Privacy Policy

General provisions

1.1. This Privacy Policy (hereinafter — the Policy) for the use of the website https://zaokvant.com/ applies to all information that JSC Kvant (address: 78 Akademika Gubkina St., Yekaterinburg, 620010, Russia; phone: +7 (343) 227-60-06; e-mail: connect@zaokvant.com) (hereinafter — the Operator) (hereinafter — the Organisation) may obtain about a user while the user accesses the website (services) at https://zaokvant.com/

1.2. This Policy sets the terms of access to and use of the Site unless separate rules apply. Use of the services constitutes the user's unconditional acceptance of this Policy and the terms set out herein; if the user disagrees with these terms, the user must refrain from using the services.

1.3. The Policy applies only to the services and does not govern third-party websites that the user may visit through links available on the services.

1.4. This Policy describes how the Organisation processes data when the user uses the services.

1.5. The following key terms are used in this Policy:

  • personal data — any information relating directly or indirectly to an identified or identifiable individual (the data subject);
  • processing of personal data — any action (operation) or set of actions (operations) carried out on personal data, with or without the use of automation tools;
  • personal data operator (Operator) — a public authority, municipal body, legal entity or individual that, alone or jointly with others, organises and/or performs the processing of personal data, and determines the purposes of processing, the categories of personal data to be processed and the actions (operations) performed on personal data;
  • user — a person who submits personal data to the Organisation by completing a dedicated form on the Site;
  • visitor — a person who accesses a page of the Organisation's Site but does not submit personal data to the Organisation;
  • customer — a person with whom the Organisation has entered into a contractual relationship, or a person directly connected with a party to such a relationship;
  • automated processing of personal data — processing of personal data using computer equipment;
  • dissemination of personal data — actions aimed at disclosing personal data to an unrestricted group of persons;
  • blocking of personal data — temporary suspension of the processing of personal data (except where processing is necessary to refine the personal data);
  • destruction of personal data — actions that make it impossible to restore the contents of personal data in the personal data information system and/or that result in the destruction of the physical media on which personal data is stored;
  • personal data information system — a body of personal data contained in databases and the information technology and technical means that ensure their processing.

Scope of processed personal data. Data subjects

For the purposes of the Policy, the user's personal information includes:

2.1. Personal information that the user provides about themselves during the use of the services, or that the Organisation obtains otherwise, including:

  • e-mail address;
  • full name;
  • phone number;
  • region and city of residence.

2.2. For the purposes of the Policy, data subjects include:

  • users and visitors of the Organisation's Site;
  • employees, former employees and candidates for vacancies at the Organisation;
  • customers and other counterparties of the Organisation;
  • representatives/employees of customers and other counterparties.

2.3. Cookie data and other tracking technologies. Data that is automatically transmitted to the Organisation by the services during their use through software installed on the device, including cookie information and information about the user's/visitor's device:

  • internet protocol address of the user's/visitor's computer (e.g., IP address);
  • browser type and version;
  • pages of the services visited, the user's/visitor's visit time and the time spent on those pages;
  • unique device identifiers and other diagnostic data, mobile device type, mobile device IP address, mobile operating system, mobile browser type;
  • other cookie data.

2.3.1. The Organisation uses cookies and similar tracking technologies to track activity and store information. Cookies are small data files that may include an anonymous unique identifier. Cookies are sent to a browser from a website and stored on the user's/visitor's device. Other tracking technologies used include beacons, tags and scripts for collecting and tracking information and improving the services.

The user/visitor may refuse all cookies (by changing browser settings, and by changing service settings where technically possible). If cookies are refused, the user/visitor acknowledges that some parts (features) of the services may be unavailable.

Examples of cookies used by the Organisation:

  • session cookies — to operate the services;
  • preference cookies — to remember the user's/visitor's preferences and various settings;
  • security cookies — to ensure security.

2.4. Other information about the user/visitor whose processing is provided for by the user's/visitor's consent to personal data processing and/or by an agreement with the customer.

Purposes of collecting and processing user personal information

3.1. The Organisation collects and stores only the personal information that is necessary to provide the services or perform agreements and contracts with the user, or that is processed with the user's consent as set out in section 3.2 of the Policy, except where applicable law requires personal information to be stored for a specific period.

3.2. The Organisation processes the user's personal information, including collection, receipt, recording, systematisation, accumulation, storage, refinement (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction, both with and without the use of automation tools, and through mixed processing, for the following purposes:

  • identifying the user;
  • providing information about the Organisation's services and the Organisation itself;
  • providing the user with access to personalised resources of the services;
  • notifying the user of important events and sending non-commercial informational and news updates to the user;
  • establishing feedback with the user, including sending notices and requests, and handling requests and orders from the user;
  • performing a contract with the user;
  • determining the user's location to ensure security and prevent fraud;
  • confirming the accuracy and completeness of the personal data provided by the user;
  • providing the user with effective customer and technical support when issues arise during the use of the services;
  • monitoring the use of the services;
  • sending advertising messages with the user's consent, providing the user with personalised offers, additional capabilities and services, subject to compliance with applicable advertising laws;
  • improving the user experience, the quality of service and operation of the services, their usability, and developing new services;
  • analysing user data, performing statistical and other research on the user's interaction with the Organisation and third parties;
  • other purposes that may be provided for by consent to the processing of personal data, by an agreement between the Organisation and the user, and by applicable law.

Conditions for processing user personal information and transferring it to third parties

4.1. The Organisation processes and stores user personal information in accordance with internal policies and applicable data protection laws.

4.2. The confidentiality and security of all user personal information is maintained, except where the user voluntarily makes information about themselves publicly available to an unrestricted group of persons.

4.3. The Organisation may transfer the user's personal information and/or instruct its processing to third parties in the following cases:

  • the user has consented to such actions;
  • the transfer is necessary for the user to use the services or to perform a contract with the user;
  • to protect the rights and legitimate interests of the Organisation;
  • the transfer is required by applicable law under the procedure established by law.

4.4. Representatives of public authorities (including supervisory, regulatory, law-enforcement, investigative and other authorised bodies on grounds provided for by applicable law) have access to the personal data processed by the Organisation to the extent and in the manner established by applicable law.

4.5. The services may contain links to other websites not operated by the Organisation. If the user follows such a link, the user will be taken to a third-party website. The Organisation strongly recommends that the user reviews the privacy policy of each website they visit. The Organisation does not control and assumes no responsibility for the content, privacy policies or actions of third-party websites or services.

4.6. The user's personal data is processed without a time limit by any lawful means, including in personal data information systems, with or without the use of automation tools. The legal basis for processing personal data is provided by applicable data protection laws and the related regulations governing the Operator's activities; the Operator's constituent documents; other internal policies of the Operator; contracts entered into between the Operator and the data subject; and consent to the processing of personal data.

4.7. In the event of loss or disclosure of personal data, the Organisation will inform the user about the loss or disclosure of their personal data.

4.8. Processing of personal data may be terminated upon achievement of the purposes of processing, withdrawal of the data subject's consent to the processing, or detection of unlawful processing of personal data.

4.9. Personal data is stored in a form that allows identification of the data subject for no longer than required by the purposes of processing, except where a storage period for the personal data is established by applicable law or by a contract to which the data subject is a party, beneficiary or guarantor.

4.9.1. The Operator records and stores data subjects' consents in order to confirm the fact that they were obtained.

4.10. If the inaccuracy of personal data or the unlawfulness of its processing is confirmed, the personal data must be updated by the Organisation and the processing must be stopped.

4.11. Upon achievement of the processing purposes, and upon withdrawal of the data subject's consent to processing, personal data is destroyed within the periods established by applicable law:

  • unless otherwise provided for by a contract to which the data subject is a party, beneficiary or guarantor;
  • if the Organisation is not entitled to process the data without the data subject's consent on the grounds provided for by applicable law;
  • unless otherwise provided for by another agreement between the Organisation and the data subject.

4.12. Conditions for processing personal information under the GDPR.

4.12.1. In its activities the Organisation is governed by applicable law and also takes into account the conditions and principles of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter — the GDPR).

4.12.2. Considering the criteria and scope of the GDPR, the Organisation states the following:

  • the Organisation is not established in the territory of the European Union and has no representative there;
  • the Organisation does not, in the course of its activities, target the offering of products and services — regardless of whether payment is required from the data subject — to data subjects in the territory of the European Union;
  • the Organisation does not monitor the behaviour of data subjects located in the EU in the sense that would make the GDPR applicable to organisations operating outside the EU. Accordingly, the GDPR does not apply to the activities of the Organisation.

4.12.3. At the same time, the Organisation takes all necessary and sufficient legal, organisational and technical measures to ensure the confidentiality and security of personal data during processing, in accordance with the general principles and rules of personal data processing and applicable law.

4.12.4. Personal data is processed and stored solely in the territory of the Russian Federation. Cross-border transfer of personal data is permitted only with the permission of the competent regulatory authority and the data subject's consent.

Measures applied to protect user personal information

5.1. When processing personal information, the Organisation takes the necessary legal, organisational and technical measures to protect personal information against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination of personal information, as well as against other unlawful actions in relation to the user's personal information, in accordance with the Organisation's internal policies and applicable data protection laws.

5.2. Measures to ensure the security of personal data during its processing in the Organisation's personal data information systems are determined and applied taking into account the established security levels of personal data during processing, in accordance with applicable regulations.

5.3. Protection of personal data during processing in the Organisation's personal data information systems against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination of personal data and other unlawful actions is ensured by applying an interconnected set of measures and protection tools, in particular:

  • threats to the security of personal data during processing in personal data information systems are identified;
  • information protection tools that have undergone the established compliance assessment procedure and are intended to neutralise the actual security threats are applied;
  • the effectiveness of the measures taken to ensure the security of personal data is assessed before the personal data information system is put into operation;
  • physical media of personal data are recorded;
  • measures are taken to detect unauthorised access to personal data and to respond accordingly, including detecting, preventing and remediating cyberattacks on personal data information systems and responding to security incidents in them;
  • the ability to restore personal data that has been modified or destroyed as a result of unauthorised access is ensured;
  • access rules to the personal data processed in the personal data information system are established;
  • registration and accounting of actions performed on personal data in the personal data information system are ensured;
  • oversight of the measures taken to ensure the security of personal data is performed.

Rights and obligations of the parties

6.1. The user is required to:

6.1.1. Provide the Organisation with accurate personal information that is necessary for the use of the services.

6.1.2. Not unlawfully use or copy content without the consent of the rights holder of the relevant Site content.

6.2. The Organisation is required to:

6.2.1. Use the user's personal information solely for the purposes set out in this Privacy Policy and in the consent to personal data processing.

6.2.2. Keep confidential information secret, not disclose it without the user's prior written permission, and not sell, exchange, publish or otherwise disclose the user's personal data, except as provided for by this Policy.

6.2.3. Take precautions to protect the confidentiality of the user's personal data in accordance with the procedure normally used to protect such information in current business practice.

6.2.4. Block personal data relating to the relevant user from the moment of a request from the user, their legal representative or the competent data protection authority, for the period of verification in the event of inaccurate personal data or unlawful actions being identified.

6.2.5. Destroy the personal data in the event that the user withdraws consent to its processing, unless otherwise provided for by law or by an agreement to which the data subject is a party, beneficiary or guarantor.

6.2.6. Provide information at the user's request about the processing of such user's personal data.

6.2.7. Send the user, on its own behalf or with the involvement of technical partners, informational, service and advertising messages (subject to the user's consent) to the user's e-mail, mobile phone or via the services they use (social networks, messengers and others).

6.2.8. Consent to receive advertising and informational mailings is given separately and is not part of the consent to personal data processing.

6.3. The user is entitled to:

6.3.1. Receive information from the Organisation concerning the processing of their personal data, including:

  • confirmation that personal data is being processed by the Organisation;
  • the legal basis and purposes of personal data processing;
  • the purposes and methods used by the Organisation to process personal data;
  • the name and location of the Organisation, information about persons (other than employees) who have access to personal data or to whom personal data may be transferred or disclosed under a contract with the Organisation or under applicable law;
  • the list and categories of personal data being processed that relate to the relevant data subject, and their source, unless a different procedure for providing such data is provided for by applicable law;
  • the periods for which personal data is processed, including the storage periods;
  • the procedure for the data subject to exercise their rights under applicable data protection laws;
  • the name or full name and address of the person processing personal data on behalf of the Organisation, if such processing has been or will be entrusted to such a person;
  • other information provided for by applicable law.

6.3.2. The data subject may withdraw consent at any time by sending a written notice to the e-mail address connect@zaokvant.com.

6.3.3. Request that their personal data be corrected if inaccuracies are discovered in the personal data processed by the Organisation, and add to the personal data, including by submitting a supplementary statement.

6.3.4. Request that their personal data be deleted from the Organisation's systems if the personal data is no longer required for the purposes for which it was obtained and the Organisation has no legal grounds for processing it.

6.3.5. Opt out of receiving advertising and other information without giving reasons. Opting out is effected by contacting the Organisation.

6.4. In the event that the Organisation fails to comply with its obligations regarding the processing of personal data, it is liable for the user's actual, documented losses arising from the Organisation's unlawful use of personal data in accordance with applicable law.

6.5. In the event of loss or disclosure of the user's personal data, the Organisation is not liable if the said personal data:

  • became publicly available prior to its loss or disclosure;
  • was obtained from a third party before being received by the Organisation;
  • was disclosed with the user's consent.

Additional terms

7.1. The Organisation may amend the Policy and will notify users by publishing the new version on the Site. It is recommended to review the Policy periodically for changes.

7.2. The new Policy takes effect from the moment it is posted on the Organisation's website https://zaokvant.com/, unless otherwise provided for in the new version of the Policy.

7.3. If the user has any questions about the Policy, they may contact the Organisation using the contact details provided on the Organisation's website https://zaokvant.com/.

→ Consent to personal data processing