Personal Data Processing Policy

This is an English translation provided for convenience. In the event of any discrepancy between this text and the Russian original, the Russian version shall prevail.

This Policy describes what personal data the Nalichniki.com project collects, for what purposes, on what legal basis, and how it is protected.

The Policy applies to all of the project's services: the photo archive at foto.nalichniki.com, the online shop at store.nalichniki.com, the main site at nalichniki.com, and the blog at blog.nalichniki.com.

By using any of the project's services, the user confirms that they have read this Policy.

1. Personal Data Controller

Sole Proprietor Ivan Kharisovich Khafizov
Email: [enable JavaScript]
Project website: nalichniki.com

2. What Data We Collect

When registering and using the photo archive:

• email address;
• name, pseudonym, or display name;
• city, profile description, and other information voluntarily provided by the user;
• information about uploaded photographs and the date and time of actions on the site;
• your consent status for receiving separate emails from the project, if you checked that box;
• technical data: IP address, browser type, cookies, session data.

When placing an order in the shop:

• recipient's first and last name;
• email address;
• phone number;
• delivery address (city, street, building, apartment, postal code) or pickup point address;
• order and status history.

The photo archive and shop accounts are unified: a user registered in the photo archive can use the same account in the shop.

3. Purposes and Legal Basis for Processing

• Account management and authorization — performance of the User Agreement, the user's consent upon registration.
• Order fulfillment — name, phone number, and delivery address are necessary to hand the order over to the delivery service and to contact the customer; basis: performance of a contract (Art. 6(1)(5) of Federal Law No. 152-FZ).
• Order and delivery status notifications — informing the customer by email; basis: performance of a contract.
• Operation of the photo archive — displaying authorship, place of shooting, and other information related to photographs; basis: the user's consent upon uploading photographs.
• Separate emails from the project — technical notices, order-status messages beyond the delivery services' automatic notifications, and occasional greetings on important occasions; basis: the user's consent (a separate checkbox at registration or checkout).
• Site protection — detecting abuse, ensuring security; basis: the controller's legitimate interest.

4. Disclosure to Third Parties

Customers' personal data may be disclosed to the following organizations to the extent necessary to fulfill an order:

• CDEK — for arranging and tracking delivery (recipient's name, phone number, address).
• InSales — the e-commerce platform through which orders are processed.
• YooKassa — the payment service used to process payment.

We do not sell personal data and do not disclose it to third parties for other purposes without the user's consent, except as required by law.

5. Data Retention Periods

• Account data — until the account is deleted at the user's request or until the controller decides to close the service.
• Order data — no less than 5 years from the date the order was fulfilled (tax and accounting record-keeping requirements).
• Technical logs (IP addresses, cookies) — up to 1 year.

6. Cookies and Technical Data

The project's sites use cookies to maintain an authenticated user's session. No additional analytics or marketing cookies are used.

Cookies can be disabled in browser settings. This will prevent you from being able to log into your account.

7. User Rights

Under the laws of the Russian Federation, the user has the right to:

• request confirmation of the fact of processing and the composition of the data processed;
• request correction of inaccurate or incomplete data;
• withdraw previously given consent to data processing;
• request deletion of data — in cases where processing is no longer justified;
• file a complaint with Roskomnadzor.

To exercise these rights, contact: [enable JavaScript]. Requests are reviewed within 30 days.

Please note: deleting account data does not automatically delete order data, which must be retained by law.

8. Data Protection

Passwords are stored in hashed form (bcrypt). Data is transmitted over HTTPS. Access to the database is restricted and password-protected.

We take reasonable measures to protect data from unauthorized access but cannot guarantee absolute protection in an internet environment.

9. Changes to This Policy

The controller may update this Policy. The current version is always available at nalichniki.com/privacy. The date of the last update is indicated at the top of the document.

10. Contacts

For questions regarding the processing of personal data:
Email: [enable JavaScript]
Sole Proprietor Ivan Kharisovich Khafizov