Privacy policy

1. General provisions and key terms

This personal data processing policy has been prepared in accordance with Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (the Personal Data Law), and sets out the procedure for processing personal data and measures to ensure its security. 1.1. "Elyahu Nagdimaev" on the App Store and "Kiru" on Google Play, hereinafter the "Operator," undertakes to maintain the confidentiality of data and information provided by users when using the "Kiru — fashion social network" software application for Android and iOS mobile devices. 1.2. The Operator considers respect for human and civil rights and freedoms in the processing of personal data, including protection of the rights to privacy and personal and family confidentiality, to be its primary objective and a condition of its activities. 1.3. This policy of the Operator regarding personal data processing (the Policy) applies to all information that the Operator may obtain about visitors to https://kiru.space and users of the "Kiru — fashion social network" mobile app.

2. Key concepts used in the Policy

2.1. Automated personal data processing means processing personal data using computer technology. 2.2. Blocking personal data means temporarily suspending personal data processing, except where processing is necessary to clarify the data. 2.3. Website means the collection of graphic and informational materials, software, and databases that make them available online at https://kiru.space. 2.4. Personal data information system means the personal data contained in databases and the information technologies and technical resources used to process it. 2.5. Anonymization of personal data means actions that make it impossible to determine, without additional information, whether personal data belongs to a particular User or other personal data subject. 2.6. Personal data processing means any action (operation) or set of actions (operations) performed on personal data, with or without automation, including collection, recording, organization, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision, or access), anonymization, blocking, deletion, and destruction. 2.7. Operator means a state or municipal authority, legal entity, or individual that independently or jointly with others organizes and/or carries out personal data processing and determines the purposes of processing, the personal data to be processed, and the actions (operations) performed on it. 2.8. Personal data means any information directly or indirectly relating to an identified or identifiable User of https://kiru.space or the "Kiru — fashion social network" mobile app. 2.9. Personal data authorized by the subject for dissemination means personal data to which the subject has granted access to an unlimited number of persons by consenting to the processing of personal data authorized for dissemination in accordance with the Personal Data Law (hereinafter, personal data authorized for dissemination). 2.10. User means any visitor to https://kiru.space or the "Kiru — fashion social network" mobile app. 2.11. Provision of personal data means actions intended to disclose personal data to a specific person or a defined group of persons. 2.12. Dissemination of personal data means any action intended to disclose personal data to an undefined group of persons (transfer of personal data) or to make it available to an unlimited number of persons, including publication in mass media, placement on information and telecommunications networks, or provision of access in any other way. 2.13. Cross-border transfer of personal data means transferring personal data to the territory of a foreign state, to a foreign public authority, individual, or legal entity. 2.14. Destruction of personal data means any action resulting in the irreversible destruction of personal data, making it impossible to restore its content in a personal data information system, and/or the destruction of physical media containing personal data.

3. The Operator's main rights and obligations

3.1. The Operator has the right to: 3.1.1. Obtain accurate information and/or documents containing personal data from the personal data subject; 3.1.2. Continue processing personal data without the subject's consent after consent has been withdrawn, where grounds provided by the Personal Data Law exist; 3.1.3. Independently determine the measures necessary and sufficient to fulfill the obligations established by the Personal Data Law and regulations adopted under it, unless otherwise provided by that Law or other federal laws. 3.2. The Operator must: 3.2.1. Provide the personal data subject, upon request, with information about the processing of their personal data; 3.2.2. Organize personal data processing in accordance with current Russian legislation; 3.2.3. Respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the Personal Data Law; 3.2.4. Provide the authority responsible for protecting personal data subjects' rights with the necessary information upon its request, within 30 days of receiving that request; 3.2.5. Publish or otherwise provide unrestricted access to this personal data processing Policy; 3.2.6. Take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions; 3.2.7. Stop the transfer (dissemination, provision, or access) and processing of personal data and destroy it in the manner and circumstances prescribed by the Personal Data Law; 3.2.8. Fulfill other obligations established by the Personal Data Law. 3.2.9. The Operator has the right to send users, in its own name, independently or through technical partners, informational and service messages (for example, about the development of the Service and its functionality, the introduction of new features or removal of old ones, surveys, exceeding the Licensee's allocated Personal Disk Space, the approaching expiration of access to Additional Service Functionality, and other informational matters) and advertising messages by email, as well as push notifications. The Licensee may opt out of advertising and other information at any time, without giving a reason, using the methods described below.

4. Main rights and obligations of personal data subjects

4.1. Personal data subjects have the right to: 4.1.1. Obtain information about the processing of their personal data, except as provided by federal laws. The Operator provides this information in an accessible form, and it must not contain personal data relating to other subjects unless there are lawful grounds for disclosure. The information to be provided and the procedure for obtaining it are established by the Personal Data Law; 4.1.2. Require the Operator to clarify, block, or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, and take measures prescribed by law to protect their rights; 4.1.3. Require prior consent for personal data processing for the purpose of marketing goods, works, and services; 4.1.4. Withdraw consent to personal data processing; 4.1.5. Challenge unlawful actions or omissions by the Operator in processing personal data before the authority responsible for protecting personal data subjects' rights or in court; 4.1.6. Exercise other rights provided by Russian legislation. 4.2. Personal data subjects must: 4.2.1. Provide the Operator with accurate information about themselves; 4.2.2. Notify the Operator of clarifications (updates or changes) to their personal data. 4.3. Persons who provide the Operator with inaccurate information about themselves or information about another personal data subject without that person's consent are liable under Russian legislation.

5. Personal data about the User that the Operator may process

5.1. User data provided by the User, including through registration or authentication in the Service, to create an account during registration: including the account name (nickname) and email address. 5.2. Profile photo, contact information created by the User in profile settings, and information created by the User in the Service outside the profile editing section (user content and photographs). 5.3. Contact information provided voluntarily or to contact support (social network links, real name and profile description, and contact details supplied when contacting Kiru support at https://t.me/kiru_support). 5.4. The website also collects and processes anonymized visitor data through web analytics services (Yandex Metrica, Google Analytics, and others). 5.5. The data listed above is collectively referred to as Personal Data throughout this Policy. 5.6. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, or intimate life. 5.7. Processing personal data authorized for dissemination that falls within the special categories specified in Article 10, Part 1 of the Personal Data Law is permitted if the prohibitions and conditions in Article 10.1 of that Law are observed. 5.8. The User's consent to processing personal data authorized for dissemination is obtained separately from other consents to personal data processing. The conditions established, in particular, by Article 10.1 of the Personal Data Law are observed. The authority responsible for protecting personal data subjects' rights establishes requirements for the content of this consent. 5.8.1. The User provides consent to processing personal data authorized for dissemination directly to the Operator. 5.8.2. Within three working days of receiving this consent, the Operator must publish information about processing conditions and any prohibitions and conditions governing the processing of personal data authorized for dissemination by an unlimited number of persons. 5.8.3. The transfer (dissemination, provision, or access) of personal data authorized by the subject for dissemination must cease at any time upon the subject's request. The request must include the subject's surname, first name, patronymic (if any), contact information (phone number, email address, or postal address), and a list of the personal data whose processing must cease. The personal data specified in this request may be processed only by the Operator to whom it is addressed. 5.8.4. Consent to processing personal data authorized for dissemination ceases to apply when the Operator receives the request described in clause 5.8.3 of this personal data processing Policy.

6. Principles of personal data processing

6.1. Personal data is processed lawfully and fairly. 6.2. Personal data processing is limited to achieving specific, predetermined, and lawful purposes. Processing incompatible with the purposes for which the data was collected is prohibited. 6.3. Databases containing personal data processed for mutually incompatible purposes must not be combined. 6.4. Only personal data relevant to the purposes of processing may be processed. 6.5. The content and volume of processed personal data correspond to the stated processing purposes. Processing personal data in excess of what those purposes require is prohibited. 6.6. Personal data processing ensures the accuracy and sufficiency of the data and, where necessary, that it is up to date in relation to the processing purposes. The Operator takes or ensures the necessary measures to delete or clarify incomplete or inaccurate data. 6.7. Personal data is stored in a form that allows the subject to be identified for no longer than required by the processing purposes, unless a storage period is established by federal law or a contract to which the subject is a party, beneficiary, or guarantor. Processed personal data is destroyed or anonymized when the processing purposes have been achieved or are no longer necessary, unless federal law provides otherwise.

7. Purposes of personal data processing

7.1. The purposes of processing the User's personal data are: 7.1.1. Informing the User by email; 7.1.2. Providing the User with access to services, information, and/or materials on https://kiru.space and in the "Kiru — fashion social network" mobile app. 7.2. The Operator may also notify the User about new products and services, special offers, and various events. The User may always opt out of informational messages by emailing the Operator at kiru.space.dev@gmail.com with the subject "Opt out of notifications about new products, services, and special offers." 7.3. Anonymized User data collected through web analytics services is used to gather information about Users' actions on the website and improve the website and its content.

8. Legal grounds for personal data processing

8.1. The legal grounds for the Operator's personal data processing are: 8.1.1. List the legal and regulatory acts governing relationships connected with your activities. For example, if your activities involve information technology, particularly website creation, you may specify Federal Law No. 149-FZ of July 27, 2006, "On Information, Information Technologies and Information Protection"; 8.1.2. The Operator's constituent documents; 8.1.3. Contracts between the Operator and the personal data subject; 8.1.4. Federal laws and other regulations concerning personal data protection; 8.1.5. Users' consent to processing their personal data and personal data authorized for dissemination. 8.2. The Operator processes the User's personal data only when the User independently enters and/or submits it through special forms on the website or sends it to the Operator by email. By completing these forms and/or sending personal data to the Operator, the User agrees to this Policy. 8.3. The Operator processes anonymized User data if permitted by the User's browser settings (file storage and JavaScript enabled). 8.4. The personal data subject independently decides whether to provide personal data and gives consent freely, voluntarily, and in their own interest.

9. Conditions of personal data processing

9.1. Personal data is processed with the subject's consent to the processing of their personal data. 9.2. Processing is necessary to achieve purposes established by an international treaty of the Russian Federation or by law, and to carry out functions, powers, and duties assigned to the Operator by Russian legislation. 9.3. Processing is necessary for the administration of justice or enforcement of a judicial act or an act of another authority or official subject to enforcement under Russian legislation on enforcement proceedings. 9.4. Processing is necessary to perform a contract to which the subject is a party, beneficiary, or guarantor, or to conclude a contract at the subject's initiative or under which the subject will be a beneficiary or guarantor. 9.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant purposes, provided that the subject's rights and freedoms are not violated. 9.6. Personal data to which the subject has granted access to an unlimited number of persons, or access has been granted at the subject's request, is processed (hereinafter, publicly available personal data). 9.7. Personal data subject to publication or mandatory disclosure under federal law is processed (posted on the employment and recruitment website ruscred.site).

10. Collection, storage, transfer, and other personal data processing procedures

10.1. The Operator ensures the security of personal data and takes all possible measures to prevent unauthorized persons from accessing it. 10.2. The User's personal data will never, under any circumstances, be transferred to third parties, except where required to comply with current legislation or where the subject has consented to the Operator transferring data to a third party to fulfill obligations under a civil-law contract. 10.3. If inaccuracies in personal data are identified, the User may update it by sending a notice to the Operator's email address with the subject "Personal data update." 10.4. The processing period is determined by the achievement of the purposes for which the data was collected, unless a different period is established by contract or current legislation. The User may withdraw consent to personal data processing at any time by emailing the Operator with the subject "Withdrawal of consent to personal data processing." 10.5. All information collected by third-party services, including payment systems, communications providers, and other service providers, is stored and processed by those parties (Operators) under their Terms of Use and Privacy Policies. The personal data subject and/or User must independently review these documents in a timely manner. The Operator is not responsible for the actions of third parties, including the service providers described in this clause. 10.6. Prohibitions imposed by the subject on transfer (other than granting access), and prohibitions or conditions on processing (other than obtaining access) of personal data authorized for dissemination, do not apply to processing in state, social, or other public interests defined by Russian legislation. 10.7. The Operator ensures the confidentiality of personal data during processing. 10.8. The Operator stores personal data in a form that allows the subject to be identified for no longer than required by the processing purposes, unless a storage period is established by federal law or a contract to which the subject is a party, beneficiary, or guarantor. 10.9. Processing may cease when its purposes have been achieved, the subject's consent has expired or been withdrawn, or unlawful processing has been identified.

11. Actions performed by the Operator on received personal data

11.1. The Operator collects, records, organizes, accumulates, stores, clarifies (updates or modifies), retrieves, uses, transfers (disseminates, provides, or grants access to), anonymizes, blocks, deletes, and destroys personal data. 11.2. The Operator performs automated processing of personal data, with or without receiving and/or transmitting the resulting information over information and telecommunications networks.

12. Cross-border transfer of personal data

12.1. Before commencing a cross-border transfer, the Operator must ensure that the foreign state to which personal data is to be transferred provides reliable protection of personal data subjects' rights. 12.2. Cross-border transfer to foreign states that do not meet these requirements is permitted only with the subject's written consent to the cross-border transfer of their personal data and/or to perform a contract to which the subject is a party.

13. Confidentiality of personal data

13.1. The Operator and other persons who gain access to personal data must not disclose it to third parties or disseminate it without the subject's consent, unless federal law provides otherwise.

14. Final provisions

14.1. The User may obtain clarification on any questions about personal data processing by contacting the Operator by email. 14.2. This document will reflect any changes to the Operator's personal data processing policy. The Policy remains in effect indefinitely until replaced by a new version.