Privacy Policy

Privacy Policy This Personal Data Processing Policy (the "Policy") sets out the policy of thumbly.art with respect to the personal data collected through the thumbly.art Service and contains information on the personal data protection requirements implemented. This Policy is an integral part of the Rules of Use of the thumbly.art Service. Acceptance of the Policy by ticking the checkbox in the relevant personal data collection form confirms that you have carefully read the text of the Policy, accept it fully and unconditionally, and consent to the processing of your personal data on the terms set out below. You must not provide your personal data if you disagree with any provision of the Policy. 1. Terms 1.1. Personal Data Law means Federal Law of the Russian Federation No. 152-FZ "On Personal Data" dated 27 July 2006. 1.2. Registered User means an individual (personal data subject) who is a Participant and has completed the registration procedure in the thumbly.art Service. 1.3. thumbly.art Service means the Operator's software and hardware complex which, through the Website and the mobile application, using the functionality of the thumbly.art Computer Program and the "Catalogue of Goods and Services in the Agricultural Sector" database, makes it possible to search for, sell and/or purchase Goods in the agricultural sector. 1.4. Unregistered User means an individual (personal data subject) who is not a Participant and who is entitled to use the functionality of the thumbly.art Service to a limited extent without completing the registration procedure. 1.5. Personal data processing means any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer, depersonalization, blocking, deletion and destruction of personal data. 1.6. Operator means thumbly.art 1.7. Personal data means any information relating directly or indirectly to an identified or identifiable individual (personal data subject). 1.8. Policy means this Personal Data Processing Policy. 1.9. User means an Unregistered User, a Registered User or a Participant's Representative. 1.10. Rules of Use of the thumbly.art Service means the rules of use of the thumbly.art Service published on the Internet at https://thumbly.art. 1.11. Participant's Representative means an individual (personal data subject) who is an employee of a Participant or its representative acting on a lawful basis. 1.12. Website means the website located on the Internet at: https://thumbly.art. 2. Personal Data Processed by the Operator 2.1. The Operator processes personal data provided by Users through the functionality of the thumbly.art Service, for example, by filling in special interactive forms posted on the Website, uploading documents and entering data into the personal account, or using particular functions of the thumbly.art Service. 2.2. The list of personal data processed varies depending on the type of User and the functionality of the thumbly.art Service being used. In particular, the Operator may process the following personal data: – full name, email address, telephone number (landline and mobile), date of birth, photograph of the User; – passport details of the User (in the form of a scanned copy of the document or in the form of information entered into questionnaires); – individual's TIN (INN) and OGRNIP, number of the certificate of registration as an individual entrepreneur, bank details of the individual entrepreneur, legal and actual address of the individual entrepreneur; – personal data that may be contained in inquiries / applications / questionnaires / orders and documents uploaded to the Website; – data obtained as a result of the User's interaction with the thumbly.art Service (see the Cookie Policy, which is an integral part of this Policy). 2.3. Through the functionality of the thumbly.art Service, Participants may transfer to each other information and documents that may contain personal data. The processing of personal data relating to other Users carried out by Participants outside the infrastructure of the thumbly.art Service is carried out by them independently of the Operator and is not controlled by the Operator. For more details, see clause 12 of this Policy. 3. Purposes of Personal Data Processing by the Operator 3.1. The Operator collects and processes Users' personal data for a specific, predetermined and lawful purpose: the performance of the obligations imposed on the Operator by the contract, namely the Rules of Use of the thumbly.art Service, including, but not limited to, the following possible cases of personal data use: – enabling the use of the functionality of the thumbly.art Service; – registration in the thumbly.art Service; – facilitating the conclusion and performance of contracts, as well as the negotiation of contract terms using the tools of the thumbly.art Service; – collecting questionnaires for subsequent forwarding to Users with whom the Operator has concluded agreements for the placement of their offers and information materials; – carrying out KYC procedures (accreditation) by Users prior to entering into transactions; – processing and publishing reviews in the thumbly.art Service; – interacting with Users in connection with their inquiries to the Operator, namely: processing callback requests, recording conversations with the Operator's support specialists, sending answers to Users' questions, sending important information concerning the thumbly.art Service, changes to policies and other documents posted on the Website, and providing Participants with information on the history of interaction between Participants in accordance with the Rules of Use of the thumbly.art Service; – storing and recording the history of interactions between a Participant and the Operator, and between Participants, in accordance with the Rules of Use of the thumbly.art Service; – sending advertising and information materials, including news and information about offers and services of the Operator and of Participants; – maintaining and improving the quality of the thumbly.art Service and of the Operator's activities, and personalizing the experience of using the thumbly.art Service by processing statistical information and conducting research. 3.2. The Operator does not collect or process personal data that are not required to achieve the purposes specified above. 4. Legal Grounds for the Processing of Users' Personal Data by the Operator 4.1. The Operator processes Users' personal data on the following legal grounds: – Performance of a contract, namely the Rules of Use of the thumbly.art Service, to which the User or the Participant is a party, as well as the conclusion of such contract at their initiative. – Consent to the processing of personal data. – The processing of personal data is necessary for the exercise of the rights and legitimate interests of the Operator or the rights and legitimate interests of third parties, provided that the rights and freedoms of the User are not violated. – The processing of the User's personal data is necessary for statistical or other research purposes, provided that the personal data are depersonalized. – The processing of the User's personal data is necessary for the performance of the duties, functions and powers imposed on the Operator by law. 4.2. Participants warrant that they have proper legal grounds for transferring the personal data of their representatives (Participants' Representatives) to the thumbly.art Service (written consent to the processing of personal data or another lawful ground). The Operator does not verify the legal grounds on which Participants transfer the personal data of Participants' Representatives to the thumbly.art Service; however, the Operator is entitled at any time to request from a Participant confirmation that the necessary legal ground exists, and the Participant undertakes to provide such confirmation without delay. The Participant shall be liable for transferring to the thumbly.art Service and processing the personal data of its representatives (Participant's Representatives) without a proper legal ground. The Operator shall not be liable for the processing of personal data of Participants' Representatives carried out without a proper legal ground. The Participant undertakes to compensate the Operator for losses caused by a breach of the provisions set out in this clause, including, but not limited to, the amounts of penalties incurred in connection with claims by government authorities. 5. How the Operator Processes Users' Personal Data The Operator processes Users' personal data on its own, both with and without the use of automation tools. In certain cases, the Operator is entitled to entrust the processing to third parties. The Operator does not disclose or disseminate Users' personal data without their consent, unless otherwise provided by federal law (for example, the Operator may be required to provide a User's data upon a lawful and reasoned request from law enforcement authorities). 6. To Whom the Operator Transfers Personal Data 6.1. The Operator transfers Users' personal data to a limited extent to partners providing technical support for the thumbly.art Service Such persons process Users' personal data on behalf of the Operator for the purpose of fulfilling the terms of the Rules of Use of the thumbly.art Service. 6.2. Users' personal data may also be transferred to Information and Financial Partners with the consent of Users when they use particular functions of the thumbly.art Service. Information about Financial and Information Partners is available in the relevant sections of the thumbly.art Service. Financial and Information Partners, being Participants, undertake to process Users' personal data in accordance with the provisions of this Policy. 6.3. You acknowledge that you have been duly informed of the possibility of changes to the list of such persons and undertake to review the Policy at reasonable intervals. 6.4. Personal data may be transferred by the following possible means: through the functionality of the thumbly.art Service, by email, via API, and by direct entry into the system by the Operator's employees. 6.5. The Operator is entitled to transfer Users' personal data to a third party in the event of a reorganization, merger, sale, creation of a joint venture, transfer or liquidation of the Operator or of its assets, in whole or in part (including all of the foregoing in connection with bankruptcy or similar court proceedings). 6.6. When the Operator entrusts the processing of personal data to third parties or transfers personal data to such third parties, the Operator guarantees that such persons will be bound by obligations to maintain the confidentiality of Users' personal data, to ensure their protection and security during processing, and by other obligations provided for by the Personal Data Law. 6.7. The Operator does not transfer Users' personal data to the territory of foreign states. However, certain cookies may allow such transfer depending on the specifics of their operation (for more details, see the Cookie Policy). 7. Period of Personal Data Processing by the Operator 7.1. The Operator processes Users' personal data and stores them in a form that allows Users to be identified for as long as this is required to achieve the purpose of processing specified in this Policy. The processing of personal data shall cease if at least one of the following conditions occurs: – The User has unilaterally withdrawn from the Rules of Use of the thumbly.art Service. – The Participant has ceased to exist as a legal entity or individual entrepreneur. – The User has withdrawn consent to the processing of personal data. – The User has deleted the personal account in the thumbly.art Service. – The predetermined purpose of personal data processing has been achieved. – Unlawful processing of personal data has been identified. – The Operator has discontinued support of the thumbly.art Service. – Unlawful processing of personal data has been identified. – The Operator has ceased its activities. 7.2. If at least one of the conditions specified above has occurred, the Operator shall destroy or depersonalize the personal data, unless there are other grounds for the processing of personal data. 8. Information on Consent to the Terms of Personal Data Processing 8.1. The User independently decides whether to provide his or her personal data to the Operator. The User gives consent to the terms of personal data processing freely, of his or her own will and in his or her own interest. By ticking the checkbox in the interactive forms posted on the Website, the User confirms that he or she agrees to the terms of personal data processing set out in the Policy. If the User does not agree to these terms, he or she must not provide his or her personal data (that is, must not tick the checkbox in the special personal data collection forms). 8.2. Please note that consent is not required where other lawful grounds exist, including cases where the Operator processes Users' personal data in connection with the need to respond to lawful and reasoned requests from law enforcement authorities, prosecution authorities, security authorities and other bodies authorized to request information in accordance with the legislation of the Russian Federation. 9. Rights of Users as Personal Data Subjects 9.1. Users are entitled to access their personal data and to require the Operator to clarify, block or destroy them if they are incomplete, outdated, inaccurate, unlawfully obtained or not required for the stated purpose of processing. In addition, Users are entitled to receive information concerning the processing of their personal data. Users have the right to protect their rights and legitimate interests, including the right to compensation for losses and (or) compensation for moral damage in court. 9.2. The User is entitled to object to the processing of personal data at any time by contacting the Operator through any communication channel specified in the "Details" section. 9.3. If the User has subscribed to receive messages by email or telephone, in particular notifications, advertising messages, news and reminders, but wishes to stop receiving them, he or she may do so in any of the following ways: – by following the link included in each electronic message sent to the User at the email address previously provided to the Operator; or – by contacting the Operator by telephone at the number specified on the Website in the "Details" section, on business days from 9:00 to 18:00; 9.4. Notwithstanding the refusal to receive messages by email and (or) telephone, the Operator may continue to process the User's personal data if other grounds for processing remain (for example, if the User continues to use the functionality of the thumbly.art Service). 10. Security and Protection of Personal Data The Operator takes all necessary measures to protect Users' personal data. The Operator protects data against loss, misuse, unauthorized access, disclosure, alteration and destruction to the extent provided for by applicable law and best practices. Nevertheless, no system for storing or transmitting data over the Internet can objectively guarantee complete security. If the User has reason to believe that the exchange of information with the Operator is not secure, the User undertakes to notify the Operator thereof without delay. 11. Personal Data Protection and Security Requirements Fulfilled by the Operator 11.1. The protection of personal data processed by the Operator is ensured by the implementation of legal, organizational and technical measures necessary and sufficient to meet the requirements of legislation in the field of personal data protection. 11.2. When selecting such measures, the Operator takes into account the provisions of Article 18.1 of the Personal Data Law, which, in particular, may include the following: – Appointment of a person responsible for organizing the processing of personal data – Issuance of documents defining the Operator's policy with respect to the processing of personal data, local regulations on personal data processing, as well as local regulations establishing procedures aimed at preventing and detecting violations of legislation and eliminating the consequences of such violations. – Regular internal monitoring of the compliance of personal data processing with the Personal Data Law, the requirements for personal data protection, the Operator's policy with respect to the processing of personal data and other local regulations of the Operator. – Assessment of the harm that may be caused to the User in the event of a violation of personal data legislation, and the correlation between such harm and the measures taken by the Operator. – Familiarization of the Operator's employees directly engaged in the processing of personal data with the provisions of personal data legislation, including the requirements for personal data protection, documents defining the Operator's policy with respect to the processing of personal data, and local regulations on personal data processing. – Training of the Operator's employees directly engaged in the processing of personal data in the rules of handling personal data. 11.3. When selecting measures to ensure data security, the Operator takes into account the measures specified in the provisions of Article 19 of the Personal Data Law, which may, in particular, include the following: – Establishment of rules for access to personal data processed in personal data information systems, and approval of the list of persons whose access is necessary for the performance of their official (employment) duties. – Ensuring the registration and recording of all actions performed with personal data in personal data information systems. – Identification of threats to the security of personal data during their processing in personal data information systems. – Application of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems that are necessary to meet the requirements for personal data protection. – Use of information security tools built into application software products, software security tools preventing unauthorized access to personal data, and control of access to the Operator's facilities and premises. – Regular assessment of the effectiveness of the measures taken to ensure the security of personal data prior to the commissioning of personal data information systems. – Accounting of machine-readable media of personal data. – Detection of instances of unauthorized access to personal data and taking of measures, including measures to detect, prevent and eliminate the consequences of computer attacks on personal data information systems and to respond to computer incidents therein. – Restoration of personal data modified or destroyed as a result of unauthorized access to them. – Monitoring of the measures taken to ensure the security of personal data and of the level of protection of personal data information systems. 12. Processing of Personal Data Carried Out by Participants Independently of the Operator 12.1. Through the functionality of the thumbly.art Service, Participants may transfer to each other information and documents that may contain personal data. The processing of personal data relating to other Users carried out by Participants outside the thumbly.art Service is carried out by such Participants as independent personal data operators (hereinafter, "Processing of Personal Data by Participants") 12.2. Possible grounds for the Processing of Personal Data by Participants are: − the need to perform a contract to which the User is a party, beneficiary or guarantor; − the need to conclude a contract at the initiative of the User; − the need to conclude a contract under which the User will be a beneficiary or guarantor; − the User's consent. 12.3. The Operator does not control the Processing of Personal Data by Participants and under no circumstances shall be liable for such processing. If Participants violate the provisions of the Personal Data Law and (or) this Policy in the course of such processing, the relevant Participant shall be liable for such violations, and all claims, complaints, demands and lawsuits must be brought against the Participant. 12.4. The User undertakes to notify the Operator without delay if he or she believes that (1) another Participant is processing personal data obtained through the thumbly.art Service in violation of the Personal Data Law and (or) this Policy and this affects the User's rights, and (or) (2) the processing by a Participant of personal data obtained through the thumbly.art Service is not secure. 13. How to Contact the Operator If you have any questions regarding the processing of your personal data or this Policy, you may contact us with a relevant request in any of the following ways: – By telephone at the number specified on the Website, on business days from 9:00 to 18:00. – By sending a written request – By sending an email. 14. Final Provisions 14.1. The Policy applies only to the thumbly.art Service. Although the Website may contain links to other Internet resources, the Policy does not apply to any of them. 14.2. The thumbly.art Service and the Operator's activities are constantly changing. As a result, it becomes necessary from time to time to make changes to this Policy. The Operator is entitled to amend it without notice (prior or subsequent). The date of the last amendment will be indicated in the "Effective Date" item, which will denote the date on which the new version of the Policy enters into force. The "Policy Version" item will be changed accordingly. Any changes to this Policy shall enter into force from the date of publication of the new version of the Policy on the Website. 14.3. Use of the thumbly.art Service after changes have been made means that the User has read and agreed to the provisions of the Policy as amended. The User undertakes to review this Policy periodically, especially before providing any personal data. If the User does not agree with the updated version of the Policy, he or she must stop using the thumbly.art Service and notify the Operator thereof.