Privacy and Personal Data Processing Policy
Publication date: April 10, 2026.
This document, "Privacy and Personal Data Processing Policy" (hereinafter referred to as the "Policy"), has been prepared in accordance with Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (hereinafter referred to as Federal Law No. 152-FZ of July 27, 2006). It defines the cases and specifics of personal data processing by P-MART LLC, operating under the trademark "SELBY" (hereinafter referred to as "SELBY"), and is aimed at ensuring the legal rights and freedoms of personal data subjects.
This Policy applies to personal data subjects using SELBY Services (the Website, Program, Mobile App, social networks, public pages, blogs, and other information resources owned by SELBY) (hereinafter referred to as the "Services").
This Policy applies only to information processed during the use of SELBY Services. SELBY does not control and is not responsible for the processing of information by third-party services accessed by Users via links available within SELBY.
This Policy has been compiled taking into account the recommendations of Roskomnadzor for drafting a document defining the operator's policy regarding the processing of personal data, in accordance with the procedure established by Federal Law No. 152-FZ of July 27, 2006.
SELBY reserves the right to amend this Policy. When amending it, the date of the last update is indicated in the current version. The new version of the Policy takes effect from the moment it is posted, unless otherwise provided in the new version of the Policy. The current version is always available on the SELBY website at www.selby.co/.
1. Terms and Definitions
1.1. Integrated Service — a marketplace, payment service, or other resource integrated with the Program via an API.
1.2. Licensee — an individual with legal capacity and recognized as a participant in civil legal relations in accordance with the legislation of the Russian Federation, including an individual who is a professional income taxpayer or a sole proprietor registered under the laws of the state of which such individual is a resident, or a legal entity registered under the laws of the state of which such individual is a resident, who has accepted the terms of the SELBY Offer located at: https://www.selby.co/.
1.3. Personal Account — the User's account, identified by the User's email address or phone number.
1.4. Physical Media — paper, electronic, machine-readable, and other storage media used for reproduction (including copying, downloading, saving, recording) and/or storage of information containing Personal Data, processed in automated form (using computing equipment) and non-automated form (without the use of computing equipment).
1.5. Mobile Application — the Program on mobile devices.
1.6. User — any person using the Services, including the Licensee or their representative (current or potential), Website Visitor, participant in SELBY events and webinars, or Partner, by registering or filling out forms on the Services, visiting the Website, or by any other means.
1.7. Partner — a legal entity registered under the laws of the state of which such person is a resident, or a sole proprietor registered in accordance with the law, or an individual who is a professional income taxpayer and is a participant in the SELBY Partner Program, which is a form of business cooperation between the Partner and SELBY aimed at attracting customers for SELBY or the Partner.
1.8. Client — a fully capable individual, sole proprietor, or legal entity who has placed an order for a product through the Licensee's sales channel using the Program.
1.9. Pre-registration is the automatic completion of registration forms in the Integrated Service using data, including the Licensee's Personal Data, for the Licensee's subsequent independent registration in the Integrated Service.
1.10. Website Visitor is a User who is not authorized in the Personal Account.
1.11. Personal Data Processing is any action (operation) or set of actions (operations) with Personal Data, performed with or without the use of automated tools. Personal data processing includes, but is not limited to: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction.
1.12. Personal Data is any information relating to a directly or indirectly identified or identifiable individual (Personal Data Subject).
1.13. The program is a program for the SELBY Platform computer, which is a set of data and commands intended for the operation of the computer and other computing devices in order to achieve a specific result and the audiovisual displays generated by it, as well as software extensions to it. The scope of the resulting functionality is limited by the tariff plan.
1.14. Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons.
1.15. Website — the SELBY website www.selby.co.
1.16. Personal data subject — an individual who is directly or indirectly identified or identifiable using personal data.
1.17. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to a foreign government agency, to a foreign individual, or to a foreign legal entity.
2. Rights and Obligations of the Personal Data Subject
2.1. The Personal Data Subject has the right to:
2.1.1. Freely, voluntarily, and in their own interests, provide their Personal Data and consent to its processing;
2.1.2. Revoke their consent to the processing of their Personal Data;
2.1.3. Receive information regarding the processing of their Personal Data in the manner, form, and timeframe established by personal data legislation;
2.1.4. Request clarification, blocking, or destruction of their Personal Data if the Personal Data is incomplete, outdated, inaccurate, illegally obtained, is not necessary for the stated purpose of processing, or is used for purposes not previously declared;
2.1.5. Appeal the actions or inactions of SELBY to the authorized body for the protection of the rights of personal data subjects or in court if they believe that SELBY is processing their Personal Data in violation of the requirements of Federal Law No. 152-FZ of July 27, 2006, or otherwise violates their rights and freedoms;
2.1.6. Other rights provided for by personal data protection legislation.
2.2. The personal data subject is obliged to:
2.2.1. Provide SELBY with accurate information about themselves;
2.2.2. Notify SELBY of any changes to their Personal Data.
3. Rights and Obligations of SELBY in Processing Personal Data
3.1. SELBY is obligated to:
3.1.1. Process Personal Data in accordance with the current legislation of the Russian Federation;
3.1.2. Consider requests from the Personal Data Subject (their legal representative) regarding the processing of Personal Data and provide reasoned responses;
3.1.3. Organize the protection of Personal Data in accordance with the requirements of the legislation of the Russian Federation;
3.1.4. Notify the authorized body for the protection of the rights of Personal Data Subjects, upon request of such body, of the necessary information within 10 (ten) business days from the date of receipt of such request;
3.1.5. Take measures to clarify and destroy the Personal Data of the Personal Data Subject in connection with their (their legal representative's) appeal with legal and justified requests;
3.1.6. Ensure the recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of Personal Data of citizens of the Russian Federation using databases located within the Russian Federation.
3.2. SELBY has the right:
3.2.1. If the Personal Data Subject revokes consent to the processing of Personal Data, continue processing it without the consent of the Personal Data Subject, provided there are legal grounds established by the legislation of the Russian Federation;
3.2.2. Receive Personal Data from a person who is not the Personal Data Subject, subject to the provision of confirmation of the existence of legal grounds established by the legislation of the Russian Federation or an agreement between such person and the Personal Data Subject containing the instruction to transfer the Personal Data to SELBY.
3.2.3 Transfer personal data of personal data subjects to third parties, government agencies, municipal authorities, and also entrust the processing of personal data of personal data subjects to third parties/Partners, other persons, if there are appropriate legal grounds and in compliance with the requirements of the legislation of the Russian Federation.
4. Purposes of Personal Data Processing
4.1. SELBY processes Users' personal data for the following purposes:
4.1.1. Organizing the provision of services to Users within the framework of the User Agreement:
4.1.2. List of Users' personal data processed:
● User identifiers;
● Last name, first name, patronymic;
● Telephone number;
● Email address;
● Taxpayer Identification Number (TIN), registered address, date of birth, citizenship, identity document details, bank account number; personal account number, correspondence address (optional);
technical and analytical data, including IP address, browser and device information, cookies, website actions (clicks, events), website referral sources (referrers, UTM tags), geolocation (country, city), number of sessions, date/time of first and last visit and registration;
● Sign of consent to documents;
● Communications: Correspondence between the User and SELBY employees (support).
4.1.3. Category of personal data subjects: Users.
4.1.4. Legal grounds for processing personal data: the user agreement posted on the SELBY website at: https://www.selby.co/, SELBY's offer, agency or other cooperation agreement, and the requirements of Russian Federation legislation.
4.2. SELBY processes the personal data of Clients for the following purposes:
4.2.1. Providing services to Licensees in fulfillment of contractual obligations:
4.2.2. List of personal data processed:
● Client identifiers;
● Last name, first name, patronymic;
● Telephone number;
● Email address;
● Delivery addresses;
● Order and preference data, including order contents and cost, order status, payment and delivery methods, order history, order placement date and time, payment details, cart contents and history, product comparisons and favorites;
● Technical and analytical data, including IP address, browser and device information, cookies, website actions (clicks, events), website referral sources (referrers, UTM tags), geolocation (country, city);
● Document consent sign;
● Communications: correspondence between the Client and the Licensee (support);
● Client reviews (if any);
● Other personal data collected by the Licensee about the Client (date of birth, gender, order comments, etc.).
4.2.3. Category of Personal Data Subjects: Clients.
4.2.4. Legal basis for personal data processing: SELBY's offer, including the assignment to process Clients' Personal Data, accepted by the Licensee; requirements of the legislation of the Russian Federation.
4.3. SELBY processes the personal data of Users and SELBY employees:
4.3.1. Publication of personal data on SELBY information resources for marketing activities:
4.3.2. List of personal data processed:
● Last name, first name, patronymic;
● Job title;
● Name of the employing company;
● Photo;
● Video.
4.3.3. Category of personal data subjects: Users, SELBY employees.
4.3.4. Legal basis for personal data processing: consent to the distribution of personal data.
4.4. For all purposes of processing, SELBY does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, intimate life, criminal record, or biometric Personal Data.
5. Personal Data Processing Terms
5.1. Depending on the purposes of Personal Data Processing defined in Section 4.1. of this Policy, such processing may include, in particular, all or some of the following actions (operations) with Personal Data: collection (receipt), recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), blocking, deletion, and destruction of Personal Data.
5.2. For each purpose of Personal Data Processing specified in Section 4.1. of this Policy, the following methods of Personal Data processing are provided:
(a) automated processing of Personal Data (using computing equipment)
(b) non-automated processing of Personal Data (without the use of computing equipment) with the recording of Personal Data on Tangible Media.
The non-automated processing of Personal Data, including the storage of Physical Media, is carried out in premises that ensure their safety, with the ability to determine the storage locations of Personal Data (Physical Media) in the manner prescribed by the legislation of the Russian Federation.
5.3. The processing and storage periods for Personal Data for each purpose specified in paragraph 4.1 of this Policy are determined taking into account compliance with the requirements, including the terms of personal data processing, defined by the legislation of the Russian Federation, and/or taking into account the provisions of the agreement to which the Personal Data Subject is a party, beneficiary, or guarantor, and/or the consent of the Personal Data Subject. The processing and storage of Personal Data is carried out for no longer than required for the purposes of processing the Personal Data, unless otherwise provided by the legislation of the Russian Federation.
5.4. Destruction of Personal Data processed for the purposes specified in paragraph 4.1. This Policy is implemented in the following cases, unless otherwise provided by Russian Federation law:
● Upon achievement of the purpose(s) of personal data processing or if the need to achieve the purpose(s) of personal data processing is no longer necessary;
● Upon detection of unlawful personal data processing;
● Upon revocation of consent to personal data processing by the personal data subject;
● Upon request by the personal data subject to cease processing of personal data.
Destruction is carried out at SELBY in the following ways:
● Destruction of paper media containing personal data is carried out by shredding it using a paper shredder, which precludes the possibility of further recovery;
● In information systems, destruction is carried out using internal means of the information system. If personal data destruction is not possible, SELBY will block personal data and ensure its destruction within no more than six (6) months, unless otherwise specified by Russian Federation law.
● Destruction on electronic media is carried out by mechanically compromising the integrity of the media, preventing the reading or recovery of personal data, or by deleting it from electronic media using methods and means that guarantee the removal of residual information.
Based on the results of the destruction, a personal data destruction report is drawn up and an entry is made in the electronic event log in the information system.
5.5. SELBY may receive personal data from a third party and/or transfer (provide, access) personal data to a third party, as well as entrust the processing of personal data to a third party, with the consent of the personal data subject to the processing of personal data, including consent provided to the third party, or in the presence of other grounds stipulated by Russian Federation law. SELBY's receipt of personal data from a third party and/or transfer (provision, access) of personal data to a third party, as well as the assignment of personal data processing to a third party, is carried out on the basis of a relevant agreement with the third party, which includes the terms of personal data processing, requirements for ensuring the confidentiality and security of personal data during their processing, and other requirements in accordance with the legislation of the Russian Federation.
5.6. Cross-border transfer of personal data may be carried out by SELBY subject to the conditions and restrictions established by Federal Law No. 152-FZ of July 27, 2006. Prior to the commencement of the Cross-border transfer of personal data, an assessment is made of the measures taken by the third party to whom the Cross-border transfer of personal data is planned to ensure the confidentiality and security of personal data. SELBY has notified Roskomnadzor is obliged.
5.7. SELBY may post Personal Data on the Services in accordance with the purpose specified in Section 4.3.1 of this Policy. Upon consent, the Personal Data Subject has the right to establish conditions and prohibitions on the dissemination of Personal Data. The Company publishes the relevant conditions and prohibitions on the dissemination of Personal Data on the Services where the personal data is disseminated.
5.8. SELBY does not make decisions based solely on automated processing of Personal Data that generate legal consequences for the Personal Data Subject or otherwise affect their rights and legitimate interests.
6. Ensuring the Confidentiality and Security of Personal Data during Processing
6.1. The security of Personal Data processed by SELBY is ensured by the adoption of legal, organizational, and technical measures defined by the current legislation of the Russian Federation, as well as SELBY's internal regulatory documents in the field of information security.
6.2. SELBY ensures the protection of Personal Data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of Personal Data, as well as from other illegal actions with respect to Personal Data, is achieved, in particular, by the following measures:
6.2.1. Appointing a person responsible for organizing the processing of Personal Data;
6.2.2. Developing and approving organizational and administrative documents determining the procedure for processing Personal Data;
6.2.3. Organizing the procedure for the destruction of Personal Data upon expiration of the processing period;
6.2.4. Identifying threats to the security of Personal Data during its processing and creating a threat model based on these threats;
6.2.5. Conducting internal audits to ensure compliance with Personal Data security requirements;
6.2.6. Familiarizing SELBY employees involved in the processing of Personal Data with the requirements of Russian Federation legislation and SELBY's organizational and administrative documents governing the processing and security of Personal Data;
6.2.7. Assessing the harm that may be caused to personal data subjects in the event of a violation of the requirements of Federal Law No. 152-FZ of July 27, 2006, and the relationship between such harm and the measures taken to ensure the fulfillment of obligations stipulated by Federal Law No. 152-FZ of July 27, 2006.
6.2.8. Ensuring antivirus protection of Personal Data information systems;
6.2.9. Updating software on a regular basis;
6.2.10. Network infrastructure protection (access control, firewalling);
6.2.11. Ensuring fault tolerance and backup;
6.2.12. Defining access rules to Personal Data processed in Personal Data information systems;
6.2.13. Registration and recording of information security events;
6.2.14. Defining the procedure for responding to information security incidents;
6.2.15. Conducting external penetration testing;
6.2.16. Assessing the effectiveness of measures taken to ensure the security of Personal Data prior to the commissioning of the Personal Data information system.
6.2.17. Ensuring the confidentiality of Personal Data processed by SELBY is a mandatory requirement for all SELBY employees authorized to process Personal Data in connection with the performance of their job duties. All employees with active employment relationships whose activities involve the receipt, processing, and protection of Personal Data sign a confidentiality agreement, undergo signed information security training, and are personally responsible for compliance with the requirements for the processing and security of Personal Data.
7. Procedure for Processing Requests from Personal Data Subjects
7.1. A Personal Data Subject may contact SELBY regarding the processing of their Personal Data in the following cases:
7.1.1. To obtain information regarding the processing of their (the Personal Data Subject's) Personal Data:
7.1.2. To clarify their Personal Data, block it, or destroy it if it is incomplete, outdated, inaccurate, illegally obtained, or is not necessary for the stated purpose of processing;
7.1.3. To file a complaint about the unlawful processing of their (the Personal Data Subject's) Personal Data by SELBY;
7.1.4. To revoke their consent to the processing of Personal Data.
7.2. A response to the request will be sent to the Personal Data Subject or their representative within 10 (ten) days from the date of the request, with the possibility of an extension of up to 5 (five) business days.
7.3. If the request for information or action specified in the request is denied, the Data Subject will receive a reasoned response containing a reference to Part 8 of Article 14 of Federal Law No. 152-FZ of July 27, 2006, or another legal provision serving as the basis for such refusal, within 10 (ten) days from the date of the request by the Data Subject or their representative.
8. Contacts and Questions Regarding Personal Data
All inquiries regarding the processing of personal data should be sent to the following email address: info@selby.co or to the following postal address: 454 080, Chelyabinsk Region, Chelyabinsk, Entuziastov Street, Building No. 15, Office 8. P-MART LLC.
April 2026
This Policy applies to personal data subjects using SELBY Services (the Website, Program, Mobile App, social networks, public pages, blogs, and other information resources owned by SELBY) (hereinafter referred to as the "Services").
This Policy applies only to information processed during the use of SELBY Services. SELBY does not control and is not responsible for the processing of information by third-party services accessed by Users via links available within SELBY.
This Policy has been compiled taking into account the recommendations of Roskomnadzor for drafting a document defining the operator's policy regarding the processing of personal data, in accordance with the procedure established by Federal Law No. 152-FZ of July 27, 2006.
SELBY reserves the right to amend this Policy. When amending it, the date of the last update is indicated in the current version. The new version of the Policy takes effect from the moment it is posted, unless otherwise provided in the new version of the Policy. The current version is always available on the SELBY website at www.selby.co/.
1. Terms and Definitions
1.1. Integrated Service — a marketplace, payment service, or other resource integrated with the Program via an API.
1.2. Licensee — an individual with legal capacity and recognized as a participant in civil legal relations in accordance with the legislation of the Russian Federation, including an individual who is a professional income taxpayer or a sole proprietor registered under the laws of the state of which such individual is a resident, or a legal entity registered under the laws of the state of which such individual is a resident, who has accepted the terms of the SELBY Offer located at: https://www.selby.co/.
1.3. Personal Account — the User's account, identified by the User's email address or phone number.
1.4. Physical Media — paper, electronic, machine-readable, and other storage media used for reproduction (including copying, downloading, saving, recording) and/or storage of information containing Personal Data, processed in automated form (using computing equipment) and non-automated form (without the use of computing equipment).
1.5. Mobile Application — the Program on mobile devices.
1.6. User — any person using the Services, including the Licensee or their representative (current or potential), Website Visitor, participant in SELBY events and webinars, or Partner, by registering or filling out forms on the Services, visiting the Website, or by any other means.
1.7. Partner — a legal entity registered under the laws of the state of which such person is a resident, or a sole proprietor registered in accordance with the law, or an individual who is a professional income taxpayer and is a participant in the SELBY Partner Program, which is a form of business cooperation between the Partner and SELBY aimed at attracting customers for SELBY or the Partner.
1.8. Client — a fully capable individual, sole proprietor, or legal entity who has placed an order for a product through the Licensee's sales channel using the Program.
1.9. Pre-registration is the automatic completion of registration forms in the Integrated Service using data, including the Licensee's Personal Data, for the Licensee's subsequent independent registration in the Integrated Service.
1.10. Website Visitor is a User who is not authorized in the Personal Account.
1.11. Personal Data Processing is any action (operation) or set of actions (operations) with Personal Data, performed with or without the use of automated tools. Personal data processing includes, but is not limited to: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction.
1.12. Personal Data is any information relating to a directly or indirectly identified or identifiable individual (Personal Data Subject).
1.13. The program is a program for the SELBY Platform computer, which is a set of data and commands intended for the operation of the computer and other computing devices in order to achieve a specific result and the audiovisual displays generated by it, as well as software extensions to it. The scope of the resulting functionality is limited by the tariff plan.
1.14. Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons.
1.15. Website — the SELBY website www.selby.co.
1.16. Personal data subject — an individual who is directly or indirectly identified or identifiable using personal data.
1.17. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to a foreign government agency, to a foreign individual, or to a foreign legal entity.
2. Rights and Obligations of the Personal Data Subject
2.1. The Personal Data Subject has the right to:
2.1.1. Freely, voluntarily, and in their own interests, provide their Personal Data and consent to its processing;
2.1.2. Revoke their consent to the processing of their Personal Data;
2.1.3. Receive information regarding the processing of their Personal Data in the manner, form, and timeframe established by personal data legislation;
2.1.4. Request clarification, blocking, or destruction of their Personal Data if the Personal Data is incomplete, outdated, inaccurate, illegally obtained, is not necessary for the stated purpose of processing, or is used for purposes not previously declared;
2.1.5. Appeal the actions or inactions of SELBY to the authorized body for the protection of the rights of personal data subjects or in court if they believe that SELBY is processing their Personal Data in violation of the requirements of Federal Law No. 152-FZ of July 27, 2006, or otherwise violates their rights and freedoms;
2.1.6. Other rights provided for by personal data protection legislation.
2.2. The personal data subject is obliged to:
2.2.1. Provide SELBY with accurate information about themselves;
2.2.2. Notify SELBY of any changes to their Personal Data.
3. Rights and Obligations of SELBY in Processing Personal Data
3.1. SELBY is obligated to:
3.1.1. Process Personal Data in accordance with the current legislation of the Russian Federation;
3.1.2. Consider requests from the Personal Data Subject (their legal representative) regarding the processing of Personal Data and provide reasoned responses;
3.1.3. Organize the protection of Personal Data in accordance with the requirements of the legislation of the Russian Federation;
3.1.4. Notify the authorized body for the protection of the rights of Personal Data Subjects, upon request of such body, of the necessary information within 10 (ten) business days from the date of receipt of such request;
3.1.5. Take measures to clarify and destroy the Personal Data of the Personal Data Subject in connection with their (their legal representative's) appeal with legal and justified requests;
3.1.6. Ensure the recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of Personal Data of citizens of the Russian Federation using databases located within the Russian Federation.
3.2. SELBY has the right:
3.2.1. If the Personal Data Subject revokes consent to the processing of Personal Data, continue processing it without the consent of the Personal Data Subject, provided there are legal grounds established by the legislation of the Russian Federation;
3.2.2. Receive Personal Data from a person who is not the Personal Data Subject, subject to the provision of confirmation of the existence of legal grounds established by the legislation of the Russian Federation or an agreement between such person and the Personal Data Subject containing the instruction to transfer the Personal Data to SELBY.
3.2.3 Transfer personal data of personal data subjects to third parties, government agencies, municipal authorities, and also entrust the processing of personal data of personal data subjects to third parties/Partners, other persons, if there are appropriate legal grounds and in compliance with the requirements of the legislation of the Russian Federation.
4. Purposes of Personal Data Processing
4.1. SELBY processes Users' personal data for the following purposes:
4.1.1. Organizing the provision of services to Users within the framework of the User Agreement:
4.1.2. List of Users' personal data processed:
● User identifiers;
● Last name, first name, patronymic;
● Telephone number;
● Email address;
● Taxpayer Identification Number (TIN), registered address, date of birth, citizenship, identity document details, bank account number; personal account number, correspondence address (optional);
technical and analytical data, including IP address, browser and device information, cookies, website actions (clicks, events), website referral sources (referrers, UTM tags), geolocation (country, city), number of sessions, date/time of first and last visit and registration;
● Sign of consent to documents;
● Communications: Correspondence between the User and SELBY employees (support).
4.1.3. Category of personal data subjects: Users.
4.1.4. Legal grounds for processing personal data: the user agreement posted on the SELBY website at: https://www.selby.co/, SELBY's offer, agency or other cooperation agreement, and the requirements of Russian Federation legislation.
4.2. SELBY processes the personal data of Clients for the following purposes:
4.2.1. Providing services to Licensees in fulfillment of contractual obligations:
4.2.2. List of personal data processed:
● Client identifiers;
● Last name, first name, patronymic;
● Telephone number;
● Email address;
● Delivery addresses;
● Order and preference data, including order contents and cost, order status, payment and delivery methods, order history, order placement date and time, payment details, cart contents and history, product comparisons and favorites;
● Technical and analytical data, including IP address, browser and device information, cookies, website actions (clicks, events), website referral sources (referrers, UTM tags), geolocation (country, city);
● Document consent sign;
● Communications: correspondence between the Client and the Licensee (support);
● Client reviews (if any);
● Other personal data collected by the Licensee about the Client (date of birth, gender, order comments, etc.).
4.2.3. Category of Personal Data Subjects: Clients.
4.2.4. Legal basis for personal data processing: SELBY's offer, including the assignment to process Clients' Personal Data, accepted by the Licensee; requirements of the legislation of the Russian Federation.
4.3. SELBY processes the personal data of Users and SELBY employees:
4.3.1. Publication of personal data on SELBY information resources for marketing activities:
4.3.2. List of personal data processed:
● Last name, first name, patronymic;
● Job title;
● Name of the employing company;
● Photo;
● Video.
4.3.3. Category of personal data subjects: Users, SELBY employees.
4.3.4. Legal basis for personal data processing: consent to the distribution of personal data.
4.4. For all purposes of processing, SELBY does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, intimate life, criminal record, or biometric Personal Data.
5. Personal Data Processing Terms
5.1. Depending on the purposes of Personal Data Processing defined in Section 4.1. of this Policy, such processing may include, in particular, all or some of the following actions (operations) with Personal Data: collection (receipt), recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), blocking, deletion, and destruction of Personal Data.
5.2. For each purpose of Personal Data Processing specified in Section 4.1. of this Policy, the following methods of Personal Data processing are provided:
(a) automated processing of Personal Data (using computing equipment)
(b) non-automated processing of Personal Data (without the use of computing equipment) with the recording of Personal Data on Tangible Media.
The non-automated processing of Personal Data, including the storage of Physical Media, is carried out in premises that ensure their safety, with the ability to determine the storage locations of Personal Data (Physical Media) in the manner prescribed by the legislation of the Russian Federation.
5.3. The processing and storage periods for Personal Data for each purpose specified in paragraph 4.1 of this Policy are determined taking into account compliance with the requirements, including the terms of personal data processing, defined by the legislation of the Russian Federation, and/or taking into account the provisions of the agreement to which the Personal Data Subject is a party, beneficiary, or guarantor, and/or the consent of the Personal Data Subject. The processing and storage of Personal Data is carried out for no longer than required for the purposes of processing the Personal Data, unless otherwise provided by the legislation of the Russian Federation.
5.4. Destruction of Personal Data processed for the purposes specified in paragraph 4.1. This Policy is implemented in the following cases, unless otherwise provided by Russian Federation law:
● Upon achievement of the purpose(s) of personal data processing or if the need to achieve the purpose(s) of personal data processing is no longer necessary;
● Upon detection of unlawful personal data processing;
● Upon revocation of consent to personal data processing by the personal data subject;
● Upon request by the personal data subject to cease processing of personal data.
Destruction is carried out at SELBY in the following ways:
● Destruction of paper media containing personal data is carried out by shredding it using a paper shredder, which precludes the possibility of further recovery;
● In information systems, destruction is carried out using internal means of the information system. If personal data destruction is not possible, SELBY will block personal data and ensure its destruction within no more than six (6) months, unless otherwise specified by Russian Federation law.
● Destruction on electronic media is carried out by mechanically compromising the integrity of the media, preventing the reading or recovery of personal data, or by deleting it from electronic media using methods and means that guarantee the removal of residual information.
Based on the results of the destruction, a personal data destruction report is drawn up and an entry is made in the electronic event log in the information system.
5.5. SELBY may receive personal data from a third party and/or transfer (provide, access) personal data to a third party, as well as entrust the processing of personal data to a third party, with the consent of the personal data subject to the processing of personal data, including consent provided to the third party, or in the presence of other grounds stipulated by Russian Federation law. SELBY's receipt of personal data from a third party and/or transfer (provision, access) of personal data to a third party, as well as the assignment of personal data processing to a third party, is carried out on the basis of a relevant agreement with the third party, which includes the terms of personal data processing, requirements for ensuring the confidentiality and security of personal data during their processing, and other requirements in accordance with the legislation of the Russian Federation.
5.6. Cross-border transfer of personal data may be carried out by SELBY subject to the conditions and restrictions established by Federal Law No. 152-FZ of July 27, 2006. Prior to the commencement of the Cross-border transfer of personal data, an assessment is made of the measures taken by the third party to whom the Cross-border transfer of personal data is planned to ensure the confidentiality and security of personal data. SELBY has notified Roskomnadzor is obliged.
5.7. SELBY may post Personal Data on the Services in accordance with the purpose specified in Section 4.3.1 of this Policy. Upon consent, the Personal Data Subject has the right to establish conditions and prohibitions on the dissemination of Personal Data. The Company publishes the relevant conditions and prohibitions on the dissemination of Personal Data on the Services where the personal data is disseminated.
5.8. SELBY does not make decisions based solely on automated processing of Personal Data that generate legal consequences for the Personal Data Subject or otherwise affect their rights and legitimate interests.
6. Ensuring the Confidentiality and Security of Personal Data during Processing
6.1. The security of Personal Data processed by SELBY is ensured by the adoption of legal, organizational, and technical measures defined by the current legislation of the Russian Federation, as well as SELBY's internal regulatory documents in the field of information security.
6.2. SELBY ensures the protection of Personal Data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of Personal Data, as well as from other illegal actions with respect to Personal Data, is achieved, in particular, by the following measures:
6.2.1. Appointing a person responsible for organizing the processing of Personal Data;
6.2.2. Developing and approving organizational and administrative documents determining the procedure for processing Personal Data;
6.2.3. Organizing the procedure for the destruction of Personal Data upon expiration of the processing period;
6.2.4. Identifying threats to the security of Personal Data during its processing and creating a threat model based on these threats;
6.2.5. Conducting internal audits to ensure compliance with Personal Data security requirements;
6.2.6. Familiarizing SELBY employees involved in the processing of Personal Data with the requirements of Russian Federation legislation and SELBY's organizational and administrative documents governing the processing and security of Personal Data;
6.2.7. Assessing the harm that may be caused to personal data subjects in the event of a violation of the requirements of Federal Law No. 152-FZ of July 27, 2006, and the relationship between such harm and the measures taken to ensure the fulfillment of obligations stipulated by Federal Law No. 152-FZ of July 27, 2006.
6.2.8. Ensuring antivirus protection of Personal Data information systems;
6.2.9. Updating software on a regular basis;
6.2.10. Network infrastructure protection (access control, firewalling);
6.2.11. Ensuring fault tolerance and backup;
6.2.12. Defining access rules to Personal Data processed in Personal Data information systems;
6.2.13. Registration and recording of information security events;
6.2.14. Defining the procedure for responding to information security incidents;
6.2.15. Conducting external penetration testing;
6.2.16. Assessing the effectiveness of measures taken to ensure the security of Personal Data prior to the commissioning of the Personal Data information system.
6.2.17. Ensuring the confidentiality of Personal Data processed by SELBY is a mandatory requirement for all SELBY employees authorized to process Personal Data in connection with the performance of their job duties. All employees with active employment relationships whose activities involve the receipt, processing, and protection of Personal Data sign a confidentiality agreement, undergo signed information security training, and are personally responsible for compliance with the requirements for the processing and security of Personal Data.
7. Procedure for Processing Requests from Personal Data Subjects
7.1. A Personal Data Subject may contact SELBY regarding the processing of their Personal Data in the following cases:
7.1.1. To obtain information regarding the processing of their (the Personal Data Subject's) Personal Data:
7.1.2. To clarify their Personal Data, block it, or destroy it if it is incomplete, outdated, inaccurate, illegally obtained, or is not necessary for the stated purpose of processing;
7.1.3. To file a complaint about the unlawful processing of their (the Personal Data Subject's) Personal Data by SELBY;
7.1.4. To revoke their consent to the processing of Personal Data.
7.2. A response to the request will be sent to the Personal Data Subject or their representative within 10 (ten) days from the date of the request, with the possibility of an extension of up to 5 (five) business days.
7.3. If the request for information or action specified in the request is denied, the Data Subject will receive a reasoned response containing a reference to Part 8 of Article 14 of Federal Law No. 152-FZ of July 27, 2006, or another legal provision serving as the basis for such refusal, within 10 (ten) days from the date of the request by the Data Subject or their representative.
8. Contacts and Questions Regarding Personal Data
All inquiries regarding the processing of personal data should be sent to the following email address: info@selby.co or to the following postal address: 454 080, Chelyabinsk Region, Chelyabinsk, Entuziastov Street, Building No. 15, Office 8. P-MART LLC.
April 2026