Personal Data Processing Policy

1. General Provisions

This Policy on the organization of personal data processing in Evers Group Rus LLC (hereinafter referred to as the Policy) has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006 “On Personal Data”.

The purpose of the Policy is to ensure the protection of the rights and freedoms of personal data subjects during the processing of their personal data by Evers Group Rus LLC (hereinafter referred to as the Company).

The provisions of the Policy apply to all relationships related to the processing of personal data carried out by the Company:

- using automation tools, including in information and telecommunications networks, or without using such tools, if the processing of personal data without using such tools corresponds to the nature of the actions (operations) performed with personal data using automation tools, that is, it allows, in accordance with a given algorithm, to search for personal data recorded on a tangible medium and contained in card indexes or other systematized collections of personal data, and (or) access to such personal data;

– without the use of automation tools.

Information on the categories of subjects whose personal data is processed by the Company, the categories and list of personal data processed, the methods, terms of their processing and storage are presented in Appendix No. 1 to this Policy.

All employees of the Company who process personal data or have access to it must be guided by the Policy.

The policy comes into force from the moment of its approval by the General Director of the Company.

The policy is subject to revision during periodic analysis by the management of Evers Group Rus LLC (hereinafter referred to as the Company), as well as in cases of changes in the legislation of the Russian Federation in the field of personal data.

The policy shall be published on the official website of the Company (https://evers.ru/gb/).

2. Basic concepts

Personal data is any information relating to a directly or indirectly identified or identifiable natural person (subject of personal data).

Personal data permitted for distribution by the subject of personal data are personal data, access to which by an unlimited number of persons is granted by the subject of personal data by giving consent to the processing of personal data, permitted by the subject of personal data for distribution in the manner prescribed by the Federal Law "On Personal Data".

Personal data subject is a natural person who is directly or indirectly identified or identifiable using personal data.

Operator — a state body, a municipal body, a legal entity or an individual that, independently or jointly with other persons, organizes and (or) carries out the processing of personal data, and also determines the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed with personal data.

Processing of personal data is any action (operation) or set of actions (operations) performed with the use of automation tools or without the use of such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), blocking, deletion, destruction of personal data.

Automated processing of personal data is the processing of personal data using computer technology.

Dissemination of personal data is actions aimed at disclosing personal data to an indefinite number of persons.

Provision of personal data is an action aimed at disclosing personal data to a specific person or a specific group of persons.

Blocking of personal data is a temporary cessation of the processing of personal data (except in cases where processing is necessary to clarify personal data).

Destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the tangible media of personal data are destroyed.

Personal data information system is a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

Confidentiality of information is a mandatory requirement for a person who has gained access to certain information not to transfer such information to third parties without the consent of its owner.

Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to a foreign government body, a foreign individual or a foreign legal entity.

Threats to the security of personal data are a set of conditions and factors that create the danger of unauthorized, including accidental, access to personal data, which may result in the destruction, modification, blocking, copying, provision, distribution of personal data, as well as other illegal actions during their processing in the personal data information system.

The level of personal data security is a comprehensive indicator characterizing the requirements, the implementation of which ensures the neutralization of certain threats to the security of personal data when they are processed in personal data information systems.

Anonymization of personal data is an information processing process in which personal data is transformed in such a way that it becomes impossible to identify the person to whom this data belongs without the use of additional information.

3. Purposes of personal data processing

The Company processes personal data for the following purposes:

– providing the website visitor with information about the Company and the services provided by the Company and its partners, and receiving feedback;

– conducting advertising, marketing, statistical and other research activities;

– conclusion and execution of agreements to which the subject of personal data is a party;

– organization and provision of labor relations and those directly related to them;

– selection of personnel (applicants) for vacant positions;

– implementation of access control at controlled area facilities;

– ensuring compliance with the requirements of laws and other regulatory legal acts of the Russian Federation.

4. Legal grounds for processing personal data

The basis for processing personal data in the Company are the following regulatory acts and documents:

– Constitution of the Russian Federation;

– Tax Code of the Russian Federation;

– Civil Code of the Russian Federation;

– Charter of the Company;

– Labor Code of the Russian Federation;

– Federal Law of 06.12.2011 No. 402-FZ “On Accounting”;

– Federal Law of 15.12.2001 No. 166-FZ “On State Pension Provision in the Russian Federation”;

– Federal Law of 21.11.2011 No. 323-FZ “On the Fundamentals of Protecting the Health of Citizens in the Russian Federation”;

– Federal Law of March 28, 1998 No. 53-FZ “On Military Duty and Military Service”;

– Federal Law of November 29, 2010 No. 326-FZ “On Compulsory Medical Insurance in the Russian Federation”;

– Federal Law of 22.10.2004 No. 125-FZ “On Archival Affairs in the Russian Federation”;

– Federal Law of 29.12.2006 No. 255-FZ “On Compulsory Social Insurance in Case of Temporary Disability and in Connection with Maternity”;

– Federal Law of 15.12.2001 No. 167-FZ “On Compulsory Pension Insurance in the Russian Federation”;

– Federal Law of July 24, 1998 No. 125-FZ “On Compulsory Social Insurance against Industrial Accidents and Occupational Diseases”.

In cases not expressly provided for by the legislation of the Russian Federation, but corresponding to the powers of the Company, the processing of personal data is carried out with the consent of the subject of personal data to the processing of his personal data.

The processing of personal data shall cease upon liquidation or termination of the Company's activities as a result of reorganization.

5. Procedure and conditions for processing and storing personal data

The processing of personal data is carried out by the Company in accordance with the following principles:

– the processing of personal data is carried out on a lawful and fair basis;

– the processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes; processing of personal data that is incompatible with the purposes of collecting personal data is not permitted;

– it is not permitted to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other;

– only personal data that meet the purposes of their processing are subject to processing;

– the content and volume of personal data processed correspond to the stated purposes of processing;

– the personal data being processed are not excessive in relation to the stated purposes of their processing;

– when processing personal data, the accuracy of personal data, its sufficiency, and, where necessary, relevance in relation to the purposes of processing personal data are ensured;

– The Company takes the necessary measures or ensures that they are taken to remove or clarify incomplete or inaccurate data;

– personal data is stored in a form that allows the identification of the subject of personal data, for no longer than is required by the purposes of processing personal data, unless the storage period for personal data is established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor;

– processed personal data are subject to destruction or depersonalization upon achievement of the processing purposes or in the event of loss of the need to achieve these purposes, as well as in the event of amendment or invalidation of regulatory legal acts establishing the legal grounds for processing personal data, upon detection of the fact of unlawful processing of personal data, upon withdrawal of consent by the subject of personal data, but no later than 30 days, unless otherwise provided by federal law;

- the destruction of personal data processed on a tangible medium and in the Company's information system is carried out by methods that exclude further processing of these personal data by mechanically violating their integrity, preventing the reading and restoration of personal data, or deletion from electronic media by methods and means of guaranteed deletion of residual information.

- confirmation of the destruction of personal data processed on a tangible medium and in the Company's information system is formalized by a personal data destruction certificate, which is drawn up in the form approved by Order of Roskomnadzor dated October 28, 2022 No. 179 "On approval of the Requirements for confirmation of the destruction of personal data."

The storage periods for personal data in the Company are determined in accordance with the List of standard management archival documents generated in the course of activities of state bodies, local governments and organizations, indicating the storage periods, approved by Order No. 236 of the Federal Archival Agency dated December 20, 2019, an agreement to which the subject of personal data is a beneficiary or guarantor, and the Company's regulatory acts in the field of document management.

The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper media.

5.1. Conditions for processing special categories of personal data

The processing of special categories of personal data is carried out by the Company in compliance with the following conditions:

– the processing of personal data is carried out in accordance with the legislation on state social assistance, labor legislation, and pension legislation of the Russian Federation;

– the processing of personal data is carried out in accordance with the legislation on compulsory types of insurance, with insurance legislation.

5.2. Conditions for processing other categories of personal data

The processing of other categories of personal data is carried out by the Company in compliance with the following conditions:

– the processing of personal data is carried out with the consent of the subject of personal data to the processing of his personal data;

– the processing of personal data is necessary to achieve the goals stipulated by an international treaty of the Russian Federation or by law, for the implementation and fulfillment of the functions, powers and obligations imposed on the Company by the legislation of the Russian Federation;

– the processing of personal data is carried out in connection with the participation of a person in constitutional, civil, administrative, criminal proceedings, and proceedings in arbitration courts;

– the processing of personal data is necessary for the execution of a judicial act, an act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;

– the processing of personal data is necessary for the performance of an agreement to which the personal data subject is a party, beneficiary, or guarantor, as well as for the conclusion of an agreement initiated by the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor. An agreement concluded with the personal data subject may not contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing the personal data of minors, unless otherwise provided by the legislation of the Russian Federation, or provisions allowing the inaction of the personal data subject as a condition for concluding an agreement;

– the processing of personal data is necessary for the exercise of the rights and legitimate interests of the Company or third parties, including in cases stipulated by the Federal Law "On the Protection of the Rights and Legitimate Interests of Individuals in the Collection of Overdue Debt and on Amendments to the Federal Law "On Microfinance Activities and Microfinance Organizations", or for the achievement of socially significant goals, provided that the rights and freedoms of the personal data subject are not violated.

5.3. Instruction for processing personal data

The company has the right to entrust the processing of personal data to another person, with the consent of the employee.

5.4. Transfer of personal data

The Company has the right to transfer personal data to a third party, with the consent of the employee, or in cases provided for in Article 88 of the Labor Code of the Russian Federation No. 197-FZ of 30.12.2001.

5.5. Confidentiality of personal data

Employees of the Company who have received access to personal data shall not disclose or distribute personal data to third parties without the consent of the subject of the personal data, unless otherwise provided by federal law.

5.6. Publicly available sources of personal data

The Company does not create publicly available sources of personal data.

5.7. Consent of the personal data subject to the processing of his personal data

The personal data subject makes the decision to provide their personal data and consents to its processing voluntarily, of their own free will, and in their own interests. Consent to the processing of personal data must be specific, objective, informed, conscious, and unambiguous. Consent to the processing of personal data may be given by the personal data subject or their representative in any form that allows for confirmation of its receipt, unless otherwise provided by federal law. If consent to the processing of personal data is received from a representative of the personal data subject, the authority of this representative to grant consent on behalf of the personal data subject is verified by the Company.

Consent to the processing of personal data may be revoked by the personal data subject. If the personal data subject revokes consent to the processing of personal data, the Company has the right to continue processing the personal data without the consent of the personal data subject if there are grounds specified in paragraphs 2–11 of Part 1 of Article 6, paragraphs 2–10 of Part 2 of Article 10, and Part 2 of Article 11 of the Federal Law "On Personal Data."

The obligation to provide proof of obtaining the consent of the personal data subject to the processing of his personal data or proof of the existence of the grounds specified in paragraphs 2–11 of Part 1 of Article 6, paragraphs 2–10 of Part 2 of Article 10 and Part 2 of Article 11 of the Federal Law “On Personal Data” is assigned to the Company.

In cases stipulated by federal law, personal data may only be processed with the written consent of the data subject. Consent in the form of an electronic document signed with an electronic signature in accordance with federal law is considered equivalent to written consent on paper containing the personal data subject's signature. Written consent from the data subject to the processing of their personal data must include, in particular:

– the last name, first name, patronymic, address of the subject of personal data, the number of the main document certifying his identity, information about the date of issue of the said document and the authority that issued it;

- the last name, first name, patronymic, address of the representative of the personal data subject, the number of the main document certifying his identity, information about the date of issue of the said document and the body that issued it, details of the power of attorney or other document confirming the authority of this representative (upon receipt of consent from the representative of the personal data subject);

– the name or surname, first name, patronymic and address of the Company;

– the purpose of processing personal data;

– a list of personal data for the processing of which the subject of personal data consents;

– the name or surname, first name, patronymic and address of the person processing personal data on behalf of the Company, if the processing is entrusted to such person;

– a list of actions with personal data for which consent is given, a general description of the methods of processing personal data used by the Company;

– the period during which the consent of the personal data subject is valid, as well as the method of its revocation, unless otherwise established by federal law;

– signature of the personal data subject.

In case of incapacity of the subject of personal data, consent to the processing of his personal data is given by the legal representative of the subject of personal data.

In the event of the death of the personal data subject, consent to the processing of his personal data is given by the heirs of the personal data subject, unless such consent was given by the personal data subject during his lifetime.

Personal data may be received by the Company from a person who is not the subject of the personal data, provided that the Company is provided with confirmation of the existence of the grounds specified in paragraphs 2–11 of Part 1 of Article 6, paragraphs 2–10 of Part 2 of Article 10 and Part 2 of Article 11 of the Federal Law “On Personal Data”.

5.8. Cross-border transfer of personal data

The Company does not carry out cross-border transfer of personal data.

5.9. Processing of personal data carried out without the use of automation tools

The processing of personal data contained in a personal data information system or extracted from such a system is considered to be carried out without the use of automation tools (non-automated) if such actions with personal data as the use, clarification, distribution, and destruction of personal data in relation to each of the subjects of personal data are carried out with the direct participation of a person.

5.10. Features of the organization of personal data processing carried out without the use of automation tools

Personal data, when processed without the use of automation tools, are separated from other information, in particular by recording them on separate tangible personal data carriers (hereinafter referred to as tangible carriers), in special sections or in the fields of forms (blanks).

When recording personal data on tangible media, it is prohibited to record on the same tangible media personal data whose processing purposes are clearly incompatible. For processing different categories of personal data without the use of automation, a separate tangible media is used for each category of personal data.

Persons processing personal data without the use of automation tools (including employees of the Company or persons carrying out such processing under an agreement with the Company) are informed of the fact that they are processing personal data, the processing of which is carried out by the Company without the use of automation tools, the categories of personal data being processed, as well as the features and rules for carrying out such processing established by regulatory legal acts of federal executive bodies, executive bodies of constituent entities of the Russian Federation, as well as local legal acts of the Company.

When using standard forms of documents, the nature of the information in which presupposes or allows the inclusion of personal data (hereinafter referred to as the standard form), the following conditions are observed:

- a standard form or related documents (instructions for completing it, cards, registers and journals) contain information on the purpose of processing personal data carried out without the use of automation tools, the name (title) and address of the Company, the last name, first name, patronymic and address of the subject of personal data, the source of obtaining personal data, the terms for processing personal data, a list of actions with personal data that will be performed in the process of their processing, a general description of the methods of processing personal data used by the Company;

– the standard form provides a field in which the subject of personal data can indicate his consent to the processing of personal data carried out without the use of automation tools, if it is necessary to obtain written consent to the processing of personal data;

– the standard form is drawn up in such a way that each of the subjects of personal data contained in the document has the opportunity to become familiar with their personal data contained in the document without violating the rights and legitimate interests of other subjects of personal data;

– the standard form excludes the combination of fields intended for entering personal data, the purposes of processing of which are obviously incompatible.

In the event of incompatibility of the purposes of processing personal data recorded on one tangible medium, if the tangible medium does not allow the processing of personal data separately from other personal data recorded on the same medium, measures shall be taken to ensure separate processing of personal data, in particular:

– if it is necessary to use or distribute certain personal data separately from other personal data located on the same tangible medium, the personal data subject to distribution or use is copied in a manner that excludes the simultaneous copying of personal data not subject to distribution and use, and a copy of the personal data is used (distributed);

– if it is necessary to destroy or block part of the personal data, the physical medium is destroyed or blocked with preliminary copying of the information not subject to destruction or blocking, in a manner that excludes the simultaneous copying of the personal data subject to destruction or blocking.

Destruction of some personal data, if permitted by the physical medium, may be accomplished in a manner that precludes further processing of this personal data while preserving the ability to process other data stored on the physical medium (deletion, destruction). These rules also apply if it is necessary to ensure separate processing of personal data stored on the same physical medium and information that is not considered personal data.

The clarification of personal data during their processing without the use of automation tools is carried out by updating or changing the data on a tangible medium, and if this is not permitted by the technical features of the tangible medium, by recording on the same tangible medium information about the changes made to them or by producing a new tangible medium with the clarified personal data.

5.11. Measures to ensure the security of personal data during their processing carried out without the use of automation tools

The processing of personal data carried out without the use of automation tools is carried out in such a way that, for each category of personal data, it is possible to determine the storage locations of personal data (material carriers) and establish a list of persons processing personal data or having access to them.

Separate storage of personal data (material media) processed for various purposes is ensured.

When storing tangible media, conditions are observed that ensure the security of personal data and prevent unauthorized access. The list of measures necessary to ensure such conditions, the procedure for their implementation, and the list of persons responsible for implementing these measures are established by the Company.

5.12. Processing metric data

The following web analytics tools are used on the Company's website: Yandex.Metrica, Yandex.Maps, and Yandex.Direct. These web analytics tools are used to analyze the use of the Company's websites and improve their performance.

The Company processes cookies in an aggregated form and is never associated with the personal information of Users.

The website https://evers.ru/gb/ displays a warning informing users about the processing of metric data.

By visiting the website https://evers.ru/gb/, the user consents to the Company processing the provided data using metric services to analyze usage, measure, and improve the performance of the Company's website. This consent is valid from the moment it is provided and for the entire period of the User's use of the website.

In case of refusal to process cookies, the User must stop using the Company's website or disable the use of cookies in the browser settings; however, some functions of the Company's website may become unavailable.

The site is located at the facilities of Evers Group Rus LLC.

6. Updating, correcting, deleting and destroying personal data, responding to requests from subjects for access to personal data, rights and obligations of the subject of personal data, rights and obligations of the operator

The subject of personal data has the right to receive information (hereinafter referred to as the information requested by the subject) regarding the processing of his personal data, including containing:

– confirmation of the fact of processing of personal data by the Company;

– legal grounds and purposes of processing personal data;

– the purposes and methods of processing personal data used by the Company;

– the name and location of the Company, information about persons (except for employees of the Company) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Company or on the basis of federal law;

– processed personal data related to the relevant subject of personal data, the source of their receipt, unless another procedure for submitting such data is provided for by federal law;

– the terms of processing personal data, including the terms of their storage;

– the procedure for the exercise by the subject of personal data of the rights provided for by the Federal Law “On Personal Data”;

– information on completed or intended cross-border data transfer;

- the name or surname, first name, patronymic and address of the person processing personal data on behalf of the Company, if the processing is or will be entrusted to such person;

– information on the methods of fulfilling the obligations established by Article 18.1 of the Federal Law “On Personal Data”;

– other information provided for by the Federal Law “On Personal Data” or other federal laws.

The subject of personal data has the right to receive the requested

subject of information, except for the following cases:

– the processing of personal data, including personal data obtained as a result of operational-search, counterintelligence and intelligence activities, is carried out for the purposes of national defense, state security and the protection of law and order;

- the processing of personal data is carried out by the authorities that have detained the subject of personal data on suspicion of committing a crime, or brought charges against the subject of personal data in a criminal case, or applied a preventive measure to the subject of personal data before charges are brought, with the exception of cases provided for by the criminal procedure legislation of the Russian Federation, if the suspect or accused is allowed to become familiar with such personal data;

– the processing of personal data is carried out in accordance with the legislation on combating the legalization (laundering) of proceeds from crime and the financing of terrorism;

– access of a personal data subject to his personal data violates the rights and legitimate interests of third parties;

– the processing of personal data is carried out in cases stipulated by the legislation of the Russian Federation on transport security, in order to ensure the stable and safe functioning of the transport complex, to protect the interests of the individual, society and the state in the sphere of the transport complex from acts of illegal interference.

The subject of personal data has the right to demand from the Company clarification of his personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also to take measures provided by law to protect his rights.

The information requested by the subject must be provided to the subject of personal data by the Company in an accessible form, and it must not contain personal data related to other subjects of personal data, except in cases where there are legal grounds for disclosure of such personal data.

The requested information shall be provided to the personal data subject or their representative by the Company within ten business days of the request or receipt by the Company of the personal data subject or their representative. This period may be extended, but not more than by five business days, if the Company sends a reasoned notice to the personal data subject stating the reasons for extending the period for providing the requested information. The request must contain the number of the primary identity document of the personal data subject or their representative, information on the date of issue of the said document and the issuing authority, information confirming the personal data subject's involvement in relations with the Company (contract number, date of conclusion of the contract, conventional verbal designation and/or other information), or information otherwise confirming the fact of personal data processing by the Company, and the signature of the personal data subject or their representative (hereinafter referred to as the information required for the request). The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation. The Company shall provide the requested information to the personal data subject or his representative in the form in which the relevant request or inquiry was sent, unless otherwise specified in the request or inquiry.

If the information requested by the subject, as well as the personal data being processed, were provided for review to the subject of personal data at his request, the subject of personal data has the right to re-apply to the Company or send a repeat request in order to receive the information requested by the subject and review such personal data no earlier than thirty days (hereinafter referred to as the standard request period) after the initial request or sending of the initial request, unless a shorter period is established by federal law, a regulatory legal act adopted in accordance with it, or an agreement to which the subject of personal data is a party, a beneficiary, or a guarantor.

A personal data subject has the right to reapply to the Company or submit a follow-up request to obtain the information requested by the subject, as well as to review the personal data being processed, before the expiration of the standard request period, if such information and/or the personal data being processed were not provided to them for review in full following the review of the initial request. A follow-up request, along with the information required for the request, must include a justification for the follow-up request.

The Company has the right to refuse a personal data subject's repeated request if it does not meet the conditions of the repeated request. Such refusal must be reasoned. The Company is responsible for providing evidence justifying the refusal to fulfill the repeated request.

The Company processes personal data for the purpose of promoting goods, works, and services on the market by establishing direct contacts with potential consumers using communication tools.

The Company does not make decisions based solely on automated processing of personal data that generate legal consequences in relation to the subject of personal data or otherwise affect his rights and legitimate interests.

If a personal data subject believes that the Company is processing his personal data in violation of the requirements of the Federal Law "On Personal Data" or otherwise violates his rights and freedoms, the personal data subject has the right to appeal the actions or inaction of the Company to the authorized body for the protection of the rights of personal data subjects or in court.

The subject of personal data has the right to protect his rights and legitimate interests, including compensation for losses and/or moral damages in court.

Subjects whose personal data are processed are obliged to:

- provide accurate information about yourself and provide documents containing personal data, the composition of which is established by the legislation of the Russian Federation and local regulatory documents of the Company to the extent necessary for the purpose of processing;

- inform the Company about clarification (updating, changing) of your personal data.

6.1. Rights and obligations of the Company

Employees of the Company processing personal data, depending on the purposes of processing, have the right to:

- receive documents containing personal data;

- require the subject of personal data to promptly clarify the personal data provided.

When collecting personal data, the Company provides the subject of personal data, at his request, with the requested information regarding the processing of his personal data in accordance with Part 7 of Article 14 of the Federal Law "On Personal Data".

If, in accordance with federal law, the provision of personal data and (or) the receipt by the Company of consent to the processing of personal data are mandatory, the Company explains to the subject of personal data the legal consequences of refusing to provide his personal data and (or) to give consent to their processing.

If personal data is not received from the personal data subject, the Company, prior to the commencement of processing of such personal data, provides the personal data subject with the following information (hereinafter referred to as information communicated upon receipt of personal data not from the personal data subject):

– the name or surname, first name, patronymic and address of the Company or the representative of the Company;

– the purpose of processing personal data and its legal basis;

– list of personal data;

– intended users of personal data;

– the rights of the subject of personal data established by the Federal Law “On Personal Data”;

– source of obtaining personal data.

The Company does not provide the subject with information communicated upon receipt of personal data not from the subject of the personal data, in cases where:

– the subject of personal data is notified of the processing of his personal data by the Company;

– personal data were received by the Company on the basis of federal law or in connection with the execution of an agreement to which the subject of personal data is a party, beneficiary or guarantor;

– the processing of personal data permitted by the subject of personal data for distribution is carried out in compliance with the prohibitions and conditions stipulated by Article 10.1 of the Federal Law “On Personal Data”;

– The Company processes personal data for statistical or other research purposes, for the implementation of professional activities of a journalist or scientific, literary or other creative activities, if this does not violate the rights and legitimate interests of the subject of personal data;

– provision to the subject of personal data of information communicated upon receipt of personal data not from the subject of personal data violates the rights and legitimate interests of third parties.

When collecting personal data, including through the Internet information and telecommunications network, the Company ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.

The Company's authorized persons responsible for document management and archiving carry out systematic monitoring and identification of documents containing personal data with expired storage periods.

The location of the data processing center(s) and details of the organization responsible for storing the data are determined by the Company’s internal documents.

The Company shall take measures necessary and sufficient to ensure the fulfillment of its obligations. The Company shall independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of its obligations, unless otherwise provided by federal laws. Such measures shall include, in particular:

– appointment of a person responsible for organizing the processing of personal data;

– issuing a Policy, local regulations on personal data processing, and local regulations establishing procedures aimed at preventing and identifying violations of Russian Federation legislation and eliminating the consequences of such violations. Such documents and local regulations may not contain provisions limiting the rights of personal data subjects or imposing on the Company powers and obligations not provided for by Russian Federation legislation;

– application of legal, organizational and technical measures to ensure the security of personal data;

– implementation of internal control and (or) audit of compliance of personal data processing with the requirements for the protection of personal data, the Policy, and local acts of the Company;

- an assessment of the harm that may be caused to personal data subjects in the event of a violation of the Federal Law "On Personal Data", the ratio of the said harm and the measures taken by the Company aimed at ensuring the fulfillment of the obligations stipulated by the Federal Law "On Personal Data";

– familiarization of the Company's employees directly involved in the processing of personal data with the provisions of the Russian Federation legislation on personal data, including requirements for the protection of personal data, documents, the Policy, local acts on issues of processing personal data, and (or) training of these employees.

When processing personal data, the Company takes the necessary legal, organizational and technical measures or ensures their adoption to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data.

Ensuring the security of personal data is achieved, in particular:

– identification of threats to the security of personal data when processing them in personal data information systems;

– the application of organizational and technical measures to ensure the security of personal data when processed in personal data information systems, necessary to meet the requirements for the protection of personal data, the implementation of which ensures the levels of protection of personal data established by the Government of the Russian Federation;

– the use of information security tools that have undergone the established procedure for assessing the conformity of information;

– the use for the destruction of personal data that has undergone the compliance assessment procedure of information security tools in accordance with the established procedure, which include the information destruction function;

– assessment of the effectiveness of measures taken to ensure the security of personal data before putting into operation the personal data information system;

– taking into account machine-readable media containing personal data;

– detection of facts of unauthorized access to personal data and taking measures;

– restoration of personal data modified or destroyed due to unauthorized access to them;

– establishing rules for access to personal data processed in the personal data information system, as well as ensuring the registration and accounting of all actions performed with personal data in the personal data information system;

– control over the measures taken to ensure the security of personal data and the level of protection of personal data information systems.

The use and storage of biometric personal data outside of personal data information systems may only be carried out on such tangible media and using such storage technology that ensure the protection of these data from unauthorized or accidental access to them, their destruction, modification, blocking, copying, provision, and distribution.

The Company will inform the personal data subject or their representative, in accordance with the established procedure, of the availability of personal data relating to the relevant personal data subject, and will also provide access to this personal data upon request from the personal data subject or their representative, or within ten business days of receiving the request from the personal data subject or their representative. This period may be extended, but by no more than five business days, if the Company sends the personal data subject a reasoned notice stating the reasons for extending the deadline for providing the requested information.

In the event of a refusal to provide information regarding the availability of personal data about the relevant personal data subject or personal data to the personal data subject or their representative upon their request or upon receipt of a request from the personal data subject or their representative, the Company shall provide a reasoned written response within a period not exceeding ten business days from the date of the request from the personal data subject or their representative or from the date of receipt of the request from the personal data subject or their representative. This period may be extended, but by no more than five business days, if the Company sends a reasoned notice to the personal data subject stating the reasons for extending the period for providing the requested information.

The Company provides the personal data subject or their representative with the opportunity to access personal data relating to them free of charge. The Company will make the necessary changes to the personal data within seven business days of the personal data subject or their representative providing information confirming that the personal data is incomplete, inaccurate, or outdated. The Company will destroy such personal data within seven business days of the personal data subject or their representative providing information confirming that such personal data was obtained illegally or is not necessary for the stated processing purpose. The Company will notify the personal data subject or their representative of the changes made and the measures taken and will take reasonable measures to notify third parties to whom the personal data of this data subject was transferred.

The Company shall notify the authorized body for the protection of the rights of personal data subjects, at the request of that body, of the required information within ten business days of receipt of such request. This period may be extended, but by no more than five business days, if the Company sends a reasoned notice to the authorized body for the protection of the rights of personal data subjects, stating the reasons for the extension of the deadline for providing the requested information.

In the event that unlawful processing of personal data is detected upon an application by a personal data subject or his/her representative, or at the request of a personal data subject or his/her representative, or an authorized body for the protection of the rights of personal data subjects, the Company shall block the unlawfully processed personal data relating to this personal data subject or ensure their blocking (if the personal data is processed by another person acting on behalf of the Company) from the moment of such application or receipt of the said request for the verification period. In the event that inaccurate personal data is detected upon an application by a personal data subject or his/her representative, or at their request, or at the request of an authorized body for the protection of the rights of personal data subjects, the Company shall block the personal data relating to this personal data subject or ensure their blocking (if the personal data is processed by another person acting on behalf of the Company) from the moment of such application or receipt of the said request for the verification period, unless blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

In the event of confirmation of the fact of inaccuracy of personal data, the Company, on the basis of information provided by the subject of personal data or his representative or the authorized body for the protection of the rights of subjects of personal data, or other necessary documents, clarifies the personal data or ensures their clarification (if the processing of personal data is carried out by another person acting on behalf of the Company) within seven working days from the date of submission of such information and removes the blocking of the personal data.

In the event of detection of unlawful processing of personal data carried out by the Company or a person acting on behalf of the Company, the Company shall, within a period not exceeding three business days from the date of such detection, cease the unlawful processing of personal data or ensure the cessation of the unlawful processing of personal data by the person acting on behalf of the Company. If it is impossible to ensure the lawfulness of the processing of personal data, the Company shall, within a period not exceeding ten business days from the date of detection of the unlawful processing of personal data, destroy such personal data or ensure its destruction. The Company shall notify the personal data subject or their representative of the rectification of the violations committed or of the destruction of personal data, and if the appeal of the personal data subject or their representative or the request of the authorized body for the protection of the rights of personal data subjects was sent by the authorized body for the protection of the rights of personal data subjects, also the said body.

In the event of the establishment of an unlawful or accidental transfer (provision, distribution, access) of personal data, resulting in a violation of the rights of personal data subjects, the Company, from the moment of detection of such an incident by the Company, the authorized body for the protection of the rights of personal data subjects or another interested party, notifies the authorized body for the protection of the rights of personal data subjects:

- within twenty-four hours about the incident that occurred, about the alleged reasons that led to the violation of the rights of personal data subjects, and the alleged harm caused to the rights of personal data subjects, about the measures taken to eliminate the consequences of the relevant incident, as well as about the person authorized by the Company to interact with the authorized body for the protection of the rights of personal data subjects on issues related to the identified incident;

– within seventy-two hours, the results of the internal investigation of the identified incident, as well as the persons whose actions caused the identified incident (if any).

In the event that the purpose of processing personal data is achieved, the Company shall cease processing the personal data or ensure its termination (if the processing of personal data is carried out by another person acting on behalf of the Company) and destroy the personal data or ensure their destruction (if the processing of personal data is carried out by another person acting on behalf of the Company) within a period not exceeding thirty days from the date of achieving the purpose of processing the personal data, unless otherwise provided by an agreement to which the subject of personal data is a party, beneficiary or guarantor, or by another agreement between the Company and the subject of personal data, or if the Company does not have the right to process personal data without the consent of the subject of personal data on the grounds provided for by the Federal Law "On Personal Data" or other federal laws.

In the event that the subject of personal data revokes consent to the processing of his personal data, the Company shall cease processing them or ensure the termination of such processing (if the processing of personal data is carried out by another person acting on behalf of the Company) and, if the storage of personal data is no longer required for the purposes of processing personal data, destroy the personal data or ensure their destruction (if the processing of personal data is carried out by another person acting on behalf of the Company) within a period not exceeding thirty days from the date of receipt of such revocation, unless otherwise provided by an agreement to which the subject of personal data is a party, beneficiary or guarantor, or by another agreement between the Company and the subject of personal data, or if the Company does not have the right to process personal data without the consent of the subject of personal data on the grounds provided for by the Federal Law "On Personal Data" or other federal laws.

If a personal data subject requests that the processing of personal data be terminated, the Company shall, within a period not exceeding ten business days from the date of receipt of the relevant request, cease processing the personal data or ensure the termination of such processing (if such processing is carried out by the person processing the personal data), except for the cases provided for in paragraphs 2–11 of Part 1 of Article 6, Part 2 of Article 10, and Part 2 of Article 11 of the Federal Law "On Personal Data." This period may be extended, but by no more than five business days, if the Company sends a reasoned notice to the personal data subject stating the reasons for extending the period for providing the requested information.

If it is not possible to destroy personal data within the specified period, the Company blocks such personal data or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of the Company) and ensures the destruction of personal data within a period of no more than six months, unless another period is established by federal laws.

The Company, with the exception of cases stipulated by the Federal Law "On Personal Data", prior to the commencement of processing personal data, notifies the authorized body for the protection of the rights of personal data subjects of its intention to process personal data.

The notification is sent in hard copy or electronic form and signed by an authorized person. The notification contains the following information:

– name (last name, first name, patronymic), address of the Company;

– the purpose of processing personal data;

– a description of the measures, including information on the availability of encryption (cryptographic) means and the names of these means;

– the last name, first name, patronymic of the individual or the name of the legal entity responsible for organizing the processing of personal data, and their contact telephone numbers, postal addresses and e-mail addresses;

– the date of commencement of personal data processing;

– the term or condition for termination of the processing of personal data;

– information on the presence or absence of cross-border transfer of personal data during their processing;

– information about the location of the database of information containing personal data of citizens of the Russian Federation;

– the last name, first name, patronymic of an individual or the name of a legal entity that has access to and (or) processes personal data contained in state and municipal information systems on the basis of an agreement;

– information on ensuring the security of personal data in accordance with the requirements for the protection of personal data established by the Government of the Russian Federation.

If the specified information changes, the Company shall notify the authorized body for the protection of personal data subjects' rights of all changes that occurred during the specified period no later than the 15th day of the month following the month in which such changes occurred. If the Company ceases processing personal data, it shall notify the authorized body for the protection of personal data subjects' rights within ten business days of the date of cessation of personal data processing.

7. Areas of responsibility

The company appoints a person responsible for organizing the processing of personal data.

The person responsible for organizing the processing of personal data receives instructions directly from the executive body of the organization that is the operator and reports to it.

The Company provides the person responsible for organizing the processing of personal data with the necessary information.

The person responsible for organizing the processing of personal data, in particular, performs the following functions:

– carries out internal control over the compliance of the Company and the Company’s employees with the legislation of the Russian Federation on personal data, including requirements for the protection of personal data;

– brings to the attention of the Company’s employees the provisions of the legislation of the Russian Federation on personal data, local acts on the processing of personal data, and requirements for the protection of personal data;

– organizes the reception and processing of requests and inquiries from personal data subjects or their representatives and (or) exercises control over the reception and processing of such requests and inquiries.

7.1. Responsibility

Persons found guilty of violating the requirements of the Federal Law "On Personal Data" shall bear liability as provided for by the legislation of the Russian Federation.

Moral damages caused to a personal data subject as a result of a violation of their rights, a breach of the personal data processing rules established by the Federal Law "On Personal Data," or the personal data protection requirements established in accordance with the Federal Law "On Personal Data" are subject to compensation in accordance with the legislation of the Russian Federation. Compensation for moral damages is provided independently of compensation for property damages and losses incurred by the personal data subject.

8. Key results

Upon achieving the objectives, the following results are expected:

– ensuring the protection of the rights and freedoms of personal data subjects during the processing of their personal data by the Company;

– increasing the overall level of information security of the Company;

– minimization of legal risks of the Company.

Appendix No. 1 to the Policy on the Organization of Personal Data Processing

Information about personal data processed by Evers Group Rus LLC.