Privacy policy
1. General Provisions
1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) has been developed in accordance with Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and defines the policy of JSC Eastwind (hereinafter referred to as the “Company”) regarding the processing of personal data, and also contains information about the requirements for the protection of personal data implemented by the Company.
1.2. The Policy applies to all personal data that the Company may receive from visitors to the website www.eastwind.ai (hereinafter referred to as the “Website”) and users of the Company’s products and services.
1.3. Before submitting personal data to the Company through forms on the Website, users are required to familiarize themselves with the provisions of this Policy and express their consent to the processing of personal data by checking the checkbox “I consent to the collection and processing of personal data in accordance with Eastwind’s policy.”
1.4. Use of the Website signifies the user’s unconditional consent to this Policy and the terms of personal data processing specified herein. If the user disagrees with these terms, they should refrain from using the Website.
1.5. The Company reserves the right to make changes to the Policy unilaterally. The new version of the Policy takes effect from the moment it is posted on the Website, unless otherwise provided by the new version. Users are required to independently monitor changes to the Policy.
2. Categories of Personal Data Subjects
2.1. The Company processes personal data of the following categories of subjects:
2.1.1. Individuals interested in obtaining information about the Company’s products and services who have submitted a request through feedback forms on the Website (hereinafter referred to as “Potential Clients”);
2.1.2. Representatives/employees of actual or potential counterparties (partners, clients) of the Company who have communicated their personal data through forms on the Website or via the email address indicated on the Website (hereinafter referred to as “Counterparty Representatives”);
2.1.3. Subscribers to the Company’s news and mailings who have subscribed through a form on the Website (hereinafter referred to as “Subscribers”);
2.1.4. Website visitors whose depersonalized data is collected through the use of cookies and analytics systems (hereinafter referred to as “Website Visitors”).
2.2. A person whose personal data is processed by the Company is, for the purposes of this Policy, a personal data subject.
3. Legal Basis for Processing Personal Data
3.1. The Company processes personal data based on:
3.1.1. Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”;
3.1.2. The Civil Code of the Russian Federation (Parts One and Two) – with regard to the conclusion and execution of contracts with counterparties;
3.1.3. Federal Law No. 38-FZ dated March 13, 2006 “On Advertising” – with regard to the implementation of advertising mailings;
3.1.4. Consent of personal data subjects to the processing of their personal data, expressed by checking the checkbox when filling out forms on the Website or performing conclusive actions (continuing to use the Website after reviewing the cookie notice);
3.1.5. Decree of the Government of the Russian Federation No. 1119 dated November 1, 2012 “On approval of requirements for the protection of personal data during their processing in personal data information systems”;
3.1.6. Decree of the Government of the Russian Federation No. 687 dated September 15, 2008 “On approval of the Regulation on the specifics of processing personal data carried out without the use of automation means.”
3.2. The processing of personal data by the Company is carried out with the consent of subjects to the processing of their personal data, and in cases provided by the legislation of the Russian Federation, also on other legal grounds.
4. Purposes, Methods and Conditions for Processing Personal Data
4.1. The Company processes only such personal data, the volume and content of which correspond to the stated purposes of processing and are not excessive in relation to these purposes.
4.2. The processing of personal data is carried out by the Company for the following purposes and under the following conditions:
Processing of Requests for Products and Services
Purpose of processing: Processing requests for the Company’s products and services; establishing contact with potential clients; providing information about products and services; consulting; forming commercial offers; concluding contracts.
Categories of subjects: Potential Clients; Counterparty Representatives.
Processed data:
- Surname, first name
- Phone number
- Email address
- Content of the inquiry
Legal basis: Consent of the subject (Article 9 of Federal Law No. 152-FZ); necessity for the conclusion of a contract (Article 6 of Federal Law No. 152-FZ).
Processing methods: Collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, depersonalization, blocking, deletion, destruction.
Automation: Mixed method – using automation tools (CRM systems, databases) and without using such tools (paper documents).
Storage period: 3 years from the date of last interaction or until consent is withdrawn. Upon conclusion of a contract – the term of the contract + 5 years after termination.
Information Mailings and News
Purpose of processing: Sending informational and advertising mailings about the Company’s products, services, news and events.
Categories of subjects: Subscribers; Potential Clients (with consent).
Processed data:
- Surname, first name
- Email address
Legal basis: Consent of the subject (Article 9 of Federal Law No. 152-FZ); Legitimate interest of the Company in informing its clients and partners about products and services (Article 6, Part 1, Clause 7 of Federal Law No. 152-FZ).
Processing methods: Collection, recording, systematization, accumulation, storage, use, transfer, deletion.
Automation: Automated (email mailing platforms).
Storage period: Until consent is withdrawn or unsubscription.
Analytics and Website Improvement
Purpose of processing: Website analytics; studying user behavior on the Website; improving the structure, navigation and content of the Website; providing a personalized user experience.
Categories of subjects: Website Visitors.
Processed data:
- IP address (anonymized)
- Cookies data
- Information about the browser and device
- Pages visited and time spent on the Website
- Referral source
Legal basis: Consent of the subject obtained by continuing to use the Website after displaying a cookie banner (Article 9 of Federal Law No. 152-FZ).
Processing methods: Collection, recording, accumulation, storage, extraction, use, depersonalization, deletion.
Automation: Automated (Yandex.Metrica, Google Analytics).
Storage period: Analytics data: 25 months (Yandex.Metrica), 14 months (Google Analytics).
4.3. The Company notifies subjects that providing incomplete or inaccurate personal data may affect the quality of services provided and the possibility of communication.
5. Principles of Personal Data Processing
5.1. The processing of personal data is carried out by the Company based on the following principles:
5.1.1. Legality of the purposes and methods of processing personal data;
5.1.2. Compliance of the purposes of personal data processing with the purposes predefined and stated during the collection of personal data;
5.1.3. Compliance of the volume and nature of processed personal data, processing methods with the processing purposes (data minimization principle);
5.1.4. Inadmissibility of combining databases containing personal data, the processing of which is carried out for incompatible purposes;
5.1.5. Ensuring the accuracy of personal data, their sufficiency and relevance in relation to the purposes of processing;
5.1.6. Storage of personal data in a form that allows identifying the subject no longer than required by the purposes of processing;
5.1.7. Destruction or depersonalization of personal data upon achieving processing goals or in case of loss of necessity to achieve these goals.
6. Transfer of Personal Data to Third Parties
6.1. The Company maintains the confidentiality of subjects’ personal data and does not disclose personal data to third parties without their consent, except in cases provided for in this section.
6.2. The Company may transfer personal data to third parties in the following cases:
6.2.1. The subject has expressed consent to such actions;
6.2.2. The transfer is necessary for the conclusion, performance or termination of a contract with the subject;
6.2.3. The transfer is provided by the legislation of the Russian Federation within the established procedure;
6.2.4. The transfer is necessary to protect the life, health or other vital interests of the subject.
6.3. The Company may transfer personal data to the following categories of third parties:
6.3.1. Affiliated persons of the Company – for the purposes specified in Section 5;
6.3.2. Counterparties (partners, contractors) providing hosting services, technical support, CRM systems, email mailings, web analytics;
6.3.3. State authorities – in cases and in the manner established by the legislation of the Russian Federation.
6.4. The Company does not sell, exchange or otherwise transfer for consideration subjects’ personal data to third parties.
7. Cross-Border Transfer of Personal Data
7.1. The Company carries out cross-border transfer of personal data when using the Google Analytics web analytics system (Google LLC, USA) on the Website. Personal data (IP address, cookie data) may be transferred to Google servers.
7.2. Cross-border transfer is carried out only with the consent of the subject and subject to ensuring adequate protection of subjects’ rights.
7.3. The following protective measures are applied:
7.3.1. Data is transferred in depersonalized or pseudonymized form;
7.3.2. IP addresses are anonymized (masking of the last octet);
7.3.3. Google LLC applies EU standard contractual clauses to ensure data protection.
7.4. The subject may opt out of Google Analytics by disabling cookies in the browser.
7.5. The primary storage of personal data is carried out on servers located on the territory of the Russian Federation, in accordance with Federal Law No. 242-FZ dated July 21, 2014.
8. Cookies and Web Beacons
8.1. When visiting the Website, cookie files – small text files containing information about user actions – may be placed on the user’s device.
8.2. The Company uses the following types of cookies:
8.2.1. Mandatory (technical) cookies – necessary for the Website to function;
8.2.2. Functional cookies – remember user preferences (interface language);
8.2.3. Analytical cookies – collect information about how users use the Website (Yandex.Metrica, Google Analytics).
8.3. When first visiting the Website, the user sees a cookie banner with the option to accept the use of cookies.
8.4. By continuing to use the Website after the banner is displayed, the user expresses consent to the use of cookies.
8.5. The user can manage cookies in browser settings. Disabling mandatory cookies may disrupt the Website’s operation.
9. Measures to Ensure Personal Data Security
9.1. The Company takes legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution.
9.1.1. A person responsible for organizing the processing of personal data has been appointed;
9.1.2. Documents have been issued defining the Company’s policy regarding the processing of personal data, local acts on personal data processing issues, and establishing procedures aimed at preventing and detecting violations of Russian Federation legislation and eliminating the consequences of such violations;
9.1.3. Legal, organizational and technical measures to ensure personal data security have been implemented in accordance with Article 19 of the Federal Law “On Personal Data”;
9.1.4. Internal control of compliance of personal data processing with the requirements of laws and regulatory legal acts, requirements for the protection of personal data, the Company’s policy regarding personal data processing, and the Company’s local acts is carried out;
9.1.5. Employees of the Company directly engaged in personal data processing have been familiarized with the provisions of Russian Federation legislation on personal data, including requirements for the protection of personal data, documents defining the Operator’s policy regarding personal data processing, and the Operator’s local acts on personal data processing issues.
10. Rights of Personal Data Subjects
10.1. A personal data subject has the right to:
10.1.1. Contact the Operator with notifications about the need to clarify and supplement personal data at the email address info@eastwind.ai.
11. Company’s Obligations
11.1. The Company undertakes to:
11.1.1. Process personal data exclusively for the purposes specified in the Policy;
11.1.2. Ensure the confidentiality of personal data;
11.1.3. Not disclose personal data to third parties without the subject’s consent, unless otherwise provided by law;
11.1.4. Take measures to protect personal data from unauthorized access;
11.1.5. Comply with other obligations provided by the legislation of the Russian Federation.
12. Final Provisions
12.1. The law of the Russian Federation applies to relations related to the processing of personal data.
12.2. This Policy takes effect from the moment it is posted on the Website and remains in effect until it is cancelled or replaced by a new version.
