14.1. What is this policy about?
• We strive to provide you with the most accessible and at the same time full information about the personal data that we collect and the ways we process it.
• We will use the personal data and other information you provide for the purposes described in our Policy, including delivery of the services you have requested and the products you ordered to you, and enhancing your experience with us. We process only the required minimum of the personal data.
• We will also use this information to help us better understand you and your needs so that the products we offer are best suited to your interests.
• If you tell us that you do not want to receive promotional messages, we will not send them to you. It goes without saying that refusal to receive promotional/advertising messages does not deprive you of the opportunity to receive important messages about the ordered product or the services provided, you will continue to receive such messages.
• The personal data you provide are protected and we are taking all necessary measures to protect it. But if a breach happens, and your personal data is compromised, we will inform you about the breach and the counter measures taken to repair it.
• If you find that your personal data is not accurate – you can write to us, and we will correct it.
• If you no longer want us to process your personal data and let us know, we will stop doing this. But if the law obliges us to continue processing and/or storing your data, we will comply with the law and will inform you about our obligations.
• We respect your rights to exercise control over your personal data.
Below is the full text of the Policy where we explain in more detail the types of personal information (personal data) we collect, how we collect it, what we can use it for and with whom we can share it, how you can influence it, and other important issues.
We tried to make the text of the Policy as clear and simple as possible, but we could not avoid some legal language necessary for the most accurate description of terms.
If after reading our Privacy Policy you still have questions, you can write to us at the e-mail address:
weare@29.agency.
14.2. Who processes your personal data.
This Personal Data Privacy Policy (hereinafter – the Privacy Policy) is established in accordance with the General Data Protection Regulation (GDPR) in order to regulate personal data processing and describes the measures taken to ensure the security of personal data collected by the Owner identified in Section 15. For the purposes of the definition of duties under the GDPR, the aforementioned person is considered the “Data Controller”.
14.3. What do we mean by personal data?
Personal data – data that identifies you or can be used to identify you, for example, your name and contact information. There may also be other information about how you use our Site.
We do not verify the accuracy of the data you provide, we trust you and assume that you are telling the truth about yourself.
14.4. When and how does this Privacy Policy apply?
14.4.1. This Privacy Policy applies to personal data about you that we collect, use and otherwise process, not only when you are our client (Customer), but also when you are exploring our site (as a User).
Let's explain that:
Site – a set of graphic and information materials, as well as computer programs and databases, ensuring their availability on the site on the Internet at the address: www.29.agency and on all subdomains created on its basis.
User – a person to whom the relevant personal data relates, viewing the content of the Site and/or using the functionality of the Site.
Customer – any capable person who has made the order by using Site.
14.4.2. The current version of the Privacy Policy is posted on the Site at:
https://www.29.agency/en/privacy. Before using our Site, you should read the Privacy Policy, and if its conditions are unacceptable to you, refrain from transferring personal data to us.
If you transfer your personal data, it means unconditional acceptance of the terms of this Privacy Policy and the conditions for processing personal data and the purposes of processing specified in it. But you have the right to withdraw consent, more on that below.
14.4.3. The privacy policy (including any of its parts) can be changed by the Data Controller, and we will immediately publish it on the Site for public review. The new edition of the Privacy Policy comes into force from the moment it is posted on the Site. If you do not agree with the new terms of the Privacy Policy, refrain from transferring personal data.
14.4.4. We are committed to protecting and respecting your privacy and will continue to do so with any changes we make to this Privacy Policy.
14.4.5. Using the Site and its services, applying a web browser that accepts data from cookies means your consent to the fact that the Data Controller can collect and process data from cookies in order to improve the Site, its content, and its functionality. Disabling and/or blocking your web browser option for receiving data from cookies means that your use of the Site may be limited, in particular, in terms of some of its functions.
Let's explain that:
Cookies are a small piece of data sent by a web service and stored on your computer, which the browser sends to the web server each time in an HTTP request when trying to open the page of the corresponding site.
14.5. When do we collect your personal data?
We collect personal data about you whenever you use our services in any form. Most often these cases are: when you make an order, when you contact our specialists and when you use our Site, specifically:
- when authorising via social networks;
- when filling out the feedback form on the Site;
- when subscribing to the newsletter;
- when sending feedback;
- when registering and identifying on the Site;
- when using the Site in any way.
14.6. Do we collect ‘sensitive personal data’?
Some types of personal data, for example, about race, ethnicity, health, are special categories of data that require additional protection in accordance with the legislation of the European Union. Processing of biometric personal data and special categories of personal data is not carried out on the Site.
14.7. Purposes of processing and types of personal data about Users/Customers that the Data Controller receives and processes.
14.7.1. Types of personal data:
14.7.1.1. Personal data posted by Users. These may include, in particular:
- last name, first name, patronymic;
- telephone number;
- email address;
- other personal data that the User provides on his/her own.
It is forbidden for the User to provide personal data of third parties without the consent received from them for such a transfer, or if such personal data of third parties were not obtained by the User himself from publicly available sources of information.
14.7.1.2. Data automatically transmitted to the Site in the process of this data using the software installed on the User's device, incl. IP-address, data from cookies, information about the browser, operating system, access time, search requests of the User, referrer (previous page address).
Let's explain that:
IP-address is a unique network address of a node in a computer network through which you get access to the Site.
14.7.2. We collect and process only that information about Users, incl. their personal data, which is related to the achievement of the following goals:
- providing contact with the User of the Site, including sending notifications, requests and their processing, as well as processing of requests and applications from the User for the purpose of further conclusion and execution of the contract;
- receiving and publishing feedback;
- conclusion of contracts and fulfilment of the Controller's obligations to the User according to them
- personnel recruitment
- maintaining statistics and analysing the work of the Site.
- posting on the Site, in official groups of social networks and other communities of the Controller on the Internet, other advertising and information sources, for purposes not related to the identification of the User.
- improving the quality of the User's service and modernising the Site by processing requests and applications from the User, as well as for the purpose of recording telephone conversations with the Controller to improve the quality of service and to preserve evidence in the event of disputes between the Controller and the User.
- sending promotional messages, newsletters about the products and services of the Controller and its partners, special offers, promotions, drawings, contests, surveys to the User's email address via postal mail, SMS messages, push notifications. The User may opt out of receiving information messages by sending a letter to the Controller to the e-mail address weare@29.agency with the notation ‘Cancellation of notifications about new products and services and special offers’ or by unsubscribing from receiving such messages via the functionality of the message itself.
If it is necessary to use personal information about Users for purposes not provided for by the Privacy Policy, we request the User's consent to such actions.
14.8. When do we send you promotional (advertising) messages?
If you give your consent, we will occasionally send you promotional messages about our products and services.
We respect your right to opt out of receiving promotional messages as set out above.
14.9. Legal basis for data processing.
14.9.1. We process your personal data only if we have a legal basis to do it. This basis will depend on the reasons for which we collect and process your personal data.
14.9.2. Most often, the basis for data processing will be:
- contracts concluded between us and you, that is, we will process your personal data in order to fulfil our obligations to you (for example, to deliver goods);
- consent to the processing of personal data that you have given us (implies a certain list of such data and certain purposes).
14.9.3. Also, the law allows us to process personal data in the following cases:
- if it is necessary to use your personal data in accordance with a legal obligation to which we are subject;
- to protect the vital interests of you or another person.
14.9.4. We process personal information, including personal data, only if:
- processing is necessary to fulfil our contractual obligations to you.
- processing is necessary to comply with statutory obligations.
- you consent to us using your personal data for purposes of provision of promotional material or other specific purposes
- when provided by applicable law, the processing is necessary to ensure our legitimate interests in the event that such processing does not significantly affect your interests, fundamental rights and freedoms. When processing personal information on this basis, we will always strive to maintain a balance between our legitimate interests and the protection of your privacy.
14.10. How long do we keep personal data?
We will keep your information for as long as we need it for the purpose for which it is processed. For example, we store your data to fulfil the obligations under the contract, and after fulfilling it, we store the data in order to be able to respond to any of your requests, complaints or claims. Information may also be stored so that we can continue to improve our experience and to reward you for your loyalty. We constantly check the relevance of the need to process personal data, and in the event that there is no legal, business or customer need for keeping this information, we will safely delete it.
14.11. Who has access to your personal data?
In most cases, personal data is processed automatically without employees having access to it. If such access is available, then it can be provided to those persons who need it to perform their tasks. For the security of internal data, all persons must comply with the rules and procedures regarding data processing. They must also follow all technical and organizational security measures in place to protect personal data.
Consent to this Privacy Policy implies consent that we may receive statistical anonymized (without reference to the Personal Data Subject) data on the actions of the Personal Data Subject when using the Site.
14.12. How do we protect your personal data?
We have implemented sufficient technical and organizational measures to protect personal data from unauthorized, accidental or illegal destruction, loss, alteration, unscrupulous use, disclosure or access, as well as other illegal forms of processing. These security measures were implemented taking into account the current state of the technics, the cost of implementation, the risks associated with the processing and the nature of personal data, including the following measures:
- anti-virus protection with updated databases;
- information backup;
- limiting the circle of persons with access to personal data;
- appointment of those responsible for organisation of processing and protection of personal data;
- assessing whether personal data is protected, whether the measures taken are effective, whether they are implemented;
- establishment of rules of access differentiation to personal data, registration and accounting of all actions performed with personal data;
- limitation of access to the premises where personal data carriers are placed and processing is carried out;
- establishment of requirements to the complexity of passwords for access to the systems where personal data are stored;
- timely updating of software;
- detection of unauthorized access to personal data and taking measures to identify the causes and possible consequences;
14.13. Who do we share personal data with?
14.13.1. We may transfer your personal data to the following subjects:
- Partners, such as website and application owners, advertising networks and other partners that provide the Controller with services related to the placement and display of advertisements on websites, programmes, products or services owned or controlled by such partners;
- Partners engaged by the Controller to provide services to Users on the platform at
https://www.29.agency/en- Partners to provide Users with specialised offers to conclude contracts.
We only share personal data with partners who adhere to high standards of personal data protection (GDPR or similar applicable standards) on their side and ensure that we process personal data in accordance with GDPR or similar applicable principles and standards.
14.13.2. We may transfer your personal data to other third parties in the case that you have submitted such actions or we are required by law (the transfer is provided by applicable law).
14.13.3. If our company takes part in a merger, acquisition or any other form of sale of part or all of its assets, then a data array is transferred along with them. In this case, all obligations to comply with the terms of the Privacy Policy are transferred to the acquirer of the assets.
14.13.4. We will also share your information in response to a valid request from law enforcement or other government agencies, or when contacting government agencies such as police and regulatory agencies to protect our rights, property or the safety of our customers, personnel and assets.
14.13.5. We may be forced to transfer your personal data because we must comply with legal or regulatory obligations in any jurisdiction, including when this obligation arises from our voluntary action or decision (for example, our decision to operate in a country or related to solutions).
14.13.6. We do not sell personal information, including personal data, to third parties.
14.14. Cross-border transfer
The Controller processes personal data using databases in the Russian Federation, therefore your personal data may be sent and stored by us and/or third parties in countries outside the country in which you are located and outside the European Economic Area.
This may involve sending your data to countries where, according to their local laws, you may have fewer legal rights.
We will take precautions to ensure that your data is still protected in accordance with the standards set out in this Privacy Policy.
14.15. What are your legal rights in relation to the personal data we process?
14.15.1. The personal data protection laws give you a number of rights. To implement them, most often you just need to contact us in writing (by mail or email), it's free. We will reply to you within 30 days, but we will do our best to make it much faster.
Sometimes we will have to deny your request (in whole or in part), because we are obliged to comply with the applicable law. In such cases we will definitely explain in our answer to you why we cannot fulfil your request.
14.15.2. You have the following rights:
A) You can ask us to stop sending you promotional materials. For information on how to do this please refer to the section "When we send you advertising messages". Refusal from advertising mailing will not deprive you of the opportunity to receive messages about the progress of the provision of services and our performance of the contract.
B) You can ask us to stop processing your personal information for marketing purposes, including analytics for targeted marketing purposes, including online advertising.
C) You can ask for information regarding the processing of your personal data, including confirmation of the fact of processing, place and purpose of processing, types of data, to which third parties this data is disclosed, storage period and source of receiving.
D) You can ask us to correct the personal data that you have provided to us if this information is inaccurate or out of date.
E) You can ask to delete your personal data.
But we must warn you that some of the data will be archived to meet our obligations to law enforcement, national authorities and legal proceedings. We will give you a full answer which information will remain saved. When the storage period expires in accordance with the applicable law that obliges us to store this data, we will delete the data.
F) Ask us to provide a free electronic copy of personal data to another company.
G) Submit a complaint
14.16. Request forms and what we will check upon receiving your request.
14.16.1. You can send your request in writing or electronically.
14.16.2. Written requests include any of your written requests sent to us, including requests sent through post offices.
14.16.3. Electronic requests include inquiries sent by email which were used by you while registering with our service. We do not process requests related to the personal data received by phone or fax due to the inability to identify the person of the requestor.
14.16.4. The procedure for considering requests is as follows:
14.16.4.1. A written request is sent to us regardless of the form of the request (written or electronic). The preparation of answers is carried out by our responsible specialist.
14.16.4.2. Requests and appeals are checked for the presence of:
- surname, name of the applicant;
- last name, first name of the person whose personal data are processed (Personal data subject);
14.16.5. If necessary, we will ask you for additional information.14.17. What to refer to in the request?
14.17.1. Data subject has the right at any time to revoke any given consents and permissions to the processing of personal data by sending a message to email weare@29.agency.
14.17.2. Data subject has the right to demand to delete, correct, update personal data, demand to restrict the processing of personal data or object to the processing of personal data, when it is provided for by applicable law. The Data Controller responds to these requests in accordance with applicable law.
14.17.3. In case of confirmation of the fact of the inaccuracy of personal data or the unlawfulness of personal data processing, the personal data must be updated by the Data Controller, and the processing of the illegally obtained data must be stopped.
14.17.4. Upon achievement of the goals of personal data processing, as well as in case of withdrawal of consent to personal data processing, personal data should be deleted if:
- otherwise is not provided for by the contract, the party to which, the beneficiary or the guarantor of which is the data subject;
- The Data Controller is not entitled to carry out processing without the consent of the data subject provided in accordance with applicable law or otherwise by another agreement between the Data Controller and the data subject.
