Personal dataprocessing policy

This Policy sets out how IMID Limited Liability Company (brand name Sorbfil; the Operator) processes personal data and the measures it takes to protect it. The Policy is issued under Part 2 of Article 18.1 of Federal Law No. 152-FZ “On Personal Data” of 27 July 2006 (the Law) and covers all personal data the Operator receives in connection with the Sorbfil website (the Site), in both its Russian and English versions.

Terms are used in the meanings given by the Law. The Operator's details and contacts are listed at the top of this document.

The Policy is publicly available on the Site: the current edition is always on this page.

The Site is a product catalogue and reference; it is not built to collect personal data:

• there are no contact or order forms, no registration and no user accounts;
• the Site sets no cookies and loads no web analytics counters, advertising systems, social media widgets or other third-party scripts;
• you send a question or an order yourself — by e-mail, or by calling or messaging the phone number shown on the Site.

Personal data therefore reaches the Operator only when you write or call yourself, plus the technical request data without which a page cannot be delivered to your browser (Section 4). What the Site keeps in your browser is described in the Cookie Policy.

The Operator processes the personal data of:

• Site visitors who contact the Operator by phone, by message or by e-mail;
• customers who are individuals or sole proprietors, and representatives and contact persons of corporate customers;
• representatives of counterparties the Operator corresponds with about product supply.

Answering an enquiry and preparing an offer. To answer a question about the products, help choose an item, and prepare a quotation and an invoice. Data: surname, first name and patronymic; e-mail address; phone number; organisation name and position; the content of the enquiry and anything attached to it.

Concluding and performing a supply contract. To draw up the contract and closing documents and to arrange shipment, delivery or pickup. Data: the above, plus the details of the organisation or sole proprietor, the delivery address, and details of the consignee and of the power of attorney to collect the goods.

Meeting the Operator's legal obligations. Accounting and tax records, storage of primary documents. Data: what is contained in contracts and primary accounting documents.

The Operator does not process special categories of personal data (health, beliefs, etc.) or biometric data, does not use the data for mailings or advertising, and makes no decisions with legal effect for you based solely on automated processing.

Please do not send the Operator data your enquiry does not need, and do not pass on other people's personal data without their consent.

When your browser opens a page of the Site, the server hosting the Site receives the technical data of the request: IP address, date and time, the address of the requested page and of the page you came from, and browser details (User-Agent). Without them the page cannot be delivered.

This data is used only to show the Site and keep it working and secure — for example, to investigate a failure or repel an attack. The Operator does not combine it with other information to identify a visitor and does not disclose it to third parties except where the law requires. Server logs are kept no longer than these purposes need and are then deleted.

The Operator processes personal data on the following grounds (Part 1 of Article 6 of the Law):

• the data subject's consent — when you send an enquiry yourself (see the Consent to Personal Data Processing);
• the need to conclude, at the data subject's initiative, and to perform a contract to which the data subject is a party, beneficiary or guarantor;
• the exercise of the rights and legitimate interests of the Operator or third parties — correspondence with representatives of corporate customers, provided your rights and freedoms are not infringed;
• obligations imposed on the Operator by Russian law, including Federal Law No. 402-FZ “On Accounting” of 6 December 2011 and the Tax Code of the Russian Federation.

The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction.

Processing is mixed — both automated (e-mail, accounting software) and non-automated (paper contracts and delivery notes).

When collecting personal data, the Operator records, systematises, accumulates, stores, clarifies and retrieves it using databases located in the Russian Federation (Part 5 of Article 18 of the Law).

The Operator does not sell personal data and does not disclose it to third parties without your consent, except where the law provides otherwise. Data may be transferred:

• to a carrier or delivery service — as far as needed to ship and deliver an order (consignee's name and phone, delivery address);
• to a bank — as far as payment documents require;
• to public authorities — on the grounds and in the manner established by law.

The Operator may entrust processing to another party — for example, a hosting or e-mail provider — under a contract that binds that party to the processing principles and rules, confidentiality and protection measures required by the Law. The Operator remains responsible to you for that party's actions.

Personal data is not transferred across borders.

Personal data is processed no longer than its purposes require:

• correspondence on an enquiry that did not lead to a contract — until the purpose of the enquiry is achieved, but no longer than three years from the last contact;
• data related to a contract — for the term of the contract and then for the document retention periods set by law (at least five years for primary accounting documents);
• if consent is withdrawn — as described in Section 11.

Once the purpose is achieved, the period has expired or consent has been withdrawn and there are no other grounds for processing, the Operator destroys the personal data within 30 days and records the destruction in the manner set by Roskomnadzor.

The Operator takes the legal, organisational and technical measures needed to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision and dissemination (Articles 18.1 and 19 of the Law), including:

• appointing a person responsible for organising personal data processing;
• issuing internal regulations on processing and making them known to employees with access to personal data;
• limiting access to personal data to employees who need it for their duties;
• using information security and access control tools, and backups;
• serving the Site over the secure HTTPS protocol;
• monitoring internally that processing complies with the Law and this Policy.

The Operator does not publish or disseminate the personal data of visitors and customers.

You have the right to:

• obtain information about the processing of your personal data: confirmation that it is processed, its legal grounds and purposes, the data concerned and its source, the processing and retention periods, the parties to whom the data is or may be disclosed, and the other information listed in Part 7 of Article 14 of the Law;
• require that your personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
• withdraw your consent to processing;
• appeal against the Operator's actions or inaction to Roskomnadzor or in court.

Withdrawing consent does not prevent the Operator from continuing processing where the Law provides other grounds for it — for example, performing a contract or keeping accounting documents.

A request or a withdrawal of consent can be sent to the Operator's e-mail address or by post to its registered address — both are listed at the top of this document.

The request must contain the information required by Part 3 of Article 14 of the Law:

• the number of the main identity document of the data subject or their representative, its date of issue and the issuing authority;
• information confirming your relationship with the Operator (for example, the date and subject of your enquiry, or the contract number), or other information confirming that your data is processed;
• the signature of the data subject or their representative. A request sent as an electronic document is signed with an electronic signature under Russian law.

The Operator replies within 10 working days of receiving the request. This period may be extended by no more than 5 working days, in which case the Operator sends a reasoned notice explaining why.

The Operator may change this Policy — for example, if new ways of contact or services appear on the Site. A new edition is published on this page with its date and takes effect on publication unless it states otherwise. If a change requires your consent (for example, adding web analytics), the Operator will ask for it before such processing starts.

Questions about this Policy can be sent to the contacts listed at the top of this document.