Privacy Policy

This Personal Data Processing Policy (hereinafter — the "Policy") has been developed in accordance with the requirements of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and defines the procedure for processing the personal data of individuals interacting with the Imperial Hotel.

This Policy is binding on all employees of the Operator who have access to the personal data of data subjects.

1. Personal Data Operator

The personal data operator is:

Full name: Individual Entrepreneur Imran Ramazanovich Tokhchukov (Imperial Hotel)

INN: 091693696477

OGRNIP: 326080000014492 (date of assignment 28.05.2026)

Registered address: 357390, Republic of Kalmykia, Elista, Karelskaya St., 25

Postal address: Arkhyz village, Romantik settlement, Gornaya St., 55

Email: imperial.arkhyz@mail.ru

Phone: +7 (938) 025-88-88

Website: https://imperial-arkhiz.ru/ru

(hereinafter — the "Operator")

The Operator is registered with Roskomnadzor as an operator carrying out the processing of personal data, in accordance with the requirements of Article 22 of Federal Law No. 152-FZ.

2. Legal Grounds for Processing Personal Data

2.1.The processing of personal data is carried out on the basis of:

• •Federal Law No. 152-FZ of 27 July 2006 "On Personal Data";
• •the Civil Code of the Russian Federation;
• •Law of the Russian Federation No. 2300-1 of 7 February 1992 "On the Protection of Consumer Rights";
• •the Rules for the Provision of Hotel Services in the Russian Federation (Decree of the Government of the Russian Federation No. 1852 of 18 November 2020);
• •Federal Law No. 129-FZ of 8 August 2001 "On the State Registration of Legal Entities and Individual Entrepreneurs";
• •Federal Law No. 128-FZ of 25 July 1998 "On State Fingerprint Registration in the Russian Federation" (with respect to migration registration);
• •Federal Law No. 38-FZ of 13 March 2006 "On Advertising";
• •other regulatory legal acts of the Russian Federation.

2.2.Legal grounds for processing personal data depending on the purpose:

• Contract (Art. 6, part 1, clause 5, No. 152-FZ)Processing is necessary for the performance of the contract for the provision of hotel services, to which the data subject is a party.
• Consent (Art. 6, part 1, clause 1, No. 152-FZ)Marketing mailings, cookies, processing of health data (allergies and contraindications).
• Legislation (Art. 6, part 1, clause 2, No. 152-FZ)Accounting, migration registration, document retention.
• Legitimate interest (Art. 6, part 1, clause 7, No. 152-FZ)Ensuring security, video surveillance, protection of property.

3. Personal Data Subjects

3.1.The Operator processes the personal data of the following categories of subjects:

• •Guests — individuals staying at the hotel or using its services;
• •Customers — individuals and legal entities making bookings of services for the benefit of guests;
• •Website users — persons visiting the hotel's official website;
• •Employees — individuals in an employment relationship with the Operator (governed by a separate policy);
• •Counterparties — individuals who are representatives of legal entities that are partners of the Operator.

4. Composition of Processed Personal Data

4.1.Data provided at booking and check-in:

• •surname, first name, patronymic;
• •date of birth;
• •citizenship;
• •details of the identity document (series, number, date of issue, issuing authority);
• •phone number;
• •email address;
• •registration address (for migration registration of foreign nationals);
• •information on the number of guests and the presence of children;
• •information on the vehicle (when using parking).

4.2.Data generated in the course of providing services:

• •booking information (dates, room category, rate, price);
• •payment and settlement history;
• •recordings of telephone conversations and correspondence;
• •video surveillance data (in public areas) on the premises;
• •data on ordered additional services;
• •information on violations of the accommodation rules (if any).

4.3.Technical data when using the website:

• •the user's IP address;
• •cookie data;
• •date, time and fact of visiting the website;
• •information about the browser and device;
• •pages viewed by the user;
• •data from Yandex.Metrica and other analytics services.

4.4.Special categories of personal data:

Subject to the separate explicit consent of the data subject, the Operator may process health data with respect to food allergies and contraindications to visiting the SPA area solely for the purpose of ensuring safety and the proper provision of services. Such data is not transferred to third parties and is not used for any other purposes.

5. Purposes of Processing Personal Data

• Performance of the contract for the provision of hotel servicesFull name, identity document, contacts, booking data, payment data.
• Migration registration of foreign nationalsFull name, date of birth, identity document, citizenship, registration address.
• Accounting and tax recordsFull name, payment details, settlement data.
• Sending service notificationsEmail, phone, booking data.
• Marketing mailings (subject to consent)Email, phone, messenger.
• Ensuring security on the premisesVideo surveillance data, access data.
• Analytics and improvement of service qualityTechnical website data, Yandex.Metrica data.
• Handling of claims and disputesAll categories of data related to the subject matter of the dispute.

6. Principles of Processing Personal Data

6.1.When processing personal data, the Operator is guided by the following principles (Article 5 of Federal Law No. 152-FZ):

• •lawfulness and fairness — processing is carried out only on lawful grounds;
• •purpose limitation — data is collected for specific, predetermined purposes and is not processed for purposes incompatible with them;
• •minimization — the volume of processed data corresponds to the stated purposes;
• •accuracy — the Operator takes measures to maintain the relevance and accuracy of the data;
• •storage limitation — data is stored no longer than required by the purposes of processing;
• •integrity and confidentiality — the Operator ensures the protection of data against unauthorized access, loss and destruction;
• •accountability — the Operator is responsible for compliance with these principles.

7. Retention Periods of Personal Data

• Booking and accommodation data5 years from the end of the stay.
• Accounting documents5 years (Article 29 of Federal Law No. 402-FZ "On Accounting").
• Migration registration documents1 year (in accordance with the requirements of the Ministry of Internal Affairs of the Russian Federation).
• Recordings of telephone conversations3 years from the date of recording.
• Video surveillance data30 days, unless used in connection with claims or court proceedings.
• Technical website data (cookies, logs)1 year.
• Marketing mailing dataUntil consent is withdrawn + 3 years to confirm the fact of consent.
• Health data (allergies)Until the end of the provision of the services for which it was provided.

Upon expiry of the retention periods, personal data is subject to destruction or anonymization in accordance with the procedure established by the Operator's internal documents.

8. Transfer of Personal Data to Third Parties

8.1.The Operator may transfer the personal data of subjects to the following categories of recipients:

• State authorities (Ministry of Internal Affairs, Federal Tax Service, prosecutor's office, etc.)On the basis of the requirements of the legislation of the Russian Federation.
• Partners (transport companies, excursion bureaus, instructors)On the basis of a contract, for the performance of the services ordered by the subject.
• Payment systems and banksFor carrying out settlements under the contract.
• TravelLine online booking systemFor the processing and confirmation of bookings.
• Analytics services (Yandex.Metrica)On the basis of the subject's consent (cookies).
• Cloud services and IT contractorsFor ensuring the operation of the infrastructure, on the basis of a contract with a confidentiality clause.

8.2.The transfer of personal data to third parties in other cases is carried out solely with the written consent of the personal data subject or in cases expressly provided for by the legislation of the Russian Federation.

8.3.When transferring data to third parties, the Operator concludes confidentiality agreements with them, or the relevant terms are included in the contract.

9. Rights of Personal Data Subjects

9.1.The personal data subject has the right (Articles 14–17 of Federal Law No. 152-FZ):

• Right of accessTo obtain confirmation of the fact of processing of their data and a copy thereof.
• Right to rectificationTo demand the correction of inaccurate or incomplete data.
• Right to erasureTo demand the cessation of processing and the destruction of data in the absence of lawful grounds for its retention.
• Right to restriction of processingTo demand the suspension of data processing in the cases provided for by law.
• Right to withdraw consentTo withdraw consent to processing at any time; withdrawal does not affect the lawfulness of processing prior to its receipt.
• Right to appealTo file a complaint with Roskomnadzor or with a court.

9.2.To exercise their rights, the personal data subject may send a request to the Operator:

• •by email: imperial.arkhyz@mail.ru;
• •by postal address: Arkhyz village, Romantik settlement, Gornaya St., 55;
• •via the feedback form on the website.

9.3.The Operator considers requests from personal data subjects within 30 (thirty) calendar days from the receipt of the request and sends a reasoned reply.

9.4.Where it is impossible to exercise a right (for example, where there is a lawful ground for processing not related to the subject's consent), the Operator explains to the subject the grounds for the refusal.

10. Procedure for Obtaining and Withdrawing Consent

10.1.Consent to the processing of personal data necessary for the performance of the contract for the provision of hotel services is given by the subject by:

• •ticking the box "I accept the terms of the Personal Data Processing Policy" when making a booking on the website;
• •signing the check-in document.

10.2.Consent to receive marketing mailings (email, SMS, messengers) is given by ticking a separate box and is voluntary. Refusal of marketing mailings does not entail a refusal to provide services.

10.3.Consent to the processing of health data (food allergies, contraindications) is given by ticking a separate explicit box and is voluntary.

10.4.Consent to the use of cookies and analytics services is given by clicking the "Accept" button in the cookie banner on the first visit to the website. The subject may configure cookie parameters or refuse their use through the browser settings.

10.5.The subject may withdraw consent to the processing of personal data at any time by sending a notice to the Operator. Withdrawal of consent does not entail the automatic cessation of processing if other lawful grounds exist (performance of the contract, requirements of legislation).

10.6.From the receipt of the withdrawal of consent, the Operator ceases the processing of data based solely on the subject's consent within 30 (thirty) calendar days.

11. Cookies and Analytics Services

11.1.The hotel's website uses cookies — small text files stored on the user's device. Cookies do not contain personal data in explicit form and do not in themselves allow a specific user to be identified.

11.2.Types of cookies used:

• Technical (mandatory)Ensure the correct operation of the website and the booking system. Do not require consent.
• AnalyticalYandex.Metrica: collection of visit statistics, analysis of user behavior. Require consent.
• MarketingTracking the effectiveness of advertising campaigns. Require consent.
• FunctionalSaving user preferences (language, currency). Require consent.

11.3.On the first visit to the website, the user is shown a cookie banner with the option to accept all cookies or configure their use by category. Continuing to use the website without interacting with the banner does not constitute consent to the use of non-technical cookies.

11.4.The user may change cookie settings at any time through the browser settings or through the cookie management form on the website.

11.5.Data collected by Yandex.Metrica is processed in accordance with Yandex's Privacy Policy (https://yandex.ru/legal/confidential/).

12. Measures to Protect Personal Data

12.1.The Operator takes the necessary legal, organizational and technical measures to protect personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, provision, dissemination, as well as other unlawful actions.

12.2.Protection measures include:

• •appointment of a person responsible for organizing the processing of personal data;
• •limitation of the circle of persons having access to personal data;
• •use of information security tools;
• •encryption of data during transmission over the network;
• •regular backup of data;
• •maintenance of logs of access to personal data;
• •conducting briefings for employees having access to personal data;
• •assessment of the harm that may be caused to subjects in the event of a breach of legislation.

12.3.The Operator promptly notifies Roskomnadzor of identified incidents involving a breach of personal data security, in accordance with the requirements of Article 21 of Federal Law No. 152-FZ.

13. Person Responsible for Organizing the Processing of Personal Data

13.1.The Operator appoints a person responsible for organizing the processing of personal data (hereinafter — the "Responsible Person").

13.2.The Responsible Person ensures:

• •monitoring of compliance with this Policy;
• •consideration of requests from personal data subjects;
• •conducting internal audits;
• •interaction with Roskomnadzor.

13.3.Contact details of the Responsible Person: imperial.arkhyz@mail.ru, +7 (938) 025-88-88.

14. Procedure for Requests and Complaints

14.1.The personal data subject may contact the Operator with any question related to the processing of their personal data in the following ways:

• •email: imperial.arkhyz@mail.ru;
• •postal mail: Arkhyz village, Romantik settlement, Gornaya St., 55;
• •website form: https://imperial-arkhiz.ru/ru/contacts.

14.2.The Operator considers requests within 30 (thirty) calendar days.

14.3.In case of disagreement with the actions of the Operator, the subject may file a complaint with the authorized body — the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor):

• •website: https://rkn.gov.ru;
• •postal address: 109074, Moscow, Kitaygorodsky proezd, 7, building 2.

14.4.The subject also has the right to protect their rights in court in accordance with the legislation of the Russian Federation.

15. Final Provisions

15.1.This Policy comes into force from the moment of its publication on the hotel's official website.

15.2.The Operator may make changes to this Policy. The new version comes into force from the moment of its publication on the website. The Operator recommends that subjects periodically check the relevance of this Policy.

15.3.Continued use of the website or the hotel's services after the publication of a new version of the Policy constitutes the subject's consent to the amended terms, in the part not requiring separate consent.

15.4.In all matters not provided for by this Policy, the parties are governed by the applicable legislation of the Russian Federation.

15.5.This Policy is a public document and is published on the hotel's official website at: https://imperial-arkhiz.ru/ru/privacy

The document has been developed in accordance with: Federal Law No. 152-FZ "On Personal Data", Federal Law No. 38-FZ "On Advertising" (Art. 18), Federal Law No. 402-FZ "On Accounting" (Art. 29), Decree of the Government of the Russian Federation No. 1852 of 18 November 2020.