Privacy policy

1. General Provisions
This privacy policy has been formalized pursuant to the requirements of the Federal law No 152-FZ of 27.07.2006 "On Personal Data" (hereinafter "Personal Data Protection Act") in order to regulate processing of personal data and to set out the measures to be taken by the ‘Manege’ Central Exhibition Hall, residing at 1 Isaakievskaya pl., St. Petersburg, 190000 (hereinafter "Operator"), to ensure safety of personal data.
1.1. The Operator's ultimate objective and a pre-requisite for its operations is respect for human and civil rights and freedoms when processing personal data, including protection of the rights to personal and family privacy.
1.2. This Operator's privacy policy (hereinafter "Policy") applies to any and all information the Operator may obtain about the people visiting http://newnowbymanege.com/.
2. Basic terms and definitions used in the Policy
2.1. Automated personal data processing shall mean processing personal data by means of computer technology.
2.2. Blocking of personal data shall mean temporary suspension of personal data processing (except where processing is required for personal data refinement).
2.3. Website shall mean a set of images and information content, as well as computer programs and databases, ensuring their availability on the Internet at the following web address: http://newnowbymanege.com/.
2.4. Personal data information system shall mean a combination of personal data contained in personal databases as well as information technologies and technical means ensuring the processing of personal data.
2.5. Depersonalization of personal data shall mean actions making it impossible to establish a connection between personal data and a specific User or other data subject without using additional information.
2.6. Personal data processing shall mean any action (operation) or a series of actions (operations) with personal data performed with or without automated means, including collection, recording, systematization, accumulation, storage, refinement (updating, amendment), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of personal data.
2.7. Operator shall mean a government authority, a municipal authority, a legal entity or natural person that individually or jointly arrange and/or perform the processing of personal data, as well as define the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data.
2.8. Personal data shall mean any information related to a directly or indirectly identified or identifiable User of the website at http://newnowbymanege.com/.
2.9. Personal data the dissemination of which is permitted by the data subject shall mean personal data that were made available to the general public by the data subject by giving consent to the processing of personal data, the dissemination of which is permitted by the data subject in line with the procedure provided by the Personal Data Protection Act (hereinafter "disclosable personal data").
2.10. User shall mean any person visiting http://newnowbymanege.com/.
2.11. Provision of personal data shall mean actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Dissemination of personal data shall mean actions aimed at divulging personal data to an indefinite number of persons (transfer of personal data) or disclosure of personal data to an indefinite number of persons, including the publication of personal data in the media, posting it on IT networks or making personal data available in any other way.
2.13. Trans-border transfer of personal data shall mean a transfer of personal data to a foreign country, specifically to a foreign government body or a foreign natural or legal person.
2.14. Destruction of personal data shall mean any actions making it impossible to restore the content of personal data in the personal data information system and/or resulting in the destruction of physical media on which personal data are stored.
3. Operator's basic rights and obligations
3.1. The Operator is entitled to:
– obtain accurate information and/or documents containing personal data from the data subject;
– if the data subject withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data subject to the grounds set out in the Personal Data Protection Act without the consent of the data subject;
– independently determine the list of measures required and sufficient to ensure the fulfilment of the obligations under the Personal Data Protection Act and the regulations adopted in accordance with it, unless otherwise provided by the Personal Data Protection Act or other federal laws.
3.2. The Operator undertakes to:
– provide the data subject, at his/her request, with information related to the processing of his/her personal data;
– arrange the processing of personal data in accordance with the procedure established by the applicable laws of the Russian Federation;
– respond to requests and enquiries from personal data subjects and their legal representatives as required by the Personal Data Protection Act;
– following a request from the competent privacy protection body, provide it with the requested information within 30 days of receiving such a request;
– publish or otherwise provide unlimited access to this Privacy policy;
– take legal, organizational and technical measures to protect personal data against unauthorized or accidental access, destruction, amendment, blocking, copying, provision, dissemination, as well as against other misconduct with regard to personal data;
– stop the transfer (dissemination, provision, access) of personal data, cease its processing and destroy personal data as and when provided in the Personal Data Protection Act;
– comply with any other obligations imposed by the Personal Data Protection Act;
4. Basic rights and obligations of the personal data subjects
4.1. Data subjects are entitled to:
– receive information related to processing of their personal data, unless it’s prohibited by federal laws. The Operator provides the information to a data subject in accessible terms, while excluding any personal data related to other data subjects, unless there are legitimate grounds for disclosing such personal data. The list of information and the procedure for obtaining it are laid down in the Personal Data Protection Act;
– demand that the Operator updates, blocks or destroys the personal data, if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, and to pursue legal remedy established by law;
– condition prior consent to personal data processing for the sake of marketing goods, works and services;
– withdraw the consent to personal data processing;
– appeal to the competent privacy protection body or to a court against Operator's unlawful actions or lack thereof in processing of the personal data;
– exercise any other rights provided for by the Russian law.
4.2. Data subjects undertake to:
– provide the Operator with accurate personal details;
– notify the Operator of any refinement (updating, amendment) of their personal data.
4.3. Submission of false or inaccurate personal details or information about any other data subject without its consent may result in legal liability under the Russian law.
5. The Operator may process the following personal data of the User
5.1. Full name
5.2. E-mail address
5.3. Phone numbers
5.4. The website also uses Internet statistics services (Yandex.Metrica, Google Analytics and others) to collect and process anonymised visitor data (including cookies).
5.5. The above data are further jointly referred to as Personal details.
5.6. The Operator does not process special categories of personal data relating to race, ethnicity, political views, religious or philosophical beliefs and intimate life.
5.7. Processing of disclosable personal data from the list of special personal data categories set out in the Article 10 Part 1 of the Personal Data Protection Act is permitted, if the restrictions and conditions stipulated in Article 10.1 of the Personal Data Protection Act are complied with.
5.8. The User's consent to processing of disclosable personal data is made separately from other consents to his/her personal data processing. Nevertheless, conditions stipulated, without limitation, in Article 10.1 of the Personal Data Protection Act are observed. The competent privacy protection body establishes the requirements to the contents of this consent form.
5.8.1 The User submits the consent to processing of disclosable personal data directly to the Operator.
5.8.2 The Operator shall within 3 business days of receiving the above User's consent publish data processing conditions, availability of restrictions and conditions for processing the disclosable personal data by the general public.
5.8.3 The transfer (dissemination, provision, access) of personal data authorised by the data subject for dissemination must be stopped on the request of the data subject at any time. This request must include last name, first name and middle name (if applicable), contact information (telephone number, e-mail address or postal address) of the data subject, as well as a list of personal data to be excluded from further processing. Personal data provided in this request may be processed only by the Operator to whom it is sent.
5.8.4 The consent to processing of disclosable personal data expires on receipt of the request set out in item 5.8.3 of this Privacy policy.
6. Principles of personal data processing
6.1. Personal data is processed on a fair and equitable basis.
6.2. The processing of personal data is limited to achieving specific, predetermined and legitimate objectives. Processing of personal data that is incompatible with the purpose of personal data collection is prohibited.
6.3. Databases containing personal data processed for the purposes contrary to each other shall not be merged.
6.4. Only personal data that comply with their processing purposes shall be processed.
6.5. The content and scope of the processed personal data correspond to the stated processing purposes. The processing of personal data shall not be excessive with respect to the stated purposes of its processing.
6.6. Personal data processing requires that the accuracy of personal data, their sufficiency, and, if necessary, relevance for the personal data processing purposes is ensured. The Operator takes and/or arranges appropriate measures to delete or update incomplete or inaccurate data.
6.7. Personal data are stored in the form that makes it possible to identify the data subject for no longer than required for the purposes of personal data processing, unless the personal data retention period is set by federal law or an agreement under which the data subject acts as a party, beneficiary or guarantor. The processed personal data are destroyed or depersonalized as soon as the purposes of processing are achieved or if the achievement thereof is no longer required, unless otherwise provided by federal law.
7. Personal data processing purposes
7.1. The purpose of processing the User's personal data:
– sending email notifications to the User;
– providing the User with access to the services, information and/or materials presented at http://newnowbymanege.com/.
7.2. The Operator is also entitled to send the User email notifications about new products and services, special offers and various events. The User may always unsubscribe from the email notifications by sending the Operator a message to its email address at invitation@manege.spb.ru entitled "Termination of subscription to email notifications about new products, services and special offers".
7.3. The anonymised User data collected through Internet statistical services is used to collect information about Users' activities on the website and to improve the quality of the website and its content.
8. The legal authority for processing personal data
8.1. The legal authority for processing of personal data by the Operator are:
– the statutory (constituent) documents of the Operator;
– federal laws and other regulations governing personal data protection;
– the users' consent to the processing of their personal data and the disclosable personal data.
8.2. The Operator processes the User's personal data only if they are filled in and/or submitted by the User himself via special forms located on the website http://newnowbymanege.com/ or sent to the operator via email. By filling out the relevant forms and/or submitting personal data to the Operator, the User expresses his or her consent to this Policy.
8.3. The Operator processes the anonymised User data, if the User's browser settings allow it (saving cookies and the use of JavaScript are enabled).
8.4. Data subjects choose to provide personal data and give consent of their own free will and volition and for own benefit.
9. Terms and conditions of personal data processing
9.1. The processing of personal data is subject to the consent of the data subject to the processing of his or her personal data.
9.2. The processing of personal data is required to achieve objectives set out in international treaties, in which the Russian Federation is a party, and laws to exercise functions, powers and duties imposed on the Operator by the Russian law.
9.3. Processing of personal data is required for administration of justice, execution of judicial instruments, instruments issued by other bodies or officials, which are enforceable in accordance with the Russian law on enforcement proceedings.
9.4. The processing of personal data is necessary to fulfil an agreement under which the data subject acts as a party, beneficiary or guarantor, as well as to conclude an agreement initiated by the data subject or an agreement under which the data subject will be a beneficiary or guarantor.
9.5. The processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties or to achieve goals of social significance, provided that the rights and freedoms of a data subject are not violated.
9.6. Personal data, made accessible to public through the consent of the data subject or at his or her request, shall be subject to processing (personal data in the public domain).
9.7. Personal data subject to publication or required disclosure in accordance with federal law is processed.
10. The procedure for collecting, storing, transferring and other types of processing of personal data
The security of personal data processed by the Operator is ensured by implementing the legal, organizational and technical measures necessary to fully comply with the requirements of the current privacy law.
10.1. The Operator ensures the safety of personal data and takes all possible measures to exclude access to personal data by unauthorized persons.
10.2. The User's personal data will never, under no circumstances, be disclosed to third parties, except in cases related to the implementation of current legislation or if the data subject has given consent to the Operator for the transfer of data to a third party in order to fulfil obligations under a civil law contract.
10.3. If any inaccuracies in the personal data are identified, the User may update them by sending a message entitled "Personal Data Update" to the Operator's mailbox at http://newnowbymanege.com/.

10.4. The time period for processing personal data depends on achieving the objectives, for which the personal data was collected, unless a different time period is stipulated by an agreement or applicable law.
The User may withdraw his/her consent to the processing of personal data at any time by sending the Operator a notice entitled "Withdrawal of consent to the processing of personal data" via email at http://newnowbymanege.com/.

10.5. All information collected by third party services, including payment processing systems, communication infrastructure and other service providers, is stored and processed by the said parties (Operators) in accordance with their User Agreement and Privacy Policy. The data subject and/or User shall read these documents in due course. The Operator cannot be held liable for third-party actions including the service providers mentioned above.
10.6. The prohibitions by the data subject in respect of the transfer (other than granting access) and processing or conditions of processing (other than obtaining access) of disclosable personal data shall not apply if the personal data are processed for state, social and other public interests as defined by Russian law.
10.7. The Operator ensures confidentiality of the personal data when processing them.
10.8. The Operator stores personal data in a way that makes it possible to identify the data subject for no longer than required for the purposes of personal data processing, unless the personal data retention period is set by federal law or an agreement under which the data subject acts as a party, beneficiary or guarantor.
10.9. Personal data processing may be ceased if its objectives have been achieved, the data subject's consent has expired or has been withdrawn by the data subject and in case an unauthorized personal data processing has been found.
11. List of actions taken by the Operator in respect of the obtained personal data
11.1. The Operator collects, records, organizes, compiles, stores, clarifies (updates, changes), extracts, uses, transfers (disseminates, provides, accesses), anonymises, blocks, deletes and destroys personal data.
11.2. The Operator carries out automated processing of personal data with or without the receipt and/or transfer of the received information via IT networks.
12. Cross-border transfer of personal data
12.1. Before proceeding with the cross-border transfer of personal data the Operator must ensure that the foreign country, where the personal data will be potentially received, provides adequate protection of the rights of the data subjects.
12.2. The cross-border transfer of personal data to foreign countries that do not meet the above requirements may only take place, if the data subject consents in writing to the cross-border transfer of his or her personal data and/or the performance of the agreement to which the data subject is a party.
13. Privacy
The Operator and other persons, who have access to personal data undertake not to disclose or disseminate personal data to third parties without the consent of the data subject, unless otherwise provided by federal law.
14. Miscellaneous
14.1. The User may clarify any issues related to processing of his or her personal data by contacting the Operator via email at invitation@manege.spb.ru.
14.2. Any changes to the Operator's personal data processing policy will be reflected in this document. The policy remains in force indefinitely until replaced by a newer version.
14.3. The current version of the Policy is freely available on the Internet at http://newnowbymanege.com.