1. General Provisions
1.1. This Personal Data Processing Policy of Individual Entrepreneur Melkumyan Meline (hereinafter – the Policy) is developed in compliance with paragraph 2 of part 1 of article 18.1 of the Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” (hereinafter – the Personal Data Law) to ensure protection of the rights and freedoms of individuals during the processing of their personal data, including protection of privacy, personal and family secrets.
1.2. The Policy applies to all personal data processed by Individual Entrepreneur Melkumyan Meline (hereinafter – the Operator).
1.3. The Policy governs relations in the field of personal data processing arising both before and after its approval.
1.4. Pursuant to part 2 of article 18.1 of the Personal Data Law, this Policy is publicly available on the Operator’s website at: https://romankhalafyan.com_eng.
1.5. Key terms used in the Policy:

• Personal data — any information relating directly or indirectly to an identified or identifiable individual (data subject);
• Personal data operator (operator) — a government body, municipal authority, legal or natural person independently or jointly organizing and/or performing personal data processing, including determining the purposes of processing, the personal data to be processed, and the actions performed with the personal data;
• Personal data processing — any action or set of actions with personal data, performed with or without automation, including: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction;
• Automated personal data processing — processing using computing technology;
• Personal data dissemination — actions aimed at disclosing personal data to an undefined circle of persons;
• Personal data provision — actions aimed at disclosing personal data to a defined person or group of persons;
• Personal data blocking — temporary cessation of personal data processing (except where processing is necessary for clarification);
• Personal data destruction — actions that make it impossible to restore the content of personal data in information systems and/or result in destruction of physical media;
• Personal data anonymization — actions making it impossible to identify the data subject without additional information;
• Personal data information system — a set of personal data databases and information technologies ensuring their processing;
• Cross-border transfer of personal data — transfer of personal data to foreign authorities, individuals, or legal entities.

1.6. Rights and obligations of the Operator:
1.6.1. The Operator has the right to:

• independently determine the necessary and sufficient measures to fulfill obligations under the Personal Data Law and related regulations unless otherwise stipulated by law;
• delegate personal data processing to another person with the consent of the data subject, under a contract, who must comply with data processing principles and rules;
• continue processing personal data without consent if the data subject withdraws consent, where grounds specified by law exist.

1.6.2. The Operator must:

• organize data processing in accordance with legal requirements;
• respond to requests of data subjects and their representatives in compliance with the law;
• provide requested information to the authorized body (Roskomnadzor) within 30 calendar days.

1.7. Rights of the personal data subject include:

• receiving information about personal data processing, except as provided by law;
• demanding clarification, blocking, or destruction of inaccurate, outdated, unlawfully obtained or unnecessary personal data;
• requiring prior consent for data processing for marketing purposes;
• appealing unlawful actions or inaction of the Operator to Roskomnadzor or court.

1.8. Control over compliance with this Policy is carried out by the authorized person responsible for personal data processing organization.
1.9. Liability for violations of the Russian Federation legislation regarding personal data processing and protection is determined according to Russian law.
2. Purpose of Personal Data Collection
2.1. Processing is limited to achieving specific, predetermined, and lawful purposes. Incompatible processing is not allowed.
2.2. Only personal data relevant to processing purposes are handled.
2.3. The Operator processes personal data for purposes including but not limited to:

• compliance with the Constitution and laws of the Russian Federation;
• accounting and tax reporting;
• protection of Operator’s rights in administrative and legal proceedings;
• submission of reports to authorities;
• marketing and promotion of goods and services, loyalty programs, direct contacts via communication means including telephone, SMS, email, mail;
• preparation and execution of contracts;
• compliance with consumer protection laws;
• providing User access to services and materials on the website [website link].

3. Legal Grounds for Processing
3.1. Legal basis includes Russian laws such as:

• Constitution of the Russian Federation;
• Civil, Labor, Tax Codes;
• Federal laws No. 14-FZ, 152-FZ, 167-FZ, 402-FZ, and others regulating Operator’s activities.
• 3.2. Also based on contracts with data subjects and their consents.

4. Scope and Categories of Personal Data
4.1. The content and volume of processed data correspond to declared processing purposes and are not excessive.
4.2. Data types include:

• biometric data (processed according to law);
• name;
• phone number;
• email.

4.3. Special categories (racial, political, religious, health, intimate data) are not processed except as required by law.
5. Procedure and Conditions of Processing
5.1. Processing is performed in compliance with Russian legislation.
5.2. Data are processed with or without consent as provided by law.
5.3. Both automated and manual processing are used.
5.4. Only authorized employees may process data.
5.5. Data may be collected via:

• oral and written forms;
• publicly available sources;
• data entry into Operator’s registers and systems;
• other lawful methods.

5.6. Disclosure to third parties without consent is prohibited unless required by law. Separate consent is obtained for data allowed for dissemination.
5.7. Data may be transferred to authorized bodies (law enforcement, tax, pension funds, etc.) as required by law.
5.8. The Operator takes legal, organizational, and technical measures to protect data from unauthorized access, loss, alteration, etc., including:

• risk assessment;
• internal regulations;
• appointment of responsible persons;
• secure storage;
• employee training.

5.9. Data are stored only as long as required for processing purposes or law.
5.10. For Russian citizens, data are stored on servers located in Russia, except as allowed by law.
6. Updating, Correcting, Deleting Personal Data, and Responding to Access Requests
6.1. Upon request, the Operator confirms data processing facts, legal grounds, and purposes, providing information without disclosing data related to other individuals. Requests must include ID details, evidence of relationship with Operator, and signature (electronic signature allowed). Incomplete requests are denied with explanation. Access rights may be limited if disclosure infringes others’ rights.
6.2. If inaccuracies are found, data are blocked during verification and corrected within 7 business days.
6.3. Unlawfully processed data are blocked upon complaint or official request.
6.4. Data must be destroyed when processing purposes end or consent is withdrawn, unless otherwise provided by contract or law.
7. Operator Details

Individual Entrepreneur Melkumyan Meline
INN: 370226690510
Email: a.arturovna26@gmail.com
The current version of the Policy is publicly available at: https://romankhalafyan.com/privacy_eng