Personal Data Processing Policy — Customers from the Russian Federation
Operator: EVA CODE, a seller registered in the Republic of Korea.
Trade name: EVA CODE.
Business registration number in the Republic of Korea: 209-28-95980.
Representative: KIM VALENTINA.
Address: 경기도 안산시 단원구 별망로 555, 4층 420호, Republic of Korea.
Website: https://evacode.co.kr.
Email: orders@evacode.co.kr.
Telephone: +82 10-7652-8595.
This version applies to EVA CODE's processing of personal data of customers from Russia insofar as the legislation of the Russian Federation applies to such operations. The Operator's registration in Korea does not, in itself, exclude the application of Federal Law No. 152-FZ of 27 July 2006, “On Personal Data.” This Policy does not replace separate documents on payment, delivery, terms of sale or returns and does not restrict customers' rights.
1. General Provisions and Legal Grounds
1.1. This Policy sets out how personal data of website visitors, registered users, purchasers, order recipients and persons contacting customer support is processed, stored, disclosed, transferred, protected and destroyed.
1.2. Where Russian legislation applies, the Operator follows Law No. 152-FZ, including Articles 5, 6, 9, 10, 10.1, 12, 14, 18, 18.1, 19, 20, 21 and 22; and applicable provisions of the Civil Code of the Russian Federation and legislation on consumer protection, electronic communications and advertising. The lawful basis is determined for each specific purpose, rather than by claiming “automatic consent” through visiting the website.
1.3. Processing necessary to enter into or perform a contract with the data subject may rely on Article 6(1)(5) of Law No. 152-FZ. Processing needed to fulfil an obligation under applicable Russian law is based on the relevant provision of Article 6. Prevention of abuse, website security and the establishment or defence of claims rely on a ground permitted by law, including Article 6(1)(7) where its conditions are met. Marketing and other optional activities are based on separate consent where required.
2. Key Definitions
2.1. Personal data means any information relating directly or indirectly to an identified or identifiable individual (the personal data subject).
2.2. Processing of personal data means any operation carried out on such data, with or without automated tools, including collection, recording, organisation, accumulation, storage, updating, retrieval, use, disclosure, granting access, anonymisation, blocking, erasure and destruction.
2.3. Operator means the person determining the purposes of processing, the categories of data and the operations performed. Under this Policy the Operator is EVA CODE, identified above.
2.4. User means a visitor to https://evacode.co.kr; purchaser means a person placing an order; recipient means the person to whom an order is sent. Any of them may be a personal data subject.
2.5. Anonymisation means actions that make it impossible, without additional information, to determine whom data relates to. Blocking means temporarily suspending processing, except where legislation permits otherwise. Destruction means irreversible elimination of data so that it cannot be recovered by ordinary means.
2.6. Disclosure to specified recipients means providing data to a particular person or group of persons; dissemination means disclosing data to an indefinite audience. Processing on instructions means processing by a service provider on behalf of the Operator for agreed purposes. These activities are legally distinct and must not be treated as equivalent.
3. Rights and Obligations of the Operator
3.1. The Operator may obtain information necessary for user registration, processing orders, deliveries, returns, handling enquiries and lawful protection of its rights. The data requested must be limited to the specific purpose.
3.2. The Operator may continue processing certain information after consent is withdrawn where an independent ground exists under Article 6 of Law No. 152-FZ or another applicable federal law. For example, withdrawing marketing consent does not automatically terminate processing needed to complete an outstanding order or lawfully resolve a dispute.
3.3. The Operator must give data subjects the information required by law about processing, maintain the accuracy and confidentiality of data, and comply with legitimate requests for correction, blocking and destruction.
3.4. The Operator implements necessary legal, organisational and technical security measures, regulates access by staff and service providers, handles data-subject requests and cooperates with the competent authority where required by Russian law.
3.5. The Policy is available on the website, including from pages where personal data is collected. Publication of this Policy does not replace separate consents required by law or notifications to Roskomnadzor.
4. Rights and Obligations of Users
4.1. Users may receive information about processing of their personal data and, in cases provided for by law, request correction, blocking, erasure or cessation of processing, as well as withdraw consent previously given.
4.2. Users may seek protection of their rights, complain to Roskomnadzor and challenge the Operator's acts or omissions in court.
4.3. Users provide accurate information required to place and deliver an order and inform the Operator of changes. When providing another recipient's details, the user must have a lawful basis to do so. This does not relieve the Operator of its own duty to process data lawfully.
4.4. If a user declines to provide details needed for payment, delivery or a refund, the relevant service may not be available. Refusal of optional marketing or analytics does not prevent an ordinary purchase.
5. Principles of Personal Data Processing
5.1. EVA CODE processes personal data lawfully and fairly for purposes determined in advance and does not subsequently use it for incompatible purposes.
5.2. Only necessary information is collected for each purpose. Excessive collection, combining databases maintained for incompatible purposes and storage without a lawful reason are not permitted.
5.3. The Operator takes reasonable steps to ensure accuracy and currency of information and corrects or deletes inaccurate data at a data subject's request or upon discovering an error itself.
5.4. Data is stored in identifiable form only for the period needed for the relevant purpose or a mandatory period established by applicable legislation, or by a contract where that is a lawful basis.
5.5. Processing is based on grounds provided by Article 6 of Law No. 152-FZ: consent; necessity to conclude or perform a contract; compliance with applicable legal requirements; exercise of rights and lawful interests without infringing data subjects' rights; or other grounds, where applicable. Separate consent is not deemed given automatically through visiting the website or making a purchase.
6. Processing Purposes and Categories of Personal Data
6.1. The Operator may process information about website visitors, account holders, purchasers, order recipients, persons contacting customer support and representatives of counterparties within the purposes listed below.
| Processing purpose | Categories of personal data | Legal basis |
|---|---|---|
| Registration and use of a personal account | Name or display name, email, telephone where provided, account identifier, authentication data and profile preferences | Conclusion or performance of a contract with the user; other applicable grounds under Article 6 of Law No. 152-FZ |
| Placement, confirmation and fulfilment of orders | First and last names, telephone, email, delivery address and postal code, country, order contents, value and history, discounts | Conclusion and performance of a sales contract |
| Payment processing, bank transfers and refunds | Order number, amount, currency, payment method and status, transaction identifier, necessary payer details, bank account details solely when required for a refund or reconciliation | Performance of the contract, legally prescribed obligations, resolution of payment disputes |
| Delivery and customs clearance | Recipient's name and contact details, delivery address, tracking number, proof of delivery, additional customs information only where lawfully required | Performance of the contract and applicable shipment-clearance obligations |
| Returns, complaints and responses to enquiries | Contact details, order and correspondence, details of defects, returns, refunds and necessary evidence of packing/delivery | Contract performance, complaint handling and protection of rights on a lawful basis |
| Website operation and security | IP address, necessary cookies, technical identifiers, login/error logs, signs of unlawful activity | Contract, legitimate interests subject to Article 6(1)(7) or another applicable basis |
| Promotional mailings and offers | Email, telephone or identifier for a selected communication channel, consent and withdrawal records | Prior consent where required by law |
| Loyalty programmes and personalised offers, if available | Profile identifier, purchase history, bonus records and advertising preferences | Contract for an additional service or separate consent where necessary |
| Website improvement and user-experience research | Technical usage metrics, anonymised statistics; interview information and recordings of interactions only if such research actually takes place and a lawful basis exists | Appropriate lawful basis for the activity; separate consent where required |
6.2. Date and place of birth, passport details, health information, and audio/video recordings of users' activity on the website are not mandatory for an ordinary purchase. If a particular service genuinely requires such information, the Operator discloses the specific purpose, data categories, legal basis and retention period in advance and complies with special rules for sensitive data and recordings where applicable.
6.3. Where needed to resolve complaints, photographs or video of packing, dispatch or delivery may be used if such records are actually made lawfully. The Operator limits the scope of recording and access to it; this Policy does not establish continuous recording of all customers' activities.
6.4. Full payment card details and CVV/CVC codes are not requested by customer support. Information received directly by a payment system is processed in accordance with its actual technical role and applicable rules; the Operator retains only the information necessary for orders and payment disputes.
6.5. For bank transfers chosen by the purchaser, the Operator uses payment and payer details only to the extent needed to reconcile receipts, confirm an order or issue a refund.
6.6. Data comes from the user, their designated recipient, payment services, banks, logistics companies and other participants in order fulfilment, solely to the necessary and permissible extent.
7. Personal Data Processing and Retention Periods
7.1. Processing continues until the specific purpose has been achieved or a ground for termination arises under law or contract. Having an account does not justify indefinite retention of all related records.
7.2. The following retention criteria apply to individual categories:
| Category | Retention period or termination criterion |
|---|---|
| Profile and authentication data | While needed to maintain the account and fulfil obligations; after account deletion, only records with an independent retention basis |
| Orders, payments, bank transfers, delivery and return documents | Until obligations are performed, necessary settlements are completed and applicable mandatory retention periods or periods for protecting specific legal claims have expired |
| Correspondence and complaints | Until the enquiry is resolved and, where reasonably necessary, while a resulting dispute is being handled |
| Marketing contact details | Until consent is withdrawn or its stated term expires; a minimal opt-out record may be retained on a justified basis to prevent further mailings |
| Loyalty programme information | While the user participates or data is needed for lawful bonus accounting; relevant processing then ends |
| Technical logs, cookies and security records | For the actual periods established for the services and by internal policies, proportionate to the purpose; exact values require verification of the live website's configuration |
| Photo, video and audio material, if actually created | No longer than necessary for the stated purpose; relevant material may be retained longer for a specific dispute on an independent lawful basis |
| Consent records | To the necessary extent and for a justified period to demonstrate lawful processing and comply with legal obligations |
7.3. Upon achievement of the purpose, expiry of the period, withdrawal of consent, a data subject's request or discovery of unlawful processing, data processing ceases, or the data is blocked, destroyed or anonymised in the cases and within the periods specified in Article 21 of Law No. 152-FZ. Where that article's general destruction rule applies, the period is no more than 30 days after the relevant ground arises, unless the law or a permitted exception provides otherwise.
7.4. Electronic records are destroyed so they cannot be recovered by ordinary means. Physical media are destroyed securely. Records subject to mandatory retention are kept separate from current user data and are not used for incompatible marketing.
7.5. The Operator must establish actual periods for technical logs, cookies, backups and possible website-interaction recordings after checking the real infrastructure; this document does not introduce a fictitious uniform period for all data.
8. Disclosure to Independent Third Parties
8.1. The Operator does not sell customers' personal data or disclose it to an indefinite audience without a proper basis. Disclosure to specific independent recipients is permitted where needed for payment, delivery, legal compliance or protection of rights and a lawful basis exists.
8.2. Depending on the service selected, recipients may include banks and payment organisations, independent payment system operators, transport and postal services, customs representatives, organisations handling refunds and public authorities acting on lawful requests.
8.3. The availability of PayPal, Visa, Mastercard, Kaspi, Mir and bank transfers does not mean that every such participant automatically receives all customers' data. The amount of information disclosed depends on the chosen payment method and the recipient's actual role. The complete list of legal entities, countries and data fields must be verified against contracts and technical integrations.
8.4. Independent recipients receive only necessary information. Disclosure for their own advertising purposes is handled separately on an appropriate lawful basis, including consent where required.
8.5. Information about specific recipients, the bases for disclosure and international transfers is provided to users where and to the extent required by Russian legislation. This Policy is not a blanket authorisation to send data to any third party.
9. Processing Entrusted to Service Providers
9.1. To operate the website, EVA CODE may engage Russian hosting providers, technical infrastructure operators, customer support and notification services, payment processors and other suppliers, where they act as processors on the Operator's instructions rather than independent recipients.
9.2. Entrusting processing is governed by Article 6(3) of Law No. 152-FZ, under a contract or other legally permitted instruction, with compliance with data-subject consent requirements where applicable.
9.3. The instruction specifies purposes, data categories, authorised operations and obligations relating to confidentiality, data security, localisation requirements, supporting documentation, incident notification and cessation of processing when the instruction ends.
9.4. A provider may not use customer data for its own advertising merely because it supports the online store. The Operator retains responsibility under applicable law for persons processing data on its instructions.
9.5. Providers that determine their own processing purposes and grounds (such as certain banks or payment systems) are treated as independent recipients, not automatically as service providers processing on instructions.
10. Processing Methods and Security
10.1. The Operator carries out automated and, where needed, non-automated processing within the stated purposes. Activities include collection, recording, accumulation, updating, use, lawful transfer, anonymisation, blocking and destruction.
10.2. EVA CODE implements access controls, manages permissions of employees and providers, protects data transmission, controls accounts, performs backups and responds to incidents. Specific measures are selected with regard to risks and Articles 18.1 and 19 of Law No. 152-FZ.
10.3. Persons granted access must keep data confidential and must not use it beyond their authorisations. The claim that disclosure to third parties is impossible “under any circumstances” does not apply, because the law and performance of contracts allow lawful disclosure.
10.4. In the event of a data security breach, the Operator takes measures required by law, including notifications to Roskomnadzor and internal investigation where required under Article 21 of Law No. 152-FZ.
11. Cookies, Analytics and Website-Use Research
11.1. Cookies and similar technical identifiers may be used for account login, shopping cart functions, saving preferences, preventing suspicious activity and proper operation of pages.
11.2. Optional analytics and advertising technologies, if enabled, are used for stated purposes and on a proper lawful basis. Where consent is required, they must not be activated before it is obtained; users may refuse or later change their selection.
11.3. Anonymised or otherwise lawfully processed information about visits and actions on the website may be used for statistics. Screen recordings, user-action tracking, interviews and audio/video materials are not automatically authorised by this Policy: before using them, the Operator determines the purposes, necessity, data categories and legal basis.
11.4. Users can manage cookies through website controls and browser settings. Disabling strictly necessary cookies may restrict certain functions. The list of services actually used and their retention periods must reflect the live website.
12. Advertising, Mailings and Separate Consents
12.1. Service messages about payment, order status, delivery and returns are sent to perform the contract. Independent advertising, promotions and offers are sent only on an applicable lawful basis.
12.2. Promotional messages via email, telephone, SMS and other channels covered by Article 18 of the Russian Federal Law “On Advertising” are sent with the recipient's prior consent. Users may opt out using an email link, relevant settings or by writing to orders@evacode.co.kr.
12.3. Where consent to personal data processing is required, it is obtained separately from other documents and information that the user signs or confirms, in accordance with Article 9 of Law No. 152-FZ. Optional consent boxes are not preselected.
12.4. Separate expressions of choice required by law are obtained for distinct purposes, such as advertising, optional analytics, publishing identifiable reviews and disclosure to independent marketing partners. Dissemination of personal data to an indefinite audience is also assessed under Article 10.1 of Law No. 152-FZ.
12.5. The Operator retains necessary evidence of consent and withdrawal, including purpose, text version, date and means of expressing the choice. Refusal of optional consent does not justify refusal of an ordinary purchase.
13. Servers in Russia and Transfers Abroad
13.1. EVA CODE's website server infrastructure is located in the Russian Federation. When collecting Russian citizens' personal data, the Operator must comply with Article 18(5) of Law No. 152-FZ as amended: except for lawful exceptions, operations at the point of collection covered by that provision must not be performed using databases located outside Russia.
13.2. Hosting a web server in Russia does not in itself establish compliance for the entire infrastructure. Actual databases, initial recording, backups, external analytics, email and payment services, remote access and synchronisation must be assessed separately.
13.3. As the seller is registered in the Republic of Korea and delivers products worldwide, fulfilment may require cross-border transfers of limited data, including access by authorised employees or organisations abroad. The actual recipient, country, purpose and legal basis are established for each such operation.
13.4. Before a cross-border transfer falling under Article 12 of Law No. 152-FZ begins, the Operator submits a separate notification to Roskomnadzor and observes statutory commencement procedures and any applicable restrictions or prohibitions. Localisation and notification requirements are not waived by an ordinary customer checkbox.
13.5. International transfer does not mean unrestricted disclosure to any foreign partner. Only information necessary for a specific lawful purpose is provided.
14. Requests, Correction and Cessation of Processing
14.1. For access, correction, deletion, blocking, cessation of processing or withdrawal of consent, users may email orders@evacode.co.kr with the subject “Personal Data”, or use the Operator's contact information provided at the beginning of this Policy.
14.2. To prevent disclosure to unauthorised persons, the Operator may ask for information sufficient to verify that a request relates to the claimant, to the extent permitted by law. Bank passwords, CVV/CVC codes and one-time verification codes are not requested.
14.3. Information about processing and a reasoned response are provided in the cases and periods specified by Articles 14 and 20 of Law No. 152-FZ. As a general rule, an access request is subject to a 10-business-day period, which may be extended by no more than 5 business days with a reasoned notice where statutory conditions are met.
14.4. Correction, cessation, blocking and destruction are performed within the periods and in the manner specified in Article 21 of Law No. 152-FZ, subject to applicable exceptions. If information must lawfully be retained for a particular purpose, the Operator identifies the relevant basis and restricts further use.
14.5. Where grounds exist, users may contact Roskomnadzor or a court to protect their rights.
15. Final Provisions
15.1. This Policy applies to EVA CODE processing activities subject to the laws of the Russian Federation. The Operator's presence in the Republic of Korea does not replace applicable Russian requirements; equally, this Policy does not assert that Russian law applies to every international customer solely due to the language selected on the website.
15.2. Amendments are published at https://evacode.co.kr/privacypolicy with the effective date of the relevant version. Changes to purposes, recipients or operations require the Operator to reassess lawful grounds and obtain fresh consent where required.
15.3. Personal data enquiries: orders@evacode.co.kr; telephone: +82 10-7652-8595; Operator's address: as provided at the beginning of this document.
15.4. This document is not consent to personal data processing for all purposes and does not permit unconditional disclosure to third parties. Users' rights are determined by the applicable legislation of the Russian Federation.