Policy on the Processing of Personal Data

Effective date: 26 June 2026

This Policy on the processing of personal data (hereinafter — the «Policy») has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 «On Personal Data» (hereinafter — 'Federal Law No. 152-FZ "On Personal Data"') and defines the procedure for processing and the measures to ensure the security of personal data taken by the Limited Liability Company «BRUSHGROUPP» (hereinafter — the «Operator») in relation to users of the website https://myorganics.ru (hereinafter — the «Site»).

1. General provisions

1.1. This Policy defines the purposes, legal grounds, conditions and methods of processing personal data, the rights of personal data subjects, as well as the requirements implemented by the Operator for the protection of the personal data being processed.

1.2. The Policy applies to all information that the Operator may obtain about users in the course of their use of the Site and completion of the feedback forms posted on the Site.

1.3. The Operator processes personal data on the principles of lawfulness and fairness, limits itself to the achievement of specific, predefined and lawful purposes, does not allow the processing of data that is incompatible with the purposes of its collection, and does not combine databases containing personal data the processing of which is carried out for purposes incompatible with one another.

1.4. Use of the Site and submission of a request through the feedback forms constitutes the user's unconditional consent to this Policy and the conditions for the processing of his personal data specified herein. In the event of disagreement with the conditions of the Policy, the user must refrain from using the relevant services of the Site.

1.5. This Policy does not apply to the actions and internet resources of third parties to which the user may navigate via links available on the Site.

2. Basic concepts

The following basic concepts are used in this Policy:

  • Personal data — any information relating directly or indirectly to an identified or identifiable natural person (a personal data subject).
  • Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion, and destruction of personal data.
  • Operator — a state body, municipal body, legal entity or natural person which, independently or jointly with other persons, organises and (or) carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with personal data. The Operator under this Policy is OOO BRUSHGROUPP (BRUSHGROUPP LLC).
  • Personal data subject — a natural person to whom the relevant personal data relate (a user of the Site).
  • Consent to the processing of personal data — a free, specific, informed and conscious expression of will by the personal data subject to the processing of his personal data.
  • Automated processing of personal data — the processing of personal data by means of computer technology.
  • Dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons.
  • Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons.
  • Blocking of personal data — the temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify the personal data).
  • Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and (or) as a result of which the material carriers of personal data are destroyed.
  • Depersonalisation of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the ownership of personal data by a specific personal data subject.
  • Cookies — small text files saved in the user's browser when visiting the Site and intended to ensure the operation and improve the functionality of the Site.

3. Personal data operator

The Operator that organises and carries out the processing of personal data is:

  • Full name: Limited Liability Company «BRUSHGROUPP» (OOO BRUSHGROUPP / BRUSHGROUPP LLC);
  • INN: 1685006355;
  • KPP: 168501001;
  • OGRN: 1221600073012;
  • Registered address: Chapaevsky Pereulok 6, premises 2/1, Moscow, 125057, Russia;
  • Telephone: +7 985 875-88-82;
  • Email address: support@myorganics.ru;
  • Website: https://myorganics.ru.

4. Categories of subjects and processed personal data

4.1. Personal data subjects are natural persons — users of the Site who voluntarily submit their data through the feedback forms posted on the Site.

4.2. The Operator processes the personal data provided by the user when completing the feedback forms. Depending on the form used, such data may include:

  • first name;
  • last name;
  • email address;
  • telephone number;
  • the text of the request (message) and other information voluntarily provided by the user in the free fields of the form;
  • salon name and city (when using the form for salons / professional partners).

4.3. When visiting the Site, technical data may be collected automatically: IP address, information about the browser and device, the date and time of access, and cookies. Such data is processed in a depersonalised form for the purposes of ensuring the functioning of the Site and its statistical analysis.

4.4. The Operator does not process special categories of personal data (concerning racial or ethnic origin, political views, religious or philosophical beliefs, state of health, or intimate life) or biometric personal data.

4.5. The Operator does not deliberately collect or process the personal data of minors. By completing the forms on the Site, the user confirms that he is of full legal age and has legal capacity.

5. Purposes of processing personal data

The Operator processes personal data for the following purposes:

  • reviewing and processing requests, enquiries and messages submitted by the user through the feedback forms of the Site;
  • maintaining feedback with the user, including sending replies, notifications and information on the substance of the request;
  • providing the user with information about the products of the MY.ORGANICS brand, including at the user's request;
  • reviewing applications from professional partners and salons regarding cooperation;
  • processing applications related to enquiries about product quality and returns;
  • ensuring the functioning, security and improvement of the operation of the Site, and conducting depersonalised statistics and analytics of its use;
  • compliance with the requirements of the legislation of the Russian Federation.

6. Legal grounds for processing personal data

6.1. The legal grounds for processing personal data are:

  • Federal Law No. 152-FZ of 27.07.2006 «On Personal Data»;
  • the consent of the personal data subject to the processing of his personal data (clause 1 of part 1 of Article 6 of Federal Law No. 152-FZ "On Personal Data"), expressed by voluntarily completing and submitting the feedback forms on the Site;
  • other regulatory legal acts of the Russian Federation in the field of the protection of personal data and information;
  • the constituent documents of the Operator.

6.2. Consent to the processing of personal data is given by the subject freely, by his own will and in his own interest. Consent to processing is deemed to be given from the moment the completed feedback form is submitted and the corresponding consent mark is checked (where present in the form).

6.3. The processing of personal data for the purposes of informing about products, promotions and news (advertising mailings) is carried out solely where separate consent of the user is present and may be terminated at his request at any time.

7. Procedure and conditions for processing personal data. Localisation within the territory of the Russian Federation

7.1. The processing of personal data is carried out both with and without the use of automation tools.

7.2. The Operator ensures the recording, systematisation, accumulation, storage, clarification (updating, modification) and extraction of the personal data of citizens of the Russian Federation using databases located within the territory of the Russian Federation, in accordance with part 5 of Article 18 of Federal Law No. 152-FZ "On Personal Data". The servers and databases of the Site are located within the territory of the Russian Federation (hosting in Moscow).

7.3. The Operator takes reasonable and sufficient legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as from other unlawful actions in respect of personal data.

7.4. The conditions for terminating the processing of personal data are the achievement of the purposes of processing, the expiry of the consent period, the withdrawal of consent by the personal data subject, as well as the detection of unlawful processing of personal data.

8. Transfer of personal data to third parties

8.1. The Operator does not sell or disclose personal data to third parties, except in the cases expressly provided for by this Policy and the legislation of the Russian Federation.

8.2. The Operator has the right to entrust the processing of personal data to third parties (including the hosting service provider located within the territory of the Russian Federation) on the basis of an agreement concluded with such persons, provided that they comply with the requirements of Federal Law No. 152-FZ "On Personal Data" and ensure the confidentiality and security of personal data.

8.3. The transfer of personal data to authorised state bodies is carried out on the grounds and in the manner established by the legislation of the Russian Federation.

8.4. Cross-border transfer of personal data (transfer to the territory of foreign states) is not carried out by the Operator.

9. Periods of processing and storage of personal data. Destruction

9.1. Personal data is processed and stored for the period necessary to achieve the purposes of its processing, unless a different period is established by the legislation of the Russian Federation.

9.2. Personal data is subject to destruction or depersonalisation upon the achievement of the purposes of processing or in the event that the need to achieve these purposes is lost, as well as in the event of the subject's withdrawal of consent to the processing of personal data, unless otherwise provided by law.

9.3. In the event of withdrawal of consent and (or) a request to terminate processing, the Operator terminates the processing of personal data and destroys it within a period not exceeding thirty days from the date of receipt of the relevant request, except in cases where processing must be continued by virtue of the requirements of the legislation.

10. Rights of the personal data subject

10.1. The personal data subject has the right to obtain information concerning the processing of his personal data to the extent provided for by Article 14 of Federal Law No. 152-FZ "On Personal Data", including:

  • to confirmation of the fact of the processing of personal data by the Operator;
  • to obtain information about the legal grounds and purposes of processing, the methods of processing, and the periods of processing and storage of personal data;
  • to review his personal data;
  • to clarify (update, modify) his personal data in the event that it is incomplete, outdated or inaccurate;
  • to block or destroy personal data in the event that it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
  • to withdraw consent previously given to the processing of personal data;
  • to take the measures provided for by law to protect his rights, including to appeal the actions or inaction of the Operator to the authorised body or through the courts.

10.2. To exercise the said rights, the personal data subject sends the Operator a corresponding request (enquiry) to the email address support@myorganics.ru or to the postal address of the Operator specified in section 3 of this Policy. The request must contain information enabling the identification of the personal data subject and the substance of the request.

10.3. The Operator reviews the request and provides a response within the periods established by Federal Law No. 152-FZ "On Personal Data".

10.4. The withdrawal of consent to the processing of personal data is carried out by sending the Operator a written notice to the specified contact details. Upon receipt of such notice, the Operator terminates the processing of personal data in the manner provided for in section 9 of this Policy.

11. Cookies

11.1. The Site uses cookies to ensure correct operation, to save user settings (including the choice of language), as well as for the depersonalised analysis of the use of the Site.

11.2. The user has the right at any time to disable or restrict the use of cookies in the settings of his browser. Disabling technically necessary cookies may affect the operability of certain functions of the Site.

11.3. Detailed information about the cookies used is provided in the Cookie Policy.

12. Measures to ensure the security of personal data

12.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data in accordance with Articles 18.1 and 19 of Federal Law No. 152-FZ "On Personal Data", including:

  • appointing a person responsible for organising the processing of personal data (where necessary);
  • issuing internal documents defining the policy on the processing of personal data and the measures for their protection;
  • applying organisational and technical measures to ensure the security of personal data during their processing in information systems;
  • restricting and delimiting access to personal data;
  • applying information protection tools, including encryption during data transfer (the HTTPS protocol);
  • monitoring the measures taken to ensure the security of personal data and assessing the effectiveness of such measures;
  • ensuring the detection of facts of unauthorised access to personal data and the adoption of appropriate response measures.

12.2. Access to personal data is granted only to authorised employees of the Operator, who are obliged to observe the confidentiality regime.

13. Amendment of the Policy

13.1. The Operator has the right to make amendments to this Policy. When amendments are made, the date on which the amendments take effect is indicated in the current version.

13.2. The new version of the Policy takes effect from the moment it is posted on the Site, unless otherwise provided by the new version. The current version of the Policy is permanently available on this page at https://myorganics.ru.

14. Contacts and enquiries. Appeals

14.1. For all questions related to the processing of personal data, as well as to exercise his rights, the personal data subject may contact the Operator:

  • OOO BRUSHGROUPP (BRUSHGROUPP LLC);
  • Address: Chapaevsky Pereulok 6, premises 2/1, Moscow, 125057, Russia;
  • Email: support@myorganics.ru;
  • Telephone: +7 985 875-88-82.

14.2. In the event of disagreement with the actions or inaction of the Operator in the processing of personal data, the personal data subject has the right to appeal such actions (inaction) to the authorised body for the protection of the rights of personal data subjects — the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), as well as through the courts in accordance with the legislation of the Russian Federation.