russian Federation;
      2. if the Personal Data provided relate to a third party, the Subject has obtained the consent of the third party to transfer the Personal Data for Processing.
6. Operator's Responsibilities
1. Operator shall:
   1. provide, at the Subject's request, information about the Processing or a justified refusal;
   2. take measures necessary and sufficient to fulfill the obligations stipulated by the legislation of the Russian Federation.
   3. at the Subject's request, clarify the Personal Data being processed, block or delete if they are incomplete, outdated, inaccurate, illegally obtained or unnecessary for the stated purpose of the Processing;
   4. ensure the lawfulness of the Processing. If it is impossible to ensure the lawfulness of Processing, the Operator shall, within a period not exceeding 10 business days from the date of detection of unlawful Processing, destroy or ensure the destruction of Personal Data;
   5. within a period not exceeding 30 days from the date of receipt of the Subject's withdrawal of consent, cease Processing and destroy Personal Data if their retention is no longer required for the purposes of Processing; Exception – when Processing may be continued in accordance with the laws of the Russian Federation.
7. Measures to ensure protection of Personal Data
   1. Operator ensures implementation of legal, organizational and technical measures necessary and sufficient to ensure protection of Personal Data.
   2. Legal measures include, without limitation:
      1. development by the Operator of local documents implementing the requirements of the Russian legislation, including – Policy and posting it on the Website;
      2. rejection of any methods of Processing that do not meet the purposes predetermined by the Operator.
   3. Organizational measures include:
      1. appointment of a person responsible for the organization of Processing;
      2. periodic risk assessment of the Processing process;
      3. conducting periodic audits in order to carry out internal control over the compliance of Processing with the requirements of the legislation of the Russian Federation.
   4. Technical measures:
      1. preventing, including through internal investigations, unauthorized access to systems where Personal Data is stored;
      2. backup and restoration of Personal Data, operability of technical means and software, information protection means in information systems of Personal Data;
      3. other necessary security measures.
8. Subject's Requests
   1. The Subject or his/her representative has the right to send to the Operator his/her requests, including withdrawal of consent to Processing, in the form of an electronic document.
   2. The request must contain the following information:
      1. information confirming the Subject's participation in relations with the Operator – telephone number, e-mail address;
      2. data of the representative and confirmation of his/her authority, if the Subject's representative is applying;
      3. signature of the Subject, his/her representative.
   3. Operator will consider and send a response to the request within 10 working days from the date of receipt of the request.
   4. All correspondence received by the Operator (requests in writing or electronically) refers to restricted information and is not disclosed without the written consent of the Subject.
9. Secular provisions
   1. The Policy applies exclusively to the Website and does not apply to other Internet resources.
   2. The Policy applies to all Personal Data received by the Operator.
   3. The Operator is not responsible for the actions of third parties who have accessed Personal Data through the Subject's fault.
   4. The Operator does not verify:
      1. ability of the Subject;
      2. reliability of the submitted Personal Data.

Requentials

IP Mamutov Arsen Yurievich

INN: 500403391128

OGRNIP: 304500402600030

141407, Moscow region, Khimki, Gorshina street, 1, sq.735.