Information on the personal data protection measures implemented

This document is published by AELITA PRODUCTION LLC (the “Data Controller”) pursuant to part 2 of article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”, which requires a controller to publish not only its personal data processing policy but also information on the protection measures it implements. The Policy is published separately — at this link.

1. Organisational measures

1.1. A person responsible for organising the processing of personal data has been appointed by order of the Data Controller.

1.2. A Personal Data Processing Policy has been approved and published in open access; this document is published alongside it.

1.3. Access to personal data is granted only to those employees and engaged persons who need it to perform their duties. The list of such persons is limited and is reviewed whenever the composition of the team changes.

1.4. Persons granted access to personal data sign agreements containing a confidentiality clause; where processing is entrusted to a third party, a separate personal data processing instruction is concluded in accordance with part 3 of article 6 of Federal Law No. 152-FZ.

1.5. Internal monitoring is carried out to verify that the processing of personal data complies with the law and with the Data Controller's internal documents.

1.6. Requests from personal data subjects are handled in the manner and within the time limits set out in the Policy (section 6).

2. Technical measures

2.1. Data is exchanged between the user's device and the Data Controller's services over the secure HTTPS protocol with channel encryption (TLS).

2.2. Account passwords are stored solely in irreversibly hashed form (scrypt algorithm). The plain password is not known to the Data Controller and cannot be recovered — only reset.

2.3. Access rights to the information systems are segregated: internal sections and ticket control interfaces are protected by a separate staff access code.

2.4. Bank card details are neither transmitted to nor processed by the Data Controller: payment is handled on the payment service's side.

2.5. Databases containing personal data are backed up.

2.6. Analytics services that process information about user behaviour on the Site are loaded only after the user has given consent via the banner; without consent such services are not connected.

3. Measures relating to data storage

3.1. Personal data of citizens of the Russian Federation processed in connection with the account, ticket purchases and event registration is held on infrastructure physically located within the territory of the Russian Federation, in accordance with part 5 of article 18 of Federal Law No. 152-FZ.

3.2. Retention periods are limited by the purposes of processing and by statutory requirements; specific periods by category of data are set out in section 5.4 of the Policy. Once the purposes have been achieved or consent is withdrawn, the data is destroyed, except for data the Data Controller is required by law to retain.

3.3. Documents belonging to the special category of personal data and attached by the subject to a ticket refund request are stored separately from the rest of the order data, with restricted access, and are deleted once the period specified in the Policy has expired.

3.4. Video recordings obtained through video surveillance at the venue where events are held are kept for no more than 30 days, unless a longer period is required to investigate a specific incident.

4. Measures applied when collecting personal data

4.1. Personal data is collected only through forms in which the subject confirms consent to processing by a separate action and is able to read the Policy before submitting the data.

4.2. Consent to receive information messages is requested separately from consent to the processing of personal data and may be withdrawn at any time.

4.3. The amount of data collected is limited to what is necessary for the stated purpose; excessive information is not requested.

5. Keeping this information up to date

5.1. This information is reviewed whenever the set of measures applied, the services used or statutory requirements change.

5.2. Questions relating to the processing and protection of personal data should be sent to aelita.production@yandex.ru.

See also: Privacy Policy · Cookie Policy · All documents