PRIVACY POLICY

Federal State Budgetary Institution of Culture “The State Russian Museum”

 

1. GENERAL PROVISIONS

 

1.1 The Privacy Policy of the Federal State Budgetary Institution of Culture “The State Russian Museum” (hereinafter referred to as the Privacy Policy or Policy) has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, other federal laws and regulatory legal acts of the Russian Federation.

1.2 This Privacy Policy applies solely to the Website of the Federal State Budgetary Institution of Culture “The State Russian Museum”. The Website does not control and is not responsible for third-party websites that the User may access via links available on the Website: http://rusmuseum.ru/.

1.3 The User is obliged to fully review the Policy prior to commencing use of the Website.

1.4 Accessing the Website or using the Website services constitutes the User’s unconditional acceptance of this Policy and the terms of processing Personal Data specified herein. If the User does not agree with the provisions contained in this Policy, the User must cease using the Website. Any use of the Website by the User shall constitute their full agreement to and acceptance of all terms of this Policy.

1.5 The Federal State Budgetary Institution of Culture “The State Russian Museum” (hereinafter – the Museum) reserves the right to amend the text of this Policy by publishing a new version of the Policy on the Website. The User is obliged to regularly monitor changes made to the Policy. If the User does not agree with the new version of the Policy, the User must immediately stop using the Website. If, after the new version of the Policy takes effect, the User continues to use the Website, such User thereby confirms their full agreement with the new version of the Policy.

1.6 This Policy applies solely to the website http://rusmuseum.ru. The Website may contain links to other websites (vk.com, facebook.com, instagram.com, youtube.com, ok.ru, etc.). The Museum is not responsible for the personal data processing policies of third-party websites that the User may access via links available on the Website’s pages.

1.7 The Museum does not verify the accuracy of the personal data provided by the User, nor does it carry out preliminary moderation of comments left by the User on the Website.

1.8 The Museum is not responsible for information voluntarily disclosed by the User in a publicly accessible form.

1.9 The Museum processes personal data of the following categories of data subjects: visitors to the website http://rusmuseum.ru/.

 

2. DEFINITIONS

The terms used in this Policy shall have the following meanings:

Museum – the Federal State Budgetary Institution of Culture “The State Russian Museum”.

User – an individual using the Website’s Services or having accessed the Website in any form.

Website – an information system owned by the Museum, consisting of a collection of graphic and informational materials, as well as software code and databases that ensure the availability of such materials on the Internet at http://rusmuseum.ru/.

Use of the Website Services – registration/sign-in to the Personal Account; posting comments on articles; sending messages to the Website’s support service; subscribing to newsletters; using the “Ask a Question”, “Feedback” and “Ask the Museum Administration” forms; filling out other feedback forms; and other actions by the User that may result in the collection of the User’s Personal Data.

User’s Personal Information – any information that the User provides about themselves independently during registration (creating an account) or in the process of using the Website, including the User’s personal data.

Personal Data – any information relating directly or indirectly to a specific or identifiable individual (personal data subject).

Technical Data – data that is automatically transmitted via software installed on the User’s device, including IP address, cookie data, information about the User’s browser, access time, the address of the requested page, operating system version and other similar information.

Cookies – a small piece of data sent by a web server and stored on the User’s device, which the web client sends back to the web server as part of an HTTP request each time it attempts to open a website page.

IP Address – a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol.

Processing of Personal Data – any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools. Processing of personal data includes, but is not limited to, collection, recording, systematization, accumulation, storage, clarification (update, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction.

Anonymization of Personal Data – actions as a result of which it becomes impossible, without the use of additional information, to determine the ownership of personal data to a specific personal data subject.

Dissemination of Personal Data – actions aimed at disclosing Personal Data to an indefinite circle of persons.

Provision of Personal Data – actions aimed at disclosing Personal Data to a specific person or a specific circle of persons.

Terms used in this Policy, the meaning of which is not determined in this section, shall have the meaning defined by the regulatory legal acts of the Russian Federation.

 

3. PURPOSES OF PERSONAL DATA PROCESSING

 

By using the Website, the User, in accordance with Federal Law No. 38-FZ of 13 March 2006 “On Advertising”, gives consent to receive electronic mailings of advertising and informational messages to the email address they have provided. The User may unsubscribe from the mailing list by clicking the link provided in the email or by sending a corresponding request to the Museum at the email address specified in Section 12 of this Policy.

 

4. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

 

The legal grounds for the processing of personal data by the Operator are:

– The Constitution of the Russian Federation;

– The Civil Code of the Russian Federation;

– Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and the Protection of Information”;

– Decree of the President of the Russian Federation No. 188 of 6 March 1997 “On Approving the List of Confidential Information”;

– Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012 “On Approving the Requirements for the Protection of Personal Data When Processed in Personal Data Information Systems”;

– Order of the Federal Service for Technical and Export Control of Russia No. 21 of 18 February 2013 “On Approving the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data When Processed in Personal Data Information Systems”;

– Internal documents of the Russian Museum;

– Consent to the processing of personal data on the Website.

 

5. PERSONAL DATA PROCESSING

 

5.1 The Museum processes only those Personal Data that are necessary for providing the User with services (subscription to newsletters, placing orders, filling out feedback forms) and for concluding and executing agreements with the User.

The abovesaid Personal Data are mandatory for registration and are stored in a restricted section of the Museum’s Website.

Categories of Personal Data: first name, last name, patronymic; email address; phone number; delivery address; order pickup point address.

Legal basis for personal data processing: Processing of Personal Data is carried out with the consent of the personal data subject to the processing of their Personal Data.

List of actions: collection; storage; deletion; destruction.

Methods of processing: mixed; without transmission over the internal network of the legal entity; with transmission over the Internet.

 

5.2 The Museum processes the User’s Personal Data solely for the purpose of providing the User with individual services or concluding and executing agreements and contracts with the User, which includes the following:

– To identify the User as a party to the agreement;

– To communicate with the User, sending notifications and other necessary information (notifications on order composition and status, personal responses to questions submitted via feedback forms);

– To provide the User with access to the Website’s services;

– To determine the User’s location in the event of automated requests, abuse, and unauthorized access for the purposes of Website information security, as well as to prevent such activities;

– To provide effective customer and technical support in the event of issues related to the use of the Website;

– To confirm the accuracy and completeness of the personal data provided;

– To send informational and advertising messages about news and offers;

– To fulfil other obligations to the User.

 

Data Collection Point	Categories of Personal Data	Legal Basis for Personal Data Processing	List of Actions	Methods of Processing
Feedback Form	First name, email address, last name (if required), phone number (if required)	Consent of the personal data subject to the processing of their Personal Data	Collection, recording, systematization, storage, use, deletion and destruction of Personal Data	Mixed processing of Personal Data with/without automation tools; without transmission over the internal network of the legal entity; transmission over the Internet
Newsletter Subscription	Email address	Consent of the personal data subject to the processing of their Personal Data	Collection, recording, storage, use, deletion, destruction of Personal Data	Automated processing of Personal Data; transmission over the Internet
Online Store Personal Account	First name, email address	Consent of the personal data subject; performance of a contract	Collection, recording, systematization, storage, use, deletion, destruction of Personal Data	Mixed processing of Personal Data with/without automation tools; transmission over the Internet
Order and Delivery Processing	Last name, first name, patronymic; phone number, delivery address, order pickup point address	Performance of a contract; consent of the personal data subject	Collection, recording, systematization, storage, use, transfer, deletion, destruction of Personal Data	Mixed processing of Personal Data; transmission over the Internet
Cookies and Analytics	IP address, browser and operating system information, cookies, device information; information about the User’s actions on the Website, pages visited, date and time of Website visits	Consent of the personal data subject to the processing of cookies; the Operator’s legitimate interest in ensuring the functioning and security of the Website	Collection, recording, systematization, accumulation, storage, use, anonymization, deletion	Automated processing of Personal Data; transmission over the Internet

 

5.3 Personal Data may also include additional data provided by the User. Such data may include information specified by the User in feedback forms and comments.

 

5.4 The Personal Data processed by the Operator also include User’s data processed through the Yandex.Metrica analytics system, which processes the following Personal Data of visitors and users of the Website in anonymized form:

- IP address;

- browser and operating system information;

- information about the User’s device;

- information about the User’s actions on the Website;

- information about pages visited on the Website;

- information about the time of visits to the Website;

- cookies;

- technical data generated during the use of the Website;

- data generated by Webvisor technology which analyzes user interactions with the Website.

 

Upon the first visit to the Website using a new browser or in private browsing mode, a banner is displayed warning the Visitor about the collection of cookies and requesting the Visitor’s consent to the processing of their cookies.

 

By clicking the “I agree” button or by continuing to use the Website, the Visitor provides their consent to the collection and processing of their cookies by the Operator and third parties, including the Yandex.Metrica web analytics service, in accordance with this Policy, and also confirms their agreement with the provisions of this Policy.

 

The User has the right to change the cookie settings at any time in their browser settings.

 

More detailed information on the processing features can be found at the following link: https://yandex.ru/support/metrica/en/general/cookie-usage

 

5.5 The User’s consent to the Processing of Personal Data is valid for 3 (three) years, but not less than the period necessary for the purposes of Personal Data processing.

 

The consent to the Processing of Personal Data may be withdrawn by the User at any time.

 

Personal Data provided through the feedback form are stored for the period necessary to achieve the purposes of personal data processing, or until the withdrawal of consent by the personal data subject, unless a different storage period is provided for by the legislation of the Russian Federation.

 

Data related to the use of the online store personal account are stored for the duration of the User’s account usage.

 

Cookies and other analytical data may be stored for the periods established by the relevant analytics services and cookies.

 

Personal Data may be stored in backup copies of information systems for the period necessary to ensure restoration and uninterrupted operation of the Website.

 

Information on the storage period for anonymized data by Yandex.Metrica can be found at the following link: https://yandex.ru/support/metrica/en/general/cookie-usage.

 

The Website collects and stores only that personal information which is necessary for the provision of services or the performance of agreements with the User, except in cases where the law provides for the mandatory storage of personal information for a period specified by law.

 

Upon receipt of a notification from the User regarding the withdrawal of consent to the Processing of Personal Data, the Website shall cease processing the User’s Personal Data within no more than 10 (ten) business days from the date of receipt.

 

5.6 A User wishing to block or edit information provided to the Museum, or to cease its processing, may contact the Museum at the email address specified in Section 12 of this Policy. The User agrees that the Museum shall not be held liable if the further provision of services to the User and the performance of agreements with the User become impossible after the destruction or blocking of the Personal Data.

 

The exercise of the User’s rights shall not constitute grounds for terminating the processing of the User’s Personal Data if there are grounds provided for by Federal Law No. 152-FZ of 27 July 2006 “On Personal Data.”

 

5.7 The Museum does not process Personal Data related to race, nationality, political views, religious, philosophical or other beliefs, intimate life, membership in public associations, including trade unions, or biometric data.

 

5.8 The Museum does not carry out cross-border transfer of Personal Data.

 

6. PROCESSING OF TECHNICAL DATA

 

6.1 The Museum may collect anonymized information that does not specifically relate to the User but has been provided by them, for the purpose of providing the User with personalized services and improving the Website’s performance.

 

6.2 During visits to the Website, technical and statistical information is collected from standard server logs. The Museum gains access to the following data: the IP address of the User’s device (or proxy server, if used), the name of the Internet service provider, the domain name, the browser type and operating system, information about the website from which the User navigated to the Website, as well as about the pages visited on the Website, and the date and time of such visits.

 

6.3 The Museum may use cookies and other technologies such as web beacons. The Museum does not store Personal Data or passwords in cookies. The User understands that the hardware and software they use to visit websites on the Internet may have the function of disabling operations with cookies, as well as deleting previously received cookies. It should be noted that some features of the Website may become unavailable after cookies are disabled.

 

6.4 The User understands and agrees that the Museum may transfer to Yandex company information about the User’s visits to the Website through counters such as Yandex.Metrica. The technical specifications of the counters may be changed without notice to the User.

 

7. PROCESSING USERS’ PERSONAL INFORMATION AND ITS TRANSFER TO THIRD PARTIES

 

7.1 The Website stores Users’ Personal Information in accordance with internal regulations.

 

7.2 The confidentiality of the User’s Personal Information is maintained, except in cases where the User voluntarily provides information about themselves for public access to an unlimited circle of persons. When using certain services, the User agrees that a certain part of their personal information becomes publicly available.

 

7.3 The Museum has the right to transfer the User’s personal information to third parties in the following cases:

 

7.3.1 The User has expressed consent to such actions;

7.3.2 The transfer is necessary for the User to use a specific service or to perform a specific agreement with the User;

7.3.3 The transfer is provided for by Russian or other applicable legislation within the framework of the procedure established by law.

 

7.4 The Website Administration takes necessary organizational and technical measures to protect the User’s Personal Information from unlawful or accidental access, destruction, modification, blocking, copying, distribution, as well as from other unlawful actions of third parties.

 

7.5 The Website Administration, together with the User, takes all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the User’s Personal Data.

 

8. OBLIGATIONS OF THE PARTIES

 

8.1 The User is obliged to:

 

8.1.1 Provide the Personal Data necessary for using the Website;

8.1.2 Update the Personal Data in the event of changes to such information.

 

8.2 The Museum is obliged to:

 

8.2.1 Use the Personal Data received solely for the purposes specified in this Privacy Policy;

8.2.2 Not disclose User’s Personal Data without the User’s prior written consent, and not sell, exchange, publish or disclose such information by any other possible means, except as provided for in this Privacy Policy;

8.2.3 To ensure the protection of the User’s Personal Data during their processing, the Museum adopts legal, organizational and technical measures against unauthorized, unlawful or accidental access to the Personal Data, as well as against destruction, modification, blocking, copying, provision and distribution of the Personal Data;

8.2.4 The Museum shall block the Personal Data relating to the relevant User from the moment of the User’s or their legal representative’s request or inquiry, or from the authorized body for the protection of the rights of personal data subjects, for the period of verification in the event of the discovery of inaccurate Personal Data or unlawful actions.

 

9. LIABILITY OF THE PARTIES

 

9.1 The Museum, having failed to fulfil its obligations, shall be liable for losses incurred by the User in connection with the unlawful use of Personal Data, in accordance with the laws of the Russian Federation.

 

9.2 In the event of loss or disclosure of confidential information, the Museum shall not be held liable if such confidential information:

 

9.2.1 Became publicly available prior to its loss or disclosure;

9.2.2 Was received from a third party prior to its receipt by the Website Administration;

9.2.3 Was disclosed with the User’s consent.

 

10. DISPUTE RESOLUTION

 

10.1 If a dispute arises between the Website User and the Museum, both parties shall attempt to resolve it amicably before filing a lawsuit.

 

10.2 The recipient of the claim shall, within 30 calendar days from the date of receipt of the claim, notify the claimant in writing of the results of the claim review.

 

10.3 If an agreement is not reached, the dispute shall be referred for consideration to the Arbitration Court of St Petersburg and the Leningrad Region in accordance with the applicable laws of the Russian Federation.

 

10.4 This Privacy Policy and the relations between the User and the Museum shall be governed by the applicable laws of the Russian Federation.

 

11. ADDITIONAL TERMS

 

11.1 The Museum has the right to amend this Privacy Policy without the User’s consent.

 

11.2 The new Privacy Policy shall take effect from the moment it is posted on the Website, unless otherwise provided for by the new version of the Privacy Policy.

 

11.3 This Policy shall be governed by and construed in accordance with the laws of the Russian Federation. If one or more provisions of the Policy lose their force or are found to be invalid or unenforceable, this shall not affect the validity or applicability of the remaining provisions of the Policy.

 

11.4 Inquiries, suggestions, and claims to the Museum in connection with violations of the rights and interests of the User or third parties, as well as withdrawal of consent to the processing of the Personal Data, may be sent to the contact details specified in Section 12, including by email.

 

12. CONTACT DETAILS

 

Federal State Budgetary Institution of Culture

“The State Russian Museum”

Address: 4 Inzhenernaya Street, St Petersburg, 191186, Russia

Phone: +7 (812) 595-42-04

Email: info@rusmuseum.ru

INN 7830002230, KPP 784101001

OKTMO 40908000, OGRN 1037843029883