Privacy Policy

1. General provisions

1.1 This Policy on the processing of personal data (hereinafter — the “Policy”) sets out the procedure and conditions for the processing of personal data of Individual Entrepreneur Aliev Konstantin Ramizovich (INN: 672220093407/324670000018857, address: 2 Bolshaya Ochakovskaya St., Moscow, Moscow Oblast, 119361 and in respect of users of the website: techno-buyer.ae).

1.2 Terms are used in the meaning established by the legislation of the Russian Federation on personal data.

1.3 The Operator processes personal data on the principles of lawfulness, fairness, minimisation, and limiting processing to the achievement of specific, predetermined and legitimate purposes.

1.4 The Operator ensures the confidentiality of personal data (Article 7 of the Law on Personal Data) and also takes the measures necessary to fulfil the obligations established by Part 2 of Article 18.1 and Part 1 of Article 19 of that law (organizational and technical protection measures).

1.5 Contact details for enquiries from data subjects: e-mail: info@techno-buyer.ae; postal address: 2 Bolshaya Ochakovskaya St., Moscow, Moscow Oblast, 119361. The Policy has been in force since 2025-01-01 and is published openly on the website.

2. Basic concepts used in the Policy

2.1 Automated processing of personal data — the processing of personal data using computer technology.

2.2 Blocking of personal data — the temporary suspension of the processing of personal data (except where processing is necessary to clarify the personal data).

2.3 Website — the set of graphical and informational materials, together with the computer programs and databases that make them available on the Internet at the network address techno-buyer.ae.

2.4 Personal data information system — the set of personal data contained in databases together with the information technologies and technical means that ensure its processing.

2.5 Depersonalisation of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine that the personal data belongs to a particular User or other data subject.

2.6 Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation on personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data.

2.7 Operator — a state body, municipal body, legal entity or natural person that, alone or jointly with other persons, organizes and/or carries out the processing of personal data, and also determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with personal data.

2.8 Personal data — any information relating directly or indirectly to an identified or identifiable User of the website techno-buyer.ae.

2.9 Personal data permitted by the data subject for dissemination — personal data to which access by an unlimited circle of persons has been granted by the data subject by giving consent to the processing of personal data permitted by the data subject for dissemination in the manner established by the Law on Personal Data (hereinafter — personal data permitted for dissemination).

2.10 User — any visitor to the website techno-buyer.ae.

2.11 Provision of personal data — actions aimed at disclosing personal data to a particular person or a particular circle of persons.

2.12 Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite circle of persons (transfer of personal data), or at familiarising an unlimited circle of persons with personal data, including the publication of personal data in the media, placement in information and telecommunications networks, or the granting of access to personal data by any other means.

2.13 Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign natural person or a foreign legal entity.

2.14 Destruction of personal data — any actions as a result of which personal data is destroyed irrecoverably, with no possibility of further restoration of the content of the personal data in the personal data information system, and/or the material carriers of personal data are destroyed.

3. Basic rights and obligations of the Operator

3.1 The Operator has the right:

• to receive from the data subject reliable information and/or documents containing personal data;
• in the event that the data subject withdraws consent to the processing of personal data, or sends a request to cease processing personal data, to continue processing the personal data without the data subject's consent where the grounds set out in the Law on Personal Data are present;
• to determine independently the composition and list of measures necessary and sufficient to ensure fulfilment of the obligations established by the Law on Personal Data and by the regulatory legal acts adopted under it, unless otherwise provided by the Law on Personal Data or other federal laws.

3.2 The Operator is obliged:

• to provide the data subject, on request, with information concerning the processing of their personal data;
• to organize the processing of personal data in the manner established by the applicable legislation of the Russian Federation;
• to respond to enquiries and requests from data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
• to provide the authorized body for the protection of the rights of data subjects, on that body's request, with the necessary information within 10 days from the date of receipt of the request;
• to publish or otherwise ensure unlimited access to this Policy on the processing of personal data;
• to take legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, and from other unlawful actions;
• to cease the transfer (dissemination, provision, access) of personal data, to cease processing and to destroy personal data in the manner and cases established by the Law on Personal Data;
• to fulfil other obligations established by the Law on Personal Data.

4. Basic rights and obligations of data subjects

4.1 Data subjects have the right:

• to receive information concerning the processing of their personal data, except in the cases provided for by federal laws. Such information is provided to the data subject by the Operator in an accessible form, and must not contain personal data relating to other data subjects, except where there are lawful grounds to disclose such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
• to require the Operator to clarify their personal data, block it or destroy it where the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or is not necessary for the stated purpose of processing, and also to take the measures provided by law to protect their rights;
• to make prior consent a condition of processing personal data for the purpose of promoting goods, works and services on the market;
• to withdraw consent to the processing of personal data, and also to send a request to cease the processing of personal data;
• to challenge, before the authorized body for the protection of the rights of data subjects or in court, unlawful actions or omissions of the Operator when processing their personal data;
• to exercise other rights established by the legislation of the Russian Federation.

4.2 Data subjects are obliged:

• to provide the Operator with reliable data about themselves;
• to inform the Operator of any clarification (updating, modification) of their personal data.

4.3 Persons who have provided the Operator with unreliable information about themselves, or information about another data subject without that person's consent, are liable in accordance with the legislation of the Russian Federation.

5. Purposes of collecting and processing personal data

5.1 E-commerce: order processing, delivery, returns and claims.

5.2 Payment operations and billing.

5.3 Preparation, conclusion and performance of a civil-law contract.

5.4 User support and handling of enquiries.

5.5 Ensuring the operation and security of the website/application.

5.6 Statistical accounting.

5.7 Promotion of goods, works and services on the market.

5.8 Registration and authentication of website/application users.

5.9 Running events, webinars and mailings.

5.10 Loyalty programme, bonuses and referral programmes.

6. Legal grounds for processing personal data

6.1 For the purpose “E-commerce: order processing, delivery, returns and claims”, the legal grounds are: the Civil Code of the Russian Federation; Law 2300-1 “On the Protection of Consumer Rights”; 54-FZ (cash register equipment); the contract of sale / offer.

6.2 For the purpose “Payment operations and billing”, the legal grounds are: 161-FZ “On the National Payment System” (via payment providers); 54-FZ; the contract; consent (where required).

6.3 For the purpose “Preparation, conclusion and performance of a civil-law contract”, the legal grounds are: the Civil Code of the Russian Federation; the contract.

6.4 For the purpose “User support and handling of enquiries”, the legal grounds are: the contract / offer; 126-FZ (recording of calls when providing information); consent (where required).

6.5 For the purpose “Ensuring the operation and security of the website/application”, the legal grounds are: the legitimate interest of the Operator (ensuring functionality and security); 149-FZ; internal regulatory acts; consent (for cookies/analytics where required).

6.6 For the purpose “Statistical accounting”, the legal grounds are: 282-FZ; depersonalisation.

6.7 For the purpose “Promotion of goods, works and services on the market”, the legal grounds are: the data subject's consent to marketing; 38-FZ “On Advertising”; 126-FZ “On Communications”.

6.8 For the purpose “Registration and authentication of website/application users”, the legal grounds are: the contract (offer / user agreement); 126-FZ “On Communications” (notifications); consent (where required).

6.9 For the purpose “Running events, webinars and mailings”, the legal grounds are: the contract (offer to participate); consent to mailings/advertising; 38-FZ “On Advertising”; 126-FZ “On Communications”.

6.10 For the purpose “Loyalty programme, bonuses and referral programmes”, the legal grounds are: the contract (accession to the programme rules); consent (to marketing/profiling — where required).

6.11 The Operator's constitutional documents and internal regulatory acts, together with contracts concluded with data subjects and/or consents given by them (in the cases provided for by law), may also serve as legal grounds.

Note: Federal Law No. 152-FZ “On Personal Data” establishes the general requirements for the processing of personal data and is not in itself a legal ground for processing.

7. Scope and categories of personal data processed; categories of data subjects

7.1 For the purpose “E-commerce: order processing, delivery, returns and claims”, the following categories of data may be processed: full name, delivery address, contact details, order contents, purchase history, details required for refunds, acts/claims.

7.2 For the purpose “Payment operations and billing”, the following categories of data may be processed: full name, contact details, partially masked payment details, payment amounts and statuses, receipts, anti-fraud identifiers.

7.3 For the purpose “Preparation, conclusion and performance of a civil-law contract”, the following categories of data may be processed: full name / entity name, passport / registration data, address, contact details, payment details, transaction and settlement history.

7.4 For the purpose “User support and handling of enquiries”, the following categories of data may be processed: full name, contact details, contents of enquiries/calls/chats, call recordings, ticket metadata, payment/order data where necessary.

7.5 For the purpose “Ensuring the operation and security of the website/application”, the following categories of data may be processed: IP addresses, date/time, URLs, headers and technical identifiers, cookies/SDKs, device data, error and access logs.

7.6 For the purpose “Statistical accounting”, the following categories of data may be processed: depersonalised and aggregated data; where necessary — the minimum necessary personal data, subsequently depersonalised.

7.7 For the purpose “Promotion of goods, works and services on the market”, the following categories of data may be processed: full name, contact details (telephone/e-mail/messengers), order and interaction history, cookies and behavioural data (where consent has been given).

7.8 For the purpose “Registration and authentication of website/application users”, the following categories of data may be processed: full name, login, e-mail, telephone, account identifiers, passwords/hashes, 2FA codes, IP addresses, cookies/session tokens.

7.9 For the purpose “Running events, webinars and mailings”, the following categories of data may be processed: full name, contact details, job title/organization (if provided), registration forms, attendance, preferences, survey results.

7.10 For the purpose “Loyalty programme, bonuses and referral programmes”, the following categories of data may be processed: full name, contact details, participant identifiers, purchase/accrual/redemption history, referral links.

7.11 Depending on the purposes, data subjects may include website visitors and service users, customers, counterparties (natural persons), representatives of counterparties (legal entities), employees, job applicants and other persons.

8. Procedure and conditions for processing personal data

8.1 Personal data is processed on the basis of the User's consent to the processing of their personal data, unless otherwise provided for by the legislation of the Russian Federation.

8.2 Consent is expressed by the User performing actions clearly aimed at providing their personal data: completing form fields on the Site, submitting a request (message), and also confirming agreement with the Policy by ticking the box (“checkbox”) in the corresponding field next to the form (where such a field is provided).

8.3 The User may withdraw consent to the processing of personal data at any time by sending a request to info@techno-buyer.ae. After withdrawal the Operator ceases processing, except where processing is permitted without the data subject's consent by law or on other legal grounds.

8.4 For the purpose “E-commerce: order processing, delivery, returns and claims”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.5 For the purpose “Payment operations and billing”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.6 For the purpose “Preparation, conclusion and performance of a civil-law contract”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.7 For the purpose “User support and handling of enquiries”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.8 For the purpose “Ensuring the operation and security of the website/application”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.9 For the purpose “Statistical accounting”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.10 For the purpose “Promotion of goods, works and services on the market”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.11 For the purpose “Registration and authentication of website/application users”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.12 For the purpose “Running events, webinars and mailings”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.13 For the purpose “Loyalty programme, bonuses and referral programmes”, the following actions (operations) are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

8.14 Processing may be carried out with and/or without the use of automation.

8.15 When storing personal data the Operator uses databases located on the territory of the Russian Federation (Part 5 of Article 18 of the Law on Personal Data).

8.16 Retention periods: logs — 12 months, enquiries — 3 years.

8.17 The website may use cookies to ensure the services work correctly and to improve the user experience.

8.18 Visit analytics may be conducted (including using counters/pixels/SDKs), processing only the minimum necessary data. The use of marketing identifiers requires consent where this is provided for by law.

8.19 The Operator may transfer personal data to authorized bodies on the grounds established by the legislation of the Russian Federation.

9. Measures to ensure the protection of personal data

9.1 The Operator takes the legal, organizational and technical measures necessary to protect Users' personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, and from other unlawful actions.

9.2 Such measures include, in particular: appointing persons responsible for organizing the processing and ensuring the security of personal data; adopting internal acts on the processing and protection of personal data; limiting the circle of employees with access to personal data and establishing the procedure for such access; using antivirus software, firewalls and other technical means of information protection; storing personal data under conditions that ensure its safety and exclude unauthorized access; conducting internal control and audit of compliance with the requirements of the legislation of the Russian Federation on personal data and with this Policy; familiarising employees who directly process personal data with the provisions of the legislation of the Russian Federation and with the Operator's internal acts.

10. Updating, correcting, deleting and destroying personal data; responses to data subject requests

10.1 Where it is confirmed that personal data is inaccurate or that its processing is unlawful, the Operator updates the data and/or ceases processing.

10.2 Personal data is subject to destruction upon achievement of the purposes of processing, upon withdrawal of consent by the data subject (where processing was based on consent), upon expiry of the retention period, or upon discovery of unlawful processing, unless otherwise provided for by law or contract.

10.3 A data subject may send a request for information about the processing of their personal data and/or an application for clarification, blocking or deletion. A request may be sent to the e-mail address info@techno-buyer.ae or to the postal address: 2 Bolshaya Ochakovskaya St., Moscow, Moscow Oblast, 119361.

10.4 The Operator's response to a data subject's request is due within no more than 30 calendar days from the date the request is received.

10.5 Conditions for ceasing processing: achievement of the purposes of processing; withdrawal of consent; discovery of unlawful processing; other grounds established by law.

11. Updating the Policy

11.1 This Policy is subject to review and update in the event of changes to the legislation of the Russian Federation or to applicable regulatory acts, and also at the discretion of the Operator.

11.2 The current version of the Policy is always available on the Operator's website techno-buyer.ae.

11.3 A new version takes effect from the moment it is published on the website, unless the new version states otherwise.