Personal Data
Processing Policy

General Provisions

This Personal Data Processing Policy has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006, "On Personal Data," and other applicable laws and regulations of the Russian Federation.

This Policy establishes the procedures for processing personal data and the measures taken to ensure its security by Individual Entrepreneur Aleksey Mikhailovich Karvasovsky (hereinafter referred to as the "Controller").

This Policy applies to personal data collected by the Controller from website visitors and customers when they use the Hoco Store website, place orders, submit inquiries, or otherwise interact with the Controller.

Using the website does not, in itself, constitute consent to all forms of personal data processing. Where consent is required by law, it is requested in the legally prescribed form.

What Personal Data May Be Processed

Depending on how a user interacts with the website, the Controller may process personal data necessary to fulfill the relevant purpose.

• last name, first name, and patronymic, where applicable;
• phone number;
• email address;
• delivery address and information required to deliver an order;
• order details and information about purchased products;
• information contained in user inquiries and requests;
• technical information automatically transmitted when using the website, to the extent necessary for the operation of the website and the internet technologies it uses.

The Controller also does not intentionally process the biometric personal data of website users.

Purposes of Personal Data Processing

Personal data is processed only for specific, predetermined, and lawful purposes.

Legal Grounds for Processing

The Controller processes personal data only when a legal basis established by applicable legislation exists.

Depending on the specific purpose, these legal grounds may include:

• the laws of the Russian Federation;
• the necessity of entering into or performing a contract to which the user is a party, beneficiary, or guarantor;
• the necessity of fulfilling legal obligations imposed on the Controller;
• the consent of the personal data subject, where such consent is required by law;
• other grounds provided for by the laws of the Russian Federation.

Data Processing Procedures and Methods

Personal data may be processed using automated systems or without automation, to the extent necessary to achieve the relevant purposes.

The Controller may perform the following operations on personal data:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• correction and updating;
• retrieval;
• use;
• transfer in cases permitted by law;
• anonymization;
• blocking;
• deletion;
• destruction.

The nature and volume of personal data processed must correspond to the stated purposes of processing. Processing excessive personal data in relation to those purposes is not permitted.

Personal data is processed for no longer than necessary to achieve the purposes of processing, fulfill contractual obligations, or comply with statutory retention periods, unless otherwise required by law.

Once the purposes of processing have been achieved or the relevant legal basis has ceased to apply, personal data processing must be discontinued and the data deleted or destroyed in accordance with the procedures and deadlines established by law, unless another legal basis permits continued processing.

Sharing Personal Data

The Controller does not disclose personal data to third parties without an appropriate legal basis.

To fulfill an order, certain personal data may be shared with parties involved in its fulfillment, but only to the extent necessary for that purpose.

Depending on the user's chosen ordering, payment, and delivery methods, such parties may include:

• courier and transportation companies;
• delivery service providers;
• payment service providers and banks;
• service providers responsible for operating the Controller's information systems and services, where an appropriate legal basis exists;
• government authorities, where disclosure is expressly required by law.

Cookies and Technical Data

When visiting the website, cookies and similar technologies may be used to ensure proper website operation, save user preferences, maintain security, and support other website functions.

Depending on the website's configuration, technical information may include browser details, device type, session parameters, visit times, actions performed on website pages, and other technical data.

If the website uses optional analytics or other technologies that require user consent, such technologies are used only where the necessary legal basis exists.

Users may restrict or delete cookies through their browser settings. However, disabling technically necessary cookies may affect the proper functioning of certain website features.

Rights of Personal Data Subjects

Users may exercise the rights granted to them under the laws of the Russian Federation concerning personal data protection.

In particular, where provided by law, users have the right to:

• obtain information about the processing of their personal data;
• request correction of personal data that is incomplete, outdated, or inaccurate;
• request the blocking or destruction of personal data where legal grounds exist;
• withdraw consent to personal data processing where processing is based on such consent;
• object to processing in cases provided for by law;
• challenge the Controller's actions or inaction before the competent supervisory authority or through the courts.

Personal Data Protection

The Controller implements the necessary legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, distribution, and other unlawful actions.

The scope of these measures is determined with consideration of applicable legal requirements, the nature of the personal data processed, and the risks associated with its processing.

Access to personal data is granted only to the extent necessary to perform the relevant duties and tasks.

Processing Data of Russian Citizens

When collecting personal data of citizens of the Russian Federation, including via the internet, the Controller complies with the legal requirements concerning the recording, systematization, accumulation, storage, updating, and retrieval of personal data using the relevant databases.

Any cross-border transfer of personal data, where such transfer takes place, is carried out only in compliance with the requirements of Russian legislation.

Requests and Withdrawal of Consent

To exercise their rights concerning personal data, users may submit a request to the Controller.

To properly review a request, the Controller may ask for information necessary to identify the applicant and verify their authority, to the extent permitted by law.

Changes to This Policy

The Controller may update this Policy in response to changes in legislation, personal data processing procedures, services used, or other relevant circumstances.

The current version of this Policy is published on the website and takes effect upon publication unless otherwise specified in the updated version.