Personal Data Processing Policy

Effective date / last updated: 2024-01-01

1. General provisions

This Personal Data Processing Policy (hereinafter — the «Policy») has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» (hereinafter — «Law No. 152-FZ») and defines the procedures for personal data processing and the security measures taken by the Operator.

The personal data operator is ООО «Мезон» (operating the hotel «Villa Deja Vu»), TIN 2317061567, PSRN 1112367005354, registered address: 354364, г. Сочи, ул. Просвещения, 154 (hereinafter — the «Operator»).

The Policy applies to all personal data that the Operator receives from data subjects through the website villadejavu.ru (hereinafter — the «Website»). By using the Website and submitting data through its forms, the user confirms agreement with the terms of this Policy.

The Policy is a publicly available document and is posted at villadejavu.ru/privacy/ in accordance with Part 2 of Article 18.1 of Law No. 152-FZ.

2. Key definitions

Personal data — any information relating directly or indirectly to an identified or identifiable individual (data subject).

Personal data processing — any action or set of actions performed on personal data, whether or not by automated means.

Data subject — an individual whose personal data is being processed.

3. Categories of data subjects

The Operator processes personal data of the following categories of individuals:

— visitors and users of the Website;
— individuals who have submitted enquiries through the contact and booking forms;
— guests (clients of accommodation services).

4. Types of personal data processed

The following personal data, provided voluntarily by the data subject, is processed through the Website forms:

— name;
— phone number;
— Email address;
— subject of the enquiry;
— message text.

The following data may be processed automatically when visiting the Website:

— IP-Address
— Cookie data;
— browser and device information;
— information about pages visited and actions taken on the Website.

The Operator does not process special categories of personal data (relating to race, ethnicity, political or religious views, health status, etc.) or biometric personal data.

5. Purposes of personal data processing

— processing booking requests and contact enquiries;
— entering into and performing accommodation service agreements;
— providing booking status updates and communicating with the guest;
— Improving service quality
— Ensuring Website functionality;
— sending information about promotions and special offers (only with separate consent).

6. Legal basis for processing

Personal data processing is carried out on the basis of:

— the data subject's consent to the processing of their personal data (Article 6, Part 1, Clause 1 of Law No. 152-FZ);
— the necessity to perform a contract to which the data subject is a party (Article 6, Part 1, Clause 5 of Law No. 152-FZ);
— this Policy and the consent forms published on the Website.

7. Processing procedures and conditions

Personal data is processed using automated means and without such means, and includes: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer, blocking, deletion and destruction of personal data.

Recording, systematisation, accumulation, storage, clarification and extraction of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation, in accordance with Part 5 of Article 18 of Law No. 152-FZ.

8. Processing and retention periods

Personal data is processed until the purposes of processing have been achieved or until the data subject withdraws consent. Once the purposes have been achieved or consent has been withdrawn, personal data shall be destroyed within 30 days, unless a different retention period is required by the legislation of the Russian Federation.

9. Transfer of personal data

The Operator does not disclose or transfer personal data to third parties, except in cases provided for by the legislation of the Russian Federation, and in cases where the transfer is necessary for the fulfilment of obligations to the data subject (for example, transfer of data to a payment service, online booking system or transfer service). Such parties process data under confidentiality obligations.

The Operator entrusts the processing of anonymised statistical data to YANDEX LLC (TIN 7736207543) — the provider of the Yandex Metrica web analytics service — in the manner prescribed by Part 3 of Article 6 of Law No. 152-FZ. The composition of such data and the conditions of its processing are set out in Section 10 of this Policy.

The Operator does not carry out cross-border transfer of personal data (to the territory of foreign states).

10. Cookies and web analytics

The Website uses cookies to ensure proper operation, to preserve the user's language preferences and to analyse traffic. Technically necessary cookies are used for the functioning of the Website; analytical and statistical cookies are used only after obtaining the User's consent, expressed through the cookie notification banner.

The website uses the Yandex Metrica web analytics service, provided by YANDEX LLC (TIN 7736207543), which acts as a data processor on behalf of the Operator in accordance with Part 3 of Article 6 of Law No. 152-FZ.

Yandex Metrica collects anonymised data: IP address, cookies, browser and device information, referral sources and User actions on the Website. This data is processed exclusively for statistical purposes — to assess traffic, improve the Website and the quality of service — and is not used to identify a specific User.

The service uses Session Replay (Webvisor) technology, which records anonymised User actions on the Website pages (cursor movements, clicks, scrolling) for usability analysis. The contents of form input fields are masked during recording and are not stored in the recordings.

Data collection by Yandex Metrica begins only after the User has given consent to the use of cookies. Until such consent is given, the Yandex Metrica code is not loaded and no data is transmitted.

Processing and storage of data collected by Yandex Metrica is carried out on servers of YANDEX LLC located in the Russian Federation; no cross-border data transfer takes place. The retention periods and conditions for such data are determined by the documents of YANDEX LLC.

The User may opt out of data processing by web analytics tools: by not providing consent through the cookie banner, by disabling cookies in their browser settings, or by using dedicated browser extensions to block them. Detailed processing terms are set out in the documents of YANDEX LLC (Yandex Metrica Terms of Service and the Yandex Privacy Policy).

11. Personal data protection measures

The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions.

12. Rights of the data subject

The data subject has the right to:

— obtain information regarding the processing of their personal data;
— request clarification, blocking or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
— withdraw consent to personal data processing;
— appeal the actions or inaction of the Operator to the authorised body for the protection of data subjects' rights (Roskomnadzor) or through the courts.

To exercise their rights or to withdraw consent to personal data processing, the data subject shall send a corresponding request to the Operator at the email address contacts@villadejavu.ru or by telephone at +7 (862) 247-11-11. Upon receipt of the withdrawal of consent, the Operator shall cease processing and destroy the personal data within 30 days, except in cases where processing may be continued in accordance with the legislation of the Russian Federation.

13. Policy amendments

The Operator reserves the right to amend this Policy. The revised version shall take effect upon its publication on the Website, unless otherwise provided by the revised version.

14. Operator contact information

ООО «Мезон»
Registered address: 354364, г. Сочи, ул. Просвещения, 154
Hotel address: Sochi, Adler district, ul. Prosveshcheniya 154
Telephone: +7 (862) 247-11-11
Email: contacts@villadejavu.ru
Person responsible for organising personal data processing: Данельян Ашот Ашотович