PERSONAL DATA PROCESSING POLICY

1.1. The Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" and other applicable regulations in order to protect the rights and freedoms of personal data subjects when the Operator processes their personal data, including the rights to privacy, personal and family secrets.

1.2. This Policy defines the procedure and conditions for personal data processing by the Operator, including transfer to third parties, specific features of processing, access to personal data, the personal data protection system, internal control procedures and liability for violations.

1.3. Key terms used in this Policy include: personal data, the Personal Data Law, Operator, Personal Data Subject/User, Website, personal data processing, processor, recipient, third party, automated and non-automated processing, dissemination, provision, blocking, destruction, anonymization, use, publicly available personal data, confidentiality, User Device, statistics, cookies, web beacons, counters/trackers, IP address, and HTTP header. These terms are interpreted in accordance with applicable Russian law and this Policy.

1.4. Other terms are interpreted in accordance with applicable law, international internet standardization recommendations and customary internet usage.

1.5. Terms may be used in singular or plural form and with uppercase or lowercase spelling depending on context.

1.6. Section headings and the structure of the Policy are provided for convenience and have no independent legal meaning.

1.7. This Policy enters into force when approved by the Operator and remains effective until replaced by a new policy.

1.8. The Operator may amend this Policy without the User's consent. Amendments are made by an administrative act of the Operator.

1.9. This Policy applies to all personal data processing performed by the Operator with or without automation. The Operator is not responsible for third-party services accessible through links on the Website.

1.10. The Personal Data Subject has the rights provided by personal data law, including the right to receive information on processing, request correction, blocking or destruction of incomplete, outdated, inaccurate, unlawfully obtained or unnecessary data, access personal data, appeal the Operator's actions or omissions, withdraw consent, and protect their rights and legitimate interests.

1.11. The Operator has the rights provided by personal data law, including the right to determine necessary and sufficient measures, engage another person to process personal data where permitted, and continue processing without consent where statutory grounds exist.

1.12. When collecting personal data, the Operator performs the duties required by law, including informing the data subject where required, localizing Russian citizens' personal data where required, and taking measures necessary and sufficient to comply with this Policy and personal data law.

2.1. Personal data, including collection, is processed by the Operator for the purposes specified in Appendix No. 1 to this Policy.

2.2. The Operator does not combine databases containing personal data processed for incompatible purposes.

3.1. The legal basis for processing is the body of legal acts under which the Operator processes personal data, including the Constitution of the Russian Federation, the Civil Code, Labor Code, Tax Code, accounting law, corporate law, other federal laws and regulations, the Company's constituent and local acts, agreements with data subjects, agreements with counterparties including data processing agreements, and personal data processing consent.

3.2. The Company presumes that counterparties and end customers have lawfully obtained all required data subject consents or otherwise ensured lawful transfer of personal data to the Company before processing begins.

4.1. The scope and categories of processed personal data and the categories of data subjects are specified in Appendix No. 1.

4.2. The Operator does not process biometric personal data.

4.3. The Operator may process special categories of personal data, including health data, only where permitted by Russian law or with separate data subject consent where such consent is legally allowed. The Operator does not process special categories related to race, nationality, political opinions, religious or philosophical beliefs or intimate life except where Russian law provides otherwise.

4.4. Personal data permitted by a data subject for dissemination is processed on the basis of that data subject's dissemination consent and in compliance with restrictions and conditions established by the data subject.

5.1. Personal data is processed where grounds specified by personal data law exist.

5.2. The Operator transfers personal data to third parties with written consent of the data subject except where consent is not required by law. The Operator may transfer personal data to investigative and other authorized authorities on statutory grounds.

5.3. The Operator performs mixed personal data processing, both automated and non-automated. Certain operations may be performed with direct involvement of the Operator's employees.

5.4. Personal data is processed and stored for the periods specified in Appendix No. 1.

5.5. Personal data remains confidential except where the data subject voluntarily makes information publicly available.

5.6. The Operator may entrust processing to another person under an agreement or transfer personal data to other persons in compliance with personal data law.

5.7. The Operator does not perform cross-border transfer of personal data.

5.8. If an incident involving unlawful personal data transfer or access is detected, the Operator acts in accordance with legal requirements, including notifying Roskomnadzor where required and taking measures to protect data subjects.

5.9. The Operator takes organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, dissemination and other unlawful actions.

5.10. The Operator and the data subject take necessary measures to prevent losses or adverse consequences caused by loss or unauthorized disclosure of personal data.

5.11. The Operator may transfer personal data to authorized public authorities on statutory grounds.

5.12. Processing stops and data is destroyed or anonymized when purposes are achieved or in other cases specified by law, including withdrawal of consent, expiry of statutory retention periods, unlawful processing, liquidation of the Operator or other statutory cases.

6.1. Processing through the Website is performed in accordance with this Policy unless this section provides otherwise.

6.2. Using the Website means acceptance of this Policy. If the User disagrees, use of the Website must stop immediately.

6.3. Through the Website the Operator processes only data necessary to use the Website or perform transactions and agreements, except where mandatory retention is required by law.

6.4. Website processing purposes, categories, scope and retention periods are specified in Appendix No. 1.

6.5. The Operator may receive personal data through feedback forms, Website use, support requests, marketing programs and similar interactions. The Operator processes data provided through Website forms and data generated during Website use.

6.6. Data subject categories include individuals using the Website, individuals using the Operator's services under agreements and transactions, and visitors of public Website pages.

6.7. Website processing may include user form data, Website usage data, User Device technical characteristics and approximate location data, where needed for the stated purposes.

6.8. If a data subject provides more personal data than necessary for Website functionality, the Operator may choose not to process such data.

6.9. Where such data is processed, it is processed under this Policy and consent is deemed received when the data is provided.

6.10. The Operator may transfer Website user data to processors, recipients or third parties through secure HTTPS channels where requested by the User, consented to, necessary for functionality or agreement performance, required by law, necessary during transfer of rights to the Website, required to protect rights and legitimate interests, or necessary for anonymized analytics using Yandex Metrica.

6.11. Cookies, web beacons and counters may be used for the purposes of this Policy. Cookie categories may include mandatory, analytical, technical, functional and third-party cookies.

6.12. Mandatory cookies and mandatory counter data are used without a separate express request for consent where they are strictly necessary for Website operation.

6.13. Analytical, functional and marketing cookies and similar technologies are used only with User consent where applicable, and consent may be withdrawn through Website or browser settings.

6.14. User devices and software may or may not support cookie blocking or deletion.

6.15. Strictly necessary cookies may be used where Website operation, security and anti-abuse protection would otherwise be impossible or materially impaired.

6.16. Cookie structure, content and technical parameters are determined by the Operator and may change without prior notice.

6.17. Counters may be used to analyze cookies and collect Website usage data to improve quality and usability.

6.18. Web beacons may be used separately or with cookies. Users may block web beacons by disabling image loading in browser settings.

6.19. The Website uses Yandex Metrica to analyze Website use and User behavior. Yandex Metrica uses cookies and collects anonymized data including IP address, browser and device information and Website actions. Its privacy terms are available at https://yandex.ru/legal/confidential/.

6.20. Where Website interfaces are unavailable or do not allow data updates or deletion, the User may request correction, blocking or destruction of incomplete, outdated, inaccurate, unlawfully obtained or unnecessary personal data in writing.

Only the Operator's employees who need access for their official duties may access personal data. The Operator maintains an up-to-date list of employees with access. Unauthorized access is prohibited except where required by law. Access ends when employment ends or the employee loses the relevant access rights.

The data subject may request updates, additions or deletion by email at sales@hivetrace.ru. The Operator takes measures to update, delete or destroy incomplete, inaccurate, outdated, unlawfully obtained or unnecessary data within statutory periods, notifies the data subject where required, and destroys paper and electronic media using methods preventing recovery where destruction is required.

The data subject may receive information about personal data processing, including confirmation of processing, legal bases, purposes, methods, categories of data, recipients, retention periods, rights, source of data and information on Yandex Metrica opt-out tools. The Operator responds within statutory periods and provides motivated refusals where access cannot be granted.

The Operator maintains a personal data protection system including legal, organizational, technical and other measures. These measures include appointing a responsible person, adopting local acts, internal control and audits, employee training and confidentiality obligations, access control, accounting of media, incident response, restoration of modified or destroyed data, logging of actions in information systems and control over security measures.

The User provides personal data and consent freely, of the User's own will and in the User's interest. Consent is specific, informed and conscious. Where processing is based on agreements or transactions, separate consent is not required. Where separate Website consent is used, it may be expressed electronically, including by clicking a button, ticking a checkbox, sending an SMS or email, and may be withdrawn under applicable law.

This Policy is publicly available at https://hivetrace.ru/policy/. Questions and suggestions may be sent to sales@hivetrace.ru.

HiveTrace LLC. Address: 25D Sverdlova St., Yaroslavl, Yaroslavl Region, Russia, 150040. OGRN 1257600004969, INN 7604401431. Phone: +7 903 827-44-88. Email: sales@hivetrace.ru.

1. Processing purpose: HR and accounting records

Categories of personal data subjects:

Employees, employees' relatives, former employees, other categories of data subjects whose personal data is processed, and individuals who have entered into civil-law contracts.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; marital status; income; gender; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; driver license data; bank account number; position; employment information, including work experience and current employment information with employer name and account details; military duty status and military registration information; education information; education document data; professional development information; place of study for students; temporary disability information and sick leave certificate details; recipient status (resident/non-resident); insurance record; internship information.

Legal basis for personal data processing:

Processing is necessary for performance of an agreement to which the data subject is a party, beneficiary or guarantor, or to conclude an agreement at the data subject's initiative or an agreement under which the data subject will be a beneficiary or guarantor. The agreement may not contain provisions restricting the data subject's rights and freedoms, cases of processing minors' personal data unless otherwise provided by Russian law, or provisions allowing the data subject's inaction as a condition for concluding the agreement. Processing is also necessary to perform legal duties, including the Labor Code of the Russian Federation and Federal Law No. 402-FZ of 06.12.2011 "On Accounting"; processing is also carried out with the data subject's consent.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

2. Processing purpose: recruitment for the Operator's open positions

Categories of personal data subjects:

Applicants.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; email address; registration address; residential address; phone number; other personal data, including employment history, positions held, current employment and employer name, education, profession, desired salary level, hobbies, interests, driver license availability, foreign language skills, and other information stated in the CV.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing. Processing is also necessary to achieve purposes provided for by Russian law and to perform the Operator's legal functions, powers and duties.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the Operator decides whether to hire or refuse to hire the applicant.

3. Processing purpose: compliance with Russian labor law

Categories of personal data subjects:

Employees, employees' relatives, former employees.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; marital status; income; gender; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; driver license data; bank account number; position; employment information; education information; health information where required by law; social status; family composition; marriage or divorce information; birth of children; social benefits information; reason for disability.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law. This includes compliance with the Labor Code of the Russian Federation; processing is also carried out with the data subject's consent.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until contractual and/or other relations between the Operator and the data subject end and until expiry of information retention periods established by applicable law.

4. Processing purpose: compliance with Russian tax law

Categories of personal data subjects:

Employees, applicants, employees' relatives, former employees, counterparties, representatives of counterparties, website visitors, pupils and students.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; income; email address; residential address; registration address; SNILS; INN; phone number; citizenship; identity document data; position; bank account number; personal account number; employment information; other personal data including tax deduction supporting document data.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law. This includes compliance with the Tax Code of the Russian Federation.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

5. Processing purpose: compliance with Russian pension law

Categories of personal data subjects:

Employees, former employees, other categories of data subjects whose personal data is processed, and individuals who have entered into civil-law contracts.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; income; gender; residential address; registration address; phone number; SNILS; citizenship; identity document data, including identity documents outside the Russian Federation; bank account number; personal account number; position; employment information; health information where required by law.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law. This includes Federal Law No. 27-FZ of 01.04.1996, Federal Law No. 167-FZ of 15.12.2001, and Federal Law No. 400-FZ of 28.12.2013 "On Insurance Pensions".

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

6. Processing purpose: compliance with Russian insurance law

Categories of personal data subjects:

Employees, employees' relatives, former employees, relatives of former employees, other data subjects whose personal data is processed, and individuals who have entered into civil-law contracts.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; marital status; income; gender; phone number; SNILS; INN; citizenship; profession; social benefits information; reason for disability; temporary disability information; recipient status; payment details; insurance record; child birth information; spouse workplace; grounds for financial assistance.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law. This includes legislation on individual pension insurance accounting, compulsory pension insurance, and compulsory social insurance against workplace accidents and occupational diseases.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

7. Processing purpose: employee social benefits

Categories of personal data subjects:

Employees, employees' relatives, former employees, relatives of former employees, other data subjects whose personal data is processed, individuals who have entered into civil-law contracts, and relatives of such individuals.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; income; phone number; SNILS; INN; citizenship; social benefits information; reason for disability; temporary disability information; recipient status; payment details; insurance record; child birth information; spouse workplace; grounds for financial assistance.

Legal basis for personal data processing:

Processing is necessary for performance of an agreement to which the data subject is a party, beneficiary or guarantor, or to conclude an agreement at the data subject's initiative or an agreement under which the data subject will be a beneficiary or guarantor. The agreement may not contain provisions restricting the data subject's rights and freedoms, cases of processing minors' personal data unless otherwise provided by Russian law, or provisions allowing the data subject's inaction as a condition for concluding the agreement. Processing is also necessary to perform legal duties, including legislation on compulsory social insurance and individual pension insurance accounting; processing is also carried out with the data subject's consent.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

8. Processing purpose: compliance with military registration obligations

Categories of personal data subjects:

Employees.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; identity document data; military duty status; military registration information; education information; military specialty; fitness category; military rank; driver license details; military commissariat information; professional development information; education document data; place of study; marital status and family composition.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law. This includes Federal Law No. 53-FZ of 28.03.1998 "On Military Duty and Military Service" and the Military Registration Regulations approved by Russian Government Resolution No. 719 of 27.11.2006.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

9. Processing purpose: compliance with deferment/reservation requirements

Categories of personal data subjects:

Employees.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; position; military duty status; military registration information; job duties; work experience; fitness category; military rank; military profile and military commissariat information; deferment certificate series and number; issuing military commissariat; driver license details.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law. This includes Federal Law No. 53-FZ of 28.03.1998 and Federal Law No. 31-FZ of 26.02.1997 "On Mobilization Preparation and Mobilization in the Russian Federation".

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

10. Processing purpose: compliance with Russian civil law

Categories of personal data subjects:

Counterparties, representatives of counterparties, website visitors, beneficiaries under agreements.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; gender; email address; residential address; registration address; phone number; SNILS; INN; identity document data; birth certificate data; personal account number; payment account details.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing. Processing is also necessary to achieve statutory purposes and to perform the Operator's legal duties, and is necessary for performance or conclusion of agreements involving the data subject.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

11. Processing purpose: maintaining participant lists and minutes of general meetings and board meetings, and other corporate-law and governance matters

Categories of personal data subjects:

Other categories of data subjects whose personal data is processed; participants; sole executive body; members of the board of directors.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; gender; residential address; registration address; email address; phone number; INN; SNILS; identity document data; position.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; until the expiry of information retention periods established by applicable law.

12. Processing purpose: promotion of goods, works and services

Categories of personal data subjects:

Counterparties, representatives of counterparties, website visitors, beneficiaries under agreements.

List of processed personal data:

Last name, first name, patronymic; email address; residential address; registration address; phone number; INN; citizenship; position; HTTP headers; user device IP address; cookie data; counter data; web beacon data; browser information; device and software technical characteristics; technical data on operation of the Service or Website, including dates and times of use and access; requested interface window identifiers; location information; other data that may be uploaded and/or used by the User through the Service and/or Website.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the processing purposes are achieved; where an agreement exists, during the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; where processing is based on consent, until consent is withdrawn; where mandatory retention periods apply, during the periods established by Russian law.

13. Processing purpose: preparation, conclusion and performance of civil-law contracts

Categories of personal data subjects:

Counterparties, representatives of counterparties, website visitors, beneficiaries under agreements, employees of counterparties, and individuals who have entered into civil-law contracts.

List of processed personal data:

Last name, first name, patronymic; year, month and date of birth; place of birth; email address; residential address; registration address; phone number; SNILS; INN; identity document data; bank account number; personal account number; position; payment details and other data required for contract preparation, conclusion and performance.

Legal basis for personal data processing:

Processing is necessary for performance of an agreement to which the data subject is a party, beneficiary or guarantor, or to conclude an agreement at the data subject's initiative or an agreement under which the data subject will be a beneficiary or guarantor. The agreement may not contain provisions restricting the data subject's rights and freedoms, cases of processing minors' personal data unless otherwise provided by Russian law, or provisions allowing the data subject's inaction as a condition for concluding the agreement. Processing is also necessary to achieve statutory purposes and to comply with the Civil Code of the Russian Federation.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the processing purposes are achieved; where an agreement exists, during the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; where processing is based on consent, until consent is withdrawn; where mandatory retention periods apply, during the periods established by Russian law.

14. Processing purposes for Website users

For Website users, processing is carried out including for the following purposes:

• conclusion and performance of any transaction with the Operator;
• determining user preferences and providing targeted information about the Operator's products and services;
• using the User's personal data for proper Website operation according to User expectations, including correct User identification;
• marketing programs, offers, promotions and advertising activities related to the Website;
• compliance with mandatory requirements of applicable law;
• data collected through third-party analytics services such as Yandex Metrica, including Website actions, Website path, page depth and other anonymized statistics.

Categories of personal data subjects:

Website visitors and users.

List of processed personal data:

Last name, first name, patronymic; position; email address; location (address or address elements); other data necessary to perform an agreement with the data subject; HTTP headers; device IP address; cookie data; counter data; web beacon data; browser information; device and software technical characteristics; technical data on Website operation, including dates and times of use and access; requested Website interface window identifiers; geolocation data.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the processing purposes are achieved; where an agreement exists, during the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; where processing is based on consent, until consent is withdrawn; where mandatory retention periods apply, during the periods established by Russian law.

15. Processing purpose: participation in civil, administrative and commercial court proceedings

Categories of personal data subjects:

Employees, representatives of counterparties, other data subjects whose personal data is processed, representatives of employees, and attorneys.

List of processed personal data:

Last name, first name, patronymic; email address; registration address; residential address; phone number; SNILS; INN; identity document data; position; bar association membership information; higher education document data; premarital surname information; procedural role and other data required for court proceedings.

Legal basis for personal data processing:

Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform functions, powers and duties imposed on the Operator by Russian law. This includes the Civil Procedure Code, Administrative Procedure Code, Code of Administrative Offenses and Commercial Procedure Code of the Russian Federation. Processing is also carried out in connection with participation in civil, administrative and commercial court proceedings.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until expiry of information retention periods established by applicable law.

16. Processing purpose: compliance with Russian enforcement proceedings law

Categories of personal data subjects:

Employees, counterparties, representatives of counterparties, other categories of data subjects whose personal data is processed, and individuals who have entered into civil-law contracts.

List of processed personal data:

Last name, first name, patronymic; email address; residential address; registration address; phone number; SNILS; INN; identity document data; position; bank account information and payment details.

Legal basis for personal data processing:

Processing is necessary to execute a court act or an act of another body or official enforceable under Russian enforcement proceedings law. Processing is also necessary to achieve statutory purposes and to comply with Federal Law No. 229-FZ of 02.10.2007 "On Enforcement Proceedings".

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

During execution of the enforcement document and until expiry of information retention periods established by applicable law.

17. Processing purpose: feedback with website visitors to review and process requests, applications and inquiries received through the Website; feedback with the User, including notices, requests and information related to Website use and/or the Operator's activities

Categories of personal data subjects:

Website visitors and users; individuals who are representatives of counterparties.

List of processed personal data:

Last name, first name, patronymic; phone number; email address; position; organization information.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the processing purposes are achieved; where processing is based on consent, until consent is withdrawn.

18. Processing purpose: statistical and other studies of Service use based on anonymized data; service quality improvement; improvement of Service or Website software; proper functioning of the Service or Website; user identification; information systems, analysis, modeling, forecasting and research purposes

Categories of personal data subjects:

Website visitors and Website users.

List of processed personal data:

Last name, first name, patronymic; email address; phone number; HTTP headers; user device IP address; cookie data; counter data; web beacon data; browser information; device and software technical characteristics; technical data on operation of the Service or Website, including dates and times of use and access; requested interface window identifiers; location information; other data uploaded and/or used by the User through the Service and/or Website.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the processing purposes are achieved; where an agreement exists, during the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; where processing is based on consent, until consent is withdrawn; where mandatory retention periods apply, during the periods established by Russian law.

19. Processing purpose: educational seminars and webinars

Categories of personal data subjects:

Employees, representatives of counterparties, other data subjects whose personal data is processed, and seminar/webinar participants.

List of processed personal data:

Last name, first name, patronymic; email address; phone number; position; workplace.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the processing purposes are achieved; where an agreement exists, during the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; where processing is based on consent, until consent is withdrawn; where mandatory retention periods apply, during the periods established by Russian law.

20. Processing purpose: student educational and industrial internships

Categories of personal data subjects:

Employees; students.

List of processed personal data:

Last name, first name, patronymic; email address; registration address; residential address; phone number; SNILS; INN; identity document data; education information, including university name, faculty and specialty.

Legal basis for personal data processing:

Processing is carried out with the data subject's consent to personal data processing. Processing is also necessary for performance or conclusion of agreements involving the data subject.

Actions performed with personal data:

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

Methods of personal data processing:

Mixed processing, with transfer over the legal entity's internal network and transfer over the Internet.

Personal data processing and retention periods:

Until the processing purposes are achieved; where an agreement exists, during the term of the agreement and for 3 years after its termination where necessary to protect the Operator's rights and legitimate interests, unless other periods are established by law; where processing is based on consent, until consent is withdrawn; where mandatory retention periods apply, during the periods established by Russian law.