• Main
• Personal information processing policy

This document sets out the rules of SUN OF MOSCOW LLC and Ferris Wheel Management Company LLC (hereinafter — the Company) regarding the processing of personal data.

The Personal Data Processing Rules (hereinafter — the Rules) have been developed in accordance with the applicable personal data legislation of the Russian Federation.

The Rules apply to all operations involving the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymisation, blocking, deletion and destruction of personal data, carried out both with and without the use of automation tools.

1. Principles of personal data processing

Personal data are processed on the basis of the following principles:

• personal data are processed on a lawful and fair basis;

• the processing of personal data is limited to the achievement of specific, predetermined and lawful purposes;

• the processing of personal data that is incompatible with the purposes of their collection is not permitted;

• the merging of databases containing personal data processed for purposes that are incompatible with each other is not permitted;

• only such personal data as correspond to the purposes of their processing are subject to processing;

• the content and volume of the personal data processed correspond to the declared purposes of processing. The personal data processed are not excessive in relation to the declared purposes of processing;

• when personal data are processed, their accuracy and sufficiency are ensured and, where necessary, their relevance to the declared purposes of their processing;

• personal data are destroyed or anonymised once the purposes of their processing have been achieved, or in the event that the need to achieve those purposes has ceased, where the violations of personal data requirements committed by the Company cannot be remedied, unless otherwise provided by federal law.

2. Conditions for the processing of personal data

Personal data are processed in compliance with the principles and rules established by Federal Law No. 152-FZ of 27 July "On Personal Data" (hereinafter — the Personal Data Law). The processing of personal data is permitted in the following cases:

• personal data are processed with the consent of the personal data subject to the processing of their personal data;

• the processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, or for the exercise and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation;

• the processing of personal data is necessary for the administration of justice, the enforcement of a judicial act or of an act of another authority or official that is subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings;

• the processing of personal data is necessary for the performance of a contract to which the personal data subject is a party, a beneficiary or a guarantor, as well as for the conclusion of a contract at the initiative of the personal data subject or of a contract under which the personal data subject will be a beneficiary or a guarantor;

• the processing of personal data is necessary to protect the life, health or other vital interests of the personal data subject, where obtaining the consent of the personal data subject is impossible;

• the processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or of third parties, or for the achievement of socially significant purposes, provided that the rights and freedoms of the personal data subject are not thereby violated;

• personal data are processed for statistical or other research purposes, subject to mandatory anonymisation of the personal data. An exception is the processing of personal data for the purpose of promoting goods, works or services on the market by making direct contact with a potential consumer by means of communication, as well as for the purposes of political campaigning;

• processing is carried out in respect of personal data to which access has been granted to an unlimited number of persons by the personal data subject or at their request (hereinafter — personal data made publicly available by the personal data subject);

• processing is carried out in respect of personal data that are subject to publication or mandatory disclosure in accordance with federal law.

The Company may include the personal data of subjects in publicly available sources of personal data; in doing so, the Company obtains the subject's written consent to the processing of their personal data.

The Company may process special categories of personal data concerning racial and ethnic origin and state of health; in doing so, the Company undertakes to obtain the subject's written consent to the processing of their personal data.

Biometric personal data (information that characterises the physiological and biological features of a person, on the basis of which their identity can be established and which is used by the operator to establish the identity of the personal data subject) are processed by the Company in accordance with the provisions of the law.

The Company carries out cross-border transfers of personal data only to the territory of foreign states that ensure adequate protection of the rights of personal data subjects.

Decisions that give rise to legal consequences in respect of the personal data subject or otherwise affect their rights and legitimate interests are not taken solely on the basis of automated processing of personal data.

The terms of the licence for the Company's activities do not contain a prohibition on the transfer of personal data to third parties without the written consent of the personal data subject.

Where the subject's written consent to the processing of their personal data is not required, consent may be given by the personal data subject or their representative in any form that makes it possible to confirm the fact that it was obtained.

The Company has the right to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person (hereinafter — the operator's instruction). In such a contract, the Company obliges the person processing personal data on the Company's instructions to comply with the principles and rules for the processing of personal data provided for by the said Federal Law.

Where the Company entrusts the processing of personal data to another person, the Company remains liable to the personal data subject for the actions of that person. The person processing personal data on the Company's instructions is liable to the Company.

The Company undertakes, and obliges other persons who have obtained access to personal data, not to disclose personal data to third parties and not to distribute them without the consent of the personal data subject, unless otherwise provided by federal law. 

3. Rights of the personal data subject

The personal data subject takes the decision to provide their personal data and gives consent to their processing freely, of their own will and in their own interest. Consent to the processing of personal data may be given by the personal data subject or their representative in any form that makes it possible to confirm the fact that it was obtained, unless otherwise established by federal law.

The obligation to provide evidence that the consent of the personal data subject to the processing of their personal data was obtained, or evidence of the existence of the grounds specified in the Personal Data Law, rests with the Company.

The personal data subject has the right to receive information concerning the processing of their personal data, unless such right is restricted in accordance with federal laws. The personal data subject has the right to require the Company to clarify their personal data, to block or destroy them where the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the declared purpose of processing, and also to take the measures provided for by law to protect their rights.

The processing of personal data for the purpose of promoting goods, works or services on the market by making direct contact with a potential consumer by means of communication, as well as for the purposes of political campaigning, is permitted only subject to the prior consent of the personal data subject. Such processing of personal data is deemed to be carried out without the prior consent of the personal data subject unless the Company proves that such consent was obtained.

The Company is obliged to cease immediately, at the request of the personal data subject, the processing of their personal data for the above purposes.

It is prohibited to take, solely on the basis of automated processing of personal data, decisions that give rise to legal consequences in respect of the personal data subject or otherwise affect their rights and legitimate interests, except in the cases provided for by federal laws or where the written consent of the personal data subject has been obtained.

If the personal data subject believes that the Company processes their personal data in breach of the requirements of the Federal Law "On Personal Data" or otherwise violates their rights and freedoms, the personal data subject has the right to appeal against the actions or omissions of the Company to the authorised body for the protection of the rights of personal data subjects or before a court.

The personal data subject has the right to the protection of their rights and legitimate interests, including compensation for losses and/or compensation for moral harm before a court.

4. Measures to ensure the security of personal data during their processing

When processing personal data, the Company takes the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision and distribution, as well as from other unlawful actions in relation to personal data.

Information on the implemented personal data protection requirements.

• A person responsible for organising the processing of personal data has been appointed.

• Documents have been approved that define the organisation's policy regarding the processing of personal data and establish procedures aimed at preventing and detecting violations of the law, namely:

• an action plan for ensuring the security of personal data;

• a list of personal data subject to protection;

• a list of personal data information systems;

• a regulation on the differentiation of access to personal data;

• an order approving the list of persons authorised to process personal data;

• a regulation on the processing and protection of personal data;

• rules for the processing of personal data;

• an order approving the storage locations for personal data and the persons responsible for maintaining the confidentiality of personal data during their storage;

The consequences of violations of the legislation of the Russian Federation are remedied in accordance with the applicable legislation of the Russian Federation, with the regulation on the processing and protection of personal data, with the instructions for the personal data security administrator, and with the procedure for backing up and restoring the operability of hardware and software, databases and information protection tools.

Internal monitoring of the compliance of personal data processing with the legislation of the Russian Federation in this area is carried out in accordance with the internal audit plan, the instructions for the security administrator and the regulation on the processing and protection of personal data.

The User Agreement regarding the processing of personal data is published on the website www.moscow-sun.ru.

Machine-readable media are recorded in the relevant register.

The detection of instances of unauthorised access to personal data and the adoption of measures are carried out by means of the information protection tools in use, in accordance with the instructions for the security administrator.

The rules of access to personal data are approved in the relevant regulation.

Employees authorised to process personal data undergo information security briefings, sign a personal data non-disclosure agreement and acknowledge, by signature, the documents on the protection of personal data.

The security of personal data is ensured, in particular, by:

• identifying threats to the security of personal data during their processing in personal data information systems;

• applying organisational and technical measures to ensure the security of personal data during their processing in personal data information systems, which are necessary to meet the personal data protection requirements the fulfilment of which ensures the levels of personal data protection established by the Government of the Russian Federation;

• using information protection tools that have passed the conformity assessment procedure in the established manner;

• assessing the effectiveness of the measures taken to ensure the security of personal data before the personal data information system is put into operation;

• keeping records of machine-readable media containing personal data;

• detecting instances of unauthorised access to personal data and taking measures;

• restoring personal data that have been modified or destroyed as a result of unauthorised access to them;

• establishing rules of access to personal data processed in the personal data information system, as well as ensuring the registration and recording of all actions performed with personal data in the personal data information system;

• monitoring the measures taken to ensure the security of personal data and the level of protection of personal data information systems.