Privacy policy

Operator: GRANO MARKET Limited Liability Company (INN 9725204456, OGRN 1267700121831), address: Bldg. 9, 15 Malaya Kaluzhskaya St., Donskoy Municipal District, Moscow, 119071, Russia, privacy e-mail: info@grano-market.ru. This policy is drawn up under Federal Law No. 152-FZ of 27 July 2006 on Personal Data and describes how the Grano Market website processes personal data: supply enquiries, data subject requests, protection of the form against abuse and visit analytics.

The website is intended for business representatives and is not aimed at persons under 18; the operator does not knowingly collect data of minors. Special categories of personal data (health, beliefs and the like) and biometric data are not requested: do not enter them, or data of third parties, in the free comment. No decision that produces legal consequences for you is taken solely on the basis of automated processing.

Key terms. Personal data means any information relating to a directly or indirectly identified or identifiable individual. Processing means any operation with personal data: collection, recording, storage, use, transfer, restriction, deletion, destruction. The operator is GRANO MARKET Limited Liability Company. A subject is an individual whose data is processed. A processor is a person to whom the operator has entrusted processing under a contract.

Processing rests on the principles of lawfulness and fairness, limitation to specific predefined purposes, data that is adequate and not excessive for those purposes, no merging of databases created for incompatible purposes, accuracy and currency of data and storage no longer than the purposes require (Article 5 of Law No. 152-FZ). The operator collects only the data needed for the purposes listed below.

Legal framework of this policy: the Constitution of the Russian Federation, the Civil Code of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 on Personal Data, Federal Law No. 149-FZ of 27 July 2006 on Information, Information Technologies and Information Protection, Government Resolutions No. 687 of 15 September 2008 (processing without automated means) and No. 1119 of 1 November 2012 (requirements for protecting personal data in information systems), and other acts in this field.

Purpose 1 — to answer a supply enquiry and prepare an offer. Data subjects: representatives of organisations and other persons who send an enquiry. Data: name, phone, e-mail (optional), request type (quotation or sample), the chosen catalogue item, optional supply details (volume, frequency, delivery city, preferred date, comment), the page the enquiry was sent from, language and time of sending. Basis: the data subject’s consent (Article 6(1)(1) of Law No. 152-FZ). The data is not used for advertising mailings without a separate basis. Retention: 365 days from receipt, or until the purpose is achieved or consent is withdrawn; after that the data is destroyed by deleting the record. An enquiry cannot be answered without this data; declining consent does not limit the other parts of the website.

Purpose 2 — to prove the fact and time of consent and to protect the form against automated submissions and repeats. The same data subjects. Data: the version and time of consent, the IP address in hashed form (a one-way transformation with the operator’s secret key; the address itself is not stored; such data remains personal data), a request-rate counter and a duplicate-enquiry marker. Basis: the subject’s consent (Article 6(1)(1)) as to proof of the consent itself, and pursuit of the operator’s legitimate interests in protecting the form provided the subject’s rights are not infringed (Article 6(1)(7) of Law No. 152-FZ). Retention: the consent record — together with the enquiry, counters and markers — no more than two days; they are then deleted automatically. The form is checked by the website itself; no third-party captcha service is loaded.

Purpose 3 — to find an enquiry and handle requests of data subjects (withdrawal of consent, information, correction, deletion). Only hashes of the phone and e-mail are kept to find an enquiry; they are deleted with it. The record of the action and minimal request metadata are kept for 3 years; document details are deleted when the request is closed. The details and the data of a request are on the personal data requests page. Basis: performance of the duties the law places on the operator (Articles 14, 20 and 21 of Law No. 152-FZ; Article 6(1)(2)) and consent to the processing of the request data.

Purpose 4 — to understand how visitors use the website and improve it. The data and the procedure are described below in the analytics section. Basis: the visitor’s separate consent (Article 6(1)(1) of Law No. 152-FZ). Without consent the counter is not loaded and the website works in full; the choice is kept for 180 days, and the retention periods inside Metrica are set by the Yandex Metrica service.

Processing is carried out with the use of automated means (the website, a database, e-mail) and manually by the operator’s manager when answering an enquiry. Permitted operations are collection, recording, organisation, accumulation, storage, correction, use, transfer to a processor, restriction, deletion and destruction. No cross-border transfer takes place.

Yandex Metrica loads only when enabled by the operator and separately accepted by the visitor. Declining prevents the counter code from loading. Metrica may process device, browser, IP, cookie, page and interaction information; this data is received by Yandex LLC (INN 7736207543, OGRN 1027700229193, 16 Lva Tolstogo St., Moscow, 119021) under the terms of the Yandex Metrica service. Webvisor, form contents and contact-data transmission are disabled.

The analytics choice, timestamp and version are stored in your browser’s localStorage for up to 180 days and can be changed in the footer. The theme preference is stored separately and is not sent to analytics. The website sets no other cookies for visitors.

An enquiry is kept for 365 days from receipt and is then deleted automatically (the check runs daily); earlier, if you withdraw consent or ask for deletion, or when the purpose has been achieved sooner. The consent record is part of the enquiry and is deleted with it. Indefinite retention is not permitted. Earlier versions of records (backups) are kept for no more than 7 days and are then deleted automatically. Request-rate counters and duplicate markers are kept for no more than two days, the server-side operation logs, which contain no personal data, for 30 days, and the log of staff actions on records (who opened which record and when; without the contents of enquiries) for at least one year, and it cannot be altered. Destruction means irreversible deletion of the record with all of its versions from storage. Processing ends when the purpose is achieved, the retention period expires, consent is withdrawn, or unlawful processing is found that cannot be remedied; inaccurate data is corrected on the basis of your request and may be blocked until it is corrected.

Enquiries and requests are stored in a database located in the Russian Federation, in the infrastructure of two hosting providers, the primary and the reserve site: Yandex.Cloud LLC (INN 7704458262, OGRN 1187746678580, 16 Lva Tolstogo St., office 528, Moscow, 119021) and TimeWeb JSC (INN 7810353960, OGRN 1247800127112, Bldg. 22, block 2, lit. A, Zastavskaya St., Saint Petersburg, 196006). The data is kept on the primary site and duplicated on the reserve site; both are located in the Russian Federation, and switching between the sites involves no transfer of data abroad. Only the operator’s general director and the staff to whom the director has given access to the closed administration area can access them. Processors: Yandex.Cloud LLC (INN 7704458262, OGRN 1187746678580, 16 Lva Tolstogo St., office 528, Moscow, 119021) and TimeWeb JSC (INN 7810353960, OGRN 1247800127112, Bldg. 22, block 2, lit. A, Zastavskaya St., Saint Petersburg, 196006), which store the data, make backup copies of it and (the former) send service e-mails on the operator’s behalf; each processor must keep the data confidential and secure. The hosting providers may keep technical connection logs (IP address, time, requested address) for the operation and security of their networks.

Recipients by category. The hosting providers (processors) receive all enquiry and request data for storage and backup, under contracts that oblige them to keep the data confidential and secure. Yandex LLC receives Metrica data only after your analytics consent. Telegram receives only the enquiry number and a link to the closed area. There are no other recipients.

Personal data is not sent to messengers. The manager receives in Telegram only a notice with a number and a link to the closed administration area: no name, phone, email or enquiry text. The data is not disclosed to other third parties except where the law expressly requires it.

You may obtain information about the processing of your data (including purposes, methods, periods, processors and the source of the data), require its correction, blocking or destruction, withdraw consent, and appeal against the operator’s actions to the authority for the protection of data subjects’ rights (Roskomnadzor) or to a court. A request can be filed on the personal data requests page of this website, by e-mail to info@grano-market.ru or by post to Bldg. 9, 15 Malaya Kaluzhskaya St., Donskoy Municipal District, Moscow, 119071, Russia. Analytics consent can also be withdrawn in the footer settings: the page then reloads without the counter. Withdrawal does not invalidate earlier lawful processing.

Response periods: withdrawal and deletion — 30 calendar days; access to information — 10 working days, which may be extended by no more than 5 working days with a reasoned notice; correction — 7 working days. A period starts once the submission of the request is confirmed.

So that only the owner of the data can have a request carried out, the operator verifies identity to the extent the law requires. Document details are used only for comparison and are deleted when the request is closed. The record of the action and minimal request metadata without contact details are kept for 3 years.

Access to the data is role-based and protected by a password and a one-time code from an authenticator app; actions with personal data are recorded in a log that cannot be altered or deleted during its retention period; the website and the closed area work over a secure connection (HTTPS) only; storage is encrypted; records are kept with versions and deleted on the set schedules. All data is processed on servers in the Russian Federation. The operator has appointed a person responsible for organising the processing of personal data; messages to that person are accepted at info@grano-market.ru. The operator notifies Roskomnadzor of personal data processing under Article 22 of Federal Law No. 152-FZ.

The operator may amend this policy; the current edition is published on this page with its date and version. A new edition does not extend the purposes or the data you consented to without fresh consent. Earlier editions can be requested at info@grano-market.ru.