Personal Data Handling Policy

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter — the Policy) defines the procedure for processing personal data and the measures to ensure their security applied by OLR LLC, TIN 7707285392 (hereinafter — the Operator).

1.2. The Policy has been developed in accordance with the requirements of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (hereinafter — the Law).
1.3. The Policy applies to the personal data of website visitors, clients, partners, users of the Operator’s services, including data obtained through phone calls, online chats, the CRM system and other interaction channels.
1.4. The main goal of the Operator is to respect human rights and freedoms when processing personal data, including ensuring the inviolability of private life and personal secrets.

2. Basic Concepts

2.1. The terms and definitions used in the Policy correspond to Article 3 of the Law. Additionally:

Personal data processor — a legal entity engaged by the Operator to process personal data on the basis of a data processing agreement (including providers of CRM systems, analytics services, telephony and online chats, affiliated companies).
Anonymized data — data as a result of the processing of which it is impossible to determine the belonging to a specific subject without additional information.

3. Processing Purposes and Legal Bases

3.1. The Operator processes personal data for the following purposes and on the following legal bases:

Processing Purpose	Legal Basis
Performance of a contract (order placement, delivery, provision of services, technical support)	clause 5, part 1, Article 6 of the Law (performance of a contract to which the subject is a party/beneficiary)
Processing of applications, requests, inquiries, feedback	clause 5, part 1, Article 6 of the Law
Promotion of goods and services (mailings, informing about new products, promotions, personalization of commercial and advertising offers)	clause 1, part 1, Article 6 of the Law (consent of the subject)
Ensuring website security, fraud prevention, incident detection	clause 2, part 1, Article 6 of the Law (legitimate interests of the Operator)
Website improvement, analysis of user behavior, generation of anonymized statistics	clause 1, part 1, Article 6 of the Law (consent of the subject)

3.2. For each processing purpose, the Operator collects only the minimum necessary volume of data.

4. Categories and Composition of Personal Data

4.1. Data provided by the subject: last name, first name, patronymic, email address, phone number, delivery address, other information specified in the forms on the website or sent to the Operator.

4.2. Automatically collected data: IP address, browser type and version, operating system, screen resolution, cookies, LocalStorage, SessionStorage, UTM tags, information about viewed pages, session duration, referral sources, etc.

4.3. Data collected during interaction: audio recordings of telephone conversations, history of correspondence in online chats, interaction events (clicks, scrolls, form submissions).

4.4. Special categories of personal data (concerning racial or national origin, political views, religious beliefs, intimate life) are not processed by the Operator.

5. Procedure and Conditions of Processing

5.1. Processing is carried out both with the use of automation tools and without them.
5.2. Transfer of personal data to third parties is allowed exclusively:

To processors under a data processing agreement — for the purposes specified in clause 3.1, provided that the agreement contains obligations to ensure the confidentiality and security of the data.
In cases expressly provided for by law (state authorities, court, etc.).
5.3. Primary collection and storage of personal data of citizens of the Russian Federation is carried out on the territory of the Russian Federation.

5.4. The processing period is determined by the achievement of the processing purposes or until the consent is withdrawn by the subject.

6. Rights of the Personal Data Subject

6.1. The subject has the right to:

receive information about the availability and processing of their personal data;
demand clarification, blocking or destruction of inaccurate, incomplete or illegally obtained data;
withdraw consent to the processing of personal data at any time;
appeal the actions of the Operator to Roskomnadzor or to the court.

6.2. The Operator considers the subject’s requests within a period of up to 30 days from the date of receipt.
6.3. Withdrawal of consent is carried out by sending a notification to the address info@gl-solutions.ru with the note “Withdrawal of consent to the processing of personal data”. After receiving the withdrawal, the Operator immediately ceases processing the data for purposes based on consent (including advertising mailings). Processing for the performance of a contract and ensuring security may continue if other legal grounds exist.

7. Measures to Ensure the Security of Personal Data

7.1. The Operator takes legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution and other unlawful actions.
7.2. Such measures include: differentiation of employee access rights, appointment of responsible persons, use of information protection tools, accounting of media, backup, internal control and incident response.
7.3. In the event of detection of unlawful transfer of personal data, the Operator notifies Roskomnadzor within 24 hours from the moment of detection of the incident and provides the results of the internal investigation within 72 hours.

8. Final Provisions

8.1. The Policy is published in open access on the Operator’s website at: https://gl-solutions.ru/law/policy-personal-data/
8.2. Changes to the Policy are made by order of the head of the Operator and published on the website. The version posted on the website as of the date of data processing is considered current.
8.3. Questions regarding the processing of personal data can be asked at info@gl-solutions.ru or through the feedback form on the website