Historical Geography Journal ISSN 2782-6511 (Print) | ISSN 3034-5286 (Online)

1. Purpose and Scope of the Document
1.1. This Privacy Policy (hereinafter – the “Policy”) has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (hereinafter – “152-FZ”) and is the official document of the Autonomous Nonprofit Organization “Research Center ‘Young Historians of the Urals'” (hereinafter – the “Operator”). It defines the procedure, purposes of processing, and measures to ensure the security of personal data of individuals who use the website (hereinafter – the “Users”) located at https://hist-geo.ru/ and https://xn—-7sbzpdg2b.xn--p1ai/ (hereinafter – the “Website”).
1.2. This Policy applies to personal data (hereinafter – “PD”) of Users collected through the Website and received both before and after this Policy came into effect.
1.3. This Policy is mandatory for all managers and employees of the Operator who have access to Users’ PD.

2. Terms, Definitions, and Abbreviations
Personal Data (PD) – any information relating directly or indirectly to an identified or identifiable natural person (data subject).
User – a natural person using the Operator’s Website, a data subject.
User Authentication – the process of verifying a User’s authenticity.
User Identification – the process of recognizing a User by their identifier.
User Identifier (ID) – a unique attribute of a User that allows distinguishing them from other Users.
User Authorization – the process of verifying the rights granted to a specific User to perform certain actions.
User Personalization – determination of individual settings and preferences established by the User for interaction with the Website, including chosen layout, functionality, personal actions, and interests detected while using the Website.
Cookies – small pieces of data sent by a web server and stored on the User’s device.
IP Address – a unique network address of a device in an IP-based network, serving as a unique identifier for a device connected to a global or local network.
Personal Data Processing – any operation or set of operations performed with or without the use of automation tools with the Users’ PD, including collection, receipt, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision), anonymization, blocking, deletion, and destruction.
Personal Data Security – protection of PD from unauthorized or unlawful access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful or unauthorized actions.

3. Consent to Personal Data Processing
3.1. The User decides to provide their personal data and gives consent to its processing freely, of their own will, and in their interest. Consent may be given by the User or their representative in any form that confirms the fact of receipt, unless otherwise provided by federal law.
3.2. A User who provides PD via the Website thereby agrees to this Privacy Policy. The responsibility to prove that such consent was obtained lies with the Operator. If the User does not agree with the Policy terms, they must stop using the Website.
3.3. The User agrees that the Operator has the right to transfer PD to third parties, in particular to courier services, postal services, and telecommunications operators solely for the purposes of providing services and conducting transactions. Data transfer is carried out only under contract and in accordance with the legislation of the Russian Federation.

4. Collection of Personal Data
4.1. Only the PD necessary and sufficient for the stated purpose of processing is collected.
4.2. The Operator collects PD from the following User groups:
• Registered and unregistered Users.
4.3. The Operator receives PD from Users in the following cases:
• When visiting the Website and its pages.
• When filling out feedback or subscription forms on the Website as per its functionality.
4.4. The PD that may be collected by the Operator from Website Users includes:
• Name
• E-mail address
• Phone number
• The Operator may additionally request a copy of an identity document or other documents containing name, surname, photo, and additional information necessary, at the Operator’s discretion, for identification and prevention of abuse and rights violations.
4.5. The Website uses cookies to store the following data on the User’s side:
• Data for statistical tracking of the User.
Cookies are created only if enabled in browser/device settings. You may disable cookies, but some features of the Website may become unavailable.
4.6. Additionally, the Operator automatically registers your IP address, browser and device type, software and hardware data, requested web page address, time spent on the page, and time of access.

5. Purposes of Personal Data Processing
5.1. PD processing is limited to achieving specific, pre-defined, and lawful purposes.
5.2. PD is processed to:
• Fulfill obligations of the Operator to Users regarding the Website and its services.
• Establish feedback with the User.
• Send notifications about new products, services, special offers, and events.
• Provide effective client and technical support for Website-related issues.
• Conduct audits, data analysis, and various research to improve Company services and Website user support.
5.3. The Operator may use PD for declared purposes with the User’s consent where required by Russian PD legislation.

6. Actions with Personal Data
6.1. User PD is processed lawfully in personal data information systems with or without automation tools.
6.2. The Operator processes PD legally, fairly, reasonably, and in good faith, respecting human rights and freedoms, especially privacy and family life.
6.3. The Operator does not process PD related to race, nationality, political views, religion, philosophical beliefs, intimate life, membership in public associations including trade unions.
6.4. The Operator ensures PD accuracy, sufficiency, and relevance where necessary.
6.5. If non-personal information is combined with personal data, it is treated as personal data while combined.
6.6. User PD is processed without time limitations.
6.7. Anonymized PD may be used to better understand User needs and improve service quality.
6.8. The Operator and others with access to PD shall not disclose or disseminate it without User consent, unless otherwise stipulated by law.
6.9. The Operator blocks PD upon request by the User, their representative, or the authorized data protection body, in case of incorrect PD or unlawful actions, until verified.

7. Security, Storage, Transfer, and Destruction of Personal Data
7.1. PD security is ensured by the Operator in accordance with the Constitution of the Russian Federation, 152-FZ, regulatory acts, federal laws, and guidelines of FSTEC and FSB of Russia.
7.2. User PD is stored only on electronic media within the territory of the Russian Federation.
7.3. The Operator takes necessary organizational and technical measures to protect User PD from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unauthorized actions.
7.4. The Operator and the User take all necessary measures to prevent loss or disclosure of PD.
7.5. User PD is destroyed upon withdrawal of consent for PD processing by the data subject.

8. Subscription and Mailing
8.1. The Operator may use the User’s e-mail to send information including:
• Notifications about new services, special offers, and events (subject to prior User consent).
Each email contains instructions on how to unsubscribe from the mailing list.

9. Interaction Between the Operator and Users
9.1. The relationship between the User and the Operator is governed by the laws of the Russian Federation.
9.2. Users may send requests to the Operator, including those concerning use of their PD or withdrawal of consent, in writing to the address listed in the “Contacts” section, or via an electronic document signed with a qualified electronic signature according to Russian law, sent via the contact form or to the e-mail address archethno@mail.ru.

9.3. A request submitted by the User must comply with the requirements established by the Rules for Submitting Inquiries to the Service and Support Department, specifically including the following information:

• the number of the primary document proving the identity of the User or their representative;

• information about the date of issue of the specified document and the issuing authority;

• information confirming the User’s participation in relations with the Operator (in particular, the User’s ID number or login for accessing the Website);

• the signature of the User or their representative;

• email address;

• contact phone number.

The Operator undertakes to review and respond to the User’s request within 30 days from the date of receipt of the inquiry.

9.4. In the process of handling the request, the Operator is obliged to:

• provide the personal data subject with information concerning the processing of their personal data, or refuse to provide such information in the manner, on the grounds, and within the timeframes established by law within thirty days from the date of receiving the request from the personal data subject or their representative;

• in the case of refusal by the personal data subject to provide personal data, explain the consequences of such refusal.

9.5. Withdrawal by the User of consent to the processing of personal data entails the destruction of records containing the User’s personal data in the personal data processing systems of the Autonomous Nonprofit Organization “Young Historians of the Urals” Research Center, and makes it impossible to use the Website’s services.

10. Miscellaneous
10.1. In all other matters not directly reflected in this Regulation, the Operator undertakes to be guided by the norms and provisions of Federal Law No. 152 “On Personal Data.”

10.2. The Operator reserves the right to make any changes to this Regulation at any time at its discretion in order to further improve the system for protection against unauthorized access to personal data provided by Users without the User’s consent. Upon making significant changes to this Regulation, the User will receive an appropriate notification, and the updated version of the Regulation will be published on the Website. The new Regulation comes into effect from the moment of its placement on the Website, unless otherwise provided by the new version of the Privacy Policy.

10.3. In case of non-compliance with this Regulation, the Operator and its employees bear responsibility in accordance with the current legislation of the Russian Federation.