Privacy Policy

Approval and effective date — 1 January 2026

1 General Provisions

1.1. This Privacy Policy (the “Policy”) sets out the purposes, legal grounds and procedures for processing the personal data of visitors to https://krinitsa.wine/ (the “Website”), the measures taken to protect such data, and the procedures for exercising data subjects’ rights.

1.2. The personal data operator is Joint Stock Company “Axis Investments” (the “Operator”). Enquiries concerning the processing of personal data may be sent to info@krinitsa.wine.

1.3. This Policy has been prepared in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“Law No. 152-FZ”), and the regulations adopted pursuant to that Law. The Policy applies to personal data obtained through the Website and when visitors contact the Operator using the contact details provided on the Website. The processing of personal data relating to employees and other individuals outside these interactions is governed by separate documents of the Operator.

1.4. Personal data means any information relating directly or indirectly to an identified or identifiable individual (a “data subject”). Personal data processing includes operations performed on such data with or without automated means. Other terms have the meanings assigned to them by Law No. 152-FZ.

1.5. Reading this Policy, visiting the Website or confirming that the visitor is of legal age does not, in itself, constitute consent to the processing of personal data. Where consent is required for processing, it is documented separately from this Policy and other documents acknowledged by the user.

2 Processing Principles

2.1. Personal data is processed lawfully and fairly, and processing is limited to specific purposes determined in advance.

2.2. The types and amount of data are appropriate to the purposes of processing. Excessive data is not requested. Databases containing data processed for incompatible purposes must not be combined.

2.3. The Operator ensures that personal data is accurate, up to date and confidential, and ceases processing where there is no lawful basis for doing so.

2.4. Personal data is retained for no longer than is necessary to achieve the purposes of processing, unless a different retention period is prescribed by law or an applicable contract.

3 Purposes of Processing and Types of Data Processed

3.1 Handling Visitors’ Enquiries

3.1.1. The category of data subjects is Website visitors who submit an enquiry. The data processed comprises the visitor’s name, email address, telephone number if a response by telephone is requested, the text of the enquiry and any information it contains that is necessary to respond. Information unrelated to the enquiry is not requested.

3.1.2. The legal basis for processing is the data subject’s consent under Article 6, Part 1, Paragraph 1 of Law No. 152-FZ. Where an enquiry is necessary to enter into a contract at the data subject’s initiative or to perform a contract with that person, processing is based on Article 6, Part 1, Paragraph 5 of Law No. 152-FZ. The legal basis for processing data contained in an email enquiry is determined in light of its content. Sending an email does not constitute consent to the processing of data for other purposes.

3.1.3. Data is processed until the enquiry has been dealt with and a response has been provided. Where processing is based on consent, the processing period is also limited by the duration of that consent or its withdrawal. If there is an independent lawful basis for further retention, only the data necessary for that purpose is retained. Processing is terminated and data is destroyed in accordance with Section 7 of this Policy.

3.2 Website Operation and Security

3.2.1. The category of data subjects is Website visitors. The data processed comprises the IP address, the date and time of the request, the address of the requested page, browser and device information, and technical identifiers. The purposes of processing are to operate the Website, handle requests to it, identify technical errors and prevent unlawful access.

3.2.2. The legal basis for processing is Article 6, Part 1, Paragraph 7 of Law No. 152-FZ: pursuing the Operator’s legitimate interests in the operation and security of the Website, provided that visitors’ rights and freedoms are respected. Using technical data for other purposes requires an independent legal basis. Technical logs are retained for 12 months. Data is destroyed in accordance with Section 7 of this Policy.

3.3. Automated processing is used for the purposes specified in Clauses 3.1 and 3.2 of this Policy. When handling enquiries, non-automated processing is also used if information is recorded on paper. Data operations include collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, disclosure and access in the circumstances specified in Section 5 of this Policy, blocking, deletion and destruction. Dissemination of data to an indefinite group of persons is not included in these purposes.

4 Data Collection and Cookies

4.1. Data is received directly from visitors when they complete forms or submit enquiries. Technical data is received when the browser interacts with the Website, within the purposes set out in Section 3. When data is obtained from other persons, the Operator verifies the legal basis and fulfils its obligation to inform the data subject under Article 18 of Law No. 152-FZ, unless a statutory exception applies.

4.2. This Policy does not provide for the collection of special categories of personal data, including information on health, political views or religious beliefs, or biometric data for identification purposes. Visitors should not include such information in free-text fields or enquiries. Its inadvertent receipt does not authorise its use for other purposes. In the absence of a lawful basis, the Operator ceases processing and destroys the data within the statutory time limits.

4.3. Cookies are small files stored by a browser. Where the information they contain makes it possible to identify a visitor directly or indirectly, its processing is governed by this Policy and Law No. 152-FZ.

4.4. The Website does not use cookies or similar technologies.

4.5. Before introducing cookies or similar technologies, the Operator updates the Policy to specify their types, purposes, providers, expiry periods and data retention periods, as well as how users can manage their choices. Where consent is required for the relevant processing, such technologies are used only after consent has been obtained. Amending the Policy does not itself replace consent.

4.6. Where processing is based on consent, the Operator ensures that it can demonstrate that consent was obtained, its content, the date it was given and the purposes of processing. Pre-selected checkboxes and silence do not constitute consent. A data subject may withdraw consent by sending a request to info@krinitsa.wine.

4.7. Contact details may be processed for the direct promotion of goods, works or services only after the relevant purpose has been specified in the Policy and the data subject’s prior consent has been obtained, and subject to applicable restrictions under advertising legislation. Such processing ceases immediately at the data subject’s request. Receiving a response to an enquiry does not mean that the visitor has subscribed to a mailing list. Personal data may be published only where there is an independent lawful basis, including separate consent under Article 10.1 of Law No. 152-FZ where required.

5 Data Disclosure and Processing Locations

5.1. Authorised employees of the Operator are granted access to personal data to the extent necessary to perform their duties. Data may be disclosed to public authorities in the circumstances and in accordance with the procedures established by the legislation of the Russian Federation.

5.2. If the Operator decides to entrust the processing of personal data to another person, it complies with Article 6, Part 3 of Law No. 152-FZ before such processing begins, including obtaining the data subject’s consent unless otherwise provided by federal law. The processing mandate specifies the data, processing operations and purposes, confidentiality, security and data localisation requirements, and obligations to demonstrate compliance and report incidents. The Operator remains liable to the data subject for the actions of the person processing data on its behalf to the extent provided by law.

5.3. For the purposes set out in this Policy, personal data is not transferred to external organisations and is not processed by third parties on the Operator’s behalf. This provision does not preclude disclosure to public authorities in the circumstances specified in Clause 5.1 of this Policy. Before engaging an external recipient or processor, the Operator establishes the legal basis for the transfer and adds the relevant information to the Policy.

5.4. When collecting personal data of citizens of the Russian Federation, recording, systematisation, accumulation, storage, clarification and retrieval using databases located outside the Russian Federation are not permitted, except as expressly provided in Article 18, Part 5 of Law No. 152-FZ. The Operator ensures compliance with this requirement when processing data through the Website, including through any external services used.

5.5. No cross-border transfers of personal data are carried out. If the Operator decides to make such transfers, before any transfer begins it adds the relevant information to the Policy and complies with Article 12 of Law No. 152-FZ. This includes obtaining the required information about recipients and data protection, conducting the assessment required by law and submitting a separate notification to Roskomnadzor. Transfers are permitted only in accordance with the statutory procedure for commencing them and subject to any prohibitions or restrictions imposed by Roskomnadzor. The data subject’s consent does not remove the requirements relating to data localisation and cross-border transfers.

6 Personal Data Protection

6.1. The Operator organises data protection in accordance with Articles 18.1 and 19 of Law No. 152-FZ. It appoints a responsible person, establishes processing and access rules, assesses threats and potential harm, implements the necessary information system security measures, maintains records of data storage media, detects unauthorised access, ensures data recovery, conducts internal monitoring and familiarises employees with the applicable requirements.

6.2. In the event of an incident specified in Article 21, Part 3.1 of Law No. 152-FZ, the Operator sends an initial notification to Roskomnadzor within 24 hours and the results of its internal investigation within 72 hours of detection of the incident, and takes steps to remedy its consequences.

7 Termination of Processing and Data Destruction

7.1. Processing is terminated when its purpose has been achieved, the applicable period has expired, consent has been withdrawn and there is no other lawful basis, a request to cease processing has been made in the circumstances provided by law, or unlawful processing has been identified. This Policy does not provide for indefinite data retention.

7.2. Once the purpose has been achieved, the Operator ceases processing and destroys the personal data within 30 days of that date. If consent is withdrawn, the Operator ceases processing and, where retention is no longer required for the purposes of processing, destroys the data within 30 days of receiving the withdrawal. A different procedure may apply in the circumstances provided in Article 21, Parts 4 and 5 of Law No. 152-FZ, including where there is an independent lawful basis for continued processing.

7.3. At the data subject’s request, the Operator ceases processing within 10 working days of receiving the request. This period may be extended by no more than 5 working days, provided that the data subject is sent a notice explaining the reasons for the extension. Continued processing is permitted only in the circumstances provided in Article 21, Part 5.1 of Law No. 152-FZ.

7.4. If unlawful processing is identified following an enquiry or request, the Operator blocks the data for the duration of the review. Unlawful processing ceases within 3 working days of its identification. If processing cannot be made lawful, the data is destroyed within 10 working days of identification. Where the data subject provides evidence that the data was obtained unlawfully or is unnecessary for the stated purpose, the data is destroyed within 7 working days of that evidence being provided, in accordance with Article 20, Part 3 of Law No. 152-FZ.

7.5. If data cannot be destroyed within the time limits specified in Article 21, Parts 3–5.1 of Law No. 152-FZ, the Operator blocks the data and ensures its destruction within no more than 6 months, unless a different period is prescribed by federal law. Blocked data is not used for routine processing.

7.6. Electronic data is destroyed in a manner that prevents its recovery, and paper records are destroyed in a manner that makes them unreadable. Destruction covers copies that must be deleted and data held by processors acting on the Operator’s behalf. Backups are blocked and deleted within the applicable statutory time limits. Restoration from a backup must not return deleted data to routine processing.

7.7. Destruction is documented in accordance with Roskomnadzor Order No. 179 of 28 October 2022. The Operator ensures that destruction is recorded and monitors compliance with its instructions by the processors it engages. The data subject and, in the circumstances prescribed by law, Roskomnadzor are notified that violations have been remedied and of the measures taken.

8 Visitors’ Rights and Requests

8.1. A data subject has the right, free of charge, to obtain information about the processing of their data, its purposes and legal grounds, the types and sources of data, processing periods, recipients, processors and cross-border transfers; to access their data; to request its clarification, blocking or destruction; to withdraw consent and request that processing cease; and to challenge the Operator’s actions before Roskomnadzor or a court.

8.2. Enquiries concerning personal data processing may be sent to info@krinitsa.wine. The subject line may state “Personal Data”, “Data Correction” or “Withdrawal of Consent”. The absence of such a subject line is not a reason to refuse to consider the enquiry. This contact method does not restrict the data subject’s right to contact the Operator by other means provided by law.

8.3. To help locate the data, the request should include the person’s name, the contact details used when submitting an enquiry or completing a form, and the substance of the request. A request for access under Article 14 of Law No. 152-FZ must include the number of the primary identity document of the data subject or their representative, its date of issue and issuing authority, information about the relationship with the Operator or other information confirming that processing takes place, and the signature of the data subject or their representative. An electronic request must bear an electronic signature in accordance with the legislation of the Russian Federation. The Operator verifies the representative’s authority and does not disclose data to unauthorised persons. A copy of a passport is not automatically required.

8.4. Information about processing is provided when the data subject contacts the Operator or within 10 working days of receipt of a request. This period may be extended by no more than 5 working days, with notice explaining the reasons. Where there is a lawful basis for refusal, the Operator provides a reasoned response referring to the relevant legal provision within the statutory time limit.

8.5. Where an inaccuracy is confirmed, the data is corrected within 7 working days of the supporting information being provided. Inaccurate data is blocked during the review, provided that doing so does not infringe the rights and legitimate interests of the data subject or third parties. The Operator informs the data subject of the corrections and takes reasonable steps to notify recipients of the data.

9 Publication and Amendment of the Policy

9.1. The Policy is publicly available on the Website at https://krinitsa.wine/. Access to the Policy is provided, including through links on Website pages where personal data is collected.

9.2. The Policy applies from its approval date until it is replaced by a new version. Each new version is published with its effective date. Amending the Policy does not replace the need to obtain new consent where consent is required for a new purpose or changed processing conditions.

9.3. Any questions concerning this Policy may be addressed to JSC “Axis Investments” at info@krinitsa.wine.