This policy defines how personal data is processed and protected across the Narayana digital ecosystem. The operator is Individual Entrepreneur Veniamin Vasilievich Tkachuk (Индивидуальный предприниматель Ткачук Вениамин Васильевич) (INN 500117586550, OGRNIP 320237500209283), entry No. 23-25-168561 in the Roskomnadzor register of personal data operators.
1. Scope of This Policy
This policy applies to narayana108.com, club.narayana108.com, narayana.center, network.narayana108.com, spaces.narayana108.com, academy.narayana108.com, ai.narayana108.com, lab.narayana108.com, id.narayana108.com, assets.narayana108.com, veniamintkachuk.ru, mantra-sochi.ru, narayanashop.ru, narayana-eda.ru and seva.narayana108.com, including their pages and forms and subsequent correspondence relating to an enquiry. Additional terms may apply to individual services and will be published next to the relevant service.
2. Processing Principles
The operator processes only the data needed for specific, lawful purposes; does not combine incompatible purposes; maintains accuracy, confidentiality and security; and stops processing and deletes or anonymises data once the purpose has been achieved, unless the law requires longer retention.
3. Data Subjects, Purposes, Data and Legal Grounds
Website visitors and prospective customers
Purposes: receiving and handling an enquiry, preparing an offer, contacting the applicant and protecting the website from abuse. Data: name, telephone number, email address or another chosen contact, enquiry content, selected direction, date and source of the enquiry, and its technical identifier. Legal grounds: consent; steps taken at the data subject's request before entering into a contract; and legitimate interest in maintaining security.
Customers, guests and purchasers
Purposes: booking and providing services, selling and delivering goods, payments, receipts, refunds, support and legal compliance. Delivery address, order details, dates of stay and group composition may also be processed. Legal grounds: entering into and performing a contract, the law, and consent only where it is required.
Partners, contractors and organisation representatives
Purposes: discussing cooperation, verifying authority, entering into and performing contracts, business correspondence and accounting. Data: name, position, organisation, business contacts, details and correspondence. Legal grounds: contract, law, consent or legitimate interest in conducting business while respecting the data subject's rights.
Applicants, employees and service providers
Purposes: recruitment, engagement, employment administration and accounting. The data involved depends on the vacancy and applicable employment and tax law. CVs and portfolio links are not published without a separate legal basis.
Marketing subscribers
Marketing and informational messages are sent only with separate prior consent. A response to a specific enquiry, a service message under a contract or a requested commercial proposal is not treated as a marketing campaign.
Website visitors
For security purposes, the IP address, request time and address, device and browser type, error logs and security markers may be processed. Optional analytics and measurement cookies are enabled only after the visitor's choice where consent is required by law.
4. Special Categories and Biometric Data
General forms are not intended for information about health, religious or philosophical beliefs, intimate life, criminal records, biometric data or identity-document copies. Please do not include such information in a free-text comment. If information about health is objectively required for catering, accessibility or the safe provision of a particular service, the operator will request the minimum amount and separate consent in the form required by law.
5. Processing Operations and Methods
Processing may include collection, recording, organisation, accumulation, storage, updating, retrieval, use, provision to an authorised processor, blocking, deletion and destruction. Processing may be automated, manual or mixed. Decisions producing legal consequences for a person are not made solely by automated means.
6. Storage in Russia and Processors
The initial recording, organisation, accumulation, storage, updating and retrieval of Russian citizens' data are performed using databases located in the Russian Federation. Russian hosting, CRM, email, payment, fiscal receipt, delivery and analytics providers may be engaged only to the extent required for their function and under a contract and processing instruction.
Automatic transfer of personal data to foreign forms, messengers and overseas cloud storage is not the standard way of receiving applications. Cross-border transfer is permitted only after the requirements of Article 12 of Federal Law No. 152-FZ have been met, including prior notification of Roskomnadzor, and where an appropriate legal basis exists. A person who independently chooses an external messenger should consider that service's rules and infrastructure.
7. Retention Periods
- an enquiry that does not result in a contract: up to one year after the last contact;
- a job application: up to one year unless consent is given for a talent pool;
- contract and claim data: for the contract term and up to three years afterwards;
- primary accounting records: at least for the period required by law;
- marketing consent: until withdrawal or three years without interaction;
- security logs: up to one year unless an incident requires longer retention.
8. Data Subject Rights
A data subject may obtain information about processing; request correction, blocking or deletion; withdraw consent; object to processing based on legitimate interest; and challenge the operator's actions before Roskomnadzor or a court. To verify identity and prevent disclosure to a third party, the operator may request reasonable confirmation.
9. Requests and Withdrawal
Send a request to info@narayana.center with the subject “Personal Data”. Include your name, contact or another identifier that allows the record to be found, the substance of the request and the desired response method. The operator responds within the statutory time limits. Withdrawal does not affect the lawfulness of earlier processing or stop processing required by contract or law.
10. Security and Incidents
Measures include access control, activity logging, backups, system updates, communications protection, responsible-person training and processor review. If an incident occurs, the operator acts to stop it and notifies Roskomnadzor within the legally prescribed time limits.
11. Operator
Individual Entrepreneur Veniamin Vasilievich Tkachuk (Индивидуальный предприниматель Ткачук Вениамин Васильевич)
INN 500117586550, OGRNIP 320237500209283
Address: 33/1 Martovskaya Street, SNT BRIZ, Lazarevsky District, Sochi, Krasnodar Region, 354208, Russia
Email: info@narayana.center