Guts & Glory

Privacy policy

This is an English translation provided for convenience. The Russian version of this document is legally binding and prevails in case of any discrepancy.

Personal Data Protection and Processing Policy

1. General Provisions

1.1 This Policy regarding the processing of personal data (hereinafter referred to as the "Policy") has been prepared in accordance with Clause 2 of Part 1 of Article 18.1 of the Federal Law of the Russian Federation "On Personal Data" No. 152-FZ dated July 27, 2006 (hereinafter referred to as the "Law") and defines the position of Individual Entrepreneur Pavel Sergeyevich Barinov (hereinafter referred to as the "Operator") in the field of processing and protecting personal data (hereinafter referred to as personal data), with respect to the observance of rights and freedoms, describes the specifics of the collection, storage, use, and transfer of personal data, the requirements implemented for their protection, as well as information regarding the rights of the individuals to whom the corresponding personal data relate.

1.2 Personal data shall mean any information relating directly or indirectly to an identified or identifiable natural person (citizen).

1.3 Personal data processing shall mean any action (operation) or set of actions (operations) performed on personal data, using automated tools and/or without using such tools. Such actions (operations) include, in particular: collection, recording, systematization, accumulation, storage, clarification (updating, amendment), extraction, use, transfer (provision, access), collation, depersonalization, blocking, deletion, and destruction of personal data.

1.4 Personal data security shall mean the protection of personal data from unlawful and/or unauthorized access thereto, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions with respect to personal data.

1.5 The Policy applies to all actions associated with the processing of personal data on the website https://gutsglory.ru/ (hereinafter referred to as the "Website"), as well as in the course of organizing and holding sailing regattas and other events, within the framework of concluded agreements and interaction with participants and partners.

1.6 The use of the Website by the User constitutes their unconditional consent to the terms of the Privacy Policy and the terms of personal data processing specified therein. If the User does not agree with the terms of this Policy, the User should refrain from using the Website.

1.7 This Policy applies to personal data obtained both before and after the entry into force of this Policy.

2. Legal Grounds and Purposes of Personal Data Processing by the Operator

2.1 The Operator processes and ensures the security of personal data to execute the functions, powers, and duties assigned to the Operator in accordance with the Constitution of the Russian Federation, federal laws, in particular Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", the Civil Code of the Russian Federation, as well as the charter and local regulations of the Operator.

2.2 The Operator is a personal data operator in accordance with the Law.

2.3 The processing of personal data may be carried out by the Operator in the following cases and on the following legal grounds:

  • the processing of personal data is carried out with the consent of the personal data subject, expressed in any form that allows confirming the fact of obtaining consent, including by the methods specified in Clause 1.6 of this Policy;
  • to achieve the purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and fulfillment of the functions, powers, and duties assigned by the legislation of the Russian Federation to the personal data operator;
  • for the performance of a contract to which the personal data subject is a party, including for organizing participation in regattas, concluding and executing contracts with partners and counterparties;
  • for the exercise of the rights and legitimate interests of the operator or third parties, or for the achievement of socially significant purposes, provided that the rights and freedoms of the personal data subject are not violated thereby;
  • for statistical or other marketing and research purposes, subject to the mandatory depersonalization of personal data.

2.4 Subjects of personal data processed through the Website include, among others: Website users, participants and guests of regattas and sports events; employees and representatives of the Operator's counterparties and clients under concluded contracts; applicants for vacant positions; and any other individuals contacting the Operator with applications/inquiries.

2.5 The Operator processes personal data for:

2.5.1 organizing, holding, and participating in sailing regattas, competitions, and other sports events;

2.5.2 concluding and executing contracts to which the User (participant) is a party, including contracts for the provision of services for participation in a regatta;

2.5.3 providing information about events, promotions, and special offers;

2.5.4 informing about the status of an application for participation;

2.5.5 assisting in dispute and claim settlement;

2.5.6 organizing the refund process (if necessary);

2.5.7 providing the opportunity to leave feedback on events;

2.5.8 analyzing the quality of service provided by the Operator and improving service quality;

2.5.9 identifying participants in promotions, ensuring the procedure for calculating and tracking ratings or bonuses;

2.5.10 interacting with counterparties, clients, and partners within the framework of concluded contracts;

2.5.11 ensuring information security, preventing unauthorized access to the Operator's information resources.

3. Categories of Personal Data Processed by the Operator

3.1 The Operator processes the following categories of personal data:

3.1.1 Participants of regattas and Website users:

  • full name;
  • date of birth;
  • contact telephone number;
  • email address;
  • registration and/or actual residential address;
  • passport data (in cases provided for by law or event rules);
  • details of sports rank/category, yacht class, regatta experience (if necessary);
  • cookies;
  • geolocation information.

3.1.2 Employees and representatives of counterparties, clients, and partners:

  • full name;
  • job title, place of work;
  • contact details (telephone numbers, email addresses);
  • data necessary for the conclusion and performance of contracts;
  • logins, passwords, and other credentials for accessing the Operator's information systems.

3.1.3 Applicants for vacant positions:

  • full name;
  • date and place of birth;
  • contact details (telephone number, email address, residential address);
  • details of education, qualifications, work experience, professional skills;
  • other information contained in resumes and cover letters.

3.2 The Operator processes the following categories of personal data of subjects who submit statements regarding an alleged violation of their rights: full name, passport data (data of another identity document), contact information (telephone and/or fax numbers, email address), information regarding the statements received, and the progress and result of their consideration.

3.3 The personal data specified in the clauses of this Section above may be obtained by the Operator during their submission by personal data subjects through filling out relevant forms on the Website, sending correspondence or emails to the Operator's email addresses, as well as in the course of performing contractual obligations.

4. Principles and Conditions of Personal Data Processing

4.1 When processing personal data, the Operator adheres to the following principles:

  • personal data processing is carried out on a lawful basis;
  • personal data are not disclosed to third parties and are not distributed without the consent of the personal data subject, except in cases provided for by the legislation of Russia;
  • determination of specific lawful purposes prior to the start of processing (including collection) of personal data;
  • combining databases, including databases containing personal data the processing of which is carried out for purposes incompatible with each other, is not permitted;
  • personal data processing is limited to achieving specific, predetermined, and lawful purposes;
  • processed personal data are subject to destruction or depersonalization upon revocation of consent to their processing by the personal data subject, upon achievement of the processing purposes, or in the event of loss of necessity to achieve these purposes, unless otherwise provided by federal law;
  • the content and scope of the personal data processed correspond to the stated processing purposes. The processed personal data are not excessive in relation to the stated processing purposes;
  • when processing personal data, the accuracy of personal data, their sufficiency, and, where necessary, relevance in relation to the stated purposes of their processing, are ensured;
  • personal data are stored in a form that allows identifying the personal data subject for no longer than required by the purposes of personal data processing, unless the storage period for personal data is established by federal law or by a contract to which the personal data subject is a party, beneficiary, or guarantor.

4.2 The Operator does not process personal data relating to racial or ethnic origin, political opinions, religious, philosophical, or other beliefs, health condition, private life, membership in public associations, including trade unions, or biometric data.

4.3 The Operator ensures the recording, systematization, accumulation, storage, clarification (updating, amendment), and extraction of personal data using databases located in the territory of Russia, and does not carry out the cross-border transfer of personal data.

4.4 The Operator has the right to delegate the processing of personal data by performing the actions specified in Clause 1.3 of this Policy to third parties, including the third parties listed in Clause 4.5 of this Policy, with the consent of the personal data subject expressed by granting consent, on the basis of a contract concluded with such third parties, in the following cases:

  • for processing inquiries of participants and (or) users and third parties via voice and non-voice communication channels, including email, online chat, mobile applications, and (or) social networks;
  • for the purpose of organizing delivery (if necessary);
  • for the purpose of analyzing the quality of service provided by the Operator and improving service quality;
  • for the purpose of preparing personalized offers and participation terms;
  • for the purpose of personalizing advertising;
  • for the purpose of sending advertising and information messages;
  • for the purpose of conducting statistical or other marketing research;
  • for the purpose of hosting information systems and software on the servers (in cloud environments) of third parties (hosting providers, data center operators).

4.5 The Operator has the right, via the Internet and in compliance with the provisions of the applicable legislation of the Russian Federation, to transfer personal data of participants and users (full name; date of birth; email; mobile phone number; information about actions performed within the scope of using the Website) to third parties for the purpose of such third parties providing (independently or jointly) participants and users with offers, advertising, and informational materials, for the purpose of preparing personalized offers and shaping individual service terms, as well as for the purpose of conducting marketing research and mailings.

The list of third parties to whom personal data are transferred for the purpose of processing in accordance with this clause includes: delivery services, hosting providers, cloud platforms, analytics services, and entities engaged to organize events.

4.5.1 Persons processing personal data on the basis of a contract (operator's assignment) concluded with the Operator, including delivery services, hosting providers, and subcontractors, undertake to comply with the principles and rules for personal data processing and protection provided for by applicable law. For each third party, the contract defines the list of actions (operations) with personal data that will be performed by the third party processing the personal data, the purposes of processing, establishes the obligation of such person to maintain confidentiality and ensure the security of personal data during their processing, and specifies the requirements for the protection of processed personal data in accordance with applicable law.

4.6 The Operator has the right to transfer personal data to third parties with the consent of the personal data subject in the following cases:

4.6.1 to delivery services for the purpose of fulfilling obligations to the participant;

4.6.2 for the purpose of enabling the protection of the rights and legitimate interests of the Operator or third parties in cases where the personal data subject violates any terms of the Website's user documents and (or) this Policy;

4.6.3 pursuant to an effective court decision or in cases established by applicable law;

4.6.4 to hosting providers, data center operators, and cloud platforms for hosting the Operator's information systems and software and ensuring their functionality;

4.6.5 to subcontractors and other persons engaged by the Operator to organize events.

4.7 In order to improve the quality of service for participants and users, and for statistical or other marketing and research purposes, the Operator develops, improves, optimizes, and implements new functionality on the Website.

4.8 The Operator has the right to transfer personal data to third parties with the consent of the personal data subject, as well as in cases where the possibility of transferring personal data to third parties is directly provided for by Russian law and does not require the consent of the personal data subject.

4.9 To comply with the requirements of applicable Russian law and its contractual obligations, the processing of personal data by the Operator is carried out both with and without the use of automated tools. The set of processing operations includes collection, recording, systematization, accumulation, storage, clarification (updating, amendment), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction of personal data.

4.10 The Operator does not make decisions that generate legal consequences for the personal data subject or otherwise affect their rights and legitimate interests solely on the basis of automated personal data processing.

4.11 The Operator does not verify and, as a rule, has no means of verifying the relevance and accuracy of information provided by personal data subjects obtained through the Website. The Operator assumes that personal data subjects, acting reasonably and in good faith, provide accurate and sufficient personal data and keep them up to date.

5. Rights of Personal Data Subjects

5.1 A personal data subject whose personal data are processed by the Operator has the right to:

  • at any time amend (update, supplement) the personal data provided by them by accessing the Personal Account in cases where the functionality of the Website allows it;
  • delete the personal data provided by them by sending a written notice to the Operator specifying the personal data that must be deleted;
  • obtain from the Operator:
  • confirmation of the fact of personal data processing and information about the existence of personal data relating to the respective personal data subject;
  • information about the legal grounds and purposes of personal data processing;
  • information about the methods of personal data processing applied by the Operator;
  • information about the name and location of the Operator;
  • information about persons (with the exception of the Operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or on the basis of federal law;
  • processed personal data relating to the personal data subject and information about the source of their acquisition, unless a different procedure for providing such personal data is provided for by law;
  • information about the terms of personal data processing, including the terms of their storage;
  • information about the procedure for exercising the rights provided for by personal data legislation by the personal data subject;
  • the name and address of persons who process personal data on behalf of the Operator;
  • other information provided for by the Law;
  • demand that the Operator clarify their personal data, block them, or destroy them if the personal data are incomplete, outdated, inaccurate, unlawfully obtained, or are not necessary for the stated purpose of processing;
  • revoke their consent to personal data processing at any time by sending an electronic message with an electronic signature to the email address: [indicate email] or by sending a written notice to the Operator's address. Upon receipt of such a message, the processing of personal data of the personal data subject will be terminated, and their personal data will be deleted, except in cases where processing may be continued in accordance with the legislation of the Russian Federation;
  • demand the rectification of unlawful actions of the Operator with respect to their personal data;
  • take measures provided for by law to protect their rights and legitimate interests, including seeking compensation for damages and (or) moral harm through judicial proceedings.

5.2 The rights provided for in the subclauses of this Section above may be restricted in accordance with the requirements of Russian law and (or) in cases where the Operator processes personal data on legal grounds other than the consent of the personal data subject.

6. Obligations of the Operator

In accordance with the requirements of the Law, the Operator is obliged to:

1) provide the personal data subject, upon their request, with information concerning the processing of their personal data, or provide a reasoned refusal on lawful grounds within thirty days from the date of receipt of the request from the personal data subject or their representative;

2) at the request of the personal data subject, clarify, block, or delete the processed personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained, or are not necessary for the stated purpose of processing within a period not exceeding seven business days from the date the personal data subject or their representative provides documents confirming these facts;

3) maintain a log of requests from personal data subjects, in which requests from personal data subjects for personal data, as well as the facts of personal data provision in response to these requests, must be recorded;

4) notify the personal data subject of the processing of personal data in the event that the personal data were not obtained from the personal data subject. The following cases constitute an exception:

  • the personal data subject is notified of the processing of their personal data by the Operator;
  • personal data were obtained by the Operator in connection with the performance of a contract to which the personal data subject is a party, beneficiary, or guarantor, or on the basis of the requirements of applicable law;
  • personal data were made publicly available by the personal data subject or obtained from a publicly available source;
  • the Operator processes depersonalized personal data for statistical or other research purposes, provided that the rights and legitimate interests of the personal data subject are not violated thereby;
  • providing the personal data subject with the information contained in the notification of personal data processing infringes upon the rights and legitimate interests of third parties;

5) in the event that the purpose of personal data processing is achieved, immediately terminate the processing of personal data and destroy the corresponding personal data within a period not exceeding thirty days from the date the purpose of personal data processing was achieved, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary, or guarantor, by another agreement between the Operator and the personal data subject, or if the Operator does not have the right to process personal data without the consent of the personal data subject on the grounds provided for by the Law or other federal laws;

6) in the event that the personal data subject revokes consent to the processing of their personal data, terminate the processing of personal data and destroy the personal data within a period not exceeding thirty days from the date of receipt of the said revocation, unless otherwise provided by an agreement between the Operator and the personal data subject. The Operator is obliged to notify the personal data subject of the destruction of personal data;

7) in the event of receipt of a demand from a personal data subject to cease processing personal data obtained for the purpose of promoting goods, works, or services on the market, immediately cease processing the personal data;

8) when collecting personal data, including via the Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, amendment), and extraction of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation.

7. Personal Data Protection

7.1 When processing personal data, the Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful and (or) unauthorized access thereto, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions with respect to personal data.

7.2 Such measures include, in particular:

  • appointment of a person responsible for organizing personal data processing and a person responsible for ensuring data security;
  • development and approval of local regulations on the processing and protection of personal data;
  • application of legal, organizational, and technical measures to ensure personal data security;
  • control over the measures taken to ensure personal data security and the level of security of personal data information systems;
  • assessment of the harm that may be caused to personal data subjects in the event of a violation of personal data legislation, the ratio of said harm to the measures taken by the Operator aimed at ensuring the fulfillment of duties provided for by personal data legislation;
  • compliance with conditions that exclude unauthorized access to material media containing personal data and ensure the preservation of personal data;
  • familiarization of the Operator's employees directly engaged in personal data processing with the provisions of Russian legislation on personal data, including requirements for personal data protection, local regulations on personal data processing and protection, and training of the Operator's employees;
  • application of information security tools, including certified ones, when processing personal data in state information systems and other information systems processing personal data, in cases provided for by the legislation of the Russian Federation.

8. Terms of Processing (Storage) of Personal Data

8.1 The terms of processing (storage) of personal data are determined based on the purposes of personal data processing, in accordance with the validity period of contracts with personal data subjects and the requirements of applicable law:

  • personal data of registered participants are stored for the entire duration of the Account and for 3 years after the last participation in an event;
  • personal data of an unregistered user are stored for three years from the date of the inquiry;
  • personal data of employees and representatives of counterparties, clients, and partners are stored for the duration of the contract and for five years after its termination (unless otherwise provided by the contract or legislation);
  • personal data of applicants for vacant positions are stored for six months from the date of their receipt, unless the applicant has consented to longer storage;
  • personal data of other persons who contact the Operator with statements regarding an alleged violation of their rights are stored for the entire period of processing and consideration of the relevant claims and for three years from the date of completion of the processing and (or) consideration of the claim, unless a different limitation period is provided for by law for the relevant disputes.

8.2 Personal data whose processing (storage) period has expired must be destroyed, unless otherwise provided by the legislation of the Russian Federation. Storage of personal data after the termination of their processing is permitted only after their depersonalization.

9. Procedure for Obtaining Clarifications on Issues of Personal Data Processing

9.1 Personal data subjects whose personal data are processed by the Operator may obtain clarifications on issues regarding the processing of their personal data by contacting the Operator in person or by sending a corresponding written request to the location address of the Operator.

IE Barinov Pavel Sergeyevich

TIN: 504708342468

Address for inquiries: [indicate actual address]

Email: [indicate email]

10. Automatically Collected Information

10.1 The Operator may collect and process the following information, including information that is not personal data:

  • information about the interests of Users on the Website based on the search queries entered by Website users in order to provide relevant information to Users when using the Website, as well as to summarize and analyze information about which sections of the Website and events are in the greatest demand;
  • technical information about user actions in information systems (logs, event logs, error details) in order to ensure the operability and security of systems, as well as to improve their functionality.

10.2 The Operator processes and stores search queries of Website Users in order to aggregate and create client statistics on the use of Website sections.

10.3 The Operator automatically receives certain types of information generated during the interaction of Users with the Website, email correspondence, etc. This refers to technologies and services such as web protocols, Cookies, Web beacons, as well as third-party applications and tools. At the same time, Web beacons, Cookies, and other tracking technologies do not provide the ability to automatically obtain personal data. If a Website User provides their personal data at their own discretion, for example, when filling out a feedback form or sending an email, only then are automated processes for collecting detailed information initiated for the convenience of using websites and (or) for improving user interaction.

10.4 If the Operator can reasonably link the information specified in this Section to the Account of a specific User, such information may be processed together with the Personal Data and other personal information of such User.

11. Policy Amendments. Miscellaneous Provisions

11.1 The Operator may periodically make amendments to this Policy, including to reflect changes in the scope of services provided by the Operator or changes in the functionality of the Website, as well as legislative changes. The new revision of the above provisions and privacy terms enters into force from the moment of its publication, unless a different effective date is specified therein.