PERSONAL DATA PROCESSING POLICY FOR WEBSITE USERS

PERSONAL DATA PROCESSING POLICY FOR WEBSITE USERS
Version as of July 7, 2026
1. GENERAL PROVISIONS1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) defines the procedure for processing and protecting personal data of users of the website of the online store “World of Katya” (Ekaterina Borisovna Bogdanova), located at https://worldofkatya.ru (hereinafter referred to as the “Website”).
The Policy is developed in accordance with:

the Constitution of the Russian Federation;
Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data”;
Federal Law No. 149‑FZ dated 27.07.2006 “On Information, Information Technologies and Information Protection”;
Federal Law No. 38‑FZ dated 13.03.2006 “On Advertising”;
Law of the Russian Federation No. 2300‑1 dated 07.02.1992 “On Protection of Consumers’ Rights”;
other regulatory legal acts of the Russian Federation.

1.2. The Policy applies to all personal data that Ekaterina Borisovna Bogdanova receives from Website users when:

visiting the Website;
placing an order;
registering a personal account (if available);
filling out feedback forms;
subscribing to promotional and informational newsletters;
submitting inquiries;
posting reviews;
using the Website’s services and functionality.

1.3. By using the Website, the user confirms that they have read and understood this Policy. If Russian legislation requires obtaining the user’s consent for certain types of personal data processing, such consent shall be requested separately via the appropriate form.
1.4. This Policy applies exclusively to the processing of Website users’ personal data and does not govern the processing of personal data when visiting third‑party websites whose links may be posted on the Website.
2. INFORMATION ABOUT THE OPERATORThe personal data operator is:
Ekaterina Borisovna Bogdanova
INN: 4519359263
Registered Address: 123154, Russian Federation, Moscow, Marshala Tukhachevskogo St., 28, bldg. 2, apt. 28
Email for inquiries regarding personal data processing: Peneloppa@list.ru
Website: https://worldofkatya.ru
3. WHAT PERSONAL DATA WE PROCESSDepending on which Website functionality the visitor uses, the Operator may process the following personal data:

3.1. Data provided by the userfirst name, last name, middle name (if available);
phone number;
email address;
delivery address;
postal address;
information provided in feedback forms;
information contained in reviews;
any other information the user voluntarily provides to the Operator.

3.2. Data related to order placementWhen placing an order, the following may be processed:

order details;
payment information;
delivery information;
order history;
return‑related information.

3.3. Technical dataWhen using the Website, the following technical data may be automatically processed:

IP address;
device information;
browser information;
operating system information;
date and time of Website visit;
pages viewed;
source of referral to the Website;
Cookie files;
other technical data necessary to ensure the Website’s operation and usage analysis.

4. PURPOSES OF PERSONAL DATA PROCESSINGUsers’ personal data are processed exclusively for the following purposes:

order placement, execution and support;
organization of goods delivery;
processing user inquiries;
providing consultations;
compliance with the requirements of Russian legislation;
accounting and tax reporting where required by law;
sending promotional and informational messages if the user has provided separate consent, where such consent is required by law;
publishing user reviews if the user has provided separate consent to the distribution of personal data, where such consent is required by law;
analyzing Website performance, improving the quality of user service and ensuring stable Website operation;
protecting the rights and legitimate interests of the Operator.

The Operator does not process personal data for purposes incompatible with the above.
5. LEGAL BASIS FOR PERSONAL DATA PROCESSINGThe Operator processes users’ personal data if one or more of the following legal bases exist:

the user’s consent to personal data processing, if such consent is required under Russian legislation;
the need to conclude, execute or terminate a goods purchase contract, or to take actions at the user’s request prior to contract conclusion;
fulfillment of obligations imposed on the Operator by Russian legislation;
exercising the Operator’s or third parties’ rights and legitimate interests, provided that the user’s rights and freedoms are not violated;
other grounds provided for by Russian legislation.

6. TRANSFER OF PERSONAL DATA TO THIRD PARTIESThe Operator does not sell or transfer users’ personal data to third parties for their independent use.
Personal data may be transferred only where required by Russian legislation or necessary to achieve the purposes of processing.
Personal data may be shared with the following categories of recipients:

delivery services (e.g., SDEK, Boxberry, Russian Post, Yandex Delivery or other delivery services used by the Operator) — for goods delivery;
banks and payment services — for payment processing and refunds;
fiscal data operator — where required by Russian legislation;
accountant or accounting service provider working with the Operator;
CRM system (e.g., Bitrix24 or another CRM used by the Operator) — to support orders and customer interactions;
email marketing service (e.g., Unisender, DashaMail or another service used by the Operator) — to send promotional and informational messages, subject to the user’s relevant consent;
web analytics services (e.g., Yandex Metrica) — to analyze Website usage and improve its performance;
hosting provider and organizations ensuring the Website’s technical operation;
government authorities, courts and law enforcement agencies — where required by Russian legislation.

Personal data are transferred only to the extent necessary to achieve the relevant processing purpose.
7. USE OF COOKIE FILESTo ensure proper Website operation, Cookie files and similar technologies are used.
Cookies allow the Operator to:

ensure the Website’s functionality;
save user preferences;
secure the Website usage;
analyze website traffic and performance;
improve the quality of user experience.

The Website may use:

mandatory (technical) Cookies;
functional Cookies;
analytical Cookies;
marketing Cookies (if applicable).

Technical Cookies are used to the extent necessary for the Website to function.
Other Cookie categories are used only if a relevant legal basis exists. Where Russian legislation requires it, the user’s consent is requested via a banner or other consent management mechanism.
Users may adjust Cookie settings in their browser or use Cookie management tools provided on the Website (if available). Disabling certain Cookies may affect the functionality of some Website features.
8. RETENTION PERIODS FOR PERSONAL DATAUsers’ personal data are retained no longer than necessary for the processing purposes or as required by Russian legislation.
Key retention periods:

data related to contract execution — during the contract term and thereafter for the periods prescribed by Russian legislation;
data required for accounting and tax reporting — for the periods prescribed by Russian legislation;
user inquiries — 3 years after resolution, unless a longer period is required by law or for protecting the Operator’s rights;
data for promotional and informational newsletters — until the user withdraws consent or the mailing is discontinued;
user reviews — until the user withdraws consent to distribute personal data or the use of such data is discontinued;
data collected via Cookies — for the duration of the respective Cookie or until the user deletes them, unless another period is set by the service’s settings.

Once the processing purposes are achieved or no other legal grounds exist, personal data are deleted, destroyed or anonymized in accordance with Russian legislation.
9. MEASURES TO PROTECT PERSONAL DATAThe Operator implements necessary legal, organizational and technical measures to protect users’ personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, distribution and other unlawful actions.
In particular, the following measures are applied:

use of TLS/HTTPS secure connections for data transmission via the Website;
access rights management for personal data;
granting access only to authorized personnel;
antivirus protection;
regular software updates;
data backup;
protection of information systems against unauthorized access;
monitoring compliance with Russian personal data protection legislation.

10. USER RIGHTSUsers have the right to:

obtain information about whether their personal data are being processed;
receive information about the personal data being processed, the purposes, legal grounds, processing and retention periods;
request clarification, updating or correction of their personal data if they are incomplete, inaccurate or outdated;
request blocking or deletion of personal data in cases provided for by Russian legislation;
withdraw previously provided consent to personal data processing in whole or in part;
withdraw consent to receive promotional and informational messages;
withdraw consent to the distribution of personal data (including the publication of name, photo and review);
obtain information about the persons to whom personal data may be disclosed, where such information is provided for by Russian legislation;
appeal the Operator’s actions (or inaction) to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court;
exercise any other rights provided for under Russian legislation.

11. HOW TO INQUIRE ABOUT PERSONAL DATA PROCESSINGUsers may contact the Operator regarding personal data processing, including to:

request information about the processing of their personal data;
clarify, change or correct their personal data;
restrict personal data processing where permitted by law;
delete (destroy) personal data if no legal grounds exist for further processing;
stop personal data processing;
withdraw previously provided consent.

Inquiries may be sent to:

Email: Peneloppa@list.ru.

To protect personal data, the Operator may request information to identify the applicant (e.g., first name, last name, middle name (if any), phone number, email address, order number or other details) if without such identification it is impossible to provide information without risking the rights and interests of third parties.
Inquiries are reviewed within the timeframes and in the manner prescribed by Russian legislation.
12. PROCEDURE FOR WITHDRAWING CONSENTUsers may withdraw previously provided consent to personal data processing at any time, provided that processing is based on such consent.
Consent may be withdrawn by:

sending a message to the Operator’s email address.

Consent to receive promotional and informational messages may also be withdrawn by clicking the “Unsubscribe” link in the email (if technically available) or by any other method provided by the mailing service.
After receiving a withdrawal request, the Operator will stop processing personal data unless other legal grounds for processing exist.
Withdrawing consent does not affect the lawfulness of personal data processing carried out prior to the Operator receiving the withdrawal request.
13. FINAL PROVISIONSThis Policy is effective from the date it is posted on the Website and applies to all Website users.
The Operator reserves the right to amend this Policy in the event of changes to Russian legislation, changes in personal data processing methods, introduction of new services or other lawful grounds.
The current version of the Policy is always available on the Website at: https://worldofkatya.ru
For inquiries regarding personal data processing, users may contact the Operator:
Ekaterina Borisovna Bogdanova
INN: 4519359263
Address: 123154, Russian Federation, Moscow, Marshala Tukhachevskogo St.
14. CHANGES TO THE POLICY
14.1. The Operator reserves the right to amend this Policy at any time without prior notice to users.
14.2. Any amendments shall be made in compliance with Russian legislation and shall not contradict the rights and legitimate interests of users.
14.3. The effective date of any amendments shall be the date of their publication on the Website.
14.4. It is the user’s responsibility to periodically review the current version of the Policy posted on the Website to stay informed of any changes. Continued use of the Website after amendments have been posted shall be deemed acceptance of the updated terms.
15. CONTACTS FOR LEGAL AND COMPLIANCE INQUIRIESFor legal or compliance‑related inquiries regarding personal data processing, users may contact:

the Operator directly via email: Peneloppa@list.ru;
the Data Protection Officer (if appointed) — information will be provided upon request.

The Operator undertakes to respond to all inquiries within the timeframes established by Russian legislation.
16. PROCEDURE FOR ADDRESSING COMPLAINTS AND DISPUTES16.1. If a user believes that their personal data are being processed in violation of Russian legislation or this Policy, they may submit a written complaint to the Operator.
16.2. The complaint must include:

the user’s full name and contact details;
a clear description of the alleged violation;
any supporting documents or evidence (e.g., screenshots, correspondence);
the requested remedy (e.g., correction, deletion, blocking of data).
16.3. The Operator shall review the complaint and provide a written response within the сроки established by Russian law (generally up to 30 calendar days from receipt).
16.4. If the user is not satisfied with the Operator’s response, they may file a complaint with Roskomnadzor or seek redress through the courts in accordance with Russian legislation.

17. CROSS‑BORDER TRANSFER OF PERSONAL DATA17.1. The Operator does not currently transfer personal data to countries outside the Russian Federation.
17.2. If such transfers become necessary in the future, they will be carried out only in compliance with Federal Law No. 152‑FZ, including:

ensuring an adequate level of personal data protection in the recipient country;
obtaining the necessary legal grounds and, where required, the user’s consent;
including appropriate contractual clauses or standard data protection clauses in agreements with foreign recipients.
17.3. Users will be informed of any material changes to cross‑border transfer practices via updates to this Policy and/or direct notifications where required by law.

18. USE OF AUTOMATED DECISION‑MAKING AND PROFILING18.1. The Operator currently does not use automated decision‑making or profiling that produces legal effects or significantly affects users.
18.2. If such technologies are introduced in the future, users will be notified in this Policy and, where legally required, will be given the opportunity to object or request human intervention.
19. FINAL PROVISIONS19.1. This Policy constitutes an integral part of the terms of use of the Website and the terms of sale of goods via the online store.
19.2. In the event of any conflict between the provisions of this Policy and other publicly available documents of the Operator (e.g., Terms of Use, Return Policy), this Policy shall prevail in matters relating to personal data processing.
19.3. Any questions regarding the interpretation or application of this Policy should be addressed to the Operator via the contact details provided herein.