This policy describes the protection of rights of individuals regarding the processing of their personal data. The purpose of this policy is to guarantee the inviolability of personality and privacy by ensuring protection of individuals in case of unauthorized processing of their personal data, in the process of free movement of data.

A. GENERAL TERMS

1. This statement defines:

1.1. The management, maintenance and protection of personal data that includes private information of customers of DEEPRELAXATION.INFO and is contained in the Personal Data Register (“Register”).

1.2. The obligations of DEEPRELAXATION.INFO staff processing personal data (“Data Controller”) and their responsibility when fulfilling these tasks.

1.3. The required technical and organizational procedures by the Data Controller for the protection of personal data from unlawful processing (accidental or unlawful destruction, loss or change, unlawful disclosure or access, non-regulated alteration or distribution, as well as all other unlawful forms of processing personal data).

B. PERSONAL DATA COLLECTED IN THE REGISTER

2. The following types of personal data are kept in the Register:

2.1. Physical identity, names, passport details, address, phone number and personal identification numbers, date of birth, personal preferences, GPS position, IP addresses, information about device used.

C.PURPOSE OF REGISTER

3. The Register collects and stores personal data from the customers of the website:

3.1. For contacting customers by phone and to send correspondence regarding completion of orders that have been received on the website (online orders).

3.2. For bookkeeping and direct marketing.

3.3. To investigate and prevent fraudulent transactions, unauthorized access to the Website, and other illegal activities.

3.4. To provide you with notices about your account, including expiration and renewal notices.

3.5. To carry out the Company's obligations and enforce its rights arising from any contracts entered into between you and the Company, including for billing and collection, photo verification, ID verification and written authorizations.

3.6. To notify you about changes to the Website or any products or services the Company offers or provides through the Website.

3.7. To allow you to participate in any interactive features on the Website.

3.8. To monitor and analyze trends, usage, and activities in connection with the Website and for marketing or advertising purposes.

3.9. To personalize the Website content, features, or advertisements.

D. REGISTER MANAGEMENT

4. The Register is kept in electronic form.

4.1. The Register is kept in electronic form and the personal data is stored in secured computer servers.

4.2. Access to the Register servers is controlled by secured passwords known only to the Data Controller staff authorized to process personal data. Data processing software is used when working with this data.

4.3. The protection of the Register from unauthorized access; corruption, loss or destruction of the data is ensured by maintaining up-to-date antivirus software and regularly scheduled backups.

E. COLLECTION, PROCESSING AND STORING OF PERSONAL DATA

5.1. Personal data is collected by placing orders in the online store of the company to the website by a person who is a customer in compliance with the General Terms of Service.

5.2. In all cases, the individuals, whose data are subject to personal data processing, shall submit, via online forms, the necessary personal data to the Data Controller appointed for processing personal data.

5.3. The need for collection of the personal data and the purposes for its use will be communicated to the individual placing the order by the Data Controller.

5.4. To rectify the personal data collected, the individual must submit an official request to the Data Controller.

F. ACCESS TO THE REGISTER BY THIRD PARTIES 

6.1. The company does not sell or rent your personal information to third-parties. We do not share your personal information, except as provided in this Privacy Policy.

6.2. The information in the Register can only be accessed the authorized Data Controller staff. Third parties do not have the right to access the Register unless required by the legal authorities (courts, prosecutors or investigative bodies). The law permits these authorities access to the personal data of the individuals.

6.3. No consent is required if the processing of the personal data is only carried out by or under the control of a competent state authority for personal data relating to the commission of legal offenses, administrative offenses or unauthorized access. Such persons shall be granted access to the personal data and, where necessary, shall be provided with appropriate working conditions in the premises of the company.

6.4. The access by state authorities to an individual's personal data requires duly legitimated relevant documents, such as written orders of the respective body, that state the names of the individuals and the reasons for access.

6.5. In case of changes in the Data Controller company's status (transformation, liquidation, etc.), requiring the transfer of the Register by the company to another data controller, the transmission of the Register shall be done after permission of the State Commission for Personal Data Protection.

6.6. The decision to grant or deny access to personal data for the person concerned shall be communicated by the Data Controller to the third parties within 30 days of the submission of the request.

 This Policy shall come into force on 1 October 2019.