Rules for processing personal data

St. Petersburg State Budgetary Cultural Institution St. Petersburg Mussorgsky State Academic Opera and Ballet Theatre — Mikhailovsky Theatre (hereinafter referred to as the administration of mikhailovsky.ru website, Operator, Theatre, we, our, ours, us), address: 1, Arts Square, Central District, St. Petersburg, Russia, 191186, attaches great importance to the protection of your privacy and security of your personal data.

This policy is intended to inform you about the Theatre’s actions to collect, process and protect your personal data to achieve the stated purposes of processing personal data on the website www.mikhailovsky.ru.

We comply with the requirements of Russian legislation in the field of personal data. When processing personal data, we adhere to the principles set out in Art. 5 of the Federal Law of July 27, 2006 No. 152-ÔÇ «On Personal Data» (hereinafter referred to as 152-ÔÇ).

We ask you to carefully study the Confidentiality Policy (hereinafter referred to as the Policy) in order to understand for what purposes we process your personal data, as well as how you can exercise your rights in relation to your personal data processed by us.

If you have questions related to the Policy, including suggestions for improving its understanding and navigation or if you have questions about our processing of your personal data and their protection, you can send us a request using one of the methods indicated in the «Contacts» section.

TERMS

Personal data — any information related to a directly or indirectly identified or identifiable individual (subject of personal data);

Personal data operator (operator) — a legal entity, organizing and (or) carrying out the processing of personal data independently or jointly with other persons, as well as determining the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;

Personal data processıng is any action (operation) or set of actions (operations) with personal data performed using automation tools or without them. Personal data processıng includes but is not limited to the following:
• collection
• recording
• systematization
• accumulation
• storage
• clarification (update, change) • extraction
• usage
• transfer (provision, access)
• depersonalization
• blocking
• deletion
• destruction

Automated personal data processing is personal data processing using computer technology;

Providing personal data is actions aimed at disclosing personal data to a certain person or a certain circle of persons;

Blocking of personal data is temporary cessation of personal data processing (except for cases where processing is necessary to clarify personal data);

Destruction of personal data is actions resulting in impossibility to restore the content of personal data in the personal data information system and (or) destruction of physical personal data carriers;

Depersonalization of personal data is actions resulting in impossibility to determine the relationship of personal data to a specific subject of personal data without the use of additional information;

Personal data information system is a set of personal data contained in databases and information technologies and technical means that ensure their processing;

Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.

SCOPE OF APPLICATION

The policy is intended to inform you about our actions regarding the collection, processing and protection of your personal data in order to achieve our stated purposes of personal data processing on the website www.mikhailovsky.ru.

Please note that our website may contain links to resources from other service providers that we do not control and that are not covered by the Policy.

The Operator is not responsible for third party websites that the User can access via links available on the Website.

PRINCIPLES FOR PERSONAL DATA PROCESSING

Personal data processing in the Theatre is carried out in compliance with the following principles and rules:
• personal data processing is carried out on a legal and fair basis;
• personal data processing is limited to the achievement of specific, predetermined and legitimate purposes;
• personal data processing that is incompatible with the purposes of personal data collection is not permitted;
• it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other;
• only personal data that meets the purposes of their processing are subject to processing;
• the content and volume of processed personal data correspond to the stated purposes of personal data processing and should not be redundant in relation to the stated purposes of their processing;
• during personal data processing, the accuracy of personal data, their sufficiency, and, if necessary, relevance in relation to the purposes of personal data processing are ensured. The theatre takes the necessary measures to delete or clarify incomplete and (or) inaccurate data;
• storage of personal data in a form that makes it possible to identify the subject of personal data is carried out no longer than required by the purposes of their processing, unless the period for personal data storage is established by federal law or an agreement to which the subject of personal data is a party;
• processed personal data are subject to destruction upon achievement of the processing goals or in the event of the loss of the need to achieve these goals, unless otherwise provided by federal law.

PURPOSES OF PERSONAL DATA PROCESSING

The website processes your personal data to achieve the purposes described below. The text in each block numbered «3.1.*. Title» should be considered the text of consent to personal data processing, information about the revocation is described in clauses 4.9 and 4.10.

REGISTRATION IN YOUR PERSONAL ACCOUNT

Purpose of personal data processing: Registration in your personal account, providing access to your personal account, providing Website services that require registration

Personal data processed for the specified purpose: Last name; Name; Patronymic; Telephone; E-mail address.

List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer* (provision, access), blocking, deletion, destruction.

Legal grounds for processing your personal data: consent to personal data processing.

Processing methods: automated personal data processing with transmission of received information via information and telecommunication networks.

Processing and storage periods: until a request to delete your personal account is sent to the Operator.

Destruction procedure: Destruction of personal data is carried out using the information system through irreversible deletion.

* The operator provides the technological ability to purchase tickets within the Pushkin Card program, provides reporting on tickets sold within the Pushkin Card program in the manner established by the Ministry of Culture of the Russian Federation in agreement with the Ministry of Digital Development, Communications and Mass Media of the Russian Federation, transmits information about the purchase of a ticket, its return and cancellation (invalidation) to the register of information about tickets sold; when purchasing tickets within Pushkin Card program, personal data (last name, name, patronymic, telephone number) is transferred to a third party PRO.Êóëüòóðà.ÐÔ platform which is operated by the Ministry of Culture of the Russian Federation.

APPLICATION FOR MEMBERSHIP IN THE FRIENDS CLUB OF THE MIKHAILOVSKY THEATRE

Purpose of personal data processing: Registration of membership in the friends club.

Personal data that is processed for the specified purpose: Last name; Name; Surname; Telephone; E-mail address.
List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), blocking, deletion, destruction.
Legal grounds for personal data processing: consent to personal data processing.

Processing methods: automated personal data processing with transmission of the received information via information and telecommunication networks.

Processing and storage periods: until consent is withdrawn.

Destruction procedure: Personal data destruction is carried out using the information system through irreversible deletion.

SENDING MESSAGES IN THE FEEDBACK FORM

Purpose of personal data processing: Processing incoming messages
Personal data that is processed for the specified purpose: Last name; Name; E-mail address.

List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), blocking, deletion, destruction.

Legal grounds for processing your personal data: consent to personal data processing.

Processing methods: automated personal data processing with transmission of the received information via information and telecommunication networks.

Processing and storage periods: until the end of correspondence as part of a response to an incoming message.

Destruction procedure: Destruction of personal data is carried out using the information system through irreversible deletion.

SUBSCRIPTION TO NEWSLETTERS

Purpose of personal data processing: Subscription to newsletters
Personal data processed for the specified purpose: Email address.

List of actions: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), blocking, deletion, destruction.

Legal grounds for personal data processing: consent to personal data processing.

Processing methods: automated personal data processing with transmission of the received information via information and telecommunication networks.

Processing and storage periods: until an individual unsubscribes from the mailing list
Destruction procedure: Personal data destruction is carried out using the information system through irreversible deletion.

WEBSITE USER RIGHTS

GENERAL INFORMATION ABOUT YOUR RIGHTS

In accordance with 152-ÔÇ, you have the following rights with respect to personal data processing:
• the right to access personal data;
• the right to clarify personal data;
• the right to appeal against our actions or inactions;
• the right to appeal against decisions made solely on the basis of automated personal data processing;
• the right to withdraw consent.

REQUEST FOR ADDITIONAL INFORMATION TO IDENTIFY THE SUBJECT OF PERSONAL DATA

When exercising your rights, we may request additional information that will allow us to reliably identify you. Such information will be required in rare cases.

We try to request the minimum necessary additional information to identify you.

We will not be able to exercise your rights if you do not provide additional information to identify you in response to our request.

CONDITIONS FOR PROVIDING INFORMATION ON YOUR RIGHTS
Information related to exercising your rights is provided free of charge. If your request is manifestly unfounded or excessive, in particular due to its repetitive nature, we may refuse to respond.

RIGHT TO ACCESS YOUR PERSONAL DATA

You have the right to receive reliable information from us about your personal data processing, and, if possible, access to personal data and to the following information:
• confirmation of the fact of personal data processing by the operator;
• legal grounds and purposes of personal data processing;
• the purposes and methods of personal data processing used by the operator;
• name and location of the operator, information about persons (except for the operator’s employees) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the operator or on the basis of federal law;
• processed personal data relating to you, their source;
• terms of personal data processing, including periods of their storage;
• the procedure for exercising your rights in accordance with 152-ÔÇ;
• information about completed or intended cross-border data transfers;
• surname, name, patronymic and address of the person processing personal data on behalf of the operator, if the processing has been or will be entrusted to such a person

RIGHT TO CLARIFY YOUR PERSONAL DATA

We make efforts to identify inaccurate, incomplete or outdated data.

If the data is inaccurate, incomplete or outdated, you have the right to request that we correct the data relating to you without undue delay.

We will notify you after correcting your personal data.

RIGHT TO APPEAL AGAINST OUR ACTIONS OR INACTIONS

You have the right to object to the processing of your personal data in response to our actions or inactions.

To do this, you can contact the territorial office of Roskomnadzor (Federal Service for Supervision of Communications, Information Technology, and Mass Media) in your region.

RIGHT TO APPEAL AGAINST DECISIONS BASED EXCLUSIVELY ON AUTOMATED PERSONAL DATA PROCESSING

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects regarding you or significantly affects you.

You have the right to contact us to appeal against our actions when we make decisions based solely on automated personal data processing, if any.

RIGHT TO WITHDRAW CONSENT

If your data is processed on the basis of consent, you have the right to withdraw it.

HOW YOU CAN EXERCISE YOUR RIGHTS

We provide several ways to exercise your rights:
• write a request to our address: 1, Arts Square, Central District, St. Petersburg 191186, indicating information about the document proving your identity or the identity of your representative (type of document, series and number, issuing authority, date of issue), your full name or full name of a representative, information about the relationship with you, which will confirm the fact of personal data processing by us, your signature or the signature of your representative. Such a request can be sent to our email in the form of an electronic document signed in accordance with the legislation of the Russian Federation on electronic signatures;
• you can also contact us directly by email a.tikunov@mikhailovsky.ru

HOW AND WHEN WE CANNOT EXERCISE YOUR RIGHTS

We may limit the scope of our obligations and your rights (to access data, clarify it, block or delete it) in the following cases:
• personal data processing, including personal data obtained as a result of operational search, counterintelligence and intelligence activities, is carried out for the purposes of national defence, state security and law enforcement;
• personal data processing is carried out by authorities that detained the subject of personal data on suspicion of committing a crime, or brought charges against the subject of personal data in a criminal case, or applied a preventive measure to the subject of personal data before bringing charges, with the exception of cases provided for by the criminal procedure legislation of the Russian Federation if the suspect or accused is allowed to become familiar with such personal data;
• personal data processing is carried out in accordance with the legislation on combating the legalization (laundering) of income from crime and financing of terrorism;
• access of the subject of personal data to his personal data violates the rights and legitimate interests of third parties;
• personal data processing is carried out in cases provided for by the legislation of the Russian Federation on transport security, in order to ensure the sustainable and safe functioning of the transport system, protect the interests of the individual, society and the state in the field of the transport system from acts of illegal interference.
• when we have legal grounds to continue processing your personal data.

There are special conditions for the exercise of some rights without which the right cannot be exercised.

If we cannot exercise your right at your request, we will write you a reasoned refusal.

COOKIES AND AUTOMATIC LOGGING

Cookies files are one of the technologies we use to automatically collect information and improve the quality of content. A cookie is a small text file that is stored on your device (computer, tablet, smartphone, etc.) and contains information about your online activity.

Also, like most other information resources of organizations, our web servers and security systems from time to time store some temporary technical data in their log files.
The operator may use cookies to remember non-personalized personal data about the subjects of personal data when using the website www.mikhailovsky.ru, interactive services and applications, collect and summarize all automatically saved non-personalized information about subjects of personal data and store it in statistics files in order to ensure operation and improve the website performance.

The operator can use statistical data and cookies for their subsequent processing by ßíäåêñ.Ìåòðèêà, ÂÊîíòàêòå retargeting pixel, and the Digital Culture subsystem. Information collected using cookies is also stored on the servers of these systems in accordance with their privacy policies. The subject of personal data can independently manage cookies by changing the browser settings. Changes to user settings that will block cookies may result in the unavailability of certain components of www.mikhailovsky.ru website.

The cookies collected on our website:
• ym_isad
• iwaf_fingerprint
• _gid
• _ga
• _ym_visorc
• _ga_Z64RK3SJH9
• utm_medium
• BX_USER_ID
• _ym_d
• PHPSESSID
• _ym_uid
• BITRIX_CONVERSION_CONTEXT_s1
• utm_source

Cookies are automatically deleted by the operating system and/or web server database management system when they reach their expiration date.

You may decide to withdraw your previously given consent to cookies processing. Webserver will stop processing cookies, the validity of which is not limited by the time of website visiting (persistent cookies), you only need to delete the cookies on the side of your browser in accordance with the instructions and delete such files from the local storage of your mobile device.

DATA SECURITY

The personal data we collect and store is considered confidential information. It is protected from loss, modification or unauthorized access in accordance with the legislation of the Russian Federation in the field of personal data. We use technical means and organizational measures to achieve this. We are constantly improving our data protection systems.

POLICY CHANGE

We reserve the right to change our Policy at any time. We ask that you review our Policy regularly for any updates. We will provide notice of changes to the Policy, if such changes are material, by all means available to us.

CONTACTS

Please note that the contacts specified in this paragraph are used only for interaction on issues of processing and protection of your personal data. Appeals sent by you to the contacts specified in the Policy that are not related to data protection will not be considered. For questions related to the processing and protection of personal data, you can contact directly our person responsible for the personal data organization and processing: Tikunov Artem Sergeevich, a.tikunov@mikhailovsky.ru