Approved
By Order of the General Director of PUMA Billing LLC
No. 3-P dated May 19, 2025
Personal Data Processing Policy of PUMA Billing LLC
(Version 2.0 dated May 19, 2025)
1. General Provisions
This Personal Data Processing Policy of PUMA Billing LLC (hereinafter referred to as the "Policy") is compiled in accordance with the requirements of Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006, and defines the main principles, objectives, conditions, and procedures for processing personal data, as well as measures to ensure the security of personal data undertaken by PUMA Billing LLC (hereinafter referred to as the "Operator").
1.1. The Operator considers upholding human and civil rights and freedoms when processing personal data, including the protection of rights to privacy, personal and family secrets, as its most important goal and condition for its activities.
1.2. This Policy applies to all information that the Operator may obtain about visitors to the website https://www.pumabilling.ru.
1.3. This Policy has been developed in accordance with the following regulatory documents:
- The Constitution of the Russian Federation;
- The Civil Code of the Russian Federation;
- The Labor Code of the Russian Federation;
- Federal Law of the Russian Federation No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter – "152-FZ");
- Federal Law of the Russian Federation No. 149-FZ of July 27, 2006 "On Information, Information Technologies, and Information Protection";
- Decree of the Government of the Russian Federation No. 687 of September 15, 2008 "On Approval of the Regulations on the Peculiarities of Personal Data Processing Carried Out Without the Use of Automation Tools";
- Decree of the Government of the Russian Federation No. 1119 of November 1, 2012 "On Approval of Requirements for the Protection of Personal Data During Their Processing in Personal Data Information Systems";
- Order of FSTEC of Russia No. 21 of February 18, 2013 "On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data During Their Processing in Personal Data Information Systems";
- Basic Model of Personal Data Security Threats During Their Processing in Personal Data Information Systems. Approved by the Deputy Director of FSTEC of Russia on February 15, 2008;
- Internal regulatory documents of the Operator governing the processing and ensuring information security of personal data.
2. Key Concepts Used in the Policy
2.1. Automated processing of personal data – processing of personal data using computer technology.
2.2. Blocking of personal data – temporary cessation of personal data processing (except when processing is necessary to clarify personal data).
2.3. Website – a collection of graphic and informational materials, as well as computer programs and databases, ensuring their availability on the internet at the network address https://www.pumabilling.ru.
2.4. Personal data information system – a set of personal data contained in databases, and the information technologies and technical means ensuring their processing.
2.5. Anonymization of personal data – actions that make it impossible to determine the ownership of personal data by a specific User or other personal data subject without using additional information.
2.6. Processing of personal data – any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, destruction of personal data.
2.7. Operator – PUMA Billing LLC (OGRN: 1227700252163, INN: 7714484960), independently or jointly with other persons organizing and/or carrying out the processing of personal data, as well as determining the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
2.8. Personal data – any information relating directly or indirectly to an identified or identifiable natural person (data subject).
2.9. Personal data authorized by the data subject for dissemination – personal data to which unlimited access has been granted by the data subject by giving consent to the processing of personal data authorized by the data subject for dissemination in accordance with Federal Law No. 152-FZ (hereinafter – "personal data authorized for dissemination").
2.10. Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.11. Dissemination of personal data – any actions aimed at disclosing personal data to an indefinite circle of persons (transfer of personal data) or making personal data available to an unlimited circle of persons, including the publication of personal data in mass media, placement in information and telecommunication networks, or providing access to personal data in any other way.
2.12. Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign natural person, or a foreign legal entity.
2.13. Destruction of personal data – any actions resulting in the irreversible destruction of personal data with no possibility of further restoring the content of personal data in the personal data information system and/or the destruction of physical carriers of personal data.
3. Main Rights and Obligations of the Operator
3.1. The Operator has the right to:
- receive accurate information and/or documents containing personal data from the data subject;
- if the data subject withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the data subject's consent if there are grounds specified in Federal Law No. 152-FZ;
- independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by Federal Law No. 152-FZ and regulatory legal acts adopted in accordance therewith, unless otherwise provided by Federal Law No. 152-FZ or other federal laws.
3.2. The Operator is obliged to:
- provide the data subject, upon their request, with information concerning the processing of their personal data;
- organize the processing of personal data in accordance with the procedure established by the current legislation of the Russian Federation;
- respond to requests and inquiries from data subjects and their legal representatives in accordance with the requirements of Federal Law No. 152-FZ;
- report to the authorized body for the protection of data subjects' rights, upon the request of this body, the necessary information within 30 (thirty) days from the date of receipt of such a request;
- publish or otherwise ensure unlimited access to this Policy;
- take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, as well as from other unlawful actions concerning personal data;
- cease the transfer (dissemination, provision, access) of personal data, cease processing and destroy personal data in the manner and cases stipulated by Federal Law No. 152-FZ;
- fulfill other obligations stipulated by Federal Law No. 152-FZ.
4. Key Rights and Obligations of Personal Data Subjects
4.1. Personal data subjects have the right to:
- receive information concerning the processing of their personal data, except in cases stipulated by federal laws. The Operator provides this information to the personal data subject in an accessible form, and it must not contain personal data relating to other personal data subjects, except when there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by Federal Law No. 152-FZ;
- demand from the Operator the clarification of their personal data, its blocking or destruction if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated processing purpose, and also take measures provided by law to protect their rights;
- stipulate the condition of prior consent when processing personal data for the purpose of promoting goods, works, and services in the market;
- withdraw consent for personal data processing;
- appeal to the authorized body for the protection of personal data subjects' rights or to the court against unlawful actions or inaction of the Operator during the processing of their personal data;
- exercise other rights stipulated by the legislation of the Russian Federation.
4.2. Personal data subjects are obliged to:
- provide the Operator with accurate data about themselves;
- inform the Operator about the clarification (update, change) of their personal data.
4.3. Individuals who have provided the Operator with inaccurate information about themselves or information about another personal data subject without the latter's consent shall be liable in accordance with the legislation of the Russian Federation.
5. List of Processed Personal Data
5.1. The Operator may process the following personal data (hereinafter referred to as "Personal Data" in this document):
- Last name, first name, patronymic.
- Other personal data provided by the data subject.
5.2. The Website also collects and processes anonymized visitor data (including "cookie" files) using internet statistics services (Yandex Metrica, Google Analytics, and others).
5.3. The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.
5.4. The processing of personal data permitted for dissemination, from among the special categories of personal data specified in Part 1 of Article 10 of Federal Law No. 152-FZ, is allowed if the prohibitions and conditions stipulated in Article 10.1 of Federal Law No. 152-FZ are observed.
5.5. Consent for the processing of personal data permitted for dissemination is formalized separately from other consents for personal data processing. In doing so, the conditions stipulated, in particular, by Article 10.1 of Federal Law No. 152-FZ are observed. Requirements for the content of such consent are established by the authorized body for the protection of personal data subjects' rights.
5.5.1 Consent for the processing of personal data permitted for dissemination is provided directly to the Operator.
5.5.2 The Operator is obliged, no later than 3 (three) business days from the date of receiving the specified consent from the personal data subject, to publish information about the processing conditions, and about any prohibitions and conditions for the processing of personal data permitted for dissemination by an unlimited number of persons.
5.5.3 The transfer (dissemination, provision, access) of personal data permitted by the data subject for dissemination must be terminated at any time upon the data subject's request. This request must include the data subject's surname, first name, patronymic (if applicable), contact information (phone number, email address, or postal address), and a list of personal data whose processing is to be terminated. The personal data specified in this request may only be processed by the Operator to whom the request is sent.
5.5.4 Consent for the processing of personal data permitted for dissemination ceases to be valid from the moment the Operator receives the request specified in clause 5.5.3 of this Personal Data Processing Policy.
6. Principles of Personal Data Processing
6.1. Personal data processing is carried out on a lawful and fair basis.
6.2. Personal data processing is limited to achieving specific, predetermined, and legitimate purposes. Processing of personal data incompatible with the purposes of personal data collection is not permitted.
6.3. The merging of databases containing personal data, the processing of which is carried out for incompatible purposes, is not permitted.
6.4. Only personal data that corresponds to the purposes of its processing is subject to processing.
6.5. The content and scope of processed personal data correspond to the stated processing purposes. Excessive processing of personal data in relation to its stated purposes is not permitted.
6.6. When processing personal data, the accuracy, sufficiency, and, where necessary, relevance of personal data to the purposes of personal data processing are ensured. The Operator takes necessary measures and/or ensures their adoption to delete or clarify incomplete or inaccurate data.
6.7. Personal data is stored in a form that allows identification of the data subject for no longer than required by the purposes of personal data processing, unless the personal data retention period is established by federal law, by a contract to which the data subject is a party, beneficiary, or guarantor. Processed personal data is destroyed or anonymized upon achieving the processing purposes or in the event that the need to achieve these purposes is lost, unless otherwise provided by federal law.
7. Purposes of Personal Data Processing
7.1. The purpose of processing User's personal data is:
- promoting the Operator's and/or third parties' goods, works, and services in the market by making direct contact with potential consumers via telecommunication networks, including postal, telephone, and mobile radio communication;
- ensuring proper fulfillment of obligations under contracts concluded by the Operator;
- fulfilling other requirements stipulated by the legislation of the Russian Federation, the Charter, and the Operator's organizational and administrative documents.
- concluding, executing, and terminating civil law contracts;
- providing access to services, information, and/or materials contained on the Website.
7.2. The Operator also has the right to send the personal data subject notifications about new products and services, special offers, and various events. The subject can always opt out of receiving informational messages by sending an email to the Operator at office@pumabilling.ru (hereinafter – "Operator's email") with the subject line "Opt-out of notifications about new products, services, and special offers."
7.3. Anonymized personal data collected through internet statistics services is used to gather information about the actions of personal data subjects on the Website.
8. Conditions for Personal Data Processing
8.1. Personal data processing is carried out with the consent of the personal data subject.
8.2. Personal data processing is necessary to achieve the purposes stipulated by an international treaty of the Russian Federation or by law, and to fulfill the functions, powers, and duties assigned to the Operator by the legislation of the Russian Federation.
8.3. Personal data processing is necessary for the administration of justice, the execution of a judicial act, or an act of another body or official that is subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings.
8.4. Personal data processing is necessary for the performance of a contract to which the personal data subject is a party, beneficiary, or guarantor, as well as for concluding a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor.
8.5. Personal data processing is necessary for the exercise of the legitimate rights and interests of the operator or third parties, or for achieving socially significant goals, provided that the rights and freedoms of the personal data subject are not violated.
8.6. Personal data processing is carried out for data to which unlimited access has been granted by the personal data subject or at their request (hereinafter – publicly available personal data).
8.7. Personal data subject to publication or mandatory disclosure in accordance with federal law is processed.
9. Procedure for collecting, storing, transferring
and other types of personal data processing
9.1. The Operator ensures the security of personal data and takes all possible measures to prevent unauthorized access to personal data.
9.2. Personal data of data subjects will never, under any circumstances, be transferred to third parties, except in cases related to the execution of current legislation or if the data subject has given consent to the Operator for the transfer of data to a third party for the fulfillment of obligations under a civil law contract.
9.3. In case of inaccuracies in personal data, the data subject may update them independently by sending a notification to the Operator's email address office@pumabilling.ru with the subject line "Personal Data Update".
9.4. The period for processing personal data is determined by the achievement of the purposes for which the personal data was collected, unless a different period is stipulated by contract or current legislation. The User may withdraw their consent to personal data processing at any time by sending a notification via email to the Operator's email address office@pumabilling.ru with the subject line "Withdrawal of Consent for Personal Data Processing".
9.5. All information collected by third-party services, including payment systems, communication tools, and other service providers, is stored and processed by these entities (Operators) in accordance with their User Agreement and Privacy Policy. The personal data subject is obliged to independently and timely familiarize themselves with these documents. The Operator is not responsible for the actions of third parties, including the service providers mentioned in this clause.
9.6. Prohibitions established by the personal data subject on the transfer (other than providing access), as well as on the processing or conditions of processing (other than obtaining access) of personal data permitted for dissemination, do not apply in cases of personal data processing in state, public, and other public interests as defined by the legislation of the Russian Federation.
9.7. The Operator ensures the confidentiality of personal data during its processing.
9.8. The Operator stores personal data in a form that allows identification of the data subject for no longer than required by the purposes of personal data processing, unless a different storage period for personal data is established by federal law, a contract where the data subject is a party, beneficiary, or guarantor.
9.9. The conditions for terminating personal data processing may include the achievement of the personal data processing purposes, the expiration of the data subject's consent, or the withdrawal of consent by the data subject, as well as the detection of unlawful personal data processing.
10. List of actions performed by the Operator
with the personal data received
10.1. The Operator carries out the collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
10.2. The Operator performs automated processing of personal data with the receipt and/or transfer of the obtained information via information and telecommunication networks or without such.
11. Cross-border Transfer of Personal Data
11.1. Before initiating any cross-border transfer of personal data, the Operator must ensure that the foreign state to whose territory the personal data is intended to be transferred provides reliable protection of the rights of personal data subjects.
11.2. Cross-border transfer of personal data to the territories of foreign states that do not meet the aforementioned requirements may only be carried out with the written consent of the personal data subject for the cross-border transfer of their personal data and/or for the performance of a contract to which the personal data subject is a party.
12. Confidentiality of Personal Data
12.1. Information related to personal data that becomes known to the Operator is confidential and protected by law.
12.2. The Operator's employees and other individuals who have gained access to processed personal data have signed a non-disclosure agreement for confidential information and have been warned about potential disciplinary, administrative, civil, and criminal liability in case of violation of the norms and requirements of the current legislation of the Russian Federation in the field of personal data processing.
13. Final Provisions
13.1. The User may obtain any clarifications regarding questions concerning the processing of their personal data by contacting the Operator via the Operator's email.
13.2. This Policy applies to any action (operation) or set of actions (operations) performed with personal data, whether by automated means or without such means, including the collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
13.3. Other rights and obligations of the Operator as a personal data operator are determined by the legislation of the Russian Federation in the field of personal data.
13.4. The Operator is obliged to publish or otherwise ensure unrestricted access to this Policy in accordance with Part 2, Article 18.1 of Federal Law No. 152-FZ. The electronic version of the Policy is available on the Operator's website at: https://www.pumabilling.ru.
13.5. The Operator has the right to amend this Policy. The new version of the Policy comes into effect from the moment it is approved by an authorized person and published on the Operator's website, unless otherwise stipulated by the new version of the Policy.
14. Operator Details:
PUMA Billing LLC
PSRN: 1227700252163
TIN: 7714484960, KPP: 771401001
Address (location): 125040, Russian Federation, Moscow, Begovoy municipal district, intra-city territory, Nizhnyaya St., bldg. 14, structure 7.