Policy of FAREXPO LLC
regarding the processing of personal data

St. Petersburg

1. GENERAL PROVISIONS

1.1. This Policy of FAREXPO LLC regarding the processing of Personal Data (hereinafter – "Policy") has been developed in compliance with the requirements of clause 2, part 1, article 18.1 of Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006 (hereinafter – "Personal Data Law") for the purpose of ensuring the protection of the rights and freedoms of individuals and citizens in the processing of their Personal Data, including the protection of the rights to privacy, personal and family secrecy.

1.2. The Policy applies to all Personal Data processed by FAREXPO LLC (hereinafter – "Operator").

1.3. The Policy applies to relations in the field of Personal Data processing that arose with the Operator both before and after the approval of this Policy.

1.4. In compliance with the requirements of part 2, article 18.1 of the Personal Data Law, this Policy is published for free access on the information and telecommunications network "Internet" on the website https://www.en.farexpo.ru/ (hereinafter – "Website") at the following link: www.en.farexpo.ru/PersonalDataProcessingPolicy_en.php

1.5. The Operator does not verify the accuracy of the Personal Data received from the Personal Data Subject.

1.6. The Operator ensures the protection of the processed Personal Data from unauthorized access and disclosure, unlawful use or loss in accordance with the requirements of the Personal Data Law.

1.7. The Personal Data Subject agrees to this Policy by granting consent to the processing of Personal Data.

2. TERMS AND ABBREVIATIONS

2.1. For the purposes of application and interpretation of this Policy, the following basic terms are used (unless the Policy expressly provides otherwise). In the text of the Policy, these terms may be indicated with a capital or lowercase letter, in the singular or plural, as well as in the form of abbreviations.

2.1.1. Personal Data – any information relating directly or indirectly to a specific or identifiable natural person (Personal Data Subject);

2.1.2. Personal Data Operator – FAREXPO LLC (INN: 7841005070, OGRN: 1157847007460, legal address: 196105, St. Petersburg, ul. Blagodatnaya, 47 litera A, premises 13-N) is the owner of the Website and independently or jointly with other persons organizes and (or) carries out the processing of Personal Data, and also determines the purposes of Personal Data processing, the composition of Personal Data subject to processing, and the actions (operations) performed with Personal Data;

2.1.3. Subject, Personal Data Subject – a natural person whose Personal Data is processed by the Operator or by a third party on the instruction of the Operator;

2.1.4. Personal Data processing – any action (operation) or set of actions (operations) with Personal Data performed with or without the use of automation tools. Personal Data processing includes, among other things:

2.1.4.1. collection;
2.1.4.2. recording;
2.1.4.3. systematization;
2.1.4.4. accumulation;
2.1.4.5. storage;
2.1.4.6. clarification (updating, modification);
2.1.4.7. extraction;
2.1.4.8. use;
2.1.4.9. transfer (provision to a limited circle of persons; access by a limited circle of persons);
2.1.4.10. dissemination;
2.1.4.11. depersonalization;
2.1.4.12. blocking;
2.1.4.13. deletion;
2.1.4.14. destruction.

2.1.5. Personal Data storage – a process involving the presence of Personal Data in systematized form at the disposal of the Operator.

2.1.6. Personal Data collection – a purposeful process of obtaining Personal Data by the Operator directly from Personal Data Subjects.

2.1.7. Automated Personal Data processing – processing of Personal Data using computer technology;

2.1.8. Non-automated Personal Data processing – processing of Personal Data contained in a Personal Data information system or extracted from such a system is considered to be carried out without the use of automation tools (non-automated) if such actions with Personal Data as use, clarification, dissemination, destruction of Personal Data in respect of each of the Personal Data Subjects are carried out with the direct participation of a human;

2.1.9. Mixed Personal Data processing – processing by a human with the participation of computer technology;

2.1.10. Provision of Personal Data – actions aimed at disclosing Personal Data to a specific person or a specific circle of persons;

2.1.11. Blocking of Personal Data – temporary suspension of Personal Data processing (except in cases where processing is necessary for the clarification of Personal Data);

2.1.12. Destruction of Personal Data – actions as a result of which it becomes impossible to restore the content of Personal Data in the Personal Data information system and (or) as a result of which the material media of Personal Data are destroyed;

2.1.13. Depersonalization of Personal Data – actions as a result of which it becomes impossible, without the use of additional information, to determine the attribution of Personal Data to a specific Personal Data Subject;

2.1.14. Personal Data information system (hereinafter – "PDIS") – a set of Personal Data contained in databases and information technologies and technical means ensuring their processing.

2.1.15. Cross-border transfer of Personal Data – transfer of Personal Data to the territory of a foreign state, to an authority of a foreign state, to a foreign natural person or a foreign legal entity.

3. CONDITIONS OF PERSONAL DATA PROCESSING

3.1. The processing of the Subject's Personal Data by the Operator is carried out by means with or without the use of automation tools for the periods necessary to achieve the processing purposes. The condition for terminating the processing of Subjects' Personal Data by the Operator may be the achievement of the purposes of their processing, withdrawal of the Subject's consent to the processing of his/her Personal Data, withdrawal of consent to the dissemination of Personal Data, termination of the Operator's activity (reorganization or liquidation), closure of the Website, termination of the contract between the Operator and the Subject, dismissal of the Operator's employee, or detection of the fact of their unlawful processing.

3.2. The Operator's policy regarding the processing of Subjects' Personal Data is that Personal Data must be processed only in cases established by law, based on the main areas of the Operator's activity and taking into account the balance of interests of the Operator and the Subject. The processing of Personal Data by the Operator is carried out taking into account the need to ensure the protection of the rights and freedoms of the Subject, including the protection of the right to privacy, personal and family secrecy, on the basis of the following principles:

3.2.1. Personal Data processing is carried out by the Operator on a lawful and fair basis;

3.2.2. Personal Data processing is limited to the achievement of specific, predetermined and lawful purposes;

3.2.3. Personal Data processing incompatible with the purposes of Personal Data collection is not allowed;

3.2.4. only Personal Data that meets the purposes of their processing is subject to processing;

3.2.5. the content and scope of the processed Personal Data correspond to the stated processing purposes; redundancy of the processed Personal Data in relation to the stated purposes of their processing is not allowed;

3.2.6. Personal Data storage is carried out in a form that allows determining the Subject for no longer than required by the purposes of Personal Data processing. The processed Personal Data are destroyed upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by law.

3.3. Personal Data processing is carried out by the Operator in compliance with the principles and rules provided for by the Personal Data Law in the following cases:

3.3.1. with the consent of the Personal Data Subject to the processing of his/her Personal Data;

3.3.2. Personal Data processing is necessary for the performance of a contract to which the Personal Data Subject is a party, or a beneficiary or guarantor under which the Personal Data Subject is;

3.3.3. in cases where Personal Data processing is necessary for the Operator to exercise and perform the functions, powers and duties imposed by the legislation of the Russian Federation;

3.3.4. Personal Data processing is necessary to protect the life, health or other vital interests of the Personal Data Subject, if obtaining the consent of the Personal Data Subject is impossible.

3.4. The Operator has no right to obtain and process the Subject's Personal Data containing information about racial or national affiliation, political views, religious and philosophical beliefs, or state of health, except with the written consent of the Subject.

3.5. The Operator does not process special categories of Personal Data or biometric data.

3.6. Subjects become acquainted with this Policy on the Website when granting consent.

3.7. The provision of the Subject's Personal Data at the request of state bodies (local self-government bodies) is carried out in the manner provided for by the legislation of the Russian Federation.

3.8. Control over the fulfillment of the requirements of this Policy is exercised by an authorized person responsible for organizing the processing of Personal Data at the Operator.

3.9. The Operator's liability for violation of the requirements of the legislation of the Russian Federation in the field of processing and protection of Personal Data is determined in accordance with the legislation of the Russian Federation.

3.10. Only employees of the Operator whose job duties include the processing of Personal Data are allowed to process Personal Data. The list of employees allowed to process Personal Data is established by the Operator.

3.11. Disclosure to third parties and dissemination of Personal Data without the consent of the Personal Data Subject is not allowed, unless otherwise provided by federal law. Consent to the processing of Personal Data permitted by the Personal Data Subject for dissemination is executed separately from other consents of the Personal Data Subject to the processing of his/her Personal Data.

3.12. Procedure for obtaining Personal Data:

3.12.1. Personal Data collection, with the exception of publicly available Personal Data, is carried out by the Operator directly from Personal Data Subjects or from persons duly authorized to represent the interests of the Subjects; if the Subject's Personal Data can only be obtained from a third party, the Subject must be notified thereof or his/her written consent must be obtained.

3.12.2. When obtaining Personal Data, the Operator is obliged to inform the Personal Data Subject:

3.12.2.1. about the purposes of obtaining Personal Data by the Operator;
3.12.2.2. about the list of Personal Data requested by the Operator;
3.12.2.3. about the list of actions that the Operator intends to perform with the Personal Data;
3.12.2.4. about the period during which the consent of the Personal Data Subject to the processing of Personal Data is valid;
3.12.2.5. about the procedure for withdrawing consent to the processing of Personal Data;
3.12.2.6. about the consequences of the Personal Data Subject's refusal to grant the Operator consent to the receipt and processing of Personal Data.

3.13. Documents containing Personal Data are created by:

3.13.1. copying originals of documents (passport of a citizen of the Russian Federation, education document, INN certificate, pension certificate, SNILS, etc.);
3.13.2. entering information into accounting forms;
3.13.3. obtaining originals of the necessary documents (passport of a citizen of the Russian Federation, income statement, employment record book, medical report, reference/characteristic, etc.).

3.14. Personal Data processing for each processing purpose specified in clauses 5.3 – 5.13 of the Policy is carried out by:

3.14.1. Obtaining Personal Data in oral, written and electronic form directly from the Subjects;
3.14.2. Entering Personal Data into the Operator's journals, registers and information systems;
3.14.3. Using other methods of Personal Data processing depending on the Personal Data processing action.

4. RIGHTS AND OBLIGATIONS

4.1. Obligations of the Operator:

4.1.1. To organize the processing of Personal Data in accordance with the requirements of the Personal Data Law;

4.1.2. To respond to communications and requests from Personal Data Subjects and their legal representatives in accordance with the requirements of the Personal Data Law;

4.1.3. To inform the authorized body for the protection of the rights of Personal Data Subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) at the request of that body of the necessary information within 10 working days from the date of receipt of such a request. This period may be extended, but not by more than five working days. To this end, the Operator must send Roskomnadzor a reasoned notification indicating the reasons for extending the period for providing the requested information;

4.1.4. In the manner determined by the federal executive body authorized in the field of security, to ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing it about computer incidents that resulted in the unlawful transfer (provision, dissemination, access) of Personal Data.

4.1.5. In cases where the Personal Data were not obtained from the Personal Data Subject, to notify the Personal Data Subject of the fact that the Operator has obtained the Personal Data.

4.1.6. In case of refusal to provide Personal Data, to explain to the Personal Data Subject the consequences of such refusal.

4.1.7. To publish or otherwise ensure unrestricted access to the document defining the Operator's policy regarding the processing of Personal Data.

4.1.8. To take the necessary legal, organizational and technical measures or ensure their adoption to protect Personal Data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of Personal Data, as well as from other unlawful actions in relation to Personal Data.

4.2. The Operator has the right:

4.2.1. To independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Personal Data Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other Federal Laws;

4.2.2. To entrust the processing of Personal Data to another person. The person processing Personal Data on the instruction of the Operator is obliged to comply with the principles and rules of Personal Data processing provided for by the Personal Data Law.

4.2.3. In the event of withdrawal by the Subject of consent to the processing of Personal Data, the Operator has the right to continue processing Personal Data without the Subject's consent if there are grounds specified in the Personal Data Law.

4.3. The Subject has the right:

4.3.1. To receive information concerning the processing of his/her Personal Data, except in cases provided for by federal laws. The information is provided to the Personal Data Subject by the Operator in an accessible form, and it must not contain Personal Data relating to other Personal Data Subjects, except in cases where there are lawful grounds for disclosing such Personal Data. The list of information and the procedure for its receipt are established by the Personal Data Law. The information may contain:

4.3.1.1. Confirmation of the fact of Personal Data processing by the operator;
4.3.1.2. Legal grounds and purposes of Personal Data processing;
4.3.1.3. Purposes and methods of Personal Data processing applied by the operator;
4.3.1.4. Name and location of the operator, information about persons (except employees of the operator) who have access to Personal Data or to whom Personal Data may be disclosed on the basis of a contract with the operator or on the basis of federal law;
4.3.1.5. Processed Personal Data relating to the relevant Personal Data Subject, the source of their receipt, unless a different procedure for providing such data is provided for by federal law;
4.3.1.6. Periods of Personal Data processing, including periods of their storage;
4.3.1.7. Procedure for the Personal Data Subject to exercise the rights provided for by this Federal Law;
4.3.1.8. Information about the cross-border transfer of data that has been carried out or is intended to be carried out;
4.3.1.9. Name or surname, first name, patronymic and address of the person processing Personal Data on the instruction of the operator, if the processing is or will be entrusted to such a person;
4.3.1.10. Other information provided for by the Personal Data Law or other federal laws.

4.3.2. To give preliminary consent to the processing of Personal Data for the purposes of promoting goods, works and services on the market;

4.3.3. To demand from the operator clarification of his/her Personal Data, its blocking or destruction if the Personal Data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated processing purpose, as well as to take measures provided for by law to protect his/her rights.

4.3.4. To appeal to Roskomnadzor or to a court against the unlawful actions or inaction of the Operator in the processing of his/her Personal Data.

5. PURPOSES OF PERSONAL DATA PROCESSING, CATEGORIES OF SUBJECTS, CATEGORIES OF PROCESSED PERSONAL DATA AND METHODS OF THEIR PROCESSING

5.1. Personal Data processing is limited to the achievement of specific, predetermined and lawful purposes. Personal Data processing incompatible with the purposes of Personal Data collection is not allowed.

5.2. Only Personal Data that meets the purposes of their processing is subject to processing.

5.3. Purpose of Personal Data processing: Maintenance of HR and accounting records.

Categories of processed Personal Data:

Employees	Relatives of employees	Former employees
surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous); marital status; family composition (degree of kinship: close relatives, full names of relatives, their dates of birth); data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; email address; contact phone number (home, mobile); information about military registration; information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; information about social benefits (in accordance with the current legislation of the Russian Federation); bank details; photograph; additional information provided by the Subject (employee) at his/her own discretion or other personal data necessary for the employer in accordance with the current legislation of the Russian Federation in the field of Personal Data.	surname, first name, patronymic; degree of kinship; year, month and date of birth; phone number; email; other Personal Data provided by employees in accordance with the requirements of the legislation of the Russian Federation.	surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous) at the time of dismissal; data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; contact phone number (home, mobile); information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; email address; contact phone number (home, mobile); photograph.

Categories of Subjects: employees; relatives of employees; job applicants; former employees; counterparties; representatives of counterparties.

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data;
Personal Data processing is necessary for the performance of a contract to which the Subject is a party or a beneficiary or guarantor under which the Subject is, as well as for concluding a contract at the initiative of the Subject or a contract under which the Subject will be a beneficiary or guarantor. The contract concluded with the Subject cannot contain provisions restricting the rights and freedoms of the Subject;
Personal Data processing is necessary for the exercise and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of consent to the processing of Personal Data;
Validity period of the employment contract for employees and relatives of employees, legal representatives;
Validity period of the contract for counterparties, representatives of counterparties;
For former employees, in accordance with the periods established in the List of standard administrative archival documents generated in the course of the activities of state bodies, local self-government bodies and organizations, approved by order of Rosarkhiv dated 20.12.2019 No. 236.
One year for job applicants.
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), termination of the contract, dismissal of the employee, detection of the fact of their unlawful processing, or expiration of the processing periods.

5.4. Purpose of Personal Data processing: Ensuring compliance with the labor legislation of the Russian Federation.

Categories of processed Personal Data:

Employees	Relatives of employees	Former employees	Job applicants
surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous); marital status; family composition (degree of kinship: close relatives, full names of relatives, their dates of birth); data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; email address; contact phone number (home, mobile); information about military registration; information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; information about social benefits (in accordance with the current legislation of the Russian Federation); bank details; photograph; additional information provided by the Subject (employee) at his/her own discretion or other personal data necessary for the employer in accordance with the current legislation of the Russian Federation in the field of Personal Data.	surname, first name, patronymic; degree of kinship; year, month and date of birth; phone number; email; other Personal Data provided by employees in accordance with the requirements of the legislation of the Russian Federation.	surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous) at the time of dismissal; data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; contact phone number (home, mobile); information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; email address; contact phone number (home, mobile); photograph.	surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); work experience in the specialty (total, continuous); email address; contact phone number (home, mobile); photograph; other personal data reported by candidates in resumes and cover letters.

Categories of Subjects: employees; job applicants; former employees; relatives of employees.

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data;
Personal Data processing is necessary for the performance of a contract to which the Subject is a party or a beneficiary or guarantor under which the Subject is, as well as for concluding a contract at the initiative of the Subject or a contract under which the Subject will be a beneficiary or guarantor. The contract concluded with the Subject cannot contain provisions restricting the rights and freedoms of the Subject;
Personal Data processing is necessary for the exercise and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of consent to the processing of Personal Data;
Validity period of the employment contract for employees, relatives of employees;
For former employees, in accordance with the periods established in the List of standard administrative archival documents generated in the course of the activities of state bodies, local self-government bodies and organizations, approved by order of Rosarkhiv dated 20.12.2019 No. 236;
One year for job applicants.
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), termination of the contract, dismissal of the employee, detection of the fact of their unlawful processing, or expiration of the processing periods.

5.5. Purpose of Personal Data processing: Ensuring compliance with the tax legislation of the Russian Federation.

Categories of processed Personal Data:

Employees	Former employees
surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous); marital status; family composition (degree of kinship: close relatives, full names of relatives, their dates of birth); data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; email address; contact phone number (home, mobile); information about military registration; information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; information about social benefits (in accordance with the current legislation of the Russian Federation); bank details; additional information provided by the Subject (employee) at his/her own discretion or other personal data necessary for the employer in accordance with the current legislation of the Russian Federation in the field of Personal Data.	surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous) at the time of dismissal; data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; contact phone number (home, mobile); information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; email address; contact phone number (home, mobile).

Employees

Former employees

surname, first name, patronymic;
year, month and date of birth;
place of birth;
gender;
education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma);
postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates);
position;
profession;
income;
citizenship;
work experience in the specialty (total, continuous);
marital status;
family composition (degree of kinship: close relatives, full names of relatives, their dates of birth);
data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport);
registered address, date of registration at the specified address;
actual place of residence address;
email address;
contact phone number (home, mobile);
information about military registration;
information about attestation, advanced training, professional retraining;
information about existing awards (incentives), honorary titles;
information about the number and series of the state pension insurance certificate;
information about the taxpayer identification number;
information about social benefits (in accordance with the current legislation of the Russian Federation);
bank details;
additional information provided by the Subject (employee) at his/her own discretion or other personal data necessary for the employer in accordance with the current legislation of the Russian Federation in the field of Personal Data.

surname, first name, patronymic;
year, month and date of birth;
place of birth;
gender;
education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma);
postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates);
position;
profession;
income;
citizenship;
work experience in the specialty (total, continuous) at the time of dismissal;
data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport);
registered address, date of registration at the specified address;
actual place of residence address;
contact phone number (home, mobile);
information about attestation, advanced training, professional retraining;
information about existing awards (incentives), honorary titles;
information about the number and series of the state pension insurance certificate;
information about the taxpayer identification number;
email address;
contact phone number (home, mobile).

Categories of Subjects: employees, former employees.

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data;
Personal Data processing is necessary for the exercise and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of consent to the processing of Personal Data;
Validity period of the employment contract;
For former employees, in accordance with the periods established in the List of standard administrative archival documents generated in the course of the activities of state bodies, local self-government bodies and organizations, approved by order of Rosarkhiv dated 20.12.2019 No. 236.
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), termination of the contract, dismissal of the employee, detection of the fact of their unlawful processing, or expiration of the processing periods.

5.6. Purpose of Personal Data processing: Ensuring compliance with the pension legislation of the Russian Federation.

Categories of processed Personal Data:

Employees	Former employees
surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous); marital status; family composition (degree of kinship: close relatives, full names of relatives, their dates of birth); data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; email address; contact phone number (home, mobile); information about military registration; information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; information about social benefits (in accordance with the current legislation of the Russian Federation); bank details; additional information provided by the Subject (employee) at his/her own discretion or other personal data necessary for the employer in accordance with the current legislation of the Russian Federation in the field of Personal Data.	surname, first name, patronymic; year, month and date of birth; place of birth; gender; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates); position; profession; income; citizenship; work experience in the specialty (total, continuous) at the time of dismissal; data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); registered address, date of registration at the specified address; actual place of residence address; contact phone number (home, mobile); information about attestation, advanced training, professional retraining; information about existing awards (incentives), honorary titles; information about the number and series of the state pension insurance certificate; information about the taxpayer identification number; email address; contact phone number (home, mobile).

Employees

Former employees

surname, first name, patronymic;
year, month and date of birth;
place of birth;
gender;
education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma);
postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates);
position;
profession;
income;
citizenship;
work experience in the specialty (total, continuous);
marital status;
family composition (degree of kinship: close relatives, full names of relatives, their dates of birth);
data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport);
registered address, date of registration at the specified address;
actual place of residence address;
email address;
contact phone number (home, mobile);
information about military registration;
information about attestation, advanced training, professional retraining;
information about existing awards (incentives), honorary titles;
information about the number and series of the state pension insurance certificate;
information about the taxpayer identification number;
information about social benefits (in accordance with the current legislation of the Russian Federation);
bank details;
additional information provided by the Subject (employee) at his/her own discretion or other personal data necessary for the employer in accordance with the current legislation of the Russian Federation in the field of Personal Data.

surname, first name, patronymic;
year, month and date of birth;
place of birth;
gender;
education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma);
postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates);
position;
profession;
income;
citizenship;
work experience in the specialty (total, continuous) at the time of dismissal;
data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport);
registered address, date of registration at the specified address;
actual place of residence address;
contact phone number (home, mobile);
information about attestation, advanced training, professional retraining;
information about existing awards (incentives), honorary titles;
information about the number and series of the state pension insurance certificate;
information about the taxpayer identification number;
email address;
contact phone number (home, mobile).

Categories of Subjects: employees, former employees.

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data;
Personal Data processing is necessary for the exercise and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of consent to the processing of Personal Data;
Validity period of the employment contract;
For former employees, the period is 1 month from the moment of dismissal, unless other periods are provided for in the List of standard administrative archival documents generated in the course of the activities of state bodies, local self-government bodies and organizations, approved by order of Rosarkhiv dated 20.12.2019 No. 236.
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), termination of the contract, dismissal of the employee, detection of the fact of their unlawful processing, or expiration of the processing periods.

5.7. Purpose of Personal Data processing: Recruitment of personnel (job applicants) for vacant positions of the Operator.

Categories of processed Personal Data:

Job applicants

surname, first name, patronymic;
year, month and date of birth;
place of birth;
gender;
education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma);
postgraduate professional education (name of the educational or scientific institution, year of graduation), academic degree, academic title (when conferred, numbers of diplomas, certificates);
work experience in the specialty (total, continuous);
email address;
contact phone number (home, mobile);
photograph;
other personal data reported by candidates in resumes and cover letters.

Categories of Subjects: job applicants.

Legal basis for Personal Data processing:

Personal Data processing is necessary for the performance of a contract to which the Subject is a party or a beneficiary or guarantor under which the Subject is, as well as for concluding a contract at the initiative of the Subject or a contract under which the Subject will be a beneficiary or guarantor. The contract concluded with the Subject cannot contain provisions restricting the rights and freedoms of the Subject;
Personal Data processing is necessary for the exercise and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

One year for job applicants.
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, termination of the Operator's activity (reorganization or liquidation), detection of the fact of their unlawful processing, or expiration of the processing periods.

5.8. Purpose of Personal Data processing: Maintenance of military registration.

Categories of processed Personal Data:

Employees	Relatives of employees
surname, first name, patronymic; year, month and date of birth; place of birth; gender; phone number; email; registered address, date of registration at the specified address; actual place of residence address; citizenship; data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport); data of the military ID; education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma); work experience in the specialty (total, continuous); marital status; family composition (degree of kinship: close relatives, full names of relatives, their dates of birth); information about military registration.	surname, first name, patronymic; degree of kinship; date of birth; phone number; email.

Employees

Relatives of employees

surname, first name, patronymic;
year, month and date of birth;
place of birth;
gender;
phone number;
email;
registered address, date of registration at the specified address;
actual place of residence address;
citizenship;
data of the general civil passport of the Russian Federation (series and number of the all-Russian passport, date of its issue, name of the authority that issued the passport, validity period of the all-Russian passport);
data of the military ID;
education (when and which educational institutions were completed, diploma numbers, field of study or specialty according to the diploma, qualification according to the diploma);
work experience in the specialty (total, continuous);
marital status;
family composition (degree of kinship: close relatives, full names of relatives, their dates of birth);
information about military registration.

surname, first name, patronymic;
degree of kinship;
date of birth;
phone number;
email.

Categories of Subjects: employees, relatives of employees.

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data;
Personal Data processing is necessary for the exercise and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of consent to the processing of Personal Data;
Validity period of the employment contract;
For former employees, the period is 1 month from the moment of dismissal, unless other periods are provided for in the List of standard administrative archival documents generated in the course of the activities of state bodies, local self-government bodies and organizations, approved by order of Rosarkhiv dated 20.12.2019 No. 236.
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), termination of the contract, dismissal of the employee, detection of the fact of their unlawful processing, or expiration of the processing periods.

5.9. Purpose of Personal Data processing: Preparation, conclusion and performance of a civil law contract (except for contracts on the participation of visitors in exhibitions and events).

Categories of processed Personal Data:

Counterparties	Representatives of counterparties, beneficiaries under contracts
surname, first name, patronymic; registered address/place of residence address; email address; contact phone number; information about the taxpayer identification number; data of the identity document; OGRNIP; position; bank details.	surname, first name, patronymic; registered address/place of residence address; email address; contact phone number; Position.

Categories of Subjects: counterparties; representatives of counterparties, beneficiaries under contracts.

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data;
Personal Data processing is necessary for the performance of a contract to which the Subject is a party or a beneficiary or guarantor under which the Subject is, as well as for concluding a contract at the initiative of the Subject or a contract under which the Subject will be a beneficiary or guarantor. The contract concluded with the Subject cannot contain provisions restricting the rights and freedoms of the Subject.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of the contract;
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), termination of the contract, dismissal of the employee, detection of the fact of their unlawful processing, or expiration of the processing periods.

5.10. Purpose of Personal Data processing: Preparation, conclusion and performance of a civil law contract on the participation of visitors in exhibitions and events.

Categories of processed Personal Data:

surname, first name, patronymic;
position;
email address;
phone number;
country of residence.

Categories of Subjects: visitors of the Website, visitors of exhibitions (events).

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data;
Personal Data processing is necessary for the performance of a contract to which the Subject is a party or a beneficiary or guarantor under which the Subject is, as well as for concluding a contract at the initiative of the Subject or a contract under which the Subject will be a beneficiary or guarantor. The contract concluded with the Subject cannot contain provisions restricting the rights and freedoms of the Subject.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer.

Processing methods: mixed; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of the contract;
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), detection of the fact of their unlawful processing, or expiration of the processing periods.

5.11. Purpose of Personal Data processing: Sending information and advertising messages (upon granting separate consent to receive information and/or advertising messages).

Categories of Subjects: visitors of the Website, visitors of exhibitions (events).

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data and consent to receive advertising and information messages.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
depersonalization;
blocking;
deletion;
destruction;
transfer (provision, access).

Processing methods: automated; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period of Personal Data processing and storage:

Validity period of consent to the processing of Personal Data;
Validity period of consent to receive advertising and information mailings;
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), detection of the fact of their unlawful processing, or expiration of the processing periods.

5.12. Purpose of Personal Data processing: Use of information collected by means of the "Yandex.Metrica" analytics program.

Categories of processed Personal Data:

Information collected by means of analytics programs.

Categories of Subjects: visitors of the Website.

Legal basis for Personal Data processing:

Personal Data processing is carried out with the consent of the Subject to the processing of his/her Personal Data.

List of actions for Personal Data processing:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
transfer (provision to a limited circle of persons; access by a limited circle of persons);
depersonalization;
blocking;
deletion;
destruction.

Processing methods: automated; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period (and conditions of termination) of Personal Data processing and storage:

Validity period of consent to the processing of Personal Data.
The condition for terminating the processing of Personal Data may be the achievement of the purposes of their processing, withdrawal of consent to the processing of Personal Data, termination of the Operator's activity (reorganization or liquidation), termination of the Website's operation, detection of the fact of their unlawful processing, or expiration of the processing periods.

5.13. Purpose of personal data processing: Publication of opinions of visitors of exhibitions (events) on the Website.

Categories of personal data permitted by the Subject for dissemination:

surname, first name;
photograph;
position.

Categories of Subjects: visitors of exhibitions (events).

Legal basis for personal data processing:

personal data processing is carried out with the consent of the personal data subject to the processing of his/her personal data and consent to the dissemination of personal data.

List of actions for Personal Data processing:

dissemination.

Processing methods: automated; with transfer over the internal network of the legal entity; with transfer over the Internet.

Period (and conditions of termination) of Personal Data processing and storage:

Validity period of consent;
Validity period of consent to dissemination;
The condition for terminating the personal data processing may be the achievement of the purposes of their processing, withdrawal of consent to the processing of personal data or consent to the dissemination of personal data, termination of the Operator's activity (reorganization or liquidation), termination of operation of the Website administered by the Operator, termination of the contract, dismissal of the employee, detection of the fact of their unlawful processing, or expiration of the processing periods.

6. DATA OF ANALYTICS PROGRAMS AND TECHNICAL DATA

6.1. On the Website administered by the Operator, the "Yandex.Metrica" analytics program is used for keeping statistics. The information processed by means of analytics programs includes:

information about the software and hardware devices used by visitors of the Website, including the model and version of the operating system, unique identifiers of the devices from which the Website is visited;
information recorded in server logs, in particular, information about cookies, IP address, and system failures;
information about the location of the visitor of the Website (country, region);
visited pages/sections;
number of page visits;
information about navigation through the pages/sections of the Website;
session duration;
entry points (third-party websites from which the visitor follows a link to the Website);
exit points (links to the Website by which the visitor goes to third-party websites);
the visitor's provider;
the visitor's browser data.

6.2. The Service uses "Cookie" technology.

6.3. The processed information collected by means of cookies includes:

identification number;
date and time of visit;
viewed pages;
visitor's region;
type of device from which the visit was made, and its operating system.

The Operator also processes technical information. Technical information means information that is automatically transmitted to the Operator in the course of using the Service, namely:

IP address;
internet browser;
other technical information that does not constitute personal data.

7. TRANSFER OF PERSONAL DATA

7.1. The Operator transfers Personal Data to third parties in the following cases:

7.1.1. consent to such actions has been obtained from the Personal Data Subject;

7.1.2. the transfer is provided for by Russian or other applicable legislation within the framework of the procedure established by legislation.

7.2. The list of persons to whom Personal Data is transferred is established by the consent to the processing of Personal Data granted by the Personal Data Subject, or by the peremptory norms of applicable legislation.

7.3. The provision of the Subject's Personal Data at the request of state bodies (local self-government bodies) is carried out in the manner provided for by the legislation of the Russian Federation.

7.4. When collecting Personal Data, including by means of the information and telecommunications network Internet, the Operator ensures the processing of Personal Data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases specified in the Personal Data Law.

7.5. The Operator does not carry out cross-border transfer of Personal Data on its own.

8. UPDATING, CORRECTION, DELETION, DESTRUCTION OF PERSONAL DATA, RESPONSES TO SUBJECT REQUESTS FOR ACCESS TO PERSONAL DATA

8.1. Procedure for considering Subject requests:

8.1.1. Confirmation of the fact of Personal Data processing by the Operator, the legal grounds and purposes of Personal Data processing, as well as other information specified in part 7, article 14 of the Personal Data Law, are provided by the Operator to the Subject or his/her representative within 10 working days from the moment of contact or receipt of the request of the Personal Data Subject or his/her representative. This period may be extended, but not by more than five working days. To this end, the Operator must send the Subject a reasoned notification indicating the reasons for extending the period for providing the requested information.

8.1.2. The information provided does not include Personal Data relating to other Subjects, except in cases where there are lawful grounds for disclosing such Personal Data.

8.1.3. The request must contain data allowing the identification of the Subject and the Subject's signature, and if the request is signed by the Subject's representative, a document confirming his/her authority.

8.1.4. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

8.1.5. The Operator provides the information specified in part 7, article 14 of the Personal Data Law to the Subject or his/her representative in the form in which the corresponding communication or request was sent, unless otherwise indicated in the communication or request. If the communication (request) of the Subject does not reflect, in accordance with the requirements of the Personal Data Law, all the necessary information, or the Subject does not have access rights to the requested information, a reasoned refusal is sent to him/her.

8.1.6. The Subject's right to access his/her Personal Data may be restricted in accordance with part 8, article 14 of the Personal Data Law, including if the Subject's access to his/her Personal Data violates the rights and legitimate interests of third parties.

8.2. In the event of detection of inaccurate Personal Data upon the communication of the Subject or his/her representative, or at their request or at the request of Roskomnadzor, the Operator blocks the Personal Data relating to this Subject from the moment of such communication or receipt of the specified request for the period of verification, if the blocking of Personal Data does not violate the rights and legitimate interests of the Subject.

8.3. In the event of confirmation of the fact of inaccuracy of Personal Data, the Operator, on the basis of the information provided by the Subject or his/her representative or Roskomnadzor, or other necessary documents, clarifies the Personal Data within seven working days from the day of submission of such information and removes the blocking of the Personal Data.

8.4. In the event of detection of unlawful processing of Personal Data upon the communication (request) of the Subject or his/her representative or Roskomnadzor, the Operator blocks the unlawfully processed Personal Data relating to this Personal Data Subject within three working days from the moment of such communication or receipt of the request.

8.5. If the Operator, Roskomnadzor or another interested person detects the fact of unlawful or accidental transfer (provision, dissemination) of Personal Data (access to Personal Data) resulting in a violation of the Subject's rights, the Operator:

8.5.1. within 24 hours — notifies Roskomnadzor of the incident, the alleged causes that led to the violation of the Subjects' rights, the alleged harm caused to the Subjects' rights, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;

8.5.2. within 72 hours — notifies Roskomnadzor of the results of the internal investigation of the detected incident and provides information about the persons whose actions caused it (if any).

8.6. Destruction of Personal Data:

8.6.1. Upon achievement of the purpose of Personal Data processing, as well as in the event of withdrawal by the Personal Data Subject of consent to their processing, the Personal Data are subject to destruction if:

8.6.1.1. otherwise is not provided for by the contract to which the Subject is a party or a beneficiary or guarantor under which the Subject is;

8.6.1.2. the Operator is not entitled to process without the consent of the Personal Data Subject on the grounds provided for by the Personal Data Law or other federal laws;

8.6.1.3. otherwise is not provided for by the legislation of the Russian Federation.

8.7. Personal Data on electronic media are destroyed by erasing them from computer memory or formatting computer memory.

8.8. Destruction of documents (paper media) containing Personal Data is carried out by burning, crushing (grinding), chemical decomposition, transformation into a shapeless mass or powder. For the destruction of paper documents, the use of a shredder is permitted.

8.9. Destruction of Personal Data is carried out by a commission created by order of the Operator's general director.

8.10. The period for destruction of Personal Data is 10 working days from the moment of occurrence of one of the events provided for in clause 8.6 of this Policy.

9. MEASURES TAKEN BY THE OPERATOR TO PROTECT PERSONAL DATA

9.1. In accordance with the requirements of regulatory documents, the Operator has created a Personal Data protection system consisting of subsystems of legal, organizational and technical protection.

9.2. The legal protection subsystem is a set of legal, organizational and administrative and regulatory documents ensuring the creation, functioning and improvement of Personal Data protection systems.

9.3. The organizational protection subsystem includes the organization of the management structure of the Personal Data protection system, the authorization system, and the protection of information when working with employees, partners and third parties.

9.4. The technical protection subsystem includes a set of technical, software, and software and hardware tools ensuring the protection of Personal Data.

9.5. The main Personal Data protection measures used by the Operator are:

9.5.1. Appointment of a person responsible for Personal Data processing, who organizes Personal Data processing, training and instruction, and internal control over the Operator's and its employees' compliance with Personal Data protection requirements.

9.5.2. Identification of current threats to the security of Personal Data during their processing in Personal Data information systems and development of measures and activities for Personal Data protection.

9.5.3. Development of this Policy.

9.5.4. Establishment of rules of access to Personal Data processed in Personal Data information systems, as well as ensuring the registration and accounting of all actions performed with Personal Data in Personal Data information systems.

9.5.5. Establishment of individual access passwords for employees to the information system in accordance with their job duties.

9.5.6. Application of information protection tools that have passed conformity assessment procedures in the established manner.

9.5.7. Application of certified antivirus software with regularly updated databases.

9.5.8. Compliance with conditions ensuring the safekeeping of Personal Data and excluding unauthorized access to them.

9.5.9. Detection of facts of unauthorized access to Personal Data and taking measures.

9.5.10. Restoration of Personal Data modified or destroyed as a result of unauthorized access to them.

9.5.11. Instruction of the Operator's employees directly engaged in Personal Data processing on the provisions of the legislation of the Russian Federation on Personal Data, including requirements for the protection of Personal Data, documents defining the Operator's policy regarding Personal Data processing, and local acts on Personal Data processing issues.

9.5.12. Implementation of internal control and audit.

9.5.13. Employees holding positions that involve Personal Data processing are allowed to process it after signing an obligation on non-disclosure thereof.

9.5.14. The job descriptions of the Operator's employees processing Personal Data include, in particular, provisions on the need to report any cases of unauthorized access to Personal Data.

9.6. When processing Personal Data, the Operator ensures:

9.6.1. implementation of measures aimed at preventing unauthorized access to Personal Data and/or their transfer to persons not entitled to access such information;

9.6.2. timely detection of facts of unauthorized access to Personal Data;

9.6.3. prevention of impact on the technical means of automated Personal Data processing resulting in disruption of their functioning;

9.6.4. the possibility of immediate restoration of Personal Data modified or destroyed as a result of unauthorized access to them;

9.6.5. constant control over ensuring the level of protection of Personal Data.

9.7. The Operator conducts internal investigations in the following situations:

9.7.1. in case of unlawful or accidental transfer (provision, dissemination, access) of Personal Data resulting in a violation of the rights of Personal Data Subjects;

9.7.2. in other cases provided for by legislation in the field of Personal Data.

9.8. The employee responsible for organizing Personal Data processing exercises internal control over the compliance by employees authorized to process Personal Data with the requirements of legislation in the field of Personal Data and local regulations, and over the compliance of these acts with the requirements of legislation in the field of Personal Data.

9.8.1. Internal scheduled inspections are carried out on the basis of an annual plan approved by the Operator's general director.

9.8.2. Internal unscheduled inspections are carried out by decision of the employee responsible for organizing Personal Data processing. The basis for them is information about a violation of legislation in the field of Personal Data received orally or in writing.

9.8.3. Based on the results of the internal inspection, a report is drawn up addressed to the Operator's general director. If violations are detected, the document provides a list of measures to eliminate them within the appropriate timeframes.

9.9. The Operator uses technical means and software equipment for the processing and protection of Personal Data.

9.10. The above technical means and software equipment for the processing and protection of Personal Data are located in the office and premises of the Operator or in the premises of other persons engaged by the Operator.

9.11. All persons allowed to work with Personal Data, as well as those involved in the operation and technical maintenance of the PDIS, have been familiarized with this Policy.

9.12. The Operator has organized a process of training in the use of the protection tools operated by the Operator. Training in this area has been completed by persons with permanent access to Personal Data, persons operating the technical and software tools of the PDIS and means of protection of the PDIS, and persons responsible for the operation of information protection tools of the PDIS.

9.13. Employees are obliged to immediately inform the relevant official of the Operator about the loss or shortage of information media constituting Personal Data, as well as about the causes and conditions of a possible leak of Personal Data. In the event of an attempt by unauthorized persons to obtain from an employee Personal Data processed by the Operator, immediately notify the relevant official of the Operator thereof.

9.14. When working with the software tools of the Operator's automated system that implements the functions of viewing and editing Personal Data, it is prohibited to demonstrate screen forms containing such data to persons who do not have the appropriate authorization.

9.15. Storage of Personal Data:

9.15.1. Personal Data of Subjects may be obtained, further processed and transferred for storage, both on paper and in electronic form.

9.15.2. Personal Data on paper media are stored by the Operator for the storage periods of documents for which such periods are provided for by the legislation on archival affairs in the Russian Federation (Federal Law No. 125-FZ "On Archival Affairs in the Russian Federation" dated 22.10.2004, the List of standard administrative archival documents generated in the course of the activities of state bodies, local self-government bodies and organizations, indicating their storage periods (approved by Order of Rosarkhiv dated 20.12.2019 No. 236)).

9.15.3. Personal Data of Subjects recorded on paper media are stored in lockable cabinets or in lockable premises with restricted access rights.

9.15.4. Personal Data of Subjects processed using automation tools are processed and stored in compliance with the requirements established by Decree of the Government of the Russian Federation No. 1119 "On approval of requirements for the protection of Personal Data during their processing in Personal Data information systems" dated 01.11.2012. The storage period of Personal Data processed in Personal Data information systems corresponds to the storage period of Personal Data on paper media.

9.15.5. It is not allowed to store and place documents containing Personal Data in open electronic catalogs (file-sharing services) in Personal Data information systems.

9.15.6. Storage of Personal Data must be carried out in a form that allows determining the Subject for no longer than required by the purposes of Personal Data processing, unless the storage period of Personal Data is established by federal law.

10. LIABILITY OF THE OPERATOR

10.1. The management of the Operator is responsible for failure to ensure the confidentiality of Personal Data and non-compliance with the rights and freedoms of Subjects in relation to their Personal Data, including the rights to privacy, personal and family secrecy.

10.2. Employees of the Operator bear personal responsibility for non-compliance with the requirements for the processing and ensuring the security of Personal Data in accordance with the legislation of the Russian Federation.

10.3. An employee of the Operator may be held liable in the following cases:

10.3.1. Intentional or negligent disclosure of Personal Data;

10.3.2. Loss of material media of Personal Data;

10.3.3. Violation of the requirements of this Policy and other regulatory documents of the Operator regarding access to and work with Personal Data.

10.4. In cases of violation of the established procedure for processing and ensuring the security of Personal Data, unauthorized access to Personal Data, disclosure of Personal Data and causing material or other damage to the Operator, its employees, counterparties and other Subjects, the guilty persons bear civil, criminal, administrative, disciplinary and other liability provided for by the legislation of the Russian Federation.

10.5. The Operator informs the Subject that this Policy applies only to Personal Data processed by the Operator. The Operator does not control and is not responsible for the use of third-party websites that the Subject may, at his/her own discretion and at his/her own risk, follow via links posted on the Websites.

10.6. The Operator is not responsible for the accuracy of the Subject's Personal Data.

11. FINAL PROVISIONS

11.1. This Policy comes into force from the moment of approval, is put into effect by order of the Operator and is valid indefinitely (until cancellation or replacement by a new version of the Policy).

11.2. The requirements of this Policy apply to all employees of the Operator who have access to Personal Data, as well as to all Subjects.

11.3. The Operator has the right to unilaterally make changes and (or) additions to this Policy. In the event of changes affecting the rights of Subjects, the Operator has the right, but is not obliged, to send information about these changes to the Subjects at their contact details or notify them of the changes in another way.

12. OPERATOR DETAILS

FAREXPO LLC
Legal address: 196105, St. Petersburg, ul. Blagodatnaya, 47 litera A, premises 13-N
INN: 7841005070
OGRN: 1157847007460
Email: chief@farexpo.ru

Policy of FAREXPO LLCregarding the processing of personal data

1. GENERAL PROVISIONS

2. TERMS AND ABBREVIATIONS

3. CONDITIONS OF PERSONAL DATA PROCESSING

3.12. Procedure for obtaining Personal Data:

4. RIGHTS AND OBLIGATIONS

4.1. Obligations of the Operator:

4.2. The Operator has the right:

4.3. The Subject has the right:

5. PURPOSES OF PERSONAL DATA PROCESSING, CATEGORIES OF SUBJECTS, CATEGORIES OF PROCESSED PERSONAL DATA AND METHODS OF THEIR PROCESSING

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of processed Personal Data:

Categories of personal data permitted by the Subject for dissemination:

6. DATA OF ANALYTICS PROGRAMS AND TECHNICAL DATA

7. TRANSFER OF PERSONAL DATA

8. UPDATING, CORRECTION, DELETION, DESTRUCTION OF PERSONAL DATA, RESPONSES TO SUBJECT REQUESTS FOR ACCESS TO PERSONAL DATA

9. MEASURES TAKEN BY THE OPERATOR TO PROTECT PERSONAL DATA

10. LIABILITY OF THE OPERATOR

11. FINAL PROVISIONS

12. OPERATOR DETAILS

Policy of FAREXPO LLC
regarding the processing of personal data