Personal data processing policy

The operator is the seller named above, who also owns the website pranacandles.ru.

A request on any matter in this document can be sent by email to pranacandles@mail.ru. The reply comes through the same channel.

Half of the answer lies in what the site does not have.

• The site has no forms: no order form, no subscription, no callback request. It is technically impossible to submit your data through the site.
• There are no analytics counters or advertising pixels: no Yandex.Metrica and no Google Analytics.
• There are no tracking or advertising cookies. The only service entry in the browser is created when someone logs in to the admin panel, and it concerns only the site owner.
• There is no registration, personal account, cart, or payment.

The catalog can be browsed without giving any information about yourself. The server sees the usual technical details of a request: the page address, the browser type, and the IP address. They are needed to open the page and to fend off request flooding. They are not stored separately and are not linked to a specific person.

Customer data appears in one case: a person writes to the seller on Telegram or Instagram to order a candle. What that person reports in the correspondence is the subject of this document.

• A name or profile name, and the messenger profile itself.
• A phone number, if the person leaves one for contact or for the courier.
• An address or pickup point, if the order needs to be delivered.
• The content of the correspondence about the order: what was chosen, for what occasion, and any requests.

There is one category of data subjects: customers and people asking about a purchase. The seller does not request and does not intend to process special categories of data, biometric data, or information about minors.

There are exactly two purposes, and both relate to the order.

• To respond to a request: choose a scent, say what is in stock, work out the delivery cost.
• To complete and hand over the order: pack the parcel, send it, and resolve any problem that comes up.

Separate consent is not required for this. The processing is carried out to conclude and perform a retail sale contract to which the customer is a party, and the customer initiates that contract with their message. This is an independent legal basis under clause 5, part 1, Article 6 of Federal Law No. 152-FZ.

For mailings, publishing reviews with the customer’s name, and any other purposes beyond the order, consent is requested separately. Silence does not count as consent.

The correspondence is handled manually. There is no automated processing and no automated decision-making based on it. Profiling is not used.

Data is passed only to those without whom the order will not arrive: the delivery service receives the recipient’s name, phone number, and address. Data is not transferred to other countries: both the seller and the customer are in Russia, and the data does not leave the country.

Correspondence about a completed order is kept for one year: that is how long it is needed to deal with a claim if something is wrong with the candle. Requests that did not turn into an order are deleted within three months.

When the period ends or consent is withdrawn, the correspondence is deleted from the messenger, and the order records are deleted from the site’s admin panel. They cannot be recovered after that.

The customer has the right to:

• find out whether their data is being processed, what data it is, and where it came from;
• demand that inaccurate or incomplete information be corrected;
• demand that the data be deleted or its processing stopped;
• withdraw consent where processing is based on it;
• appeal the seller’s actions to Roskomnadzor or in court.

A request is sent by email to pranacandles@mail.ru. A reply to a request about whether data is held is given within ten working days. This period may be extended by no more than five working days with an explanation of the reason. Inaccurate data is corrected within seven working days, and a demand to stop processing is carried out within three working days.

This section is published with the policy as required by part 2, Article 18.1 of the same law. The seller does not use certified protection tools, so only the measures actually in place are listed.

• The site and the database are hosted on a server in Russia.
• The connection to the site is encrypted: only HTTPS works.
• The owner has access to the admin panel, with login by password. The owner decides who else has access.
• Database backups are made daily and stored on the same server.
• The correspondence is protected by the tools of the messengers themselves, whose rules govern it.

The seller may revise this document. The current version is always at https://pranacandles.ru/en/legal/privacy, and the date of the version is shown at the top of the page.

Changes do not worsen the customer’s position or limit their rights: the law expressly prohibits including such terms in the policy.