Personal Data Processing Policy

This Personal Data Processing Policy (hereinafter — the Policy) has been developed in accordance with Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data" and other regulatory legal acts of the Russian Federation in the field of personal data protection.

This Policy defines the procedure for processing personal data and measures to ensure the security of personal data taken by Individual Entrepreneur Dushina Evgenia Alexandrovna (hereinafter — the Operator) when using the website burokontrast.com (hereinafter — the Website) and when performing work / providing services.

The purpose of this Policy is to ensure proper protection of information about individuals, including personal data, against unauthorized access, destruction, modification, blocking, copying, distribution, and other unlawful actions.

Using the Website means unconditional acceptance of this Policy by the User. In case of disagreement with the terms of the Policy, the User must refrain from using the Website.

The Operator processes personal data in accordance with:

• The Constitution of the Russian Federation;
• Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data";
• Federal Law No. 149-FZ dated July 27, 2006, "On Information, Information Technologies, and Information Protection";
• Decree of the President of the Russian Federation No. 188 dated March 1, 1997, "On Approval of the List of Confidential Information";
• Resolution of the Government of the Russian Federation No. 1119 dated November 1, 2012, "On Approval of Requirements for the Protection of Personal Data During Their Processing in Personal Data Information Systems";
• Order of the FSTEC of Russia No. 21 dated February 18, 2013, "On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data During Their Processing in Personal Data Information Systems";
• Other regulatory legal acts and subordinate legislation.

Operator: LLC Design Bureau "Kontrast"

Tax ID (INN): 5503098175

PSRN (OGRNIP): 1065503045046

Registered address: 644086, Omsk Region, Omsk, 33-ya Severnaya St., bldg. 122, office 213

Physical address: Russia, Moscow, Letnikovskaya St., 13A

E-mail: dbkontrast@gmail.com

Website: burokontrast.com

Users' personal data is processed by the Operator for the following purposes:

• Identification of a party within agreements concluded with the Operator;
• Communication with the User, including sending notifications, requests, and information related to the use of the Website, provision of services, as well as processing User requests and inquiries;
• Providing the User with information about the Operator's products, works, and services;
• Fulfillment of the Operator's obligations to the User within the scope of service provision;
• Ensuring compliance with laws and other regulatory legal acts;
• Carrying out activities provided for by the Operator's founding documents;
• Reviewing requests and inquiries from personal data subjects;
• Conducting statistical and other research based on anonymized data.

Personal data refers to any information relating directly or indirectly to an identified or identifiable individual (personal data subject).

Users' personal data is processed in the following categories of subjects:

• Clients (individuals who have entered into a service agreement);
• Potential clients (individuals who have expressed interest in services);
• Website users (individuals visiting burokontrast.com);
• Contact persons of clients;
• Representatives of legal entities — clients of the Operator.

The Operator processes the following categories of personal data:

6.1. Data provided by the User when filling out forms on the Website:

• Full name (surname, first name, patronymic);
• Email address;
• Phone number;
• Organization name / Tax ID (if applicable);
• Other data voluntarily provided by the User.

6.2. Data automatically collected when visiting the Website:

• IP address;
• Browser type and version;
• Operating system;
• Date and time of Website access;
• Requested page URL;
• Referrer (address of the previous page);
• Cookies (if User consent is provided).

The Operator processes personal data when one or more lawful grounds exist:

• Consent of the personal data subject — the User gives consent to the processing of their personal data when filling out forms on the Website, sending emails, or by other means;
• Performance of a contract — processing is necessary for the performance of a contract to which the personal data subject is a party;
• Fulfillment of the Operator's obligations — processing is necessary for the performance of functions imposed on the Operator by applicable legislation;
• Legitimate interests of the Operator — processing is necessary for the realization of the Operator's legitimate interests, provided that the rights and freedoms of the personal data subject are not violated.

Processing of Users' personal data is carried out using the following methods:

• Automated processing of personal data (using computer technology);
• Non-automated processing of personal data (manual operations with data).

When processing personal data, the Operator does not distribute personal data to third parties, except as provided by the legislation of the Russian Federation.

9.1. Collection

Personal data is collected only from personal data subjects. Data is obtained:

• Directly from the personal data subject (when filling out forms, subscribing to newsletters, or entering into contracts);
• Automatically when visiting the Website (IP address, cookies, browser data).

9.2. Storage

Personal data of subjects is stored on servers located within the territory of the Russian Federation. Storage is carried out in compliance with the following requirements:

• The retention period for personal data is determined in accordance with the purposes of processing, the requirements of regulatory acts, and the terms of concluded contracts;
• Personal data whose processing has been terminated shall be destroyed upon the occurrence of the following conditions: achievement of processing purposes, expiration of the retention period, recognition of data as incomplete or inaccurate, as well as withdrawal of consent;
• Upon termination of the Operator's activities, personal data of subjects shall be destroyed or transferred to another operator by decision of an authorized body.

9.3. Transfer

Transfer of personal data is carried out only in the following cases:

• Upon request of a court, inquiry, or investigative body in the manner established by law;
• When necessary for the fulfillment of contractual obligations to third parties (e.g., counterparties, hosting service providers);
• On the basis of the personal data subject's voluntary consent.

When transferring personal data, the Operator requires the recipient to comply with the principles and rules of personal data processing established by Federal Law No. 152-FZ.

9.4. Deletion

Personal data of subjects shall be deleted (destroyed) in the following cases:

• Upon achievement of the purposes of personal data processing;
• Upon written request of the personal data subject;
• Upon expiration of the retention period;
• In case processing is recognized as unlawful.

Anonymization of personal data refers to actions as a result of which it becomes impossible to determine the ownership of personal data to a specific personal data subject without the use of additional information.

Anonymization is applied for:

• Obtaining statistical and analytical data (e.g., Website visit statistics);
• Enabling data aggregation without personal identification;
• Performing other tasks that do not require the identification of a specific subject.

Anonymization methods include: encryption, hashing, identifier replacement, aggregation, and removal of identifying features.

In accordance with Federal Law No. 152-FZ "On Personal Data," a personal data subject has the right to:

• Information — receive confirmation of personal data processing, as well as information about the purposes, methods, and legal grounds of such processing;
• Access — receive access to their personal data and information about its processing;
• Rectification — demand rectification of their personal data, its blocking, or deletion if the data is incomplete, inaccurate, obtained unlawfully, or is not necessary for the stated purpose of processing;
• Withdrawal of consent — withdraw consent to the processing of personal data;
• Appeal — appeal the actions or inaction of the Operator to an authorized body for the protection of personal data subjects' rights or in court;
• Protection of rights and legitimate interests — demand compensation for damages and/or compensation for moral injury in case of unlawful use of personal data;
• Restriction of processing — demand restriction of processing in case of violation of legislation.

To exercise these rights, the personal data subject shall send a request to the Operator at the email address: dbkontrast@gmail.com or by postal mail to the Operator's address.

The request must contain: the number of the main identity document; information about the date of issue and the issuing authority; email address; contact phone number; and the personal data subject's signature.

The request shall be reviewed within no more than 30 (thirty) business days from the date of receipt.

The Operator undertakes to:

• Process personal data strictly in accordance with the current legislation of the Russian Federation;
• Process personal data only with the consent of the personal data subject, except as provided by law;
• Provide the personal data subject with information about the processing of their personal data upon request;
• Implement legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions;
• Block or delete personal data upon request of the subject, an authorized body, or in other cases provided by law;
• Maintain a log of personal data subject requests and a log of personal data processing operations;
• Upon discovery of a personal data breach, immediately take measures to eliminate the consequences and notify the authorized body;
• Verify the accuracy of personal data received from the subject;
• Ensure the storage of personal data under conditions that exclude unauthorized access.

In the event of failure to comply with the requirements of this Policy and/or the legislation of the Russian Federation in the field of personal data protection, the Operator shall bear liability in the manner prescribed by:

• Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data";
• Code of Administrative Offenses of the Russian Federation (Article 13.11);
• Criminal Code of the Russian Federation (Article 137);
• Civil Code of the Russian Federation.

Users are responsible for the accuracy of the personal data they provide and bear responsibility for the consequences arising from the provision of inaccurate data.

The Operator reserves the right to make changes to this Policy. The new version of the Policy shall take effect from the moment of its publication on the Website burokontrast.com, unless otherwise provided by the new version of the Policy.

The current version of the Policy is always available at: burokontrast.com/en/privacy.

For any questions regarding this Policy, you may contact the Operator using the contact details provided in Section 3 of this Policy.

Unless otherwise provided by legislation, the law of the Russian Federation shall apply to the relationship between the Operator and the User.