Personal Data Processing Policy

1. General Provisions

This Personal Data Processing Policy is prepared in accordance with the requirements of the Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (hereinafter referred to as the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the security of personal data taken by LLC “KNAVI GROUP” (hereinafter referred to as the Operator).

1.1. The Operator’s primary objective and condition for its activities is to respect the rights and freedoms of individuals when processing their personal data, including the right to privacy, personal and family secrecy.

1.2. This Operator’s Policy regarding personal data processing (hereinafter referred to as the Policy) applies to all information that the Operator may obtain about visitors to the website https://knavi.su.

2. Key Terms Used in the Policy

Automated personal data processing — processing of personal data using computing technology.

Blocking of personal data — temporary suspension of personal data processing (except when processing is necessary to clarify personal data).

Website — a set of graphic and informational materials, as well as computer programs and databases that ensure accessibility on the internet at the network address https://knavi.su.

Personal data information system — a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

Personal data anonymization — actions as a result of which it is impossible to identify the personal data subject without additional information.

Personal data processing — any action (operation) or set of actions (operations) performed with or without automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.

Operator — a state body, municipal body, legal or natural person that independently or jointly with others organizes and/or carries out personal data processing and determines the purposes, scope, and methods of such processing.

Personal data — any information relating directly or indirectly to a specific or identifiable User of the website https://knavi.su.

Personal data permitted by the data subject for dissemination — personal data for which the data subject has granted consent for unrestricted access in accordance with the Personal Data Law (hereinafter referred to as personal data permitted for dissemination).

User — any visitor to the website https://knavi.su.

Provision of personal data — actions aimed at disclosing personal data to a specific person or group of persons.

Dissemination of personal data — any actions aimed at disclosing personal data to an unlimited number of persons (e.g., publication in media, posting online, or granting access by any other means).

Cross-border transfer of personal data — transfer of personal data to a foreign state authority, foreign individual, or foreign legal entity.

Destruction of personal data — any actions resulting in the irreversible deletion of personal data from the information system and/or destruction of physical data carriers.

3. Operator’s Rights and Obligations

3.1. The Operator has the right to:

• obtain accurate information and/or documents containing personal data from the data subject;
• continue processing personal data without the data subject’s consent if the subject withdraws consent or requests termination of processing, provided there are legal grounds under the Personal Data Law;
• independently determine the necessary and sufficient measures to fulfill obligations under the Personal Data Law and related regulations, unless otherwise required by law.

3.2. The Operator is obligated to:

• provide the data subject, upon request, with information regarding the processing of their personal data;
• process personal data in compliance with Russian Federation legislation;
• respond to requests from data subjects and their legal representatives in accordance with the Personal Data Law;
• provide the authorized personal data protection authority with requested information within 10 days of receiving such a request;
• publish or otherwise ensure unrestricted access to this Policy;
• implement legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, dissemination, or other unlawful actions;
• cease transmission (dissemination, provision, access), processing, and destroy personal data as required by the Personal Data Law;
• fulfill other obligations stipulated by the Personal Data Law.

4. Rights and Obligations of Personal Data Subjects

4.1. Data subjects have the right to:

• receive information about the processing of their personal data, except in cases provided by federal law. The Operator shall provide this information in an accessible form without disclosing other individuals’ personal data, unless legally permitted;
• request correction, blocking, or deletion of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose, and take lawful measures to protect their rights;
• require prior consent for processing personal data for marketing purposes;
• withdraw consent for personal data processing and request termination of processing;
• appeal unlawful actions or omissions by the Operator to the authorized data protection authority or in court;
• exercise other rights granted by Russian Federation legislation.

4.2. Data subjects are obligated to:

• provide the Operator with accurate personal information;
• notify the Operator of any updates or changes to their personal data.

4.3. Individuals who provide the Operator with false information about themselves or about another data subject without consent shall be held liable under Russian Federation law.

5. Principles of Personal Data Processing

Personal data processing shall be lawful and fair.

Processing shall be limited to specific, predetermined, and lawful purposes. Incompatible processing is prohibited.

Combining databases with incompatible processing purposes is not permitted.

Only personal data relevant to the processing purpose shall be processed.

The content and volume of processed personal data shall correspond to the stated purposes. Excessive data collection is prohibited.

The Operator shall ensure the accuracy, sufficiency, and, where necessary, relevance of personal data. Measures shall be taken to correct or delete incomplete or inaccurate data.

Personal data shall be stored in an identifiable form only as long as necessary to achieve the processing purposes, unless a longer retention period is required by federal law or contract. Data shall be deleted or anonymized upon achievement of the purpose or when no longer needed, unless otherwise required by law.

6. Purposes of Personal Data Processing

7. Conditions for Personal Data Processing

Processing is carried out with the data subject’s consent.

Processing is necessary to fulfill obligations under international treaties or Russian federal law.

Processing is necessary for judicial proceedings or enforcement of court decisions.

Processing is necessary to perform a contract to which the data subject is a party, beneficiary, or guarantor.

Processing is necessary to protect the legitimate interests of the Operator or third parties, or to achieve publicly significant goals, provided the data subject’s rights are not violated.

Processing concerns personal data made publicly available by the data subject or at their request (publicly available personal data).

Processing is required by federal law for publication or mandatory disclosure.

8. Procedures for Collection, Storage, Transmission, and Other Processing of Personal Data

The Operator ensures the security of processed personal data through legal, organizational, and technical measures in full compliance with Russian personal data protection legislation.

The Operator ensures the confidentiality and integrity of personal data and prevents unauthorized access.

Personal data will never be disclosed to third parties except as required by law or with the data subject’s explicit consent for the performance of a civil contract.

If inaccuracies are found, the User may update their data by sending a notice to mail@knavi.su with the subject “Personal Data Update”.

Personal data will be processed only as long as necessary to achieve the stated purposes, unless otherwise required by contract or law.

The User may withdraw consent at any time by emailing mail@knavi.su with the subject “Withdrawal of Consent for Personal Data Processing”.

Information collected by third-party services (e.g., payment systems, communication platforms) is stored and processed by those providers in accordance with their own terms and privacy policies. The Operator is not liable for third-party actions.

Restrictions imposed by the data subject on the transfer or processing of publicly available personal data do not apply when processing is required for state, public, or other legally recognized public interests.

The Operator ensures the confidentiality of personal data.

Personal data is stored in an identifiable form only as long as necessary for the processing purposes, unless a longer period is required by law or contract.

Processing may be terminated upon achievement of the purpose, expiration or withdrawal of consent, a request to cease processing, or discovery of unlawful processing.

9. List of Actions Performed by the Operator on Personal Data

The Operator performs collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.

The Operator carries out automated processing of personal data, with or without transmission via information and telecommunication networks.

10. Cross-Border Transfer of Personal Data

Before initiating cross-border data transfers, the Operator must notify the authorized personal data protection authority of its intent (separate from the general data processing notification).

Prior to submitting this notification, the Operator must obtain relevant assurances from the foreign recipient (authority, individual, or legal entity).

11. Confidentiality of Personal Data

The Operator and any persons with access to personal data must not disclose or disseminate such data to third parties without the data subject’s consent, unless otherwise required by federal law.

12. Final Provisions

Users may request clarifications regarding personal data processing by contacting the Operator at mail@knavi.su.

This document will reflect any changes to the Operator’s Personal Data Processing Policy. The Policy remains in effect indefinitely until replaced by a new version.

The current version of the Policy is publicly available at https://knavi.su/privacy.