1. General Provisions
This Personal Data Processing Policy has been drafted in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (hereinafter referred to as the "Personal Data Law") and defines the procedure for processing personal data as well as the security measures implemented by Lyubar Ekaterina Vladimirovna (hereinafter referred to as the "Operator").
1.1. The Operator considers the protection of human and civil rights and freedoms, including the right to privacy, personal and family confidentiality, as its highest priority and a fundamental condition for conducting its activities when processing personal data.
1.2. This Operator’s Policy regarding the processing of personal data (hereinafter referred to as the "Policy") applies to all information that the Operator may obtain about visitors to the website https://katelubar.ru.

2. Key Terms Used in the Policy
2.1. Automated Processing of Personal Data – processing of personal data using computer technology.
2.2. Blocking of Personal Data – temporary suspension of personal data processing (except in cases where processing is necessary to clarify personal data).
2.3. Website – a collection of graphical and informational materials, as well as computer programs and databases, made available on the internet at the web address https://katelubar.ru.
2.4. Personal Data Information System – a set of personal data contained in databases and the information technologies and technical means enabling their processing.
2.5. Depersonalization of Personal Data – actions that make it impossible to determine, without additional information, the ownership of personal data by a specific User or another personal data subject.
2.6. Processing of Personal Data – any action (operation) or set of actions (operations) performed with or without automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, or destruction of personal data.
2.7. Operator – a state body, municipal authority, legal entity, or individual that independently or jointly with others organizes and/or carries out the processing of personal data, as well as determines the purposes of processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
2.8. Personal Data – any information relating, directly or indirectly, to an identified or identifiable User of the website https://katelubar.ru.
2.9. Personal Data Authorized for Dissemination – personal data to which an unlimited number of persons have been granted access by the personal data subject through consent to the processing of personal data permitted for dissemination in accordance with the Personal Data Law (hereinafter referred to as "Personal Data Authorized for Dissemination").
2.10. User – any visitor to the website https://katelubar.ru.
2.11. Provision of Personal Data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Dissemination of Personal Data – any actions aimed at disclosing personal data to an indefinite number of persons (transfer of personal data) or making personal data available to an unlimited number of persons, including publication in mass media, posting on information and telecommunication networks, or providing access to personal data in any other way.
2.13. Cross-Border Transfer of Personal Data – the transfer of personal data to the territory of a foreign state, to a foreign government authority, foreign individual, or foreign legal entity.
2.14. Destruction of Personal Data – any actions resulting in the irreversible destruction of personal data, making it impossible to restore the content of personal data in the personal data information system and/or the physical destruction of storage media containing personal data.

3. Key Rights and Obligations of the Operator
3.1. The Operator has the right to:

• Obtain accurate information and/or documents containing personal data from the personal data subject.
• Continue processing personal data without the subject’s consent if grounds specified in the Personal Data Law apply, particularly in cases where:
• The personal data subject withdraws consent for processing.
• The subject submits a request to terminate processing.
• Independently determine the necessary and sufficient measures to fulfill obligations under the Personal Data Law and related regulatory acts, unless otherwise stipulated by the law or other federal regulations.

3.2. The Operator is obliged to:

• Provide the personal data subject, upon request, with information regarding the processing of their personal data.
• Process personal data in accordance with the applicable legislation of the Russian Federation.
• Respond to inquiries and requests from personal data subjects and their legal representatives as required by the Personal Data Law.
• Submit necessary information to the authorized body for the protection of personal data subjects' rights within 10 days of receiving an official request.
• Publish or otherwise ensure unrestricted access to this Personal Data Processing Policy.
• Implement legal, organizational, and technical measures to protect personal data from:
• Unauthorized or accidental access.
• Destruction, modification, blocking, copying, disclosure, or dissemination.
• Other unlawful actions related to personal data.
• Cease transfer (distribution, provision, access), processing, and destroy personal data in cases and manner prescribed by the Personal Data Law.
• Fulfill other obligations stipulated by the Personal Data Law.

4. Key Rights and Obligations of Personal Data Subjects
4.1. Personal data subjects have the right to:

• Obtain information regarding the processing of their personal data, except in cases restricted by federal laws. The Operator must provide this information in an accessible format, excluding personal data of other subjects unless legally justified. The scope of information and procedure for obtaining it are defined by the Personal Data Law;
• Request the Operator to clarify, block, or destroy their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purposes, as well as take legal measures to protect their rights;
• Set a prior consent requirement for processing personal data for marketing purposes (promotion of goods, works, or services);
• Withdraw consent for personal data processing and submit a request to terminate such processing;
• Appeal to the authorized body for personal data subjects' rights protection or to a court against unlawful actions or inaction of the Operator in processing their personal data;
• Exercise other rights granted by Russian legislation.

4.2. Personal data subjects are obliged to:

• Provide the Operator with accurate information about themselves;
• Notify the Operator about updates or changes to their personal data.

4.3. Individuals who provide the Operator with false information about themselves or another personal data subject without proper consent shall bear responsibility under Russian law.

5. Principles of Personal Data Processing
5.1. Personal data processing shall be lawful and fair.
5.2. Processing is limited to achieving specific, predefined, and legitimate purposes. Processing incompatible with the original collection purposes is prohibited.
5.3. Merging databases containing personal data processed for incompatible purposes is prohibited.
5.4. Only personal data relevant to the processing purposes may be processed.
5.5. The content and scope of processed data must correspond to the stated purposes. Excessive data collection relative to the stated purposes is prohibited.
5.6. The Operator ensures accuracy, sufficiency, and (where necessary) relevance of personal data to the processing purposes. The Operator takes necessary measures to delete or correct incomplete or inaccurate data.5.7. Personal data shall be stored in a form enabling identification of the data subject no longer than required by the processing purposes, unless a longer retention period is established by federal law or an agreement where the data subject is a party, beneficiary, or guarantor. Processed data shall be destroyed or anonymized upon achieving the processing purposes or when no longer necessary, unless otherwise required by federal law.

6. Purposes of Personal Data Processing


7. Conditions for Personal Data Processing
7.1 Processing is conducted with the subject's consent.
7.2 When required by international treaties or Russian law to fulfill the Operator's legal obligations.
7.3 For administration of justice or execution of judicial/administrative acts under Russian enforcement legislation.
7.4 For contract performance where the subject is a party, beneficiary, or guarantor, or for contract conclusion at the subject's initiative.
7.5 To protect the Operator's or third parties' legitimate interests or achieve socially important goals, provided subjects' rights aren't violated.
7.6 Processing of publicly available personal data disclosed by the subject.
7.7 When disclosure is mandated by federal law.

8. Procedures for Collection, Storage, Transfer and Processing
Security is ensured through legal, organizational and technical measures complying with data protection laws.
8.1 The Operator implements safeguards against unauthorized access.
8.2 Data isn't shared with third parties except when legally required or with subject's consent for contractual obligations.
8.3 Users may update inaccurate data by emailing kateliubar@gmail.com with "Data Update" in subject line.
8.4 Processing continues until purposes are fulfilled, unless contract or law specifies otherwise. Consent may be withdrawn by emailing kateliubar@gmail.com with "Consent Withdrawal" in subject line.
8.5 Third-party services (payment systems, communication tools) process data per their own policies. The Operator isn't liable for third-party actions.
8.6 Restrictions on processing don't apply when processing serves state/public interests under Russian law.
8.7 The Operator maintains data confidentiality.
8.8 Storage duration doesn't exceed processing purposes unless extended by law or contract.
8.9 Processing ceases when purposes are achieved, consent expires/withdrawn, or unlawful processing is identified.

9. Processing Activities
9.1 The Operator performs collection, recording, organization, storage, updating, retrieval, use, transfer, anonymization, blocking, deletion and destruction.
9.2 Automated processing occurs with/without information transmission via networks.

10. Cross-Border Data Transfers
10.1 The Operator must notify the data protection authority before such transfers (separate from processing notices).
10.2 Required information must be obtained from foreign recipients prior to notification.

11. Confidentiality
The Operator and authorized persons must not disclose data without consent unless permitted by law.

12. Final Provisions
12.1 For inquiries, contact kateliubar@gmail.com.
12.2 The Policy remains effective until replaced by updated versions.
12.3 The current version is publicly available at https://katelubar.ru/eng/policy.