1. General Provisions

This Personal Data Processing Policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006, “On Personal Data” (hereinafter - the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the Security of personal data undertaken by Individual Entrepreneur Sogoyan Zhirair Pogosovich (hereinafter – the Operator).

1.1. The Operator’s primary goal and condition for carrying out its activities is the

observance of human and civil rights and freedoms in the processing of personal data,

including the protection of the right to privacy, personal and family confidentiality.

1.2. This Policy of the Operator regarding the processing of personal data (hereinafter – the Policy) applies to all information that the Operator may receive about visitors to the website: https://armathotel.ru/.

2. Basic Terms Used in the Policy

2.1. Automated processing of personal data – processing of personal data using computer technology.

2.2. Blocking of personal data – temporary suspension of personal data processing (except when processing is necessary to clarify personal data).

2.3. Website – a collection of graphic and informational materials, as well as computer

programs and databases, ensuring their accessibility online at https://armathotel.ru/.

2.4. Personal data information system – a set of personal data contained in databases and information technologies and technical means that enable their processing.

2.5. Depersonalization of personal data – actions that make it impossible, without additional information, to determine the ownership of personal data to a specific User or other subject of personal data.

2.6. Processing of personal data – any action (operation) or set of actions (operations)

performed with or without the use of automation tools with personal data, including

collection, recording, systematization, accumulation, storage, clarification (updating,

modification), retrieval, use, transfer (distribution, provision, access), depersonalization,

blocking, deletion, and destruction of personal data.

2.7. Operator – a state body, municipal body, legal or natural person, independently or jointly with others, organizing and/or performing the processing of personal data, as well as determining the purposes of personal data processing, the composition of personal data to be processed, and the actions performed with personal data.

2.8. Personal data – any information relating directly or indirectly to a specific or identifiable User of the website https://armathotel.ru/.

2.9. Personal data permitted by the subject of personal data for distribution – personal data to which access by an unlimited number of persons is granted by the subject through consent in the manner prescribed by the Personal Data Law (hereinafter – personal data permitted for distribution).

2.10. User – any visitor of the website https://armathotel.ru/.

2.11. Provision of personal data – actions aimed at the disclosure of personal data to a specific person or a specific group of persons.

2.12. Distribution of personal data – any actions aimed at disclosing personal data to an indefinite number of persons (transfer of personal data) or making personal data accessible to an indefinite number of persons, including publication in the media, posting in information and telecommunication networks, or otherwise providing access.

2.13. Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual, or a foreign legal entity.

2.14. Destruction of personal data – any actions that irreversibly destroy personal data,

making it impossible to restore the content of personal data further in the personal data information system, and/or destroying physical media containing personal data.

3. Main Rights and Obligations of the Operator

3.1. The Operator has the right to:

• receive accurate information and/or documents containing personal data from the

subject of personal data;

• in the event of withdrawal by the subject of consent to personal data processing, as

well as in the case of a request to terminate processing, continue processing personal

data without consent if legal grounds specified in the Personal Data Law exist;

• independently determine the composition and list of measures necessary and

sufficient to fulfill obligations under the Personal Data Law, unless otherwise

provided by federal law.

3.2. The Operator is obliged to:

• provide the subject of personal data, upon request, with information relating to the

processing of his or her personal data;

• Organize the processing of personal data in accordance with the current legislation of the Russian Federation;

• Respond to requests from subjects of personal data and their legal representatives in accordance with the Personal Data Law;

• Submit to the authorized body for the protection of personal data subjects’ rights, the

necessary information within 10 days from the date of receipt of a request;

• Publish or otherwise ensure unrestricted access to this Policy regarding personal data

processing;

• Take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution, as well as from other unlawful actions;

• Cease transfer (distribution, provision, access) of personal data, stop processing, and

destroy personal data in the manner and cases provided by the Personal Data Law;

• Fulfill other obligations established by the Personal Data Law.

4. Main Rights and Obligations of Personal Data Subjects

4.1. Personal data subjects have the right to:

• obtain information relating to the processing of their personal data, except in cases provided by federal law. Information is provided by the Operator in an accessible form and must not include personal data of other subjects, unless there are lawful grounds for disclosure. The list and procedure are established by the Personal Data Law.
• demand clarification, blocking, or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the declared purpose of processing, as well as take measures to protect their rights;
• set a condition of prior consent for processing for purposes of promoting goods, works, and services in the market;
• withdraw consent to the processing of personal data, and demand termination of processing;
• appeal unlawful actions or inaction of the Operator to the authorized body for the protection of rights or in court;
• exercise other rights provided by the legislation of the Russian Federation.

4.2. Personal data subjects are obliged to:

• Provide accurate information about themselves to the Operator;
• Notify the Operator of updates or changes to their personal data.

4.3. Persons who provided inaccurate data about themselves or about another subject

without consent bear liability in accordance with Russian law.

5. Principles of Personal Data Processing

5.1. Processing is carried out on a lawful and fair basis.

5.2. Processing is limited to achieving specific, predetermined, legitimate purposes. Processing incompatible with the purposes of collection is not allowed.

5.3. Combining databases containing personal data for incompatible purposes is not permitted.

5.4. Only personal data relevant to the purposes of processing are subject to processing.

5.5. The content and scope of processed personal data must correspond to declared purposes. Excessive processing is not permitted.

5.6. Accuracy, sufficiency, and relevance of personal data must be ensured. The Operator shall take measures to delete or clarify incomplete or inaccurate data.

5.7. Storage of personal data must allow identification of the subject for no longer than

required by the purposes of processing, unless otherwise established by federal law or

contract. Personal data shall be destroyed or depersonalized once the purposes are achieved or the need is lost.

6. Purposes of Processing Personal Data

• Conclusion, execution, and termination of civil-law contracts;
• Informing the User via email;
• Collection of statistical information about User activity on the Website;
• Improving Website quality and content with the help of internet analytics services.

Personal data: last name, first name, patronymic, email address, phone numbers, residential address.

Also collected: depersonalized data (including cookies) via analytics services

(Yandex.Metrica).

Legal grounds: Civil Code of the Russian Federation, Federal Law “On Information,

Information Technologies and Information Protection” No. 149-FZ of July 27, 2006.

Types of processing: collection, recording, systematization, accumulation, storage,

destruction, depersonalization, and sending informational emails.

7. Conditions of Processing Personal Data

7.1. The Operator processes the User’s personal data only when they are voluntarily submitted via forms on the website. By submitting, the User consents to this Policy.

7.2. The Operator processes depersonalized User data if allowed in the browser settings

(cookies, JavaScript enabled).

7.3–7.7. Processing is also necessary in cases provided by international treaties, Russian law, execution of judicial acts, fulfillment of contracts, protection of rights and lawful interests of the Operator or third parties, or when required for public interest.

8. Procedure for Collection, Storage, Transfer, and Other

Processing of Personal Data

The Operator ensures the security of personal data through legal, organizational, and technical measures.

8.1. The Operator ensures data preservation and prevents unauthorized access.

8.2. Personal data will not be transferred to third parties except where required by law or with

User consent. The User consents to the transfer of data to “Armat Hotel” (OGRNIP

319385000044370, Irkutsk, ul. Shiryamova, 33) for the purpose of booking accommodation. The User also consents to cookie collection via Yandex.Metrica, including transfer to Yandex (OOO Yandex, OGRN 1027700229193, 16 Lev Tolstoy St., Moscow, 119021, Russia) for analysis and reporting. Information may be stored on Yandex servers in Russia. Users can opt out in browser settings or via https://yandex.ru/support/metrika/general/opt-out.html.

8.3. Users may update their personal data by emailing info@armathotel.ru with the subject “Update of personal data.”

8.4. The processing period is determined by the purpose; Users may withdraw consent by emailing info@armathotel.ru with the subject “Withdrawal of consent to personal data processing.”

8.5. Data collected by third-party services (e.g., payment systems, communication providers)is stored and processed under their own agreements. The Operator is not responsible for third parties.

8.6. Restrictions on transfer or processing do not apply in cases of state or public interest defined by law.

8.7. The Operator ensures confidentiality of personal data.

8.8. Storage is limited to the necessary period; data is destroyed or depersonalized when no longer needed.

8.9. Grounds for termination include achievement of purposes, expiration of consent,

withdrawal, or unlawful processing.

9. List of Actions Performed with Personal Data

9.1. Collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

9.2. Automated processing, including transmission via telecommunication networks or

without such.

10. Cross-Border Transfer of Personal Data

10.1. Before starting a cross-border transfer, the Operator must notify the authorized

supervisory body.

10.2. The Operator must obtain necessary assurances from foreign recipients before such transfer.

11. Confidentiality of Personal Data

The Operator and any persons with access to personal data must not disclose or distribute it without the consent of the subject, unless otherwise required by federal law.

12. Final Provisions

12.1. Users may request any clarifications regarding the processing of their personal data by emailing info@armathotel.ru.

12.2. Any changes to this Policy will be reflected in this document. The Policy is valid

indefinitely until replaced by a new version.

12.3. The current version of the Policy is publicly available at https://armathotel.ru.