1. General Provisions
This Personal Data Processing Policy (the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006, “On Personal Data” (hereinafter, “Federal Law No. 152-FZ”).
This Policy sets out the procedures for processing personal data and the measures taken to ensure the security of personal data by Individual Entrepreneur Polina Aleksandrovna Khabarova (the “Operator”), with the aim of protecting the rights and freedoms of individuals and citizens when their personal data is processed, including the right to privacy and the confidentiality of personal and family matters.
This Personal Data Processing Privacy Policy applies to all information that may be obtained about a User while the Operator’s website, hosted at mercybag.store, its software and products are being used.
Use of the Operator’s website and/or service constitutes the User’s unequivocal and unconditional acceptance of this Policy, including the terms governing the processing of their personal data. If the User does not agree with this Policy or the terms governing the processing of their personal data, the User must stop using the Operator’s website and/or service. The Operator reserves the right to amend this Policy. If the User does not agree with any amendments, the User must stop using the Operator’s website and/or service. The new version of this Policy takes effect when it is published on mercybag.store, unless otherwise stated in the new version.
Under this Policy, the information processed by the Operator includes: the User’s personal data to the extent specified in registration forms; data transmitted by the User’s software, including but not limited to cookies, IP address, and technical characteristics of the User’s hardware and software; and other information whose processing is required by the laws of the Russian Federation and/or this Policy.
The purposes of processing information, including personal data, are: enabling the User to use the Operator’s website and/or service; performance of contracts by the Operator and the User, as well as taking actions necessary to enter into contracts and make payments; identifying the User; contacting the User; preparing and sending responses to enquiries; sending notifications about the operation of the website and/or service; sending notifications about new services, products and events; providing up-to-date information; improving service quality; targeting advertising materials; and conducting statistical and other research. For these purposes, the Operator may transfer information provided by the User to third parties.
The Operator processes the following personal data of customers:

• Surname, first name and patronymic;
• Year of birth;
• Month of birth;
• Date of birth;
• Contact telephone number;
• Email address.

The following key terms are used in this Policy:

• Automated processing of personal data — processing of personal data using computer technology.
• Blocking of personal data — temporary suspension of the processing of personal data, except where processing is necessary to clarify the personal data.
• Anonymisation of personal data — actions that make it impossible to identify the specific data subject without using additional information.
• Processing of personal data — any action (operation), or set of actions (operations), performed with personal data using automated means or without them, including collection, recording, systematisation, accumulation, storage, clarification (updating or modification), extraction, use, transfer (dissemination, provision or access), anonymisation, blocking, deletion and destruction of personal data.
• Operator — a legal entity or individual who independently or jointly with others organises and/or carries out the processing of personal data and determines the purposes of processing, the categories of personal data to be processed, and the actions (operations) performed on such data.
• Personal data — any information relating directly or indirectly to an identified or identifiable individual (the data subject).
• Provision of personal data — actions intended to disclose personal data to a specific person or a specific group of persons.
• Dissemination of personal data — actions intended to disclose personal data to an indefinite number of persons or make personal data available to an unlimited number of persons, including publication in the media, posting on information and telecommunications networks, or providing access by any other means.
• Destruction of personal data — actions that make it impossible to restore the content of personal data in a personal data information system and/or destroy physical media containing such data.

The Operator must publish this Personal Data Processing Policy or otherwise ensure unrestricted access to it in accordance with Part 2 of Article 18.1 of Federal Law No. 152-FZ.

2. Principles and Conditions for Processing Personal Data
2.1. Principles of Personal Data Processing
The Operator processes personal data in accordance with the following principles:

• Lawfulness and fairness;
• Limiting the processing of personal data to specific, predetermined and lawful purposes;
• Preventing the processing of personal data in ways incompatible with the purposes for which it was collected;
• Preventing the merging of databases containing personal data processed for purposes that are incompatible with one another;
• Processing only personal data that is relevant to the purposes of processing;
• Ensuring that the content and scope of the personal data processed correspond to the stated purposes of processing;
• Preventing the processing of personal data that is excessive in relation to the stated purposes;
• Ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of processing;
• Destroying or anonymising personal data once the purposes of processing have been achieved, or when the need to achieve those purposes no longer exists, if the Operator cannot remedy any violations involving the personal data, unless otherwise provided by federal law.

2.2. Conditions for Processing Personal Data
The Operator processes personal data if at least one of the following conditions is met:

• The data subject has consented to the processing of their personal data;
• Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, or to perform functions, powers and duties imposed on the Operator by the legislation of the Russian Federation;
• Processing is necessary for the administration of justice or the enforcement of a judicial act, or an act of another body or official that must be enforced under Russian enforcement proceedings legislation;
• Processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to enter into a contract at the data subject’s initiative, or a contract under which the data subject will be a beneficiary or guarantor;
• Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the data subject are not infringed;
• The data subject has made the personal data available to an unlimited number of persons, either directly or at their request (hereinafter, “publicly available personal data”);
• The personal data is subject to publication or mandatory disclosure under federal law.

2.3. Confidentiality of Personal Data
The Operator and any other persons who have access to personal data must not disclose it to third parties or disseminate it without the data subject’s consent, unless otherwise provided by federal law.

2.4. Publicly Available Sources of Personal Data
For information purposes, the Operator may create publicly available sources of personal data, including directories and address books. With the data subject’s written consent, such sources may include their surname, first name and patronymic, date and place of birth, position, contact telephone numbers, email address and other personal data provided by the data subject.
Information about a data subject must be removed from publicly available sources at any time upon request by the data subject, the authorised body responsible for protecting data subjects’ rights, or pursuant to a court decision.

2.5. Special Categories of Personal Data
The Operator may process special categories of personal data concerning race, nationality, political views, religious or philosophical beliefs, health or intimate life if:

• The data subject has given written consent to the processing of their personal data;
• The personal data has been made publicly available by the data subject;
• Processing is carried out in accordance with legislation on state social assistance, labour legislation, or Russian legislation on state pension provision and employment pensions;
• Processing is necessary to protect the life, health or other vital interests of the data subject or another person, and it is impossible to obtain the data subject’s consent;
• Processing is carried out for preventive medical purposes, medical diagnosis, or the provision of medical or social-medical services, provided that the data is processed by a person professionally engaged in medical activities and required by Russian law to maintain medical confidentiality;
• Processing is necessary to establish or exercise the rights of the data subject or third parties, or in connection with the administration of justice;
• Processing is carried out in accordance with legislation on compulsory insurance or insurance.

Processing of special categories of personal data under the circumstances specified in Clause 4 of Article 10 of Federal Law No. 152-FZ must cease immediately once the reasons for such processing no longer apply, unless otherwise established by federal law.
The Operator may process personal data concerning criminal convictions only in the cases and in the manner established by federal laws.

2.6. Biometric Personal Data
Information describing a person’s physiological and biological characteristics that can be used to establish their identity (“biometric personal data”) may be processed by the Operator only with the data subject’s written consent.

2.7. Entrusting Personal Data Processing to Another Person
The Operator may entrust the processing of personal data to another person with the data subject’s consent, unless otherwise provided by federal law, under an agreement concluded with that person. A person processing personal data on the Operator’s behalf must comply with the principles and rules for personal data processing established by Federal Law No. 152-FZ and this Policy.

2.8. Processing Personal Data of Citizens of the Russian Federation
In accordance with Article 2 of Federal Law No. 242-FZ of 21 July 2014, “On Amendments to Certain Legislative Acts of the Russian Federation Regarding the Clarification of the Procedure for Processing Personal Data in Information and Telecommunications Networks,” when collecting personal data, including via the Internet, the Operator must ensure that the recording, systematisation, accumulation, storage, clarification (updating or modification) and extraction of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation, except where:

• Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, or to perform functions, powers and duties imposed on the Operator by Russian law;
• Processing is necessary for the administration of justice or the enforcement of a judicial act, or an act of another body or official that must be enforced under Russian enforcement proceedings legislation (hereinafter, “enforcement of a judicial act”);
• Processing is necessary for the exercise of the powers of federal executive authorities, state extra-budgetary funds, executive authorities of constituent entities of the Russian Federation, local self-government bodies, or the functions of organisations involved in providing state and municipal services under Federal Law No. 210-FZ of 27 July 2010, “On the Organisation of the Provision of State and Municipal Services,” including registration of the data subject on the unified and/or regional portals of state and municipal services;
• Processing is necessary for the professional activities of a journalist and/or the lawful activities of a mass media outlet, or for scientific, literary or other creative activities, provided that the rights and legitimate interests of the data subject are not infringed.

3. Rights of the Data Subject
3.1. Consent to the Processing of Personal Data
The data subject decides whether to provide their personal data and gives consent to its processing freely, of their own will and in their own interests. Consent may be given by the data subject or their representative in any form that allows the fact of consent being obtained to be confirmed, unless otherwise established by federal law.

3.2. Rights of the Data Subject
The data subject has the right to obtain from the Operator information concerning the processing of their personal data, unless this right is restricted by federal laws. The data subject may request that the Operator clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing. The data subject may also take any measures provided by law to protect their rights.
Processing personal data for the promotion of goods, works or services through direct contact with the data subject (a potential customer) by means of communication, as well as for political campaigning, is permitted only with the data subject’s prior consent.
At the data subject’s request, the Operator must immediately stop processing their personal data for the purposes specified above.
Decisions that produce legal consequences for a data subject or otherwise affect their rights and legitimate interests must not be based solely on automated processing of personal data, except in cases provided for by federal law or where the data subject has given written consent.
If the data subject believes that the Operator is processing their personal data in violation of Federal Law No. 152-FZ or otherwise infringing their rights and freedoms, they may appeal the Operator’s actions or omissions to the authorised body responsible for protecting data subjects’ rights or to a court.
The data subject has the right to protect their rights and legitimate interests, including the right to compensation for losses and/or non-pecuniary damage.

4. Ensuring the Security of Personal Data
The security of personal data processed by the Operator is ensured through the implementation of legal, organisational and technical measures necessary to comply with federal legislation on personal data protection.
To prevent unauthorised access to personal data, the Operator applies the following organisational and technical measures:

• Appointing officials responsible for organising personal data processing and protection;
• Restricting the number of persons authorised to process personal data;
• Familiarising relevant persons with the requirements of federal legislation and the Operator’s internal regulatory documents on the processing and protection of personal data;
• Organising the accounting, storage and handling of media containing personal data;
• Identifying threats to the security of personal data during processing and developing threat models on that basis;
• Developing a personal data protection system based on the threat model;
• Checking the readiness and effectiveness of information security tools;
• Differentiating user access to information resources and hardware and software used to process information;
• Recording and tracking user actions in personal data information systems;
• Using antivirus tools and tools for restoring the personal data protection system;
• Where necessary, using firewalls, intrusion detection systems, security analysis tools and cryptographic information protection tools;
• Organising access control to the Operator’s premises and securing rooms containing technical equipment used to process personal data.

5. Final Provisions
Other rights and obligations of the Operator in connection with the processing of personal data are determined by the legislation of the Russian Federation on personal data.
Employees of the Operator who are responsible for violations of the rules governing the processing and protection of personal data may incur financial, disciplinary, administrative, civil or criminal liability in accordance with the procedures established by federal laws.
Individual Entrepreneur Polina Aleksandrovna Khabarova
Taxpayer Identification Number (INN): 772984985538
Primary State Registration Number (OGRN): 321774600649580
Publication date: 26 October 2026