Personal Data Processing Policy

1. General provisions

1.1. This Policy describes how LLC FOS (OGRN 1147746448871, INN 7704862588, address: 27 Sushchevskaya St., bldg. 2, Moscow, 127055), hereinafter the "Operator", processes and protects the personal data of guests of the Greek taverna Porto Mykonos and users of its services.

1.2. This Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter the "Law") and is published pursuant to Part 2 of Article 18.1 of the Law.

1.3. This Policy applies to the website portomykonos.ru, the delivery service, the mobile app and the chatbot of the Friends of the Taverna programme (hereinafter the "services"). The delivery service, the app and the chatbot run on the ReMarked platform.

1.4. Terms are used in the meaning given to them by the Law.

1.5. Questions and requests concerning personal data: portomykonos.taverna@yandex.ru or by post to: 27 Sushchevskaya St., bldg. 2, Moscow, 127055.

2. How consent is given

Block address: booking

Consent to the processing of personal data is given on the terms of the document "Consent to the Processing of Personal Data" (portomykonos.ru/agreement/) by ticking the consent box:

• in the forms on the website;
• in the table booking window, in the box "I agree to the personal data processing policy";
• when registering in the Friends of the Taverna programme and when placing a delivery order, in the app, in the chatbot and on the delivery website.

Consent to receive advertising is given separately and is not required to use the services.

3. What data, why and for how long

Purpose What data Legal basis Retention period

Responding to a Big Table request and preparing an offer name, phone number, date and time of the event, number of guests, occasion, parameters selected in the calculator, comment, company name (if provided) consent (Clause 1, Part 1, Article 6 of the Law); preparation of a contract at the guest's initiative (Clause 5, Part 1, Article 6) 3 years from the date of the last request or until consent is withdrawn

Issuing a gift certificate name, phone number, denomination, company name (if provided) the same 3 years from the date of the last request or until consent is withdrawn

Booking a table name, phone number, date, time, number of guests, comment consent; performance of a contract (Clause 5, Part 1, Article 6) 3 years from the date of the visit or until consent is withdrawn

Accepting, preparing and delivering an order name, phone number, delivery address, order contents and total, payment method, order comment, order history consent; performance of a contract (Clause 5, Part 1, Article 6) 3 years from the date of the last order; payment documents: 5 years under the law on accounting

Participation in the Friends of the Taverna programme: points, levels, privileges, birthday greetings surname, first name, phone number, email address, date of birth, gender, member card number, points, level, history of visits and orders consent; performance of a contract (Clause 5, Part 1, Article 6) for as long as you participate in the programme and 3 years from the last visit or order, or until consent is withdrawn

Operation of the app and the chatbot: sign-in, push notifications about orders and points phone number, device model, operating system, app version, push notification identifier, IP address consent; performance of a contract (Clause 5, Part 1, Article 6) for as long as the app or the chatbot is used and 3 years thereafter, or until consent is withdrawn

Advertising and informational mailings: promotions, new dishes, events name, phone number, email address, push notification identifier separate consent to receive advertising (document "Consent to Receive Advertising") until consent to advertising is withdrawn

Answering a call and understanding where the guest came from caller's phone number, date, time and duration of the call, call recording, page and referral source to the website, or the number shown in the app consent up to 3 years

Replying to an email email address, name, text of the message consent; reply to the request 3 years from the date of the reply

Understanding how visitors use the website and the delivery website, and improving them cookie identifiers, IP address, browser and device information, pages viewed, referral source, actions on the website consent (Section 7) up to 12 months, according to the cookie lifetime (Section 7)

Bank card details are entered on the bank's payment page. The Operator does not receive or store them.

The Operator does not collect special categories of personal data or biometric data. The Operator does not make decisions that have legal consequences for an individual based solely on automated processing.

4. How data is processed

4.1. Actions performed with data: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (provision, access) to the persons listed in Section 5, blocking, deletion, destruction. With or without the use of automation tools.

4.2. When personal data of citizens of Russia is collected, its recording, systematisation, accumulation, storage, clarification and retrieval are carried out using databases located in Russia (Part 5, Article 18 of the Law).

4.3. Data is stored no longer than required by the purposes in Section 3. When the period expires, the purpose is achieved or consent is withdrawn, the data is destroyed within 30 days, unless the law requires it to be stored longer.

5. To whom data is transferred

5.1. The Operator entrusts processing (Part 3, Article 6 of the Law) to the following persons, only to the extent necessary for their work:

Who Why

Timeweb hosting of the website portomykonos.ru and its database, Russia

ReMarked table booking, delivery service, mobile app, chatbot, Friends of the Taverna programme, mailings, Russia

Mango Office telephony, call recording, call tracking, Russia

Yandex LLC visit statistics (Yandex Metrica), email for requests, Russia

5.2. Data is transferred to government authorities only in cases provided for by law.

6. Rights of guests and users

6.1. You have the right to:

• find out whether the Operator processes your data, what data and for what purpose;
• demand that the data be clarified, blocked or destroyed if it is incomplete, inaccurate, outdated or processed unlawfully;
• withdraw your consent to processing and, separately, your consent to receive advertising;
• appeal against the Operator's actions to Roskomnadzor or in court.

6.2. Requests are sent to the address in Clause 1.5. In your request, please state the name and phone number or email you provided, so that we can find your data.

6.3. The Operator responds within 10 working days of receiving the request. This period may be extended by a further 5 working days, with an explanation of the reason.

6.4. After consent is withdrawn, the Operator stops processing and destroys the data within 30 days, unless there are other lawful grounds for processing it. Withdrawal of consent means leaving the Friends of the Taverna programme.

7. Cookies

Block address: cookie

7.1. Cookies are small files that a website saves in the browser. On the first visit to portomykonos.ru, the website shows a cookie notice. Analytics cookies are set when the page loads.

7.2. Cookies set by the website portomykonos.ru:

Cookie Set by Purpose Lifetime

porto_csrf website protecting forms against request forgery (necessary) 1 day

porto_consent website remembers that you have seen the cookie notice (necessary) 12 months

_ym_uid, _ym_d Yandex Metrica distinguishing visitors in statistics (analytics) 1 year

_ym_isad Yandex Metrica detecting an ad blocker (analytics) 2 days

_ym_visorc Yandex Metrica recording the visit to analyse the website's usability (analytics) up to 30 minutes

mgo_uid, mgo_cnt Mango Office showing a call-tracking number and linking the call to the referral source (analytics) up to 400 days

mgo_sb_first, mgo_sb_current, mgo_sb_migrations Mango Office the same 180 days

mgo_sid, mgo_sb_session Mango Office the same until the end of the visit

7.3. The delivery website runs on the ReMarked platform and also uses Yandex Metrica and call tracking. Its cookies serve the same purposes as the analytics cookies in the table.

7.4. You can refuse cookies in your browser settings by deleting them or blocking them for the website. Without the necessary cookies, forms and ordering will not work.

7.5. The Yandex map and video players (Rutube, VK Video, YouTube) work inside their own windows and set their own cookies under the rules of those services. Video players are loaded only after you click on a video.

8. How data is protected

8.1. The Operator takes measures under Articles 18.1 and 19 of the Law:

• access to guests' data is granted only to employees who need it for their work, using personal passwords;
• the services operate over a secure HTTPS connection;
• backup copies of the website database are encrypted;
• actions in the website management system are logged.

8.2. In the event of a personal data leak, the Operator notifies Roskomnadzor within the time limits established by Part 3.1, Article 21 of the Law.

9. Final provisions

9.1. The Operator may amend this Policy. The new version takes effect from the moment it is published on this page. The date of the version is shown at the top of the page.

9.2. The current version is always available at: portomykonos.ru/processing_agreement/