Version dated October 30, 2026
Website: https://shinymango.ru
1. General Provisions and Information About the Data Controller
1.1. This Personal Data Processing Policy (hereinafter referred to as the «Policy») establishes the procedures and conditions for processing the personal data of users of the SHINY MANGO website, customers, recipients of goods, individuals submitting inquiries, and subscribers to marketing communications.
1.2. The Personal Data Controller is Individual Entrepreneur OGIRIKI SABINA RUSHANOVNA (ИП ОГИРИКИ САБИНА РУШАНОВНА), Taxpayer Identification Number (INN): 132405924013, Primary State Registration Number of an Individual Entrepreneur (OGRNIP): 322130000000792.
Postal address for correspondence: 4 Generala Varennikova Street, Podolsk, Moscow Region, 142118, Russian Federation.
Email: shinymango@yandex.ru
Telephone: +7 909 972-00-29, available from 10:00 AM to 7:00 PM Moscow Time.
1.3. The Individual Entrepreneur independently organizes personal data processing activities and monitors compliance with the applicable legal obligations.
1.4. Personal data is processed in accordance with the legislation of the Russian Federation, including Federal Law No. 152-FZ of July 27, 2006, «On Personal Data.»
1.5. The processing of personal data is limited to specific and lawful purposes. The collection of excessive information and the use of personal data for purposes incompatible with the original purposes of processing are prohibited unless an appropriate legal basis exists.
1.6. This Policy applies to personal data processing conducted in connection with the online store’s activities. It does not replace the Public Offer, Product Return Policy, or separate consents where such consents are required by law.
2. Purposes, Categories of Personal Data, and Legal Grounds for Processing
2.1. Order Placement and Fulfillment
Categories of data subjects: Customers, individuals placing orders, and recipients of goods.
Personal data processed: First and last names where provided, telephone numbers, email addresses, delivery addresses or selected pickup points, information about ordered products, prices, delivery, payment statuses, returns, and related transactions.
Purpose: Entering into and performing contracts, arranging deliveries, providing order status notifications, processing payments, and fulfilling statutory obligations.
Legal grounds: Clauses 2 and 5 of Part 1 of Article 6 of Federal Law No. 152-FZ, where applicable.
2.2. Customer Accounts and Customer Support
Categories of data subjects: Registered users and customers.
Personal data processed: Account identifiers, contact information, authentication data to the extent maintained by the system, order history, inquiries, and records of activities necessary for account servicing.
Purpose: Providing access to customer accounts, managing orders, restoring account access, and responding to inquiries.
Legal grounds: Performance of a contract or steps taken at the user’s initiative prior to entering into a contract, as well as other applicable lawful grounds.
2.3. Handling Complaints, Returns, and Disputes
Categories of data subjects: Customers, recipients of goods, complainants, and their authorized representatives.
Personal data processed: Order numbers and order history, product information, delivery and payment details, correspondence, documents, photographs, video recordings, and other information relevant to a particular inquiry or dispute.
Purpose: Investigating the circumstances of complaints, fulfilling contractual obligations, establishing relevant facts, complying with legal requirements, and protecting the lawful rights and interests of the parties.
Legal grounds: Clauses 2, 5, and 7 of Part 1 of Article 6 of Federal Law No. 152-FZ, where applicable.
2.4. Website Security and Prevention of Unlawful Activities
Categories of data subjects: Website visitors, registered users, customers, and individuals interacting with the store.
Personal data processed: IP addresses, session identifiers, authentication records, technical logs, timestamps and characteristics of requests, order transaction history, and other technical information necessary for security assessments.
Purpose: Preventing unauthorized access, detecting cyberattacks, protecting information systems, investigating suspicious transactions, and safeguarding the legitimate interests of the store and its users.
Legal grounds: Clause 7 of Part 1 of Article 6 of Federal Law No. 152-FZ, subject to the limitations established by that provision, as well as other applicable lawful grounds.
2.5. Marketing Communications
Categories of data subjects: Individuals who have separately agreed to receive marketing communications.
Personal data processed: Email addresses, voluntarily provided names, and records confirming the granting or withdrawal of consent.
Purpose: Sending information about promotions, new products, and special offers from SHINY MANGO.
Legal grounds: Separate prior consent obtained in accordance with the applicable requirements of personal data protection and advertising legislation.
Registration, visiting the website, placing an order, or accepting the Public Offer does not, by itself, constitute consent to receive advertising or promotional communications.
3. Protection of the Store Against Fraud and Abuse
3.1. To protect customers’ rights and the legitimate interests of SHINY MANGO, the Data Controller may, within the limits permitted by law, investigate transactions exhibiting indications of unauthorized access, the use of another person’s account credentials, inaccurate information, attempts to obtain unlawful benefits, or other potentially unlawful activities.
3.2. Such investigations may involve the processing of order details, payment information, delivery records, order modifications, complaints, correspondence, and necessary technical records relevant to the specific circumstances under review.
3.3. Processing shall be limited to the information reasonably necessary to investigate the relevant circumstances. Suspicion or a technical match alone does not constitute proof of unlawful conduct by an individual.
3.4. Where lawful grounds exist and applicable deadlines are respected, the Data Controller may conduct additional verification of the circumstances surrounding a complaint or transaction.
Decisions affecting customers’ statutory rights shall be made in compliance with applicable legislation and shall not be based solely on an unverified automated suspicion.
3.5. Where legally justified, information may be disclosed to competent government authorities, courts, experts, and representatives participating in the protection of the Data Controller’s rights, strictly to the extent necessary for the relevant lawful purpose.
3.6. The Data Controller shall not use personal data to publicly accuse customers, publish lists of suspected individuals, or engage in any other activities that violate personal data protection legislation.
4. Preservation of Evidence and Transaction History
4.1. For lawful processing purposes, the Data Controller may retain information documenting the circumstances of order placement, modification, payment, fulfillment, and returns.
4.2. Such information may include dates and times of actions, order numbers, order contents, applicable prices, delivery methods, fulfillment statuses, modification records, notifications, correspondence, and confirmations of completed transactions.
4.3. Where necessary to protect the legitimate interests of the store, such information may be used to investigate complaints, reconcile financial transactions, conduct expert examinations, prepare responses to claims, and present evidence in proceedings permitted by law.
4.4. Photographs, video recordings, and documents received in connection with complaints shall be processed exclusively for the relevant lawful purposes and shall not be publicly disclosed without an independent legal basis.
4.5. A request to delete a customer account or the withdrawal of consent does not automatically require the deletion of the entire order history if continued retention of specific information is necessary to comply with legal obligations, perform contractual duties, or pursue other purposes permitted by law.
4.6. Evidence and related materials shall not be retained indefinitely. Their retention shall be limited to the periods necessary for the relevant lawful purposes.
5. Personal Data of Goods Recipients and Third Parties
5.1. A customer may provide the personal data of another recipient when placing an order for delivery to a third party.
5.2. Customers should provide accurate information only and disclose third-party personal data only where lawful grounds exist for doing so.
5.3. The Data Controller shall use recipients’ personal data exclusively for activities necessary to arrange and fulfill delivery, communicate about receipt of goods, resolve delivery-related inquiries, and pursue other lawful purposes.
5.4. Recipients’ personal data shall not automatically be used for marketing communications.
5.5. Where necessary for proper delivery fulfillment, the Data Controller may verify or clarify recipient information in accordance with applicable law.
6. Procedures for Processing and Disclosing Personal Data
6.1. Personal data processing may be performed through automated, non-automated, or combined methods.
6.2. Processing activities may include collection, recording, systematization, accumulation, storage, updating, retrieval, use, lawful disclosure or transfer, blocking, deletion, and destruction of personal data.
6.3. The online store operates using WordPress and WooCommerce.
When technical services are provided, certain personal data may be processed by authorized service providers within the scope of their responsibilities and applicable lawful grounds.
6.4. Yandex Mail is used for electronic correspondence.
Information contained in correspondence may also be processed by the relevant email service provider as part of its email services.
6.5. When delivery services, including CDEK, are actually used, the Data Controller may provide the relevant carrier with necessary recipient information, contact details, and delivery-related information.
6.6. When interactive maps and pickup point selection services are used, technical request data may be processed by the providers of the relevant mapping and software services.
The scope of such processing depends on the components actually integrated into the website.
6.7. When payment processing and fiscal receipt services are integrated, they may receive information necessary to process payments, issue receipts, verify transactions, and process refunds.
6.8. The store does not request bank card numbers, CVV/CVC security codes, banking passwords, or one-time verification codes through ordinary contact forms.
When a payment service provider is integrated, payments must be processed using the secure mechanisms designated for that purpose.
6.9. Personal data may be disclosed to third parties only where permitted by law, to the extent necessary, and in compliance with applicable confidentiality and information security requirements.
6.10. Where personal data processing is entrusted to a third party, the relevant arrangements shall comply with Article 6 of Federal Law No. 152-FZ.
The responsibilities of the parties shall be determined by applicable legislation and the agreements concluded between them.
6.11. Personal data shall not be sold to third parties or made publicly available without an independent lawful basis.
7. Data Localization and Cross-Border Transfers
7.1. The collection and storage of personal data of citizens of the Russian Federation shall be organized in compliance with applicable data localization requirements, including Part 5 of Article 18 of Federal Law No. 152-FZ.
7.2. When third-party services are used, the Data Controller shall take into account the geographical location of information systems, access and data transfer arrangements, and the requirements applicable to backup storage and other processing activities.
7.3. Cross-border transfers of personal data, where actually carried out, shall be permitted only where lawful grounds exist and the applicable requirements of Article 12 of Federal Law No. 152-FZ are satisfied, including submission of a separate notification to Roskomnadzor where required.
7.4. The mere fact that a user accesses the website from a foreign country does not automatically constitute consent to transfer that user’s personal data to recipients located abroad.
8. Data Retention Periods and Destruction Procedures
8.1. Personal data shall not be processed for longer than necessary to fulfill lawful purposes, unless a different retention period is established by law or an applicable contract.
8.2. Information concerning fulfilled orders, payments, returns, and mandatory records shall be retained for periods prescribed by legislation governing settlements, accounting, taxation, other applicable legal requirements, and lawful grounds for protecting the rights of the parties.
8.3. Customer account information shall be used during the period in which the relevant account functionality is provided, as well as for any additional period during which independent lawful grounds for processing specific data continue to exist.
8.4. Correspondence, complaints, and investigation materials shall be retained for periods necessary to handle inquiries, fulfill obligations, and lawfully protect the rights of the parties.
8.5. Technical logs shall be retained for periods necessary to maintain website security, investigate incidents, and pursue other lawful purposes.
Specific retention periods shall be determined by the purpose of the relevant records and the actual system settings.
8.6. Information used for marketing communications shall be processed until the relevant consent is withdrawn or the processing purpose ceases to exist, unless another lawful basis permits the retention of specific information.
8.7. Upon fulfillment of the purposes of processing, withdrawal of consent, satisfaction of a lawful request from a data subject, or the occurrence of another legally prescribed ground, processing shall be discontinued and the relevant personal data shall be destroyed or anonymized within the applicable statutory deadlines, unless continued processing is permitted on an independent lawful basis.
8.8. The deletion of personal data from active systems and backups shall be carried out in accordance with applicable legal requirements and the technically established backup lifecycle procedures.
Access to any retained backup data shall be restricted.
9. Personal Data Protection and Confidentiality
9.1. The Data Controller shall implement the necessary organizational and technical measures to protect personal data against unauthorized access, alteration, disclosure, destruction, and other unlawful actions.
9.2. Such measures include HTTPS (TLS) encryption for data transmission, access rights management, authentication mechanisms, administrative access controls, data backups, and other security measures actually implemented.
9.3. Access to personal data shall be granted only to individuals who require such access to perform their responsibilities and have a lawful basis for accessing the relevant information.
9.4. If a personal data security incident is identified, the Data Controller shall take appropriate measures to limit its consequences, restore security, and fulfill any applicable legal obligations to notify the competent authorities.
9.5. The Data Controller does not guarantee that technical security incidents can be prevented under all circumstances.
However, this provision does not limit any liability imposed by law for failure to comply with mandatory personal data protection requirements.
10. Cookies and Technical Technologies
10.1. The website may use necessary cookies to ensure proper operation of the shopping cart, user sessions, authentication features, and website security.
10.2. Technical information, including IP addresses, session identifiers, and information about website interactions, shall be processed only within the scope of lawful purposes related to website operation and security.
10.3. Additional analytics, advertising, and marketing technologies may be used where appropriate legal grounds exist and applicable requirements concerning user information and consent have been satisfied.
10.4. When additional technologies are integrated, the Data Controller shall update the relevant information concerning their purposes, the categories of personal data processed, and the recipients of such data.
10.5. Users may manage cookies through their browser settings.
Disabling technically necessary cookies may restrict the availability or functionality of certain website features.
11. User Rights, Requests, and Identity Verification
11.1. Users have the right to obtain information about the processing of their personal data as provided by law, request correction, blocking, or destruction of their data where lawful grounds exist, withdraw consent, and seek protection of their rights.
11.2. Requests may be submitted by email to shinymango@yandex.ru or by post to the Data Controller’s address specified above.
11.3. When reviewing requests, the Data Controller may request information necessary to verify the applicant’s identity and authority, within the limits established by applicable law.
11.4. Information about orders, correspondence, payments, and personal data shall not be disclosed to a third party solely on the basis of a claim that the person is the customer, a relative of the customer, the recipient of the goods, or an authorized representative.
11.5. Identity verification shall be conducted through proportionate and lawful methods.
The Data Controller shall not require unnecessary passport copies or other excessive personal documentation without sufficient legal grounds.
11.6. Information requested through a valid personal data inquiry shall be provided within 10 business days, unless a different procedure is established by law.
In cases permitted by law, this period may be extended by no more than five additional business days, provided that a reasoned notice of extension is issued.
11.7. Requests to discontinue processing, withdraw consent, correct personal data, or destroy personal data shall be reviewed and fulfilled in accordance with the procedures and deadlines established by applicable legislation.
11.8. Withdrawal of consent does not automatically terminate the processing of personal data if the Data Controller is legally entitled to continue processing it on another lawful basis.
11.9. Users have the right to submit complaints to Roskomnadzor or seek judicial protection of their rights in accordance with the procedures established by law.
12. Separate Consents and Final Provisions
12.1. Where consent is required for a particular processing activity, it shall be requested separately from the Public Offer, Product Return Policy, and other documents acknowledged or accepted by the user.
12.2. Marketing communications are subject to separate consent to receive advertising and promotional messages.
Users may withdraw such consent through an available designated method.
12.3. The Data Controller reserves the right to update this Policy in response to changes in legislation, service providers, or actual personal data processing activities.
12.4. Updated versions of this Policy shall be published on the website with the relevant revision date.
Amendments to this Policy do not, by themselves, replace the requirement to obtain new consent where such consent is required by law.
12.5. The current version of this Policy is available at:
Personal Data Controller: Individual Entrepreneur OGIRIKI SABINA RUSHANOVNA (ИП ОГИРИКИ САБИНА РУШАНОВНА).