Privacy policy

1. General provisions

This personal data processing policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006, On Personal Data (the Personal Data Law), and defines the procedures for processing personal data and the measures taken by Photonics Systems LLC (the Operator) to protect personal data.

1.1. Respect for human and civil rights and freedoms when processing personal data, including the protection of privacy and personal and family confidentiality, is a principal objective and a condition of the Operator's activities.

1.2. This personal data processing policy (the Policy) applies to all information the Operator may obtain about visitors to https://iphs.ru/.

2. Definitions used in this Policy

2.1. Automated processing of personal data means processing personal data using computing equipment.

2.2. Blocking of personal data means temporarily suspending its processing, except where processing is necessary to clarify the personal data.

2.3. Website means the collection of graphic and informational materials, computer programs and databases that make them available online at https://iphs.ru/.

2.4. Personal data information system means the personal data held in databases together with the information technologies and technical means used to process it.

2.5. Depersonalisation of personal data means actions that make it impossible, without additional information, to determine whether personal data belongs to a particular User or another data subject.

2.6. Processing of personal data means any action or set of actions performed on personal data by automated or non-automated means, including collection, recording, organisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (dissemination, provision or access), depersonalisation, blocking, deletion and destruction.

2.7. Operator means a state authority, municipal authority, legal entity or individual that, independently or jointly with others, organises or carries out personal data processing and determines its purposes, the data to be processed and the operations to be performed.

2.8. Personal data means any information directly or indirectly relating to an identified or identifiable User of https://iphs.ru/.

2.9. Personal data authorised by the data subject for dissemination means data made accessible to an unlimited number of persons by the data subject's consent to processing for dissemination under the procedure established by the Personal Data Law (data authorised for dissemination).

2.10. User means any visitor to https://iphs.ru/.

2.11. Provision of personal data means actions intended to disclose personal data to a specific person or a defined group of persons.

2.12. Dissemination of personal data means actions intended to disclose personal data to an undefined group of persons or make it available to an unlimited number of persons, including publication in the media, placement on information and telecommunications networks, or access by other means.

2.13. Cross-border transfer of personal data means transferring personal data to the territory of a foreign state, to a foreign public authority, individual or legal entity.

2.14. Destruction of personal data means actions that irreversibly destroy personal data so that its content cannot be restored in a personal data information system, or destroy the physical media containing personal data.

3. Principal rights and duties of the Operator

3.1. The Operator has the right to:

obtain accurate information or documents containing personal data from the data subject;

continue processing personal data without the data subject's consent after consent is withdrawn, where grounds specified in the Personal Data Law apply;

independently determine the measures necessary and sufficient to fulfil the duties established by the Personal Data Law and regulations adopted under it, unless otherwise provided by that Law or other federal laws.

3.2. The Operator must:

provide the data subject, upon request, with information concerning the processing of their personal data;

organise personal data processing in accordance with applicable Russian law;

respond to enquiries and requests from data subjects and their legal representatives in accordance with the Personal Data Law;

provide the authorised personal data protection authority with the information it requests within 30 days of receiving the request;

publish this Policy or otherwise ensure unrestricted access to it;

take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;

stop the transfer (dissemination, provision or access) and processing of personal data and destroy it in the manner and circumstances specified by the Personal Data Law;

fulfil other duties established by the Personal Data Law.

4. Principal rights and duties of data subjects

4.1. Data subjects have the right to:

obtain information concerning the processing of their personal data, except in cases provided for by federal law. The Operator must provide this information in an accessible form. It must not contain personal data concerning other data subjects unless there are legal grounds for disclosure. The information to be provided and the procedure for obtaining it are established by the Personal Data Law;

require the Operator to clarify, block or destroy personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and take legally available measures to protect their rights;

require prior consent for personal data processing for the promotion of goods, works and services;

withdraw consent to personal data processing;

challenge unlawful actions or omissions by the Operator before the authorised personal data protection authority or in court;

exercise other rights provided by Russian law.

4.2. Data subjects must:

provide accurate personal data to the Operator;

notify the Operator of clarifications, updates or changes to their personal data.

4.3. Persons who provide inaccurate information about themselves or information about another data subject without that person's consent are liable under Russian law.

5. Personal data the Operator may process

5.1. Surname, first name and patronymic.

5.2. Email address.

5.3. Telephone numbers.

5.4. With the User's consent, Yandex Metrica collects technical visit data on the website: network address, browser and device information, visited page address, referral source and actions on the website. The service may use cookies.

5.5. The data listed above is collectively referred to in this Policy as Personal Data.

5.6. The Operator does not process special categories of personal data concerning race, ethnic origin, political views, religious or philosophical beliefs, or intimate life.

5.7. Processing data authorised for dissemination from the special categories listed in Article 10(1) of the Personal Data Law is permitted if the restrictions and conditions established by Article 10.1 of that Law are observed.

5.8. The User's consent to processing data authorised for dissemination is obtained separately from other consents to processing their personal data. The conditions established, in particular, by Article 10.1 of the Personal Data Law must be observed. Requirements for the content of this consent are established by the authorised personal data protection authority.

5.8.1. The User provides consent to processing data authorised for dissemination directly to the Operator.

5.8.2. Within three working days of receiving this consent, the Operator must publish information about the processing conditions and any restrictions or conditions applicable to processing the data by an unlimited number of persons.

5.8.3. Transfer (dissemination, provision or access) of data authorised for dissemination must cease at any time upon the data subject's request. The request must include the data subject's surname, first name, patronymic if applicable, contact information (telephone number, email or postal address) and a list of personal data whose processing must cease. The data specified in the request may be processed only by the Operator to which the request is addressed.

5.8.4. Consent to processing data authorised for dissemination ceases when the Operator receives the request referred to in clause 5.8.3 of this Policy.

6. Principles of personal data processing

6.1. Personal data is processed lawfully and fairly.

6.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes for which the data was collected is not permitted.

6.3. Databases containing personal data processed for incompatible purposes must not be combined.

6.4. Only personal data relevant to the purposes of processing may be processed.

6.5. The content and volume of personal data processed must correspond to the stated purposes. Excessive data processing in relation to those purposes is not permitted.

6.6. Personal data must be accurate, sufficient and, where necessary, current in relation to the purposes of processing. The Operator takes or ensures the necessary measures to delete or clarify incomplete or inaccurate data.

6.7. Personal data is retained in a form that identifies the data subject for no longer than necessary for the purposes of processing, unless a retention period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor. Data is destroyed or depersonalised when the purposes are achieved or no longer need to be achieved, unless federal law provides otherwise.

7. Purposes of personal data processing

7.1. The purposes of processing the User's personal data are:

entering into, performing and terminating civil-law contracts;

clarifying order details.

7.2. Data submitted through the enquiry form is not used for advertising or informational mailings without the User's separate consent.

7.3. Data collected using Yandex Metrica is used to analyse visits, identify technical problems and improve the website's structure and content.

8. Legal bases for personal data processing

8.1. The legal bases for the Operator's processing are:

contracts between the Operator and the data subject;

federal laws and other regulations concerning personal data protection;

Users' consents to processing their personal data and data authorised for dissemination.

8.2. Before submitting a website form, the User separately confirms consent to personal data processing using a required checkbox that is not selected by default. The form cannot be submitted without this confirmation. The consent terms are published at https://iphs.ru/en/consent/.

8.3. Yandex Metrica is loaded only after the User gives separate consent. The User may decline analytics or change their choice using the Analytics settings link in the website footer.

8.4. The data subject independently decides whether to provide their personal data and gives consent freely, of their own will and in their own interest.

9. Conditions for personal data processing

9.1. Personal data is processed with the data subject's consent.

9.2. Processing is necessary to achieve purposes established by an international treaty of the Russian Federation or by law, or to perform functions, powers and duties assigned to the Operator by Russian law.

9.3. Processing is necessary for the administration of justice or execution of a judicial act or an act of another authority or official enforceable under Russian enforcement legislation.

9.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to enter into a contract at the data subject's initiative or under which they will be a beneficiary or guarantor.

9.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant objectives, provided the data subject's rights and freedoms are not infringed.

9.6. Processing concerns personal data made accessible to an unlimited number of persons by the data subject or at their request (publicly available personal data).

9.7. Processing concerns personal data subject to publication or mandatory disclosure under federal law.

10. Collection, storage, transfer and other processing procedures

The security of personal data processed by the Operator is ensured through legal, organisational and technical measures necessary to meet the requirements of applicable personal data protection law in full.

10.1. The Operator safeguards personal data and takes all possible measures to prevent unauthorised access.

10.2. The User's personal data will not be transferred to third parties under any circumstances, except as required by applicable law or where the data subject has consented to transfer to a third party for the performance of obligations under a civil-law contract.

10.3. If inaccuracies are found, the User may update their data by sending a notification to inf.phs@yandex.ru with the subject Personal data update.

10.4. The processing period is determined by the achievement of the purposes for which the data was collected, unless a different period is established by contract or applicable law.

The User may withdraw consent at any time by emailing the Operator at inf.phs@yandex.ru with the subject Withdrawal of consent to personal data processing.

10.5. Yandex Metrica is used to analyse website visits. Data transfer to the service begins only after the User consents. The choice is stored in the browser's local storage for up to 180 days and requested again after that period expires or the consent mechanism changes. Information obtained by Yandex Metrica is stored and processed under the service's terms and privacy policy.

10.6. Restrictions imposed by the data subject on the transfer (other than granting access), processing or processing conditions (other than obtaining access) of data authorised for dissemination do not apply to processing in state, public or other public interests defined by Russian law.

10.7. The Operator ensures confidentiality when processing personal data.

10.8. The Operator retains personal data in a form identifying the data subject for no longer than required by the processing purposes, unless a retention period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.

10.9. Processing may cease when its purposes are achieved, the data subject's consent expires or is withdrawn, or unlawful processing is identified.

11. Operations performed on personal data

11.1. The Operator collects, records, organises, accumulates, stores, clarifies (updates or amends), retrieves, uses, transfers (disseminates, provides or grants access to), depersonalises, blocks, deletes and destroys personal data.

11.2. The Operator processes personal data by automated means, with or without receiving or transmitting information through information and telecommunications networks.

12. Cross-border transfer of personal data

12.1. Before a cross-border transfer, the Operator must ensure that the foreign state to which the data is to be transferred provides reliable protection of data subjects' rights.

12.2. Cross-border transfer to foreign states that do not meet the above requirements may take place only with the data subject's written consent to the cross-border transfer or for the performance of a contract to which the data subject is a party.

13. Confidentiality of personal data

The Operator and other persons who obtain access to personal data must not disclose it to third parties or disseminate it without the data subject's consent, unless federal law provides otherwise.

14. Final provisions

14.1. The User may request clarification about personal data processing by emailing the Operator at inf.phs@yandex.ru.

14.2. Changes to the Operator's personal data processing policy will be reflected in this document. The Policy remains in force indefinitely until replaced by a new version.

14.3. The current English version of the Policy is freely available online at https://iphs.ru/en/policy/.