This English text is an informational translation of the Russian-language version of the Policy. In the event of any discrepancy or conflict between the two language versions, the Russian version shall prevail. See Section 17 (Supplemental notice for Users outside the Russian Federation) for further qualifications applicable to the English-language version of this Policy.

1. SCOPE

This document governs the activities of all divisions and officers of the Company that carry out the processing of Personal Data.

2. TERMS AND ABBREVIATIONS

3. GENERAL PROVISIONS

1. The Company’s activities under this Policy pursue, first and foremost, the objective of ensuring the protection of the rights and freedoms of Personal Data subjects when their Personal Data are processed, including the protection of the right to inviolability of private life and to personal privacy.

2. This Policy has been developed in accordance with the provisions of Law No. 152-FZ, as well as other subordinate regulatory legal acts in the field of Personal Data. The Policy establishes the procedure and conditions for the processing and protection of Personal Data at the Company and the rights of Personal Data subjects; it also determines, for each purpose of Personal Data processing, the categories and list of the Personal Data processed, the categories of subjects whose Personal Data are processed, the methods and periods of processing and storage of Personal Data, and the procedure for the destruction of Personal Data upon achievement of the purposes of processing or upon the occurrence of other lawful grounds.

3. The provisions of the Policy apply to all Personal Data processed by the Operator and constitute the basis for the organization of work on the processing of Personal Data at the Company, including for the development of other internal regulatory documents governing the process of Personal Data processing at the Company.
4. The procedure for the processing of Personal Data at the Company is regulated by this Policy in accordance with the requirements of the applicable legislation of the Russian Federation in the field of Personal Data and industry-specific legislation, where such legislation establishes a procedure for the processing of Personal Data.
5. This Policy extends to all processes of the Company connected with the processing of Personal Data and is binding upon all employees of the Company who process Personal Data in the performance of their duties.
6. Pursuant to paragraph 2 of part 2 of Article 1 of Law No. 152-FZ, the handling of documents transferred to storage in accordance with the legislation of the Russian Federation on archival matters is not regulated by this Policy.
7. In all matters not regulated by this Policy, reference shall be made to the applicable legislation of the Russian Federation. If an international treaty of the Russian Federation establishes rules other than those provided for by Law No. 152-FZ, the Company shall apply the rules of the international treaty.

4. PRINCIPLES OF PERSONAL DATA PROCESSING

1. The processing of Personal Data at the Company is carried out on the basis of the following principles:

   • Personal Data are processed on a lawful and fair basis;
   • the processing of Personal Data is limited to the achievement of specific, pre-defined and lawful purposes; the processing of Personal Data incompatible with the purposes of their collection is not permitted;
   • the merging of databases containing Personal Data whose processing is carried out for mutually incompatible purposes is not permitted;
   • only Personal Data that correspond to the purposes of their processing shall be processed;
   • the content and volume of Personal Data being processed shall correspond to the declared purposes of processing; the Personal Data being processed shall not be excessive in relation to the declared purposes of their processing;
   • when processing Personal Data, the accuracy, sufficiency and, where necessary, relevance of the Personal Data in relation to the purposes of processing shall be ensured. The Company takes the necessary measures, or ensures that they are taken, for the deletion or rectification of incomplete or inaccurate data;
   • Personal Data are stored in a form permitting identification of the Personal Data subject for no longer than required by the purposes of processing, unless the storage period is established by federal law, or by an agreement to which the Personal Data subject is a party, beneficiary or surety;
   • Personal Data being processed shall be subject to destruction or de-identification upon achievement of the purposes of processing or in the event of loss of the need to achieve those purposes, unless otherwise provided by federal law.

5. CONCEPT, CATEGORIES OF PERSONAL DATA; PURPOSES OF PROCESSING

1. Within the meaning of this Policy, Personal Data shall mean any information relating, directly or indirectly, to a determined or determinable person (Personal Data subject).
2. Personal Data constitute restricted-access information (of a confidential nature) in accordance with the legislation of the Russian Federation. Personal Data may be processed independently or as part of other confidential information, the processing of which is governed by industry-specific federal laws, in particular, on commercial secrecy (commercial secret), on archival matters and others.

3. For the purposes of implementing the provisions of the applicable legislation of the Russian Federation in the field of Personal Data, Annex 1 to this Policy sets out, for each purpose of Personal Data processing, the categories and list of the Personal Data processed, the categories of subjects whose Personal Data are processed, and the methods of Personal Data processing.

   The periods for the processing and storage of Personal Data, as well as the procedure for the destruction of Personal Data upon achievement of the purposes of their processing or upon the occurrence of other lawful grounds, for each purpose specified in Annex 1 to this Policy, shall be determined in the manner provided for in Sections 11 and 12 of this Policy.

4. The specific aspects of the Company’s processing of cookie files are governed by Annex 2 to this Policy.
5. The processing of special categories of Personal Data (information on the state of health and other categories qualified as special under Article 10 of Law No. 152-FZ) is carried out by the Company only where the grounds provided for in part 2 of Article 10 of Law No. 152-FZ are present, in particular: in accordance with the labour legislation of the Russian Federation and the legislation on military registration — in the volume required for the performance of the employer’s obligations; with the consent of the Personal Data subject; and in other cases expressly provided for by law. The processing of such data shall be terminated upon the cessation of the grounds therefor, unless otherwise provided by law.

6. SOURCES OF PERSONAL DATA

1. The receipt of Personal Data at the Company is organized in a manner that excludes any breach of the confidentiality of Personal Data.
2. The Personal Data processed by the Company may be obtained both directly from the Personal Data subject and from other third parties who are counterparties of the Company.
3. When obtaining Personal Data directly from the Personal Data subject, the Company shall ensure the existence of legal grounds provided for by the legislation of the Russian Federation. In cases where the legal ground is the consent of the Personal Data subject, such consent shall be executed separately from other documents and from other consents of the Personal Data subject. Separate consents shall be executed, in particular, for the processing of Personal Data for the purposes of promoting goods, works and services (advertising), for the transfer of Personal Data to third parties and for the processing of Personal Data authorized by the Personal Data subject for dissemination. Consent shall be specific, informed, conscious and unambiguous; silence or inaction of the Personal Data subject shall not be deemed to constitute consent. Access to the Company’s services may not be made conditional upon the giving of consent to the processing of Personal Data that are not required for the provision of such services. In cases expressly provided for by federal law, consent shall be given in writing in accordance with part 4 of Article 9 of Law No. 152-FZ.
4. Where the Personal Data subject lacks legal capacity, written consent to the processing of their Personal Data shall be obtained from their legal representative.
5. Where Personal Data is obtained not from the subject, the Company, save in the cases provided for by Law No. 152-FZ, prior to the commencement of processing of such Personal Data, undertakes to provide the Personal Data subject with the following information:

   • the name and address of the Company or of its representative;
   • the purpose of processing of the Personal Data and its legal basis;
   • the list of Personal Data;
   • the intended users of the Personal Data;
   • the rights of the Personal Data subject established by Law No. 152-FZ;
   • the source from which the Personal Data were obtained.
6. In collecting Personal Data, including by way of the information and telecommunications network "Internet", the Company shall carry out the recording, systematization, accumulation, storage, clarification (updating, alteration) and retrieval of Personal Data of citizens of the Russian Federation using databases located within the territory of the Russian Federation, save in the cases provided for by Law No. 152-FZ.

7. METHODS OF PERSONAL DATA PROCESSING

1. The processing of Personal Data at the Company may be carried out either with or without the use of automation means, including by way of performing the following actions: collection, recording, systematization, accumulation, storage, clarification (updating, alteration), retrieval, use, transfer (dissemination, provision, granting of access), de-identification, blocking, deletion and destruction.

2. Automated processing of Personal Data shall be carried out in the PDIS of the Company in strict compliance with this Policy.

   Automated processing of Personal Data is performed by means of computing equipment, whether installed locally or interconnected in a PDIS.

   Access to the PDIS shall be granted to authorized employees solely for the performance of their functions and duties.

   Under automated processing, Personal Data is contained on machine-readable carriers of Personal Data. Their recording is performed using computing equipment (copying of Personal Data to any removable or non-removable machine-readable carrier, entering of Personal Data into a database, and so forth).

3. Non-automated processing of Personal Data is carried out by the Company in such a way that Personal Data are separated from other information, in particular by recording them on separate material carriers of Personal Data, in special sections of forms (blanks) or in the margins thereof, and by other means.

4. Where non-automated processing of Personal Data involves the use of standard document forms, the character of the information in which contemplates or permits the inclusion of Personal Data (hereinafter — the "Standard Form"), the Company ensures compliance with the following conditions:

   1. The Standard Form or documents related thereto (completion instructions, cards, registers and journals) shall contain:

      • information about the purpose of the processing of Personal Data carried out without the use of automation means;
      • the identifying details of the Company (name and address);
      • the surname, first name, patronymic (if any) and address of the Personal Data subject;
      • the source from which the Personal Data are obtained and the periods of processing;
      • the list of actions with Personal Data to be performed in the course of processing;
      • a general description of the Personal Data processing methods used by the Operator.
   2. The Standard Form shall contain a field in which the Personal Data subject may indicate consent to the processing of Personal Data carried out without the use of automation means — where written consent to the processing of Personal Data is required.
   3. The Standard Form shall be drawn up in such a way that each Personal Data subject whose data are contained in the document has the possibility to review their own Personal Data contained in the document without infringing upon the rights and lawful interests of other Personal Data subjects.
   4. The Standard Form shall exclude any combination of fields intended for the entry of Personal Data the purposes of processing of which are, prima facie, incompatible.
5. The Company ensures that persons who process Personal Data without the use of automation means (employees and other persons processing Personal Data on the Company’s instructions) are informed of the fact of their processing of Personal Data, whose processing is carried out by the Company without the use of automation means, of the categories of Personal Data being processed, and of the specific features and rules for carrying out such processing established by the regulatory legal acts of federal executive authorities and executive authorities of the constituent entities of the Russian Federation, as well as by the Company’s local regulatory documents.
6. When Personal Data is stored on material carriers (including machine-readable carriers), it is not permitted to store on a single material carrier Personal Data whose purposes of processing are, prima facie, incompatible. Where the purposes of processing of Personal Data recorded on the same material carrier are incompatible, and where the material carrier does not allow the Personal Data to be processed separately from other Personal Data recorded on the same carrier, measures shall be taken to ensure the separate processing of such Personal Data. For the processing of different categories of Personal Data carried out without the use of automation means, a separate material carrier shall be used for each category of Personal Data.
7. The Company shall be entitled to take decisions giving rise to legal consequences in relation to the Personal Data subject, or otherwise affecting their rights and lawful interests, on the basis of exclusively automated processing of their Personal Data, only with the written consent of the Personal Data subject or in the cases provided for by federal laws which also establish measures to ensure observance of the rights and lawful interests of the Personal Data subject.
8. The processing of Personal Data for the purposes of promoting goods, works and services on the market by means of direct contact with the potential consumer through means of communication is permitted only subject to the prior consent of the Personal Data subject. The Company undertakes, at the request of the Personal Data subject, immediately to cease the processing of the subject’s Personal Data for the purposes mentioned above.

8. TRANSFER OF PERSONAL DATA AND ENTRUSTING OF PROCESSING

1. The processing of Personal Data at the Company may be carried out by:

   • employees of the Company;
   • other persons processing Personal Data on the Company’s instructions.

2. The processing of Personal Data by other persons may be carried out on the basis of a relevant agreement with the Company, which shall contain instructions to process Personal Data, with the consent of the Personal Data subject, unless otherwise provided by Law No. 152-FZ. The instruction shall define the list of Personal Data, the list of actions (operations) with Personal Data to be performed by the person carrying out the processing, and the purposes of processing; shall establish the duty of such person to observe the confidentiality of Personal Data, the requirements set out in part 5 of Article 18 and Article 18.1 of Law No. 152-FZ, the duty upon request of the Operator, during the term of the instruction and including before commencement of the processing of Personal Data, to provide documents and other information confirming the adoption of measures and compliance, for the purposes of performing the Operator’s instruction, with the requirements, and the duty to ensure the security of Personal Data in the course of their processing; and shall set out the requirements for the protection of the Personal Data being processed in accordance with Article 19 of Law No. 152-FZ, including the requirement to notify the Operator of the events provided for in part 3.1 of Article 21 of Law No. 152-FZ.

3. Where Personal Data are transferred to a third party, the following conditions shall be met:

   • the transfer (granting of access) of Personal Data to the third party shall be effected on the basis of an agreement, an essential term of which is the third party’s duty to ensure the confidentiality and security of Personal Data during their processing;
   • the transfer (granting of access) of Personal Data to the third party shall be effected on the basis of the applicable legislation of the Russian Federation;
   • the consent of the Personal Data subject to the transfer of their Personal Data to a third party shall be obtained, save in the cases provided for by legislation.

4. The Company shall be entitled to carry out the cross-border transfer of Personal Data in compliance with the requirements of Article 12 of Law No. 152-FZ. Prior to the commencement of the cross-border transfer, the Company shall submit to the authorized body for the protection of the rights of Personal Data subjects (Roskomnadzor) a separate notification of its intention to carry out the cross-border transfer of Personal Data, and shall commence such transfer not earlier than the periods and conditions established by Article 12 of Law No. 152-FZ, having regard to any decision of the authorized body prohibiting or restricting the transfer (if any). Prior to effecting the transfer, the Company shall obtain from the authorities of the foreign state, the foreign natural persons or the foreign legal entities to whom Personal Data are being transferred the information provided for in part 5 of Article 12 of Law No. 152-FZ.

5. For the purposes of information support, publicly available sources of data may be created within the Company (including specialized directories, telephone books, address books and the like), containing Personal Data, to which access may be granted to an unlimited number of persons with the written consent of the Personal Data subject. Information concerning a Personal Data subject may at any time be removed by the Company from publicly available sources of Personal Data at the request of the Personal Data subject, or by decision of a court or other authorized state bodies.

9. SPECIFIC ASPECTS OF THE PROCESSING OF PERSONAL DATA AUTHORISED BY THE SUBJECT FOR DISSEMINATION

1. The Company, within the framework of its activities, may process Personal Data authorized by the Personal Data subject for dissemination.

2. In accordance with the requirements of Article 10.1 of Law No. 152-FZ, the Company processes Personal Data authorized by the Personal Data subject for dissemination only where the appropriate consent is present.

   Consent to the processing of Personal Data authorized by the Personal Data subject for dissemination shall be executed separately from other consents of the Personal Data subject to the processing of their Personal Data, and the form and content of such consent shall comply with the requirements established by the authorized body for the protection of the rights of Personal Data subjects.

   The silence or inaction of the Personal Data subject may under no circumstances be deemed to constitute consent to the processing of Personal Data authorized by the Personal Data subject for dissemination.

3. In its consent to the processing of Personal Data authorized for dissemination, the Personal Data subject shall be entitled to impose prohibitions upon the transfer (other than the granting of access) of such Personal Data by the operator to an unlimited number of persons, and to impose prohibitions upon or conditions for the processing (other than the granting of access) of such Personal Data by an unlimited number of persons.

   The Company shall ensure the publication of information concerning the conditions of processing and the existence of prohibitions and conditions on the processing, by an unlimited number of persons, of Personal Data authorized by the Personal Data subject for dissemination.

4. The Company undertakes to cease the transfer (dissemination, provision, granting of access) of Personal Data authorized by the Personal Data subject for dissemination upon receipt of the corresponding request from the Personal Data subject. Such request shall include the surname, first name, patronymic (if any), and contact information (telephone number, e-mail address or postal address) of the Personal Data subject, together with the list of the Personal Data whose processing is to be terminated.

10. RIGHTS AND OBLIGATIONS OF THE PERSONAL DATA SUBJECT

1. The Personal Data subject shall have the right to:

   • obtain information concerning the processing of their Personal Data, in the manner, form and time periods established by the legislation of the Russian Federation in the field of Personal Data;
   • require the clarification, blocking or destruction of their Personal Data where the Personal Data are incomplete, out of date, inaccurate, unlawfully obtained, not necessary for the declared purpose of processing, or are used for purposes other than those declared at the time the Personal Data subject gave consent to the processing of Personal Data;
   • require the cessation of the processing of their Personal Data;
   • take the measures provided by law to protect their rights;
   • withdraw their consent to the processing of Personal Data.

2. In order to exercise the right to obtain information concerning the processing of their Personal Data, the Personal Data subject, or their representative, shall address a written application to the Company using the details set out in Section 15 of this Policy; such application shall contain:

   • the number of the principal identity document of the Personal Data subject or of their representative;
   • particulars of the date of issue of the said document and of the authority that issued it;
   • information confirming the participation of the Personal Data subject in a relationship with the Operator (contract number, contract execution date, agreed alphanumeric identifier and (or) other particulars), or information otherwise confirming the fact of processing of Personal Data by the Operator;
   • the signature of the Personal Data subject or of their representative.

   Within the framework of the applicable legislation of the Russian Federation in the field of Personal Data, the Company undertakes to provide the Personal Data subject, upon request, with the following information:

   • confirmation of the processing of Personal Data by the Company;
   • the legal grounds and purposes of the processing of Personal Data;
   • the purposes and methods of processing of Personal Data applied by the Company;
   • the name and location of the Company;
   • particulars of the persons (except for the Company’s employees) who have access to the Personal Data or to whom Personal Data may be disclosed on the basis of an agreement with the Company or on the basis of federal law;
   • the Personal Data processed relating to the relevant Personal Data subject, and the source from which they were obtained, unless a different procedure for the provision of such data is provided for by federal law;
   • the periods of processing of Personal Data, including the periods of their storage;
   • the procedure by which the Personal Data subject may exercise the rights provided for by Law No. 152-FZ;
   • information about any cross-border transfer of data that has been effected or is intended;
   • the name or surname, first name, patronymic and address of the person processing Personal Data on the Company’s instructions, where such processing has been or will be entrusted to such person;
   • information on the ways in which the Company discharges the obligations established by Article 18.1 of Law No. 152-FZ;
   • other information provided for by Law No. 152-FZ or by other federal laws.
3. In exercising the right to withdraw consent to the processing of Personal Data, the Personal Data subject shall be entitled to submit to the Company an application for withdrawal of the previously given consent to the processing of Personal Data. The Personal Data subject shall likewise be entitled to submit to the Company a request for the cessation of the processing of Personal Data. The Company reserves the right to continue the processing of Personal Data without the consent of the Personal Data subject where such processing is carried out on the grounds set out in paragraphs 2 to 11 of part 1 of Article 6, paragraphs 2 to 10 of part 2 of Article 10 and part 2 of Article 11 of Law No. 152-FZ.
4. The Personal Data subject, for the purposes of clarifying and updating their Personal Data, shall promptly furnish the Company with information about any change in their Personal Data.

11. PERIODS OF PROCESSING (STORAGE) OF PERSONAL DATA

1. The procedure for the storage of Personal Data processed at the Company shall be determined by the Company’s regulatory documents in accordance with the provisions of Law No. 152-FZ.

2. The periods of processing (storage) of Personal Data shall be determined in accordance with the term of the agreement with the Personal Data subject; the period specified in the relevant consent of the Personal Data subject; the Order of the Federal Archival Agency No. 236 of 20 December 2019 "On Approval of the List of Standard Managerial Archival Documents Generated in the Course of the Activity of State Bodies, Local Self-Government Bodies and Organizations, with an Indication of Their Storage Periods"; the limitation periods; and other periods established by the legislation of the Russian Federation and the regulatory documents of the Company.

3. Personal Data whose period of processing (storage) has expired shall be destroyed, unless otherwise provided by federal law or by the regulatory documents of the Company.

12. UPDATING, RECTIFICATION, DELETION AND DESTRUCTION OF PERSONAL DATA. PROCEDURE FOR HANDLING REQUESTS FROM PERSONAL DATA SUBJECTS

1. In the cases expressly provided for in Article 14 of Law No. 152-FZ, the Company shall inform the Personal Data subject or their representative of the presence of Personal Data relating to the relevant Personal Data subject, and shall also provide the opportunity to review such Personal Data upon the application of the Personal Data subject or their representative, or within ten (10) business days of the date of receipt of the request from the Personal Data subject or their representative. The said period may be extended, but by no more than five business days, provided that the Company sends the Personal Data subject a reasoned notice stating the grounds for the extension of the time-limit for providing the information requested.
2. Within the framework of the implementation of the requirements of Law No. 152-FZ, the Company shall provide the Personal Data subject or their representative, free of charge, with the opportunity to review the Personal Data relating to that Personal Data subject. Within a period not exceeding seven (7) business days from the date on which the Personal Data subject or their representative furnishes information confirming that the Personal Data is incomplete, inaccurate or out of date, the Company shall make the necessary changes thereto. Within a period not exceeding seven (7) business days from the date on which the Personal Data subject or their representative furnishes information confirming that such Personal Data are unlawfully obtained or are not necessary for the declared purpose of processing, the Company shall destroy such Personal Data. The Company undertakes to notify the Personal Data subject or their representative of the changes made and the measures taken, and to take reasonable steps to notify third parties to whom the Personal Data of that subject was transferred.
3. If unlawful processing of Personal Data is identified upon the application/request of the Personal Data subject, their representative or the authorized body for the protection of the rights of Personal Data subjects, the Operator undertakes, from the moment of such application/request and for the duration of the investigation, to block the unlawfully processed Personal Data relating to that subject, or to ensure their blocking (where the Personal Data are processed by another person acting on the Operator’s instructions). If inaccurate Personal Data are identified upon the application/request of the Personal Data subject, their representative or the authorized body for the protection of the rights of Personal Data subjects, the Operator undertakes to block the Personal Data relating to that subject, or to ensure their blocking (where the Personal Data are processed by another person acting on the Operator’s instructions), from the moment of such application/request and for the duration of the investigation, provided that the blocking of the Personal Data does not infringe upon the rights and lawful interests of the Personal Data subject or of third parties. Where the fact of inaccuracy of Personal Data is confirmed, the Company shall, on the basis of the information provided by the Personal Data subject, their representative or the authorized body for the protection of the rights of Personal Data subjects, rectify the Personal Data or ensure their rectification (where the Personal Data are processed by another person acting on the Operator’s instructions) within seven (7) business days of the date of provision of such information, and shall lift the blocking of the Personal Data.
4. The Company shall likewise cease the processing of Personal Data or ensure the cessation of the processing of Personal Data by a person acting on its instructions:

   • if unlawful processing of Personal Data carried out by the Company or by a person acting on its instructions is identified, within a period not exceeding three (3) business days of the date of such identification;
   • in the event of withdrawal by the Personal Data subject of consent to the Company’s processing of their Personal Data, in the absence of other legal grounds for the processing of Personal Data;
   • upon receipt of a request from the Personal Data subject for the cessation of the processing of their Personal Data, in the absence of other legal grounds for the processing of Personal Data, within a period not exceeding ten (10) business days from the date of the Company’s receipt of such request. The said period may be extended, but by no more than five (5) business days, if the Company sends the Personal Data subject a reasoned notice stating the grounds for the extension of the time-limit for providing the requested information;
   • upon achievement of the purpose of the processing of Personal Data, in the absence of other legal grounds for such processing.

5. The Company is required to destroy Personal Data or to ensure their destruction (where the Personal Data are processed by another person acting on the Company’s instructions):

   • in the event of the Personal Data subject’s withdrawal of consent to the processing of their Personal Data — within a period not exceeding thirty (30) days from the date of receipt of the said withdrawal, unless another period is established by an agreement, other arrangement or federal legislation, and in the absence of other legal grounds for the processing of Personal Data;
   • upon achievement of the purpose of the processing of Personal Data — within a period not exceeding thirty (30) days from the date on which the purpose was achieved, unless another period is established by an agreement, other arrangement or federal legislation, and in the absence of other legal grounds for the processing of Personal Data;
   • upon submission by the Personal Data subject or their representative of information confirming that such Personal Data are unlawfully obtained or are not necessary for the declared purpose of processing — within a period not exceeding seven (7) business days from the date of submission of such information;
   • where it is impossible to ensure the lawfulness of the processing of Personal Data — within a period not exceeding ten (10) business days from the date on which unlawful processing of Personal Data was identified.

   Where destruction of Personal Data is not possible within the said period, the Company shall block such Personal Data or ensure their blocking (where the Personal Data are processed by another person acting on the Company’s instructions), and shall ensure destruction of the Personal Data within a period not exceeding six (6) months, unless another period is established by federal laws.

13. CONFIDENTIALITY AND ENSURING THE SECURITY OF PERSONAL DATA DURING THEIR PROCESSING

1. In the course of its activities, the Company ensures the confidentiality of the Personal Data being processed; in particular, the Company undertakes not to disclose to third parties and not to disseminate Personal Data without the consent of the Personal Data subject, unless otherwise provided by the applicable legislation of the Russian Federation.
2. When processing Personal Data, the Company adopts legal, organizational and technical measures to protect Personal Data from unlawful or accidental access to them, and from their destruction, alteration, blocking, copying, provision, dissemination, as well as from other unlawful acts in respect of Personal Data.
3. The security of Personal Data is ensured within the framework of the establishment at the Company of a security regime for information of a confidential nature.
4. The security of Personal Data is achieved, inter alia, by:

   • identifying threats to the security of Personal Data during their processing in the PDIS;
   • applying organizational and technical measures to ensure the security of Personal Data during their processing in the PDIS, necessary for compliance with the requirements for the protection of Personal Data, the performance of which ensures the levels of security of Personal Data established by the Government of the Russian Federation;
   • applying information protection tools that have undergone the conformity assessment procedure in the established manner;
   • assessing the effectiveness of the measures adopted for ensuring the security of Personal Data prior to the commissioning of the PDIS;
   • keeping records of machine-readable carriers of Personal Data;
   • detecting incidents of unauthorized access to Personal Data;
   • restoring Personal Data modified or destroyed because of unauthorized access thereto;
   • establishing rules for access to Personal Data processed in the PDIS, as well as ensuring the registration and accounting of all actions performed with Personal Data in the PDIS;
   • exercising control over the measures adopted for ensuring the security of Personal Data and the level of security of Personal Data in the PDIS.
5. The security of Personal Data processed in information systems during the conduct of operative-investigative measures is ensured in accordance with the legislation of the Russian Federation on operative-investigative activities.
6. The levels of security of Personal Data during their processing in the Company’s PDIS, and the requirements for the protection of Personal Data ensuring the levels of security of Personal Data, are determined depending on the current threats to the security of Personal Data, taking into account the potential harm to the Personal Data subject, the volume and content of the Personal Data being processed, and the type of activity in the course of which Personal Data are processed, in accordance with the requirements of the Resolutions of the Government of the Russian Federation, subordinate regulatory legal acts of the FSTEC of Russia, the FSB of Russia and the Ministry of Digital Development, Communications and Mass Media of the Russian Federation, and the agreements between the Company, Personal Data operators and Personal Data subjects.
7. The security of Personal Data during cross-border processing of Personal Data is ensured in accordance with the requirements and recommendations of international legal acts on the security of Personal Data, international information security standards, and the legislation of the states in the territory of which the Personal Data are processed.
8. The use and storage of biometric Personal Data outside the PDIS shall be carried out exclusively with the use of material information carriers and storage technologies that ensure the protection of biometric Personal Data from unlawful or accidental access, destruction, alteration, blocking, copying, provision and dissemination.
9. The protection of Personal Data during non-automated processing shall be carried out in accordance with the requirements of the regulatory legal acts of the Russian Federation and the Company’s regulatory documents on the handling of material information carriers.
10. If a fact of unlawful or accidental transfer (provision, dissemination, granting of access) of Personal Data resulting in a breach of the rights of Personal Data subjects is established, the Company shall notify the authorized body for the protection of the rights of Personal Data subjects: within 24 hours of the moment the incident is identified — of the incident itself, its presumed causes and the anticipated harm; and within 72 hours — of the results of the internal investigation and of the persons whose actions caused the incident (where such persons have been identified).

14. LIABILITY FOR BREACH OF THE RULES GOVERNING THE PROCESSING OF PERSONAL DATA

1. The Company and/or the Company’s employees found guilty of a breach of the requirements of the legislation of the Russian Federation in the field of Personal Data and of the provisions of this Policy shall bear the liability provided for by the legislation of the Russian Federation.
2. Non-material damage caused to a Personal Data subject as a result of a breach of their rights, of the rules of processing of Personal Data, or of the requirements for the protection of Personal Data, shall be subject to compensation in accordance with the legislation of the Russian Federation.

15. FINAL PROVISIONS

1. This Policy is publicly available. Public availability is ensured through its publication on the Company’s website at https://www.buzzoola.com/.
2. This Policy shall be subject to review in accordance with the Company’s regulatory documents.

3. Personal Data subjects whose Personal Data are processed by the Company may obtain clarifications on matters relating to the processing of their Personal Data, and may exercise their rights and lawful interests, by sending an appropriate written request to the postal address: 109028, Moscow, Maliy Ivanovskiy per., 6, bld. 2, floor 2, office 3 or in electronic form to the e-mail address: compliance@buzzoola.com.

16. APPENDIXES

The Appendixes are set out in separate files and constitute an integral part of this Policy.

Annex 1. List of purposes of Personal Data processing, the corresponding categories of Personal Data, categories of Personal Data subjects, and methods of Personal Data processing.

Annex 2. Cookie policy.

17. SUPPLEMENTAL NOTICE FOR USERS OUTSIDE THE RUSSIAN FEDERATION

This Policy is originally issued in Russian. The English text is provided for the convenience of Users and is informational in nature. In the event of any inconsistency, ambiguity or conflict between the Russian and the English versions, the Russian version shall prevail and shall be exclusively relied upon for the construction and interpretation of this Policy.

The processing of Personal Data by the Company is governed by the legislation of the Russian Federation, particularly Law No. 152-FZ. This Policy does not constitute, and shall not be construed as, a representation of compliance by the Company with the data-protection laws of any jurisdiction other than the Russian Federation.