Personal data processing policy What we know about you.

1. General provisions

1.1. This policy sets out how operator’s full nameoperator’s full name: to be specified (the “operator”, “we”) processes the personal data of visitors to www.kakdelacoffee.ru and how it protects them. It is issued under part 2 of article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).

1.2. The policy covers all personal data the operator receives through the site, including through the “Feedback” form. The data of employees, job applicants and other people outside the site is governed by the operator’s other documents.

1.3. Terms have the meanings given in article 3 of the Law. Personal data: any information relating directly or indirectly to an identified or identifiable person. Processing: any action with it, from collection to destruction.

1.4. The policy is publicly available at www.kakdelacoffee.ru/privacy. Every page of the site links to it, and so does the feedback form.

1.5. The consent to personal data processing is a separate document: www.kakdelacoffee.ru/privacy/consent.

2. Operator

2.1. Operator: operator’s full nameoperator’s full name: to be specified, INN INN (taxpayer number)INN (taxpayer number): to be specified, OGRN OGRN (state registration number)OGRN (state registration number): to be specified, address: operator’s addressoperator’s address: to be specified.

2.2. Person responsible for organizing the processing of personal data: person responsible for processingperson responsible for processing: to be specified.

2.3. Requests about personal data are accepted by email at email addressemail address: to be specified and by letter to the operator’s address.

2.4. The operator’s number in the register of operators processing personal data: number in the register of operatorsnumber in the register of operators: to be specified.

3. What data, why and on what basis

3.1. We process personal data for one purpose: to consider a note sent through the “Feedback” form and, if you left a contact, to reply to it.

3.2. For this purpose we process:

• the text of the note and anything you tell us in it;
• the note’s topic (“All peachy”, “An idea”, “So-so”, “A question”) and the café, if you ticked them;
• your signature, if you left one;
• a phone number or email address for the reply, if you left one;
• the date and time it was sent, the note’s number and the mark of consent.

3.3. Data subjects: visitors to the site who sent a note.

3.4. Sending a note, and leaving a signature and a contact in it, is optional. A note can be sent without a contact, but then we can’t reply. If you don’t want to give consent, call the café: the phone numbers are on the site.

3.5. Basis: your consent (item 1 of part 1 of article 6 of the Law). You give it separately, by ticking the consent box in the form before sending. Without consent the note is not sent.

3.6. If a note mentions other people, such as a member of the café’s staff or a guest, what it says about them is used only to deal with the note, on the basis of the operator’s legitimate interest (item 7 of part 1 of article 6 of the Law), is not published and is deleted with the note. Please don’t name them in full if you can avoid it: “the barista at the till” is enough. A reply to a request about your data does not include information about other people.

3.7. Please don’t write about your health, beliefs or other special categories of data (article 10 of the Law) in a note. We don’t collect them. If such information does end up in a note, for instance in a complaint about feeling unwell after a meal, we use it only to consider the complaint and protect your rights (item 6 of part 2 of article 10 of the Law), and delete it with the note.

3.8. We don’t use contacts for advertising or mailings, don’t publish notes and don’t pass them on for distribution. We take no decisions with legal consequences for you based solely on automated processing.

3.9. If you are under 14, ask a parent or other legal representative to send the note for you: they give the consent.

4. What stays on your device

4.1. The site sets no cookies and uses no analytics, ad pixels or third-party scripts. Fonts and images load from our own server. Links to maps, social networks and messengers lead to other sites with their own rules; until you follow them, those sites learn nothing about you.

4.2. To remember your settings, the site keeps a few values in your browser’s storage. They are not sent to our server and cannot identify you:

4.3. You can delete these values in your browser’s settings by clearing the site’s data.

4.4. The “Which one is nearest?” button asks your browser for your location only after you press it, and only with your permission. The coordinates are used on your device to work out the distance to the cafés and are sent nowhere. If the nearest café is in another city, the site remembers that city (kd-city).

4.5. Like any web server, the site’s server may record in a technical log the IP address, browser details, the page or file requested and the time of the request. The log is needed to run and protect the site (the operator’s legitimate interest, item 7 of part 1 of article 6 of the Law), is not used to identify visitors and is kept for no longer than 30 days.

5. How the data is processed

5.1. Processing is automated, with transfer over the Internet. The following is done with the data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (granting access) to the operator’s employees, blocking, deletion, destruction.

5.2. A note reaches the site’s server and is sent straight on by email to the operator’s mailbox. The site’s server does not keep notes and does not write them to logs.

5.3. Notes are kept in the operator’s mailbox. The site’s server and the mail service are in the Russian Federation: the personal data of Russian citizens is recorded, stored and updated in databases on its territory (part 5 of article 18 of the Law).

5.4. On the operator’s instructions the data is processed by hosting provider, addresshosting provider, address: to be specified (hosting the site) and mail service, addressmail service, address: to be specified (the mail service). They must keep it confidential and comply with the Law (part 3 of article 6 of the Law). The operator answers to you for their actions.

5.5. Personal data is not transferred across borders.

5.6. Only those of the operator’s employees who need the notes to reply have access to them. Data is passed to state bodies only in cases provided for by law.

5.7. If you left a phone number, we will call or text that number; if an email address, we will reply by email. We reply only from the operator’s phone and mailbox.

6. Retention and destruction

6.1. We keep a note and the data connected with it until we have replied and finished with it, but no longer than one year from the date it was sent.

6.2. The data is destroyed within 30 days once the purpose of processing is achieved, the retention period expires or you withdraw your consent (parts 4 and 5 of article 21 of the Law). If it cannot be destroyed within that time, we block it and destroy it within six months at the latest.

6.3. Destruction is confirmed in the manner set by Roskomnadzor.

6.4. If unlawful processing comes to light, we stop it within three working days. If it cannot be made lawful, we destroy the data within ten working days and let you know.

7. Your rights

7.1. You have the right to:

• receive information about the processing of your data: the basis, purposes and methods, what data is processed and for how long, and who processes it on the operator’s instructions (part 7 of article 14 of the Law);
• demand that data be clarified, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or not needed for the purpose of processing;
• withdraw your consent at any time;
• demand that processing stop;
• appeal against the operator’s actions to Roskomnadzor or in court.

7.2. Requests are sent by email to email addressemail address: to be specified or by letter to the operator’s address. A request must include the number of your main identity document, its date of issue and the issuing authority, information confirming your dealings with the operator (for instance, the date and number of your note, which you see after sending it, or the contact you left), and your signature (part 3 of article 14 of the Law). An electronic request is signed with an electronic signature.

7.3. To withdraw your consent, an email to email addressemail address: to be specified from the same address, or with your contact and the note’s number, is enough. Processing stops, and the data is destroyed within 30 days.

7.4. We reply within 10 working days of receiving a request. The time may be extended by another 5 working days if we tell you why. We reply in the same form the request came in, unless it says otherwise.

7.5. We correct inaccurate data within 7 working days after you confirm the inaccuracy. Data obtained unlawfully or not needed for the purpose of processing is destroyed within the same time. A demand to stop processing is carried out within 10 working days, which may be extended by 5.

8. Personal data protection requirements in place

8.1. The operator appoints a person responsible for organizing personal data processing, approves this policy and internal rules on processing, assesses the harm that could be caused to data subjects and makes its employees familiar with the requirements of the Law (article 18.1 of the Law).

8.2. Legal, organizational and technical measures protect the data (article 19 of the Law):

• the site works only over the secure HTTPS protocol;
• the site’s server does not keep notes, and the passwords and keys to the mailbox are kept only in the server’s protected settings;
• only the employees who need it have access to the mailbox with the notes, through personal accounts;
• threats to the data and its level of protection are identified, and actions with the data are recorded;
• employees may not forward guests’ notes and contacts to personal email or messengers;
• employees with access to the data must keep it confidential (article 7 of the Law).

8.3. In case of a leak, the operator notifies Roskomnadzor within 24 hours and reports the results of its investigation within 72 hours (part 3.1 of article 21 of the Law).

9. Changes to the policy

9.1. We change the policy when the law changes or when the way the site works changes. A new version applies from the moment it is published on this page. The version date is at the top.

9.2. If the purposes of processing or the data involved change, we will ask for your consent again.