1. General provisions

1.1. This Personal Data Processing Policy (hereinafter the Policy) sets out how personal data is processed and what measures are taken to keep it secure by sole proprietor Sergey Yuryevich Korol, OGRNIP 325460000038746, TIN 461107156717, registered at 305540, Russian Federation, Kursk Region, Kursk District, village of Kolodnoye, Tikhiye Pereulochki St. 116 (hereinafter the Operator).

1.2. The Policy has been drawn up in accordance with the Constitution of the Russian Federation, the Civil Code of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On personal data” (hereinafter 152-FZ), Federal Law No. 63-FZ of 6 April 2011 “On electronic signatures”, Federal Law No. 54-FZ of 22 May 2003 “On the use of cash register equipment”, Federal Law No. 38-FZ of 13 March 2006 “On advertising”, and other regulatory legal acts.

1.3. This Policy must be read by all data subjects whose data is processed by the Operator.

1.4. The Policy covers the processing of personal data carried out by the Operator both on the website grayking.ru and when the subject uses the Telegram bots @GKPhoto_bot and @GKDesign_bot (hereinafter jointly the Platforms), as well as in correspondence with the Operator in messengers and by email.

2. Purposes of processing personal data

2.1. The Operator processes personal data for the following purposes:

• concluding and performing contracts of sale and of paid services (photo sessions, masterclasses, printed products, digital goods);
• delivering digital goods to the buyer and confirming that delivery;
• keeping accounting and tax records;
• issuing and sending till receipts in accordance with Federal Law No. 54-FZ;
• arranging delivery of goods;
• informing clients about the status of orders and services provided;
• communication with clients, including correspondence in the Telegram bot;
• sending informational and promotional messages about the Operator's new work, services and special offers — only where the subject has consented, and with the option to opt out at any time;
• reviewing enquiries, claims and demands;
• fulfilling the duties placed on the Operator by Russian law.

3. Categories of personal data processed

3.1. The Operator processes the following personal data of subjects:

• surname, first name, patronymic;
• date of birth;
• passport details or details of another identity document;
• address of residence or registration;
• delivery address;
• contact telephone numbers and email addresses;
• payment details;
• images (photographs, video recordings) provided in the course of performing contracts;
• other information provided by the data subject on their own initiative.

3.2. When a Telegram bot is used, the Operator additionally processes the data that the Telegram service passes to the Operator automatically when the subject contacts the bot:

• the numeric chat identifier (chat id);
• the first name and surname given by the subject in their Telegram profile;
• the username, if the subject has set one;
• information about interaction with the bot: the date of first contact, the sections viewed, the orders placed and paid for, whether files were issued, and whether consent to receive mailings was given;
• the content of messages sent by the subject to the Operator through the bot.

3.3. The Telegram bot does not ask for the subject's telephone number. If the subject provides it voluntarily, the number is processed on the general grounds set out in clause 3.1.

4. Legal grounds for processing

4.1. Personal data is processed on the basis of:

• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• 152-FZ “On personal data”;
• 54-FZ “On the use of cash register equipment”;
• 38-FZ “On advertising” — as regards sending promotional messages;
• the Russian Law “On the protection of consumer rights”;
• contracts concluded between the Operator and data subjects;
• the consent of the data subject.

5. How personal data is processed and stored

5.1. Personal data is processed with or without the use of automated means.

5.2. Personal data is stored in a form that allows the data subject to be identified for no longer than the purposes of processing require, unless a longer retention period is prescribed by Russian law.

5.3. Processing of personal data ceases when the purposes of processing have been achieved, when the retention period expires, or when the data subject withdraws consent.

6. Transfer of personal data

6.1. The Operator may transfer personal data to third parties in the following cases:

• performance of a contract (transfer to courier and postal services, banks and payment systems, fiscal data operators, IT providers and hosting providers);
• fulfilment of duties established by Russian law;
• where the consent of the data subject has been obtained.

6.2. Messages and files are exchanged between the subject and the Operator in the Telegram bot by means of the Telegram service, which acts independently and on its own terms in respect of such transfer.

7. Rights of data subjects

7.1. A data subject has the right to:

• obtain information about the fact that their personal data is being processed;
• demand that their personal data be corrected, blocked or destroyed;
• withdraw consent to the processing of personal data;
• opt out of receiving informational and promotional messages at any time;
• appeal against the Operator's acts or omissions to the authorised body for the protection of data subjects' rights or to a court.

7.2. Mailings are cancelled with the command /stop in the Telegram bot, or by writing to art@graykingdesign.com. Opting out of mailings does not end correspondence with the Operator and does not affect the fulfilment of orders already placed.

7.3. Withdrawal of consent to the processing of personal data and a demand for its destruction are sent to art@graykingdesign.com. The Operator complies with such a demand within the period prescribed by Russian law, except for data the Operator is required by law to retain (in particular, records of payments made).

8. Measures to keep personal data secure

8.1. The Operator takes the necessary organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, disclosure, distribution and other unlawful acts.

8.2. These measures include:

• restricting access to personal data;
• using antivirus software and other information security tools;
• concluding confidentiality agreements with persons who have access to the data;
• regularly updating organisational measures and protection technologies.

9. Liability

9.1. If the provisions of this Policy are not complied with, the Operator is liable in accordance with the applicable law of the Russian Federation.

10. Final provisions

10.1. This Policy is published openly on the Operator's website grayking.ru and is provided in the Telegram bots @GKPhoto_bot and @GKDesign_bot in the “Documents” section.

10.2. The Operator may amend this Policy. A new version takes effect from the moment it is published, unless the new version of the Policy provides otherwise.

10.3. Questions about the processing of personal data are to be sent to art@graykingdesign.com.