Personal Data Processing Policy

1. General provisions

1.1. This document defines the policy of LLC "SMART TECHNO SERVICE" (hereinafter referred to as the Company) regarding the processing of personal data and sets out the system of basic principles applied in relation to the processing of personal data in the Company

1.2. This Policy applies to all operations carried out in the Company with personal data, whether using automated means or not

1.3. This Policy is mandatory for review and compliance by all persons authorized to process personal data in the Company, as well as individuals involved in organizing the processes of processing and ensuring the security of personal data in the Company

1.4. This Policy is drafted in accordance with Council of Europe Convention No. 108 on the protection of individuals with regard to automatic processing of personal data and Federal Law of the Russian Federation "On Personal Data" №152-FZ dated July 27, 2006

1.5. This Policy is subject to updating in case of changes in Russian legislation on personal data

2. Introduction

2.1. The Company is the operator of personal data

2.2. Ensuring the protection of the rights and freedoms of the personal data subject in the processing of their personal data is an important condition for achieving the goals of the Company's activities

2.3. The Company has developed and implemented documents governing the procedures for processing and ensuring the security of personal data, which ensure compliance with the requirements of the Federal Law of the Russian Federation "On Personal Data" №152-FZ dated July 27, 2006, and regulatory legal acts adopted in accordance with it

3. Principles and conditions for processing personal data in the Company

3.1. The Company, acting as the operator, processes the following personal data:

• applicants for vacant positions - in the composition and within the time frames necessary for the Company to make a decision on acceptance or rejection of employment, with the consent of the data subjects, as well as for the formation of a personnel reserve with the consent of the data subjects

• employees who are or have been in employment relationships with the Company - in the composition and within the time frames necessary to achieve the goals provided by Russian Federation, to carry out and fulfill the functions, powers, and duties imposed on the Company by Russian Federation, for the formation of a personnel reserve with the consent of the data subjects, as well as for the conclusion and execution of a contract, where the data subject is a party to or a beneficiary or guarantor of the contract, including for the purpose of providing insurance with the consent of the data subjects

• relatives of Company employees - in the composition and within the time frames necessary to carry out and fulfill the functions, powers, and duties imposed on the Company by Russian Federation, to exercise the rights and legitimate interests of the Company, as well as for the conclusion and execution of a contract, where the data subject is a party to or a beneficiary or guarantor of the contract, including for the purpose of providing insurance with the consent of the data subjects

• foreign employees of the Company (hereinafter referred to as "Expatriates") - in the composition and within the time frames necessary to achieve the goals provided by Russian Federation, to carry out and fulfill the functions, powers, and duties imposed on the Company by Russian Federation, to assist Expatriates in obtaining invitations, visas, and in registering with immigration authorities, obtaining work permits, patents, for forming a personnel reserve with the consent of the data subjects, as well as for the conclusion and execution of a contract, where the data subject is a party to or a beneficiary or guarantor of the contract, including for the purpose of providing insurance with the consent of the data subjects

• relatives of Expatriates of the Company - in the composition and within the time frames necessary to achieve the goals provided by Russian Federation, to carry out and fulfill the functions, powers, and duties imposed on the Company by Russian Federation, to assist in obtaining invitations, visas and registering with immigration authorities, to exercise the rights and legitimate interests of the Company, as well as for the conclusion and execution of a contract, where the data subject is a party to or a beneficiary or guarantor of the contract, including for providing insurance with the consent of the data subjects

• representatives of Company suppliers - in the composition and within the time frames necessary to interact with suppliers with the consent of the data subjects

• individuals related to accidents - in the Composition and within the time frames necessary to achieve the goals provided by Russian Federation, to carry out and fulfill the functions, powers, and duties imposed on the Company by Russian Federation

• individuals receiving income but not in an employment relationship with the Company, within the scope and time frames necessary to achieve the purposes provided for by the legislation of the Russian Federation, for the implementation and fulfillment of functions, powers, and responsibilities assigned to the Company by the legislation of the Russian Federation

• representatives of potential and existing clients, within the scope and time frames necessary to interact with potential and existing clients, with the consent of the data subjects

• representatives of partners, within the scope and time frames necessary to interact with partners, with the consent of the data subjects

• representatives of organizations providing fitness services, processed within the framework of reimbursing employees for purchasing fitness memberships, within the scope and timeframe necessary to achieve the purposes provided for by law, for the implementation and fulfillment of functions, powers, and responsibilities assigned to the Company by the legislation of the Russian Federation.

3.2. The processing period for personal data is determined taking into account:

• the established purposes of processing personal data

• the duration of contracts with data subjects and consents of data subjects for processing their personal data

• the deadlines specified in Order № 558 of the Ministry of Culture of the Russian Federation dated August 25, 2010, "On approval of the List of typical management archival documents formed in the course of activities of state bodies, local self-government bodies, and organizations, indicating storage periods"

3.3. The company processes personal data on a lawful and fair basis

3.4. When processing personal data, their accuracy, sufficiency, and, when necessary, relevance to the purposes of personal data processing are ensured

3.5. The company does not disclose personal data to third parties or distribute personal data without the consent of the data subject (unless otherwise provided by the Federal Law of the Russian Federation)

3.6. The company processes special categories of personal data of individuals related to accidents, employees, and expatriates (health data within the scope of labor relations). In doing so, the company complies with the requirements for processing special categories of personal data as provided by Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006, and the Labor Code of the Russian Federation

3.7. The company does not process biometric personal data

3.8. The company carries out cross-border transfer of personal data. In doing so, the company complies with the requirements for cross-border transfer of personal data as provided by Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006

3.9. The company does not make decisions that have legal consequences for the data subject or otherwise significantly affect their rights and legitimate interests based solely on automated processing of personal data

3.10. The company entrusts the processing of personal data to another person. In doing so, the company complies with the requirements for entrusting the processing of personal data as provided by Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006

3.11. The company processes personal data using automation means and without their use. In doing so, the company complies with the requirements for automated and non-automated processing of personal data as provided by Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006, and regulatory legal acts adopted in accordance with it

4. Rights of personal data subjects processed in the Company

A personal data subject has the right to receive information regarding the processing of their personal data. To obtain this information, a personal data subject can send a written request (the request can also be sent in the form of an electronic document and signed with an electronic signature) to the address: 191040, Ligovsky Prospekt, Building 12, Room 107, in accordance with the procedure established by Article 14 of the Federal Law of the Russian Federation "On Personal Data" №152-FZ dated July 27, 2006

5. By clicking the "Submit" button, I confirm that the data entered by me (surname, first name, patronymic, email address, phone number) is correct

I confirm that all data is provided voluntarily

I give my full and unconditional consent to use my data to maintain communication with me by any means, including phone calls to the specified landline and/or mobile phone, sending SMS messages to the specified mobile phone, sending emails to the specified email address for the purpose of informing about new products/services, notifying about ongoing promotions, events, discounts, their results, conducting remote surveys to study opinions about products/services, trade organizations, sending news, etc

6. Performance of operator duties by the Company

6.1. The Company receives personal data from personal data subjects and third parties (individuals who are not personal data subjects). In this case, the Company fulfills the obligations provided for by the Federal Law of the Russian Federation "On Personal Data" №152-FZ dated July 27, 2006 and the Labor Code of the Russian Federation when collecting personal data

6.2. The Company shall cease the processing of personal data in the following cases:

• upon the occurrence of conditions for the cessation of personal data processing or upon the expiry of established terms

• upon achieving the purposes of their processing or in case of losing the necessity to achieve these purposes

• at the demand of the personal data subject, if the personal data processed by the Company are incomplete, outdated, inaccurate, unlawfully obtained, or are not necessary for the declared purpose of processing

• in the event of detecting unlawful processing of personal data, if it is impossible to ensure the lawfulness of the personal data processing

• in case of the withdrawal by the personal data subject of consent to process his or her personal data or upon the expiry of such consent (if the personal data are processed by the Company exclusively on the basis of the subject's consent)

• in the event of the Company's liquidation

6.3. The Company has implemented the following measures to ensure compliance with the obligations set forth by the Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006, and the regulatory legal acts adopted in accordance with it:

• an individual has been appointed responsible for organizing the processing of personal data

• Internal regulations have been issued concerning the processing and security of personal data, as well as regulations establishing procedures aimed at preventing and detecting violations of Russian Federation legislation, and eliminating the consequences of such violations:

1. regulations on the processing of personal data
2. this Policy
3. other internal regulations on the processing and security of personal data

• legal, organizational, and technical measures have been applied to ensure the security of personal data

• internal control over the compliance of personal data processing with the requirements of the Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006, and the regulatory legal acts adopted in accordance with it, this Policy, and the Company's internal regulations is carried out

• An assessment of the harm that could be caused to personal data subjects in the event of a violation of federal personal data legislation has been conducted, and a correlation has been made between the indicated harm and the measures taken by the Company to ensure compliance with the obligations set forth by the requirements of the Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006, and the regulatory legal acts adopted in accordance with it

• Employees of the Company who directly process personal data have been acquainted with the provisions of the Federal Law of the Russian Federation "On Personal Data" №152-FZ of July 27, 2006, and the regulatory legal acts adopted in accordance with it, this Policy, and the Company's internal regulations on the processing of personal data

6.4. The Company implements the following requirements for the protection of personal data:

• a security regime is organized for premises where information systems are located, preventing the possibility of uncontrolled penetration or presence in these premises by persons without access rights

• measures have been implemented to ensure the preservation of personal data carriers

• the head of the Company has approved a document defining the list of persons whose access to personal data processed in the information system is necessary for the performance of their official (employment) duties

• information protection tools that have passed the conformity assessment procedure to the requirements of the Russian Federation legislation in the field of information security are used

• The requirements set by the Decree of the Government of the Russian Federation of September 15, 2008, №687 "On the Approval of the Regulation on the Specifics of Processing Personal Data Carried Out Without the Use of Automation Means" have been implemented