Personal Data Processing Policy
In force from 12 August 2026.
The Russian-language version of this document is the governing text. This translation is provided for convenience.
1. General
1.1. This Policy sets out how Общество с ограниченной ответственностью «Велфарм» (the "Operator") processes personal data and the measures it takes to protect them. It is issued under clause 2 of part 1 of article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data".
1.2. Operator details:
- Full name: Общество с ограниченной ответственностью «Велфарм»
- INN / KPP: 7733691513 / 770501001
- OGRN: 1097746038180
- Registered address: 115184, г. Москва, Озерковский переулок, д. 12, эт. 1, пом. I, ком. 9
- Address for data-subject requests: privacy@velpharm.ru
1.3. This Policy applies to processing carried out by the Operator in providing access to the closed tender platform at `velpharmbid.ru` (the "Platform").
1.4. The current version is published in open access at `velpharmbid.ru/legal/privacy-policy`.
2. Definitions
2.1. Personal data — any information relating to a directly or indirectly identified or identifiable natural person (the data subject).
2.2. Processing — any action or set of actions performed on personal data, including collection, recording, systematisation, accumulation, storage, rectification, retrieval, use, transfer, depersonalisation, blocking, erasure and destruction.
2.3. User — a natural person acting on behalf of a legal entity: an employee of the Operator admitted to the Platform as a buyer, or a representative of an invited supplier organisation.
3. Categories of subjects and data
3.1. The Operator processes personal data of:
- employees of the Operator who use the Platform to run procurement;
- representatives of supplier organisations invited to take part.
3.2. The following personal data are processed:
| Category | Contents | Source |
|---|---|---|
| Account data | surname, first name, email address, password hash | provided by the subject |
| Contact data | telephone number, job title, department | provided by the subject |
| Profile | profile image (if uploaded), interface language | provided by the subject |
| Activity data | date, time and content of actions on the Platform, IP address, browser information | generated automatically |
3.3. The Operator does not process special categories of personal data (race, ethnicity, political opinions, religious beliefs, health, sex life), biometric personal data, or data of minors. The Platform is not intended for use by natural persons for personal purposes.
3.4. Information about tenders, commercial offers and prices is not personal data and is processed as a trade secret under Federal Law No. 98-FZ of 29 July 2004.
4. Purposes and legal grounds
| Purpose | Legal ground |
|---|---|
| Providing access to the Platform, identifying the User | 152-FZ art. 6(1)(5) — performance of a contract |
| Running procurement procedures and corresponding with suppliers | 152-FZ art. 6(1)(5) |
| Sending notifications relating to the Platform | 152-FZ art. 6(1)(5) |
| Keeping an activity log so procurement remains traceable | 152-FZ art. 6(1)(7) — legitimate interests |
| Information security and incident investigation | 152-FZ art. 6(1)(7) |
| Sending informational mailings | 152-FZ art. 6(1)(1) — consent, withdrawable separately |
4.1. Processing is limited to these purposes. Processing incompatible with them is not permitted.
5. How data are processed
5.1. Processing is carried out using automated means.
5.2. Localisation. The databases in which personal data of citizens of the Russian Federation are recorded, systematised, accumulated, stored, rectified and retrieved are located within the Russian Federation (152-FZ art. 18(5)).
5.3. Cross-border transfer of personal data is not carried out.
5.4. Transfer to third parties. The Operator does not transfer personal data to third parties, except:
- persons engaged to deliver email messages, to the extent needed for
delivery;
- where required by the legislation of the Russian Federation, at the request
of authorised state bodies.
5.5. A User's personal data are not disclosed to other organisations taking part in procurement, except for information needed to correspond about a specific procedure.
5.6. Retention. Personal data are kept no longer than the purposes require:
| Data | Period |
|---|---|
| Account and contact data | until Platform access ends, plus 3 (three) years |
| Procurement activity log | 5 (five) years from completion of the procurement procedure |
| Data the law requires to be kept | for the statutory period |
5.7. Once the purposes are met, or consent is withdrawn, personal data are destroyed or depersonalised unless the law requires otherwise.
6. Protective measures
6.1. The Operator applies legal, organisational and technical measures to protect personal data against unlawful access, destruction, alteration, blocking, copying and dissemination, including:
- appointing a person responsible for organising personal data processing;
- separating access rights: buyers and suppliers work in separate areas, and a
supplier's access is limited to procedures they were invited to;
- transmitting data between the browser and the Platform only over TLS;
- storing passwords only as irreversible hashes;
- limiting the rate of sign-in and password-recovery attempts;
- keeping a log of actions that change the state of a procurement procedure;
- regular backups with encryption of backup copies;
- briefing staff who carry out processing on the law and on this Policy.
7. Rights of the data subject
7.1. A data subject has the right to:
- obtain the information about the processing of their personal data listed in
152-FZ art. 14(7);
- require rectification, blocking or destruction of personal data that are
incomplete, out of date, inaccurate, unlawfully obtained, or unnecessary for the stated purpose;
- withdraw consent to the processing of personal data;
- appeal against the Operator's actions to Roskomnadzor or in court.
7.2. Requests are sent to privacy@velpharm.ru and must contain enough information to identify the applicant. A response is provided within the period set by 152-FZ.
7.3. Withdrawal of consent. Processing of account data is necessary to provide access to the Platform. Withdrawing consent to that processing therefore ends access and closes the account. Consent to informational mailings is withdrawn separately and affects neither Platform access nor procurement-related notifications.
8. Cookies
8.1. The Platform uses only cookies that are strictly necessary for the service: keeping the session, protecting against cross-site request forgery, and remembering the chosen language and appearance. Disabling them makes the Platform unusable.
8.2. The Platform does not use third-party advertising or analytics cookies.
9. Changes
9.1. The Operator may amend this Policy. A new version takes effect when published at the address in clause 1.4, unless the new version says otherwise.
9.2. Previous versions are retained and provided on request.