Data Protection Policy
The personal data protection policy (hereinafter referred to as the ‘Policy’) applies to any and all information obtained by Aeroexpress and/or its affiliates about the User while he/she is using Aeroexpress’ website, programmes, products, services and support (hereinafter referred to as the ‘Services’) and while Aeroexpress performs its obligations under any agreements and contracts with the User. The User’s consent to the Policy, expressed as part of relations with one of the aforesaid parties, shall extend to all the other parties mentioned above. This Policy shall apply to any and all personal information and data received, both before and after this Policy has been published.
Use of Aeroexpress Services means that the User unconditionally consents to this Policy and the terms and conditions of personal data processing described herein. In the case that the User does not consent to these terms and conditions, the User shall refrain from using the Services.
1. User’s Personal Data Processed by Aeroexpress
1.1. As part of this Policy, personal data shall mean the following:
1.1.1. Personal information provided by the User independently when registering on any system (creating an Account) or using the Services, including the User’s personal data, identification, financial, payment, login, and contact details. Data that must be provided in order to use the Services is marked in a special way. The User shall provide any other information at his own discretion.
1.1.2. Information that is automatically transferred to Aeroexpress Services, when they are being used, by the software installed on the User's device, including the IP address, information about the User's browser (or any other software through which the Services are accessed), technical specifications of the equipment and software used by the User, date and time of accessing the Services, addresses of the requested pages, and other information of this kind.
1.1.3. Data resulting from interactions between the User and Aeroexpress or from actions performed by Aeroexpress in relation to the User, and not provided by the User himself/herself, including audio recordings of the User’s voice.
1.1.4. Any other information about the User that must be processed under the terms and conditions regulating the use of Aeroexpress services.
1.2. This Policy shall only apply to the information processed when Aeroexpress Services are being used. Aeroexpress does not control and shall not be liable for data processing carried out by third parties’ websites when the User follows links provided on the Aeroexpress website, including search results.
1.3. Aeroexpress reserves the right to verify the authenticity of the personal information provided by the User. However, Aeroexpress assumes that the User provides reliable and complete information, which he/she keeps updated. The requirements to provide reliable personal data and consequences of providing unreliable and/or insufficient information are set out in the Conditions of Carriage (https://aeroexpress.ru/en/aero/info/rules.html) and Ticket Purchase Rules (https://aeroexpress.ru/en/aero/info/buyrules.html).
2. Purposes of Processing Users’ Personal Data
2.1. Aeroexpress collects and stores only that personal data which is required to provide the Services and/or fulfil agreements and contracts with the User until the moment when Aeroexpress has fulfilled its obligations in full, except for cases when Russian law provides for the mandatory storage of personal data for the period of time specified in these laws. Moreover, in accordance with legislation currently in effect, personal data processing required to fulfil a contract/agreement, to which the User is a party, beneficiary or a surety, and also to execute a contact/agreement at the User’s initiative or a contract/agreement under which the User will become a beneficiary or a surety, shall be carried out without the User’s consent.
2.2. Aeroexpress processes User’s personal data for the following purposes:
2.2.1. To identify the party using Aeroexpress Services and counterparties to agreements and contracts with Aeroexpress;
2.2.2. To provide the User with personalized Services and to fulfil agreements and contracts;
2.2.3. To engage in communications with the User, including sending him/her notifications, requests and information regarding the Services’ use and fulfilment of agreements and contracts, and processing the User’s requests;
2.2.4. To improve the quality of the Services and convenience of their use and to develop new Services;
2.2.5. To target marketing materials and carry out marketing campaigns initiated and carried out by Aeroexpress;
2.2.6. To carry out statistical and other research based on de-identified data, i.e. data which was processed and, as a result, cannot be identified as personal information related to a specific User without the use of additional information.
2.2.7. Other purposes specified by laws.
3. Conditions of the User’s Personal Data Processing and Transfer to Third Parties
3.1. Aeroexpress stores the User’s personal data in accordance with legislative requirements.
3.2. All User’s personal data is kept confidential, except for cases when the User has provided his/her personal information for general access to an unlimited number of people.
3.3. Aeroexpress may transfer the User’s personal data to a third party in the following cases:
3.3.1. The User has provided his/her consent to do so;
3.3.2. Such transfer is required to allow the User to use some particular Service and to perform some particular agreement and/or contract with the User;
3.3.3. Such transfer is provided for by Russian or any other applicable law as part of a procedure defined by law;
3.3.4. Such transfer is carried out as part of the sale or other transfer of business (in whole or in part), and all obligations to comply with the terms and conditions of this Policy, regulating the use of the received personal information, are transferred to the acquirer;
3.3.5. In order to ensure the protection of the rights and legal interests of Aeroexpress and/or third parties in cases when the User breaks the laws, Conditions of Carriage (https://aeroexpress.ru/en/aero/info/rules.html) and Ticket Purchase Rules (https://aeroexpress.ru/en/aero/info/buyrules.html), this Policy or other documents outlining the terms and conditions of using particular Services.
3.3.6. As a result of processing the User’s personal data by means of its de-identification, some de-identified statistical data is obtained and transferred to third parties in order to carry out research, perform some work or provide services at Aeroexpress’ request.
3.4. When processing the User’s personal data, Aeroexpress is guided by Federal Law of the Russian Federation 152-FZ "On Personal Data”, dated 27 July 2006.
4. Changing and Deleting Personal Data Mandatory Data Storage
4.1. The User may, at any time, change (update or amend) the personal information he/she has provided, or any part thereof, using the personal data editing feature available through the Account of a unified Services personal account.
4.2. The User may also delete the personal data provided by him/her for some particular personal account by using the feature of deleting the Account in the unified Services personal account. In addition, the Account deletion may limit the use of particular Aeroexpress Services.
4.3. All rights described in Clauses 4.1. and 4.2. hereof may be restricted in accordance with legislative requirements. In particular, such restrictions can oblige Aeroexpress to store the information, changed and/or deleted by the User, for the period of time established by legislation and to transfer such information to a public agency in accordance with a procedure outlined by law.
5. Other rights of the User.
5.1. The User may obtain information related to the processing of his/her personal data, including the following:
5.1.1. Confirmation of the fact that the personal data has been processed by Aeroexpress;
5.1.2. Legal grounds for and purposes of personal data processing;
5.1.3. Personal data processing methods applied by Aeroexpress;
5.1.4. Name and location of Aeroexpress, information about people (except for the Company’s employees) who have access to the personal data and to whom such personal data can be disclosed, according to an agreement with Aeroexpress or based on the Federal Law;
5.1.5. Personal data that is being processed and related to a corresponding User and the source of such data, unless the Federal Law stipulates a different procedure of submitting such information;
5.1.6. Terms of personal data processing, including its storage period;
5.1.7. Procedure for exercising the User’s rights outlined in legislation that is currently in effect;
5.1.8. Information about a completed or expected cross-border transfer of personal data;
5.1.9. Full name of a person/entity carrying out personal data processing on behalf of Aeroexpress, provided that such person/entity has been or will be commissioned to conduct such processing.
5.2. Any information regarding the User’s personal data processing provided to the User shall not contain the personal data of other Users, except for cases when there are legal grounds to disclose such personal data.
5.3. In accordance with effective legislation, information related to the User’s personal data processing may be provided to the User or his/her legal representative by Aeroexpress upon addressing Aeroexpress or submitting a request from the User or his/her legal representative to Aeroexpress.
5.3.1. Such a request shall contain the number of the User’s or his/her representative’s basic identification document, this document’s date of issue and name of the issuing agency, information confirming that the User is under contract with Aeroexpress (contract number, its execution date, keyword, confirmation that the public offer conditions have been accepted and/or other information) or other data otherwise confirming that personal data has been processed by Aeroexpress, as well as the signature of the User or his/her representative.
5.3.2. A request can be sent in written form to Aeroexpress: Sheremetyevo Airport, Khimki, Moscow Region, Russia 141400 or by email to Aeroexpress’ email address at firstname.lastname@example.org and signed with an e-signature, as provided under the effective legislation of the Russian Federation.
5.4. The User may request that the Company update his/her personal data, block it or delete it in the case that such personal data is incomplete, dated, inaccurate, illegally obtained or is not necessary for the specified processing purpose, as well as may take measures to protect his/her rights, as provided by law.
6. Measures to Protect the User’s Personal Data
6.1. Aeroexpress shall take all necessary and sufficient organisational and technical measures to protect the User’s personal data from unauthorised or accidental access, destruction, modification, blocking, copying, and distribution, as well as from other illegal actions carried out by third parties, including measures to securely transfer such data using modern encryption methods.
7. Changing the Data Protection Policy Applicable Law
7.1. Aeroexpress reserves the right to change this Data Protection Policy. If such changes have been introduced, the latest Policy version shall indicate the date of the latest update. The new Policy version shall become valid only after it has been published unless otherwise provided by the new edition of the Policy. The valid version is constantly available at https://aeroexpress.ru/aero/confidential_politics.html.
7.2. Legislation of the Russian Federation shall be applicable to this Policy and relations between the User and Aeroexpress arising out of the application of this Data Protection Policy.
Publication date: 26.04.2018