Personal Data Processing and Protection Policy

1. General Provisions
   1. This personal data processing policy is prepared in accordance with the requirements of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data" (hereinafter - the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the security of personal data taken by IE Kurtov Maxim Aleksandrovich, TIN 312323460170, OGRN 317312300008202 (hereinafter - the Operator).
   2. The Operator considers the observance of human and civil rights and freedoms when processing their personal data, including the protection of rights to privacy, personal and family secrets, as its most important goal and condition for carrying out its activities.
   3. This Privacy Policy applies to all information that the Operator can obtain about visitors to the website: https://www.tisland.travel. This Privacy Policy is an integral part of the Public Offer posted on the website at: https://www.tisland.travel.
   4. Within this Policy, the following is understood as the User's personal information:
      • Personal information that the User provides about themselves independently when registering (creating an account) or in the process of using services, including the User's personal data. Information required for providing services is marked in a special way.
      • Data that is automatically transmitted to the Site's services during their use through software installed on the User's device, including IP address, cookie data, information about the User's browser (or other program used to access the services), technical characteristics of the equipment and software used by the User, date and time of access to services, addresses of requested pages and other similar information.
      • This Privacy Policy applies only to the Site at: https://www.tisland.travel. The Operator does not control and is not responsible for third-party websites that the User may access via links available on the Site.
   5. The Operator may process the following personal data of the User:
      • Last name, first name, patronymic
      • Date and year of birth
      • Phone number
      • Email address

      The above data is hereinafter referred to as Personal Data in this Policy.

   6. Processing of personal data must be carried out in compliance with the following principles:
      • Processing of personal data must be carried out on a lawful and fair basis.
      • Processing of personal data must be limited to achieving specific, predetermined purposes. Processing of personal data incompatible with the purposes of collecting personal data is not allowed.
      • Merging databases containing personal data processed for incompatible purposes is not allowed.
      • Only personal data that meets the purposes of their processing shall be processed.
      • The content and volume of processed personal data must correspond to the stated purposes of processing. Processed personal data must not be excessive in relation to the stated purposes of their processing.
      • When processing personal data, the accuracy of personal data, their sufficiency, and, where necessary, relevance in relation to the purposes of processing personal data must be ensured. The Operator must take necessary measures or ensure their adoption to delete or clarify incomplete or inaccurate data.
      • Storage of personal data must be carried out in a form that allows identification of the subject of personal data, no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by federal law, contract, of which the subject of personal data is a party, beneficiary, or guarantor. Processed personal data must be destroyed or anonymized upon achieving the purposes of processing or in case of loss of necessity in achieving these purposes, unless otherwise provided by federal law.
      • Some content or applications on the Site, including advertising, may be served by independent third parties. They may place cookies on the User's device for their own purposes. The Site does not control the tracking technologies used by these third parties or how they may be used and is not responsible for any actions or policies of third parties. To prevent the placement of such third-party cookies and tracking through them, the User can adjust or change their browser settings accordingly. For additional information, the User should refer to their browser instructions.
2. Purposes of Personal Data Processing
   1. The Site collects and stores only the personal information that is necessary for providing services or fulfilling agreements and contracts with the User, except when the law provides for mandatory storage of personal information for a period specified by law.
   2. The Site processes the User's personal information for the following purposes:
      • Preparation, conclusion, and execution of civil law contracts;
      • Promotion of goods, works, and services on the market;
      • Conducting advertising activities with the User's consent.
      • Other purposes specified in this Policy, including in its appendices (if any).
   3. Personal data is processed for user identification, contract conclusion, service provision, product promotion, compliance with legal requirements, and other purposes directly provided for by the policy.
3. Conditions for Personal Data Processing
   1. Processing of personal data is carried out with the consent of the subject of personal data to the processing of their personal data.
   2. The Site stores personal information of Users in accordance with internal regulations of specific services.
   3. The Operator has the right to entrust the processing of personal data to another person with the consent of the subject of personal data, unless otherwise provided by federal law, on the basis of a contract concluded with this person, including a state or municipal contract, or by adopting an appropriate act by a state or municipal body (hereinafter - the Operator's instruction). The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by this Federal Law, maintain confidentiality of personal data, and take necessary measures aimed at ensuring the fulfillment of obligations provided for by this Federal Law. The Operator's instruction must specify the list of personal data, the list of actions (operations) with personal data that will be performed by the person processing personal data, the purposes of their processing, the obligation of such person to maintain confidentiality of personal data, requirements provided for by part 5 of Article 18 and Article 18.1 of Federal Law No. 152-FZ, the obligation to provide documents and other information confirming the adoption of measures and compliance with requirements established in accordance with this article at the request of the Operator during the term of the Operator's instruction, including before processing personal data, the obligation to ensure the security of personal data during their processing, and requirements for the protection of processed personal data in accordance with Article 19 of Federal Law No. 152-FZ, including the requirement to notify the operator of cases provided for by part 3.1 of Article 21 of Federal Law No. 152-FZ. The person processing personal data on behalf of the Operator is not required to obtain the consent of the subject of personal data to the processing of their personal data. If the Operator entrusts the processing of personal data to another person, the responsibility to the subject of personal data for the actions of the specified person is borne by the person processing personal data on behalf of the Operator. This person is also responsible to the Operator. If the Operator entrusts the processing of personal data to a foreign individual or foreign legal entity, the responsibility to the subject of personal data for the actions of these persons is borne by the Operator and the person processing personal data on behalf of the Operator.
   4. Processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or law, for the performance of functions, powers, and duties imposed on the operator by the legislation of the Russian Federation.
   5. Processing of personal data is necessary for the administration of justice, execution of a judicial act, act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings.
   6. The Operator has the right to transfer the User's personal information to other third parties in the following cases:
      • The User has expressed consent to such actions.
      • The transfer is necessary for the User to use a specific service or to fulfill a specific agreement or contract with the User.
      • The transfer is provided for by Russian or other applicable legislation within the framework of the procedure established by law.
      • In case of sale of the Site, all obligations to comply with the conditions of this Policy regarding the received personal information pass to the acquirer.
   7. Processing of the User's personal data is carried out without time limit and is processed in the following ways: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data, including in personal data information systems using automation tools or without using such tools. Processing of Users' personal data is carried out in accordance with Federal Law No. 152-FZ.
   8. In case of loss or disclosure of personal data, the Operator informs the User about the loss or disclosure of personal data within 3 working days.
   9. The Operator takes necessary organizational and technical measures to protect the User's personal information from unlawful or accidental access, destruction, modification, blocking, copying, distribution, as well as from other unlawful actions of third parties.
   10. The Operator, together with the User, takes all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the User's personal data.
   11. The Operator processes the User's personal data only if they are filled in and/or sent by the User independently through special forms located on the Site at: https://www.tisland.travel. By filling out the relevant forms and/or sending their personal data to the Operator, the User expresses their consent to this Policy. The User is considered to have given consent to the processing of their personal data entered in the form fields at the moment of placing a symbol in the checkbox (in the input field) on the Site next to the text: "I consent to the processing of my personal data in accordance with the terms of the privacy policy" or similar text, provided that the Subject of personal data is given the opportunity to familiarize themselves with the full text of this Policy in each place of collection of personal data.
   12. The Subject of personal data makes a decision on providing their personal data and gives consent to their processing freely, of their own free will and in their interest. Consent to the processing of personal data is specific, informed, and conscious.
       In cases provided for by Federal Law No. 152-FZ, processing of personal data is carried out only with the written consent of the subject of personal data. Consent in the form of an electronic document signed in accordance with federal law with an electronic signature is recognized as equivalent to consent in writing on paper containing the personal signature of the subject of personal data. Written consent of the subject of personal data to the processing of their personal data must include, in particular:
       1. Last name, first name, patronymic, address of the subject of personal data, number of the main document proving their identity, information about the date of issue of the specified document and the issuing authority;
       2. Last name, first name, patronymic, address of the representative of the subject of personal data, number of the main document proving their identity, information about the date of issue of the specified document and the issuing authority, details of the power of attorney or other document confirming the authority of this representative (when obtaining consent from the representative of the subject of personal data);
       3. Name or last name, first name, patronymic and address of the Operator receiving the consent of the subject of personal data;
       4. Purpose of processing personal data;
       5. List of personal data for the processing of which consent is given by the subject of personal data;
       6. Name or last name, first name, patronymic and address of the person processing personal data on behalf of the Operator, if processing will be entrusted to such person;
       7. List of actions with personal data for which consent is given, general description of the methods used by the Operator for processing personal data;
       8. Term during which the consent of the subject of personal data is valid, as well as the method of its withdrawal, unless otherwise established by federal law;
       9. Signature of the subject of personal data. Information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish their identity (biometric personal data) and which is used by the Operator to establish the identity of the subject of personal data, may be processed only with the written consent of the subject of personal data, except for cases provided for by part 2 of Article 11 of Federal Law No. 152-FZ.
4. Basic Rights and Obligations of Personal Data Subjects
   1. Subjects of personal data have the right to:
      • Receive information regarding the processing of their personal data, except in cases provided for by federal laws. Information is provided to the subject of personal data by the Operator in an accessible form, and it should not contain personal data relating to other subjects of personal data, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
      • Require the operator to clarify their personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as take measures provided by law to protect their rights;
      • Set a condition of prior consent when processing personal data for the purpose of promoting goods, works, and services on the market;
      • Withdraw consent to the processing of personal data, as well as send a request to terminate the processing of personal data;
      • Appeal to the authorized body for the protection of the rights of subjects of personal data or in court against unlawful actions or inaction of the Operator when processing their personal data;
      • Exercise other rights provided for by the legislation of the Russian Federation.
   2. Subjects of personal data are obliged to:
      • Provide the Operator with reliable data about themselves;
      • Inform the Operator about the clarification (updating, changing) of their personal data.
   3. Persons who have provided the Operator with false information about themselves, or information about another subject of personal data without the consent of the latter, bear responsibility in accordance with the legislation of the Russian Federation.
   4. If a subject of personal data believes that the Operator is processing their personal data in violation of the requirements of Federal Law No. 152-FZ or otherwise violates their rights and freedoms, the subject of personal data has the right to appeal against the actions or inaction of the Operator to the authorized body for the protection of the rights of subjects of personal data or in court. The subject of personal data has the right to protect their rights and legitimate interests, including compensation for losses and (or) compensation for moral damage in court. The Operator who has not fulfilled its obligations bears responsibility for losses incurred by the User in connection with the unlawful use of personal data, in accordance with the legislation of the Russian Federation. The assessment of harm that may be caused to subjects of personal data in case of violation by the Operator of the requirements of Federal Law No. 152-FZ, in accordance with the requirements established by the authorized body for the protection of the rights of subjects of personal data, is determined in accordance with Articles 15, 151, 152, 1101 of the Civil Code of the Russian Federation. Moral harm caused to a subject of personal data as a result of violation of their rights, violation of the rules for processing personal data established by Federal Law No. 152-FZ, as well as requirements for the protection of personal data established in accordance with Federal Law No. 152-FZ, is subject to compensation in accordance with the legislation of the Russian Federation. Compensation for moral harm is carried out regardless of compensation for property damage and losses incurred by the subject of personal data.
   5. In case of loss or disclosure of confidential information, the Operator is not responsible if this confidential information:
   6. Became public domain before its loss or disclosure.
   7. Was received from a third party before it was received by the Operator.
   8. Was disclosed with the User's consent.
5. Principles of Personal Data Processing
   1. Processing of personal data is carried out on a lawful and fair basis.
   2. Processing of personal data is limited to achieving specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of collecting personal data is not allowed.
   3. Merging databases containing personal data processed for incompatible purposes is not allowed.
   4. Only personal data that meets the purposes of their processing shall be processed.
   5. The content and volume of processed personal data correspond to the stated purposes of processing. Excessiveness of processed personal data in relation to the stated purposes of their processing is not allowed.
   6. When processing personal data, the accuracy of personal data, their sufficiency, and, where necessary, relevance in relation to the purposes of processing personal data must be ensured. The Operator takes necessary measures and/or ensures their adoption to delete or clarify incomplete or inaccurate data.
   7. Storage of personal data is carried out in a form that allows identification of the subject of personal data, no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by federal law, contract, of which the subject of personal data is a party, beneficiary, or guarantor. Processed personal data must be destroyed or anonymized upon achieving the purposes of processing or in case of loss of necessity in achieving these purposes, unless otherwise provided by federal law.
6. Dispute Resolution
   1. Before going to court with a claim for disputes arising from the relationship between the Site User and the Operator, it is mandatory to submit a claim (written proposal for voluntary settlement of the dispute).
   2. The recipient of the claim within 7 (seven) calendar days from the date of receipt of the claim shall notify the claimant in writing of the results of consideration of the claim.
   3. If no agreement is reached, the dispute will be referred to a court in accordance with the current legislation of the Russian Federation.
   4. The current legislation of the Russian Federation applies to this Privacy Policy and the relationship between the User and the Operator.
7. Conditions for Personal Data Processing
   1. Processing of personal data is carried out with the consent of the subject of personal data to the processing of their personal data, as well as without consent for the purposes of fulfilling a contract, legal obligations, protecting the legitimate interests of the Operator or third parties.
   2. Processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or law, for the performance of functions, powers, and duties imposed on the operator by the legislation of the Russian Federation.
   3. Processing of personal data is necessary for the administration of justice, execution of a judicial act, act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings.
   4. Processing of personal data is necessary for the execution of a contract, of which the subject of personal data is a party, beneficiary, or guarantor, as well as for concluding a contract on the initiative of the subject of personal data or a contract under which the subject of personal data will be a beneficiary or guarantor.
   5. Processing of personal data is necessary for the exercise of rights and legitimate interests of the operator or third parties or for achieving socially significant goals, provided that the rights and freedoms of the subject of personal data are not violated.
   6. Processing of personal data is carried out, access to which is granted to an unlimited number of persons by the subject of personal data or at their request (hereinafter - publicly available personal data).
   7. Processing of personal data subject to publication or mandatory disclosure in accordance with federal law is carried out.
8. Procedure for Collection, Storage, Transfer and Other Types of Personal Data Processing
   1. The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of current legislation in the field of personal data protection, by limiting access to data, and regular checking of security systems.
   2. The Operator ensures the safety of personal data and takes all possible measures to exclude access to personal data by unauthorized persons.
   3. The User's personal data will never, under any circumstances, be transferred to third parties, except in cases related to the implementation of current legislation or if the subject of personal data has given consent to the Operator to transfer data to a third party to fulfill obligations under a civil law contract.
   4. In case of inaccuracies in personal data, the User can update them independently by sending a notification to the Operator's email address support@tisland.travel with the note "Updating personal data".
   5. The term for processing personal data is determined by the achievement of the purposes for which the personal data were collected, unless another term is provided for by the contract or current legislation. The User can at any time withdraw their consent to the processing of personal data by sending a notification to the Operator's email address support@tisland.travel with the note "Withdrawal of consent to the processing of personal data".
   6. All information collected by third-party services, including payment systems, communication means, and other service providers, is stored and processed by these persons (Operators) in accordance with their User Agreement and Privacy Policy. The subject of personal data and/or with these documents. The Operator is not responsible for the actions of third parties, including the service providers specified in this paragraph.
   7. Prohibitions established by the subject of personal data on the transfer (except for granting access), as well as on processing or conditions of processing (except for obtaining access) of personal data permitted for distribution, do not apply in cases of processing personal data in state, public, and other public interests determined by the legislation of the Russian Federation.
   8. The Operator ensures the confidentiality of personal data when processing personal data.
   9. The Operator stores personal data in a form that allows identification of the subject of personal data, no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by federal law, contract, of which the subject of personal data is a party, beneficiary, or guarantor.
   10. The condition for termination of personal data processing may be the achievement of the purposes of processing personal data, expiration of the consent of the subject of personal data, withdrawal of consent by the subject of personal data or requirement to terminate the processing of personal data, as well as identification of unlawful processing of personal data.
9. Confidentiality of Personal Data
   1. The Operator and other persons who have gained access to personal data are obliged not to disclose to third parties and not to distribute personal data without the consent of the subject of personal data, unless otherwise provided by federal law.
   2. Final Provisions
   3. The User can get any clarification on questions of interest regarding the processing of their personal data by contacting the Operator via email support@tisland.travel.
   4. This document will reflect any changes to the Operator's personal data processing policy. The Policy is valid indefinitely until it is replaced by a new version. Users will be notified of changes via the email they provided as contact.
   5. The current version of the Policy is freely available on the Internet at: https://www.tisland.travel.
   6. The Operator has the right to make changes to this Privacy Policy without the User's consent.
   7. The new Privacy Policy comes into force from the moment it is posted on the Site, unless otherwise provided by the new version of the Privacy Policy.
   8. All suggestions or questions regarding this Privacy Policy should be sent to: support@tisland.travel.
   9. The current Privacy Policy is posted on the page on the Internet at: https://www.tisland.travel.