PERSONAL DATA PROCESSING POLICY

1.1. This Policy applies to all personal data that the Operator obtains through the Website and related services from users, buyers, registered Personal Account holders, persons submitting enquiries, complaints, applications, or messages, and other natural persons interacting with the Operator.

1.2. This Policy applies to personal data processing carried out by automated means, without automated means, and through a combination of such means.

1.3. When processing personal data, the Operator respects human and civil rights and freedoms, including the right to privacy and protection of personal information.

1.4. Use of the Website, registration of a Personal Account, placing an Order, sending an enquiry, or other interaction with the Operator constitutes acknowledgment by the data subject of those provisions of this Policy relevant to that interaction.

2.1. Personal data means any information relating directly or indirectly to an identified or identifiable natural person.

2.2. Operator means Continent Trading Group LLC, which independently organizes and carries out personal data processing and determines its purposes, the data involved, and the actions taken with them.

2.3. Personal data processing means any operation or series of operations involving personal data, including collection, recording, systematization, accumulation, storage, updating, retrieval, use, transmission, anonymization, blocking, deletion, and destruction.

2.4. Website means the Operator's website at https://continent.ltd, including its pages, forms, Personal Account, catalogues, services, and other related sections.

2.5. Personal data subject means the natural person to whom personal data relates.

3.1. Personal data is processed lawfully and fairly.

3.2. Processing is limited to the achievement of specific, predetermined, and lawful purposes.

3.3. The Operator does not process personal data in a manner incompatible with the purposes for which it was collected.

3.4. The content and amount of processed personal data must correspond to stated purposes and must not be excessive in relation to those purposes.

3.5. The Operator takes measures to ensure that personal data is accurate, sufficient, and up to date.

3.6. Personal data is not stored longer than required for processing purposes unless Russian Federation law prescribes a different period.

4.1. The Operator processes personal data for the following purposes:

• →registering and authenticating users on the Website and in their Personal Accounts;
• →placing, confirming, supporting, and fulfilling Orders;
• →arranging payments, refunds, and settlements;
• →arranging delivery and handover of Goods;
• →contacting users or buyers about Orders, refunds, complaints, or enquiries;
• →reviewing enquiries, applications, complaints, messages, and requests;
• →maintaining Order and interaction history in the Personal Account;
• →performing the Operator's contracts and obligations;
• →complying with Russian Federation legal requirements, including accounting, tax, fiscal, and other mandatory recordkeeping;
• →ensuring Website operation and information security and preventing abuse and fraud;
• →analysing Website use and improving its functionality and user experience;
• →sending service and information messages about Orders, payment, delivery, refunds, and Website operation;
• →sending advertising and marketing communications only where an appropriate separate lawful basis exists, when legally required.

5.1. The Operator processes personal data on the following grounds:

• →the personal data subject's consent where Russian Federation law requires consent;
• →the necessity of processing to enter into and perform a contract to which the data subject is a party;
• →the necessity of processing to fulfil the Operator's legal obligations under Russian Federation law;
• →the necessity of processing to exercise the Operator's or third parties' rights and legitimate interests, provided the data subject's rights and freedoms are not infringed;
• →other grounds established by Russian Federation law.

6.1. The Operator may process personal data relating to the following categories:

• →Website users;
• →registered Personal Account users;
• →buyers and recipients of Goods;
• →persons submitting enquiries, requests, applications, or complaints;
• →representatives of sellers, suppliers, partners, and counterparties;
• →other natural persons interacting with the Operator through the Website and related services.

7.1. Depending on the processing purposes, the Operator may process the following personal data:

• →surname, given name, and patronymic;
• →telephone number;
• →email address;
• →delivery or collection address;
• →Personal Account details, including username, email, registration and authentication information, and, where applicable at the relevant registration or use stage, a securely stored password hash;
• →Order, payment, refund, enquiry, and interaction history in the Personal Account;
• →information in messages, complaints, applications, and feedback forms;
• →records of the fact, date, time, and version of the User Agreement, Personal Data Processing Policy, and other mandatory Website documents accepted by the User;
• →IP address, cookies, user-agent, browser and device information, technical connection parameters, visited Website pages, and on-site actions;
• →the fact, status, amount, time, and transaction identifiers for payments as necessary for payment confirmation, Order performance, and refunds;
• →records of User actions taken to ensure Website security, verify registration, and prevent abuse or fraud;
• →other data voluntarily supplied by the data subject and needed for the relevant processing purpose.

7.2. The Operator does not process special categories of personal data concerning race or ethnic origin, political opinions, religious or philosophical beliefs, private life, or health unless expressly permitted or required by Russian Federation law.

7.3. The Operator does not process biometric personal data unless expressly provided for by a separate service, document, or Russian Federation law.

7.4. The Operator does not process complete bank card details of Users. Card details are entered and processed by acquiring banks, payment service providers, or other authorized payment partners. The Operator may receive only the payment fact, status, amount, time, and transaction identifier needed to confirm payment, fulfil Orders, or issue refunds.

8.1. The Operator performs collection, recording, systematization, accumulation, storage, updating, retrieval, use, transmission, anonymization, blocking, deletion, and destruction of personal data.

8.2. Personal data may be processed by automated, non-automated, or mixed methods.

8.3. The Operator takes necessary legal, organizational, and technical measures against unlawful or accidental access to, destruction, modification, blocking, copying, distribution, disclosure, and other unlawful processing of personal data.

9.1. To achieve processing purposes, the Operator may disclose personal data to third parties to the necessary extent, including:

• →sellers, suppliers, and other persons involved in fulfilling Orders;
• →banks, payment partners, acquiring banks, and payment system operators;
• →fiscal data operators;
• →delivery services, couriers, and transport companies;
• →IT contractors, hosting, notification, CRM, and technical support providers;
• →call centres and enquiry handling services;
• →state authorities and organizations as required by Russian Federation law;
• →other persons requiring data to perform a contract, comply with law, or act on the data subject's consent.

9.2. Where the Operator engages another person to process personal data, the engagement is based on a contract or another lawful ground and complies with Russian Federation law.

9.2.1. Within the Operator, personal data may be accessed only by employees and other authorized persons whose duties, contractual obligations, operation of the Website, information systems and Personal Accounts, or work on Orders, enquiries, payments, delivery, refunds, information security, or other Policy purposes require that access. They must comply with personal data confidentiality requirements and Russian Federation law.

9.3. The Operator does not publish or disclose personal data to an indefinite audience without a separate lawful ground or, where required by law, the data subject's consent.

10.1. The Operator does not transfer personal data across national borders except where Russian Federation law and/or a separate Operator service expressly permits this; data subjects will be separately notified if such transfers occur.

10.2. Where a cross-border transfer is required, the Operator complies with Russian Federation law, including notification of the competent authority where legally required.

11.1. When collecting personal data, including via the internet, the Operator ensures that personal data of Russian Federation citizens is recorded, systematized, accumulated, stored, updated, and retrieved using databases located within the Russian Federation.

12.1. Personal data is processed and stored no longer than necessary for its processing purposes, unless Russian Federation law, a contract, consent of the data subject, or internal documents lawfully adopted by the Operator provide otherwise.

12.2. Once processing purposes have been achieved or are no longer relevant, personal data is deleted, destroyed, or anonymized unless Russian Federation law provides otherwise.

12.3. After a data subject withdraws consent, the Operator stops processing and destroys the relevant personal data if there is no other lawful basis for continued processing.

13.1. A personal data subject has the right to:

• →obtain information about the processing of their personal data;
• →request correction, blocking, or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated processing purposes;
• →withdraw consent where processing is based on consent;
• →challenge actions or omissions of the Operator before a competent supervisory authority or court;
• →exercise other rights provided by Russian Federation law.

13.2. To exercise these rights, the data subject may email info@continent.ltd or send a request to the Operator's mailing address or through other channels specified on the Website.

14.1. The Operator is entitled to:

• →obtain accurate information from the data subject required for processing purposes;
• →continue processing without consent where Russian Federation law provides a lawful ground;
• →determine independently the measures necessary and sufficient to fulfil obligations imposed by Russian Federation law.

14.2. The Operator must:

• →organize personal data processing in accordance with Russian Federation law;
• →publish this Policy or otherwise ensure unrestricted public access to it;
• →take the necessary and sufficient measures to perform obligations imposed by Russian Federation law;
• →provide information about processing of a data subject's personal data upon request;
• →protect personal data;
• →stop processing and destroy personal data where required by Russian Federation law;
• →perform other duties imposed by Russian Federation law.

15.1. The Operator may use cookies, localStorage, sessionStorage, pixels, event logs, device identifiers, and other technologies to:

• →ensure the Website functions correctly;
• →save User settings and authentication status;
• →ensure security;
• →analyse Website usage;
• →improve functionality and user experience.

15.2. Users may limit or disable cookies in their browser settings, but some Website functions may then operate incorrectly.

15.3. Where particular categories of cookies, analytics, or advertising tools require separate consent under Russian Federation law or the Website's actual configuration, the Operator obtains such consent through the appropriate form.

16.1. The Operator and other persons lawfully granted access to personal data must not disclose or distribute such data without the data subject's consent unless Russian Federation law provides otherwise.

16.2. The Operator ensures the confidentiality of personal data and takes measures to prevent unauthorized access.

17.1. The Operator considers enquiries and requests from personal data subjects in the manner and within the periods established by Russian Federation law.

17.2. The Operator may request information needed to verify the applicant's identity and authority where necessary to handle the request properly and protect personal data.

18.1. The Operator may amend this Policy.

18.2. A revised Policy takes effect upon publication on the Website unless that revision specifies otherwise.

18.3. The current version of this Policy is always available on the Operator's Website.