This Regulation on Confidentiality and Personal Data Protection applies to all information that the Company receives from its counterparties: employees, suppliers, customers and other persons who provide confidential information to the Company by any means and in any form.

1. This Regulation in relation to the processing of personal data (hereinafter referred to as the "Policy") sets out the position and intentions of the Company regarding the processing and protection of personal data, in order to comply with Federal Law No. 152-FZ "On Personal Data" of 27 July 2006, as well as with other regulatory legal acts of the Russian Federation relating to the protection and processing of personal data.

2. The head of the Company and the employees of all its structural subdivisions must strictly comply with the Policy.

3. The Policy applies to all personal data of data subjects, whether processed with or without the use of means of automation.

4. Any data subject has access to this Policy.

5. The Company processes the personal data of the following data subjects:

• Employees and candidates for vacant positions;

• Counterparties with whom civil-law contracts have been concluded, as well as representatives of such counterparties;

• Registered users of websites and other online resources administered by the Company;

6. The Company processes personal data for the following purposes:

• The conclusion and performance of contracts, including to ensure the exercise of the right to judicial protection.

• The preparation of statutory reporting.

• The processing of data in accordance with statutory requirements.

• The processing of personal data for the purposes approved in the privacy policies of the websites and other online resources administered by the Company.

7. The Company processes the following personal data:

• Surname;

• First name;

• Patronymic;

• Year, month and date of birth;

• Place of birth;

• Address;

• Marital status;

• Property status;

• Education;

• Profession;

• Income;

• Identity document details;

• SNILS number (individual insurance account number);

• Place of registration;

• Place of actual residence;

• Telephone number;

• Email address.


The particular set of personal data processed for each data subject is determined by the specific purpose of the processing, taking into account the criterion of data sufficiency.

8. Personal data are stored for the limitation period laid down by civil legislation, extended by one year, unless legislation provides for different retention periods for the data concerned.

9. Personal data are destroyed in a manner that precludes their recovery.

10. The Company itself determines the legal, organisational and technical measures needed to protect the personal data it processes.

11. The Company may entrust the processing of personal data to third parties under a contract with them. The Company remains liable for the actions of those third parties.

12. The Company may carry out cross-border transfers of personal data unless applicable legislation prohibits this.

13. The Company may process personal data by any means consistent with the purposes of the processing, including by automated means.

14. The Company may transfer personal data to third parties in the following cases:

• The data subject has consented to such actions;

• The transfer is necessary to perform an agreement or contract concluded with the data subject;

• Russian or other applicable legislation provides for the transfer, and it takes place in accordance with the procedure established by that legislation;

• The transfer takes place as part of a sale or other disposal of the business (in whole or in part), in which case the acquirer assumes all obligations to comply with this Policy in respect of the personal data it receives;

• To enable the Company or third parties to protect their rights and legitimate interests.

• Statistical data obtained as a result of the depersonalisation of personal data are transferred to a third party for the purpose of conducting research, performing work or providing services at the Company's instruction.

15. The Company destroys or depersonalises personal data once the purposes of the processing have been achieved or where it is no longer necessary to achieve those purposes.

16. The data subject has the right:

• to obtain confirmation from the Company that their personal data are being processed, together with the other information specified in clause 7 of Article 14 of Federal Law No. 152-FZ "On Personal Data";

• to require that their personal data be corrected, blocked or destroyed where they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of the processing;

• to require the Company to remedy any unlawful conduct in respect of their personal data.



The data subject may send any proposals, questions, requests or other communications concerning this Policy to the Company by email or to the postal address given on the website.

When submitting a formal request, the data subject must provide the following information to prevent their personal data from being disclosed to third parties:

• Surname, first name and patronymic;

• Information confirming their relationship with the Company, or information otherwise confirming that their personal data are being processed;

• The signature of the citizen (or of their legal representative).

• If the request is sent in electronic form, it must be drawn up as an electronic document and signed with an electronic signature in accordance with the applicable legislation.