Individual Entrepreneur Viktoria Igorevna Spirina
INN: 781439681661
OGRNIP: 323784700141414

1. General Provisions

1.1. Individual Entrepreneur Viktoria Igorevna Spirina (hereinafter — the Operator) carries out the processing of personal data using an information system, including the website palmarytravel.com, the users' personal account, the Telegram bot, and related information systems (hereinafter — the Website).

1.2. This Policy has been developed pursuant to Clause 2 of Part 1 of Article 18.1 of Federal Law No. 152-FZ "On Personal Data" dated 27 July 2006 (hereinafter — the Personal Data Law), in order to protect the rights and freedoms of individuals in the processing of their personal data.

1.3. By using the Website and providing personal data, the data subject confirms that they have read this Policy.

1.4. Key terms used in this Policy:

  • Personal Data — any information relating directly or indirectly to an identified or identifiable individual (a Data Subject).
  • Operator — a person who organizes and/or carries out the processing of personal data and determines the purposes of processing, the scope of data, and the actions performed with it.
  • Data Subject — an individual who is directly or indirectly identified or identifiable by means of personal data.
  • Processing of Personal Data — any action (operation) or set of actions performed with personal data, including collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, de-identification, blocking, deletion and destruction.
  • Automated Processing — the processing of personal data by means of computing technology.
  • Dissemination of Personal Data — actions aimed at disclosing personal data to an indefinite group of persons.
  • Blocking of Personal Data — the temporary suspension of processing, except where processing is necessary to update the data.
  • Destruction of Personal Data — actions as a result of which it becomes impossible to restore the content of personal data.
  • Cookies — small text files sent from the Website to the Data Subject's device that allow session and settings information to be stored.

1.5. Categories of data subjects:

  • users of the Website who have registered an account;
  • customers ordering travel and other services;
  • participants of the affiliate (referral) programme.

1.6. By registering on the Website and providing personal data, the Data Subject confirms that they are of legal age and have full legal capacity. The Website is not intended for persons under the age of 18.

2. Rights and Obligations of the Operator

2.1. The Operator has the right to:

  • independently determine the composition and list of measures necessary to fulfil the obligations set out in the Personal Data Law;
  • entrust the processing of personal data to another person under a contract, subject to the requirements of Part 3 of Article 6 of the Personal Data Law;
  • transfer personal data to authorised bodies on the grounds provided for by the legislation of the Russian Federation.

2.2. The Operator is obliged to:

  • organise the processing of personal data in accordance with the requirements of the law;
  • not disclose to third parties or disseminate personal data without the Data Subject's consent, unless otherwise provided by federal law;
  • ensure compliance with this Policy by persons involved in the processing of personal data;
  • respond to requests and inquiries from Data Subjects in the manner set out in Section 10 of this Policy;
  • in cases established by law, provide the authorised body for the protection of the rights of personal data subjects with the requested information within 30 days of receiving the request.

3. Rights of the Data Subject

The Data Subject has the right to:

  • receive information regarding the processing of their personal data: confirmation of the fact of processing, the legal grounds and purposes of processing, the methods applied, and the periods of processing and storage;
  • request the correction, blocking or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
  • withdraw consent to the processing of personal data;
  • appeal the actions or omissions of the Operator to the authorised body for the protection of the rights of personal data subjects, or in court;
  • take other measures provided for by law to protect their rights.

Requests may be sent to the following e-mail address: victoria.spirina@mail.ru.

4. Purposes of Personal Data Processing

4.1. Processing is limited to the achievement of specific, predetermined and lawful purposes. Only data that corresponds to the purposes of processing and is not excessive is subject to processing.

4.2. The Operator processes personal data for the following purposes:

  • registration and maintenance of the Data Subject's account on the Website;
  • conclusion and performance of the offer agreement, including in connection with travel services;
  • providing access to the materials, services and features of the personal account;
  • accepting and processing payments, issuing cash register receipts;
  • organising and administering the affiliate programme, including record-keeping of the affiliate structure and accrual and payment of rewards;
  • verifying the tax status of an affiliate programme participant, as necessary for processing payouts;
  • sending service notifications necessary for the provision of services;
  • reviewing requests and complaints;
  • ensuring the security of the Website and preventing fraud and unauthorised access;
  • storing supporting documents for the periods established by law;
  • sending browser push notifications — subject to the Data Subject's consent to receive them;
  • fulfilling the requirements of the legislation of the Russian Federation.

5. Legal Grounds for Processing

5.1. The legal grounds for the processing of personal data are:

  • the Constitution of the Russian Federation;
  • the Civil Code of the Russian Federation;
  • the Tax Code of the Russian Federation;
  • Federal Law No. 152-FZ "On Personal Data" dated 27 July 2006;
  • Federal Law No. 149-FZ "On Information, Information Technologies and the Protection of Information" dated 27 July 2006;
  • Federal Law No. 54-FZ "On the Use of Cash Register Equipment" dated 22 May 2003;
  • Law of the Russian Federation No. 2300-1 "On the Protection of Consumer Rights" dated 7 February 1992;
  • Federal Law No. 38-FZ "On Advertising" dated 13 March 2006;
  • other regulatory legal acts governing the Operator's activities.

5.2. The legal grounds for processing also include:

  • the consent of the Data Subject, given upon registration on the Website;
  • the necessity of performing a contract to which the Data Subject is a party (Clause 5, Part 1, Article 6 of the Personal Data Law).

6. Scope and Categories of Personal Data Processed

6.1. The content and scope of the data processed correspond to the stated purposes of processing and are not excessive. The Operator does not collect personal data that is not necessary for the stated purposes, does not process special categories or biometric personal data, and does not request copies of identity documents.

6.2. When the biometric login method (Passkey/WebAuthn) is used, biometric data (fingerprint, facial image) is processed exclusively locally on the Data Subject's device and is not transmitted to, or stored by, the Operator.

Of all Website users:

  • first and last name;
  • e-mail address;
  • phone number;
  • country and city (if provided by the Data Subject);
  • date of birth (if provided by the Data Subject);
  • Telegram user ID (when using the Telegram bot);
  • profile picture (avatar), if uploaded by the Data Subject;
  • username, chosen by the Data Subject upon registration;
  • hashed account password;
  • IP address, cookies, information on visits to the Website;
  • browser push subscription data (subscription identifier, encryption keys) — if the Data Subject enables push notifications.

Additionally, of customers of paid services:

  • payment information: date, amount, status, payment identifier.

Additionally, of affiliate programme participants:

  • INN (Taxpayer Identification Number) — to verify the status of a self-employed taxpayer or an individual entrepreneur and to process payouts;
  • phone number for transfers via the Faster Payments System (SBP);
  • receipt details from the "Moy Nalog" application, or an act — to confirm payment;
  • information on the affiliate structure and accrued and paid rewards.

7. Procedure and Conditions of Processing

7.1. Personal data is processed with the Data Subject's consent, as well as without such consent in cases provided for by the legislation of the Russian Federation.

7.2. Consent to the processing of personal data is given by the Data Subject upon registration on the Website by means of a separate checkbox. Consent is free, specific, informed and conscious.

7.3. The Operator carries out automated and mixed processing of personal data.

7.4. Disclosure to third parties and dissemination of personal data without the Data Subject's consent is not permitted, unless otherwise provided by federal law.

7.5. The Operator takes the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking and dissemination, including by:

  • using a secure connection (HTTPS) for data transmission;
  • restricting access rights to the information system;
  • storing account passwords in hashed form;
  • performing regular backups;
  • storing personal data under conditions that prevent unlawful access.

Pursuant to Part 5 of Article 18 of the Personal Data Law, the Operator ensures the recording, systematisation, accumulation, storage, updating and retrieval of the personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.

7.6. Personal data is stored in a form that allows the Data Subject to be identified for no longer than is required by the purposes of processing, unless a longer period is established by federal law or a contract. Once the purposes of processing have been achieved, the data is subject to deletion or destruction.

8. Cookies

8.1. The Operator uses cookies and server logs when the Website is visited. The data collected may include the IP address, browser type and language, referral addresses, the date and time of activity, and information on the pages viewed.

8.2. Cookies are used to support account functionality, save the Data Subject's settings, and analyse the use of the Website.

8.3. The Data Subject has the right to refuse the use of cookies by disabling them in their browser settings. Disabling cookies may limit the functionality of certain features of the Website.

9. Transfer of Personal Data to Third Parties

9.1. The Operator transfers personal data to third parties only to the extent necessary to achieve the purposes specified in Section 4, and notifies recipients of their obligation to maintain confidentiality.

9.2. Payment processor. For the purpose of processing payments and generating cash register receipts, data is transferred to the payment service Robokassa — to the extent necessary to process the payment and send the receipt to the Data Subject.

9.3. Fiscal data operator. Information included in the cash register receipt is transferred to the fiscal data operator and to the Federal Tax Service in accordance with Federal Law No. 54-FZ dated 22 May 2003.

9.4. Disclosure of data within the affiliate programme. Where a participant has given separate consent, their name, profile picture and city are displayed to the participant who invited them and to participants above them in the structure — to the extent necessary for the operation of the affiliate programme. In the absence of such consent, the participant is displayed anonymously — by username only, without a name, profile picture or city. The absence of consent does not affect the accrual and payment of rewards. Consent is given by means of a separate checkbox and may be withdrawn at any time in the personal account.

9.5. Authorised bodies. Personal data is transferred to inquiry and investigation authorities, the Federal Tax Service and other authorised bodies in accordance with the requirements of the legislation of the Russian Federation.

9.6. Cross-border transfer. Participants located outside the Russian Federation have access to a Telegram bot. When it is used, data necessary for the bot's operation (Telegram user ID and username) is processed by Telegram Messenger LLP on the territory of a foreign state. The use of the Telegram bot is voluntary: all services of the Website, including access to materials and affiliate programme features, are provided through the personal account on the Website without the use of messengers. The initial collection, recording, systematisation, accumulation, storage, updating and retrieval of the personal data of citizens of the Russian Federation is carried out using databases located on the territory of the Russian Federation.

9.7. Technical support of the Website. To ensure the functioning, technical support and administration of the Website, the Operator may engage persons (including under a civil-law contract) who have technical access to the information system and the personal data processed therein, to the extent necessary to perform the relevant work. Such persons are obliged to maintain the confidentiality of personal data and to comply with the requirements of this Policy.

10. Procedure for Data Subject Requests

10.1. A request must be sent to victoria.spirina@mail.ru and must contain:

  • the first and last name of the Data Subject;
  • information confirming the Data Subject's interaction with the Operator: the e-mail address of the account or the account identifier;
  • the substance of the request.

10.2. The Operator reviews requests within 15 (fifteen) calendar days of receipt.

10.3. If inaccurate personal data is identified, the Operator blocks the data relating to that Data Subject for the duration of the review and corrects it within 7 (seven) business days of the supporting information being provided, after which the block is lifted.

10.4. Upon achievement of the purposes of processing, or upon withdrawal of consent by the Data Subject, personal data is subject to destruction, unless its further processing is provided for by a contract to which the Data Subject is a party, or is required under the legislation of the Russian Federation. Withdrawal of consent does not entail the deletion of information that is required by law to be retained, including documents confirming payments and payouts.

11. Advertising and Informational Mailings

11.1. The Operator has the right to send the Data Subject advertising messages by e-mail and messengers only with prior consent, in accordance with Part 1 of Article 18 of Federal Law No. 38-FZ "On Advertising" dated 13 March 2006.

11.2. Consent to receive advertising messages is given by means of a separate checkbox on the Website and is not a condition for the provision of services. The Data Subject has the right to opt out of receiving advertising messages by sending a request to victoria.spirina@mail.ru or by using the unsubscribe link in the message itself.

11.3. Service notifications related to the provision of services (payment status, access recovery, changes to the operation of the Website) are sent without separate consent and do not constitute advertising.

12. Final Provisions

12.1. Pursuant to Part 2 of Article 18.1 of the Personal Data Law, this Policy is published in open access on the Website.

12.2. The Operator has the right to amend this Policy. A new version takes effect from the moment it is posted on the Website. The current version of the Policy is always available at https://palmarytravel.com.

12.3. Individual Entrepreneur Viktoria Igorevna Spirina is responsible for organising the processing of personal data.

13. Operator's Details

  • Operator — Individual Entrepreneur Viktoria Igorevna Spirina
  • INN — 781439681661
  • OGRNIP — 323784700141414
  • Address — Saint Petersburg, Russia
  • E-mail — victoria.spirina@mail.ru
  • Phone — +7 981 820-09-22
  • Website — https://palmarytravel.com

14. Additional Provisions for Users in the European Union (EU) and the EEA

14.1. This section applies additionally to users of the Website located in the European Union (EU) or the European Economic Area (EEA), where the processing of their personal data is subject to the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR).

14.2. The legal bases for processing the personal data of such users under Article 6 of the GDPR are:

  • the consent of the data subject;
  • the necessity of processing for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
  • the legitimate interests of the Operator (in particular, ensuring the security of the Website and preventing fraud), provided such interests do not override the interests or fundamental rights of the data subject.

14.3. A Data Subject located in the EU/EEA, in addition to the rights set out in Section 3 of this Policy, has the right to:

  • receive a copy of their personal data in a structured, commonly used, machine-readable format (the right to data portability);
  • object to the processing of their personal data carried out on the basis of the Operator's legitimate interests;
  • withdraw consent to the processing of personal data at any time, without affecting the lawfulness of processing carried out prior to withdrawal;
  • lodge a complaint with the personal data supervisory authority of their country of habitual residence.

14.4. The personal data of users from the EU/EEA is stored and processed on the territory of the Russian Federation. The cross-border transfer of such data to the Russian Federation is carried out on the basis of the data subject's explicit consent to such transfer (point (a) of Article 49(1) GDPR), given upon registration on the Website.

14.5. For questions relating to the processing of personal data under the GDPR, the data subject may contact the Operator at the following e-mail address: victoria.spirina@mail.ru.

15. Users in Other Countries

15.1. If a Data Subject is located outside the Russian Federation and the European Union/EEA (in particular, in Canada, the United States, countries in Africa, or other states), the Operator applies the general principles set out in this Policy to the processing of their personal data: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and security.

15.2. If the applicable law of the Data Subject's country of habitual residence grants additional rights not otherwise provided for in this Policy, the Data Subject may contact the Operator at victoria.spirina@mail.ru. The Operator will consider such requests in good faith, within a reasonable time, taking into account the requirements of the legislation of the Russian Federation and the technical capabilities of the Website.

15.3. The Operator does not sell personal data to third parties for consideration.