Privacy Policy LSR Group

27.09.2023

1. Definitions and abbreviations used in the Policy

1.1. The headings to the sections and subsections of the Policy (hereinafter the Policy) are used solely for convenience and references to them and will not be used to interpret any paragraph of this document.

1.2. The following terms and definitions used in the Policy have the following meaning:

• PD blocking means temporary termination of processing of PD (except for cases when processing is necessary to clarify the PD);
• LSR GROUP means a group of companies comprising LSR Group PJSC (parent company) (TIN 7838360491, PSRN 5067847227300) and all its subsidiaries (companies) included in the International Financial Reporting Standards (IFRS) reporting consolidation circuit of LSR Group PJSC;
• Law No. 152-FZ means Federal Law No. 152-FZ On Personal Data dated July 27, 2006;
• legislation of the Russian Federation means laws, other normative legal acts, normative acts, legal acts in force on the territory of the Russian Federation, including acts of authorized state bodies, international treaties in force in the Russian Federation;
• PD policy information system means PD information system; a set of PD contained in databases and information technologies and technical means that ensure their processing;
• depersonalization of PD means actions as a result of which it becomes impossible to determine the affiliation of PD to a specific PD subject without using additional information;
• PD processing means any action (operation) or set of actions (operations) performed using automation tools or without using such tools with PD, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of PD;
• Operator means LSR Group PJSC, independently or jointly with other persons organizing and / or carrying out PD processing, as well as determining the purposes of PD processing, the composition of PD to be processed, actions (operations) performed with PD;
• PD means Personal Data, any information related directly or indirectly to a specific or identifiable individual (PD subject);
• provision of PD means actions aimed at disclosing PD to a certain person or a certain circle of people;
• employee means a subject of labor law, an individual who is in an employment relationship with an Operator;
• dissemination of PD means actions aimed at disclosing PD to an indefinite circle of people;
• automation aids means a set of software, hardware and software-hardware tools capable of functioning independently or as part of other systems;
• cross-border transfer of PD means transfer of PD to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity;
• destruction of PD means actions as a result of which it becomes impossible to restore the content of PD in the IP of PD and / or as a result of which the material carriers of PD are destroyed.

2. General Provisions

2.1. The Policy is mandatory for the application and execution of a local regulatory act, a fundamental document containing the general goals, principles and norms of the Operator in the processing of PD.

2.2. The Policy was developed in accordance with Article 18.1 of Law No. 152-FZ in order to implement the requirements of the legislation of the Russian Federation in the field of PD processing and protection and is aimed at ensuring the protection of human and civil rights and freedoms when processing the PD by the Operator, including the protection of the rights to privacy, personal and family secrets.

2.3. The relations related to the processing and protection of PD provided by the PD subject are regulated by the Policy, local regulations of the Operator and the legislation of the Russian Federation.

2.4. The legal grounds for processing PD are the following:

• federal laws and regulatory legal acts adopted on their basis regulating relations related to the activities of the Operator and enterprises of the LSR Group;
• federal laws and regulatory legal acts adopted on their basis regulating relations related to the activities of the Operator and enterprises of the LSR Group;
• consent of the PD subject to PD processing.

2.5. The Policy applies to relations related to the processing of PD received by the Operator both before and after its approval, except in cases where, for legal, organizational and other reasons, the provisions of the Policy cannot be extended to relations for the processing and protection of PD received before its approval.

3. Purposes of PD processing, categories of PD subjects, list and categories of PD being processed

3.1. PD is processed by the Operator for purposes that do not contradict the legislation of the Russian Federation and in their legitimate interests, if such processing does not violate the rights of PD subjects.

3.2. PD processing that is redundant in relation to the stated purpose of its processing is not allowed.

3.3. Purposes of PD processing:

• conclusion of transactions and fulfillment of obligations arising from contractual and other civil law relations;
• providing the PD subject with information about LSR Group products, special offers, availability of goods, providing other information and consultations, as well as carrying out newsletters, sending advertising messages, including for the subsequent conclusion of any transactions permitted by the legislation of the Russian Federation;
• conducting events with the participation of PD subjects (excursions, screenings, etc.);
• conducting promotions, surveys, marketing and other research;
• preparation and transmission of responses to requests from PD subjects;
• provision of access and on-site modes at the Operator's facilities;
• formation of reference materials for internal information support of the Operator and subsidiaries of the LSR Group;
• fulfillment of the rights and obligations of the employer provided for by the legislation of the Russian Federation, including the recruitment and selection of candidates for work;
• participation in legal proceedings and execution of judicial acts, acts of other bodies or officials subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;
• the exercise and execution of functions, powers and duties assigned to the Operator by the legislation of the Russian Federation, as well as to achieve other goals provided for by the legislation of the Russian Federation.

3.4. Operator processes the PD of the following PD subjects:

• individuals who are customers, visitors to the Operator's website on the Internet (hereinafter referred to as the Operator's website), users of the Operator's mobile application, contractors and potential customers and contractors of the Operator;
• individuals who are representatives or participants of contractors and potential contractors of the Operator;
• employees, former employees, candidates for vacant positions of the Operator and enterprises of the LSR Group (hereinafter referred to as the Applicants) and their relatives;
• individuals who are Operator participants, representatives of Operator participants (legal entities);
• other persons in cases provided for by the legislation of the Russian Federation or local regulations of the Operator.

3.5. The PD of visitors of the Operator's website, users of the Operator's mobile application, customers, employees and applicants of the Operator, their relatives includes information provided by the subjects of PD, including during the registration of a personal account on the Operator's website or in the Operator's mobile application.

3.6. Operator processes the following PD received from visitors of the Operator's website or users of the Operator's mobile application:

• surname, name, patronymic name;
• e-mail address;
• phone numbers;
• year, month, date and place of birth;
• IP address;
• other data provided to the Operator by the PD subject when he visits the Operator's website or when using the Operator's mobile application.

3.7. The following information applies to the PD of the Operator's users and potential users:

• surname, name, patronymic name;
• gender;
• date and place of birth;
• citizenship and passport data;
• Insurance individual account number (SNILS);
• TIN;
• marital status;
• family members;
• address of the place of residence, home / mobile phone;
• e-mail address;
• other information transmitted by the PD subject to the Operator.

3.8. The PD of individuals who are representatives or participants of contractors and potential contractors of the Operator includes the following information:

• surname, name, patronymic name;
• citizenship and passport data;
• other information transmitted by the PD subject to the Operator.

3.9. Processing PD of employees and the Applicants:

3.9.1. The PD of employees and applicants includes documented information obtained from the official documents of the Applicants, presented to them for the purpose of employment and when applying for a job, as well as from documents received from the employee in the course of his employment.

3.9.2. When concluding an employment contract, a person applying for employment with the Operator shall present documents in accordance with Article 65 of the Labour Code of the Russian Federation and consent to the processing of his/her PD.

3.9.3. The following information shall be included in the employee's or applicant's PD:

• surname, name, patronymic name;
• gender;
• date and place of birth;
• citizenship and passport data;
• Insurance individual account number (SNILS);
• TIN;
• knowledge of a foreign language;
• education, specialty;
• work experience;
• previous jobs;
• marital status;
• family members;
• address of the place of residence, home / mobile phone;
• information about military registration;
• other information provided by the employee or the Applicant to the Operator.

3.10. The list of processed PD of the Operator's participants is determined by the legislation of the Russian Federation.

3.11. Special categories of PD, as well as biometric PD of PD subjects, are processed by the Operator in accordance with the procedure established by the legislation of the Russian Federation.

4. Conditions for processing PD and its transfer to third parties

4.1. The PD of the PD subject is processed within the period necessary for the purposes specified in the Policy in any legal way, including in the IP of the PD, using automation aids or without the use of such aids.

4.2. In cases provided for by Law No. 152-FZ, it is allowed for the Operator to distribute PD (disclosure of PD to any number of unspecified persons).

4.3. The content and volume of processed PD are determined by the purposes of their processing, given in section 3 of the Policy, and are indicated in the consent of the PD subject to the processing of its PD, except in cases where PD processing can be carried out without obtaining such consent.

4.4. By submitting their PD to the Operator, the PD subjects confirm familiarization with the Policy and agrees that the Operator has the right to process PD, namely: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction of PD, including the right to transfer these PD to third parties, in particular, subsidiaries of the LSR Group, contractors servicing the Operator's website or mobile application of the Operator, credit organizations, other legal entities and individuals, providing marketing and other services to the Operator, including for the purpose of conducting excursions and other events.

4.5. PD may be transferred by the Operator to authorized state authorities only on the grounds and in accordance with the procedure established by the legislation of the Russian Federation.

4.5.1. The Operator has the right to transfer PD to third parties in the following cases:

• the PD subject has expressed his consent to such actions;
• the transfer is provided for within the framework of the procedure established by the legislation of the Russian Federation.

4.6. By completing and submitting to the Operator the form (feedback / questionnaire, when creating a personal account; hereinafter referred to as the form), in which the PD are entered on the Operator's website or in the Operator's mobile application, the data subject confirms that he/she:

• indicates reliable information about himself/herself, all other information is provided by the PD subject at his/her own discretion;
• is familiarized with the Policy and agrees that the Operator has the right to process PD, including transferring such PD to third parties, in particular, to the persons specified in clause 4.4 of the Policy;
• in accordance with the procedure stipulated in part 1 of Art. 1, Article 18, Part 1 of Federal Law No. 38-FZ On Advertising dated March 13, 2006, expresses its consent to receive messages, including sms notifications, of an advertising nature via telecommunication networks, including through the use of telephone, facsimile, mobile radio telephony;
• recognizes the legal validity of e-mails / documents sent by e-mail, including by the Operator;
• solely possesses the right and possibility to access the e-mail account and/or mobile radio telephony device with the address and/or number specified in the form. This access is performed by the PD subject using a password, which is confidential.

4.6.1. The Operator does not verify the reliability of the received (collected) information about the PD subject, except for cases when such verification is necessary for the purpose of fulfillment of obligations to the PD subject.

4.7. When processing PD, the Operator shall be guided by the legislation of the Russian Federation, the Policy and local regulatory acts of the Operator.

4.8. When processing PD, the Operator uses databases located on the territory of the Russian Federation.

4.9. The Operator does not carry out cross-border transfer of PD.

5. Feedback

5.1. Operator's contact details for contacting PD subjects on issues related to Personal Data:

• e-mail address: pd@lsrgroup.ru;
• 36 Kazanskaya Street, letter B, floor 4, room 32-N (18), room 404, Saint Petersburg, the Russian Federation, 190031
• contact phone number: 8 (800) 770 7577.

5.2. By contacting the contact details specified in clause 5.1 of the Policy, the subject of the PD processed by the Operator may receive information related to the processing of his/her PD, including information containing:

• confirmation of the fact of processing of PD by the Operator;
• legal grounds and purposes of processing of PD;
• the methods of processing of PD used by the Operator;
• name and location of the Operator, information about persons (except employees) who have access to PD or to whom PD may be disclosed on the basis of a contract with the Operator or on the basis of federal law;
• processed PD related to the respective data subject, the source of their receipt, unless another procedure for the submission of such data is stipulated by the federal law;
• the terms for processing PD, including the terms for their storage;
• the procedure for exercising the data subject's rights under Law No. 152-FZ;
• information on the transfer of PD across borders or on the proposed transfer of PD across borders;
• the name or surname, name, patronymic name and address of the person processing the PD on behalf of the Operator, if the processing has been or will be entrusted to such a person;
• information on the ways in which the Operator fulfills its obligations under Article 18.1 of Law No. 152-FZ;
• other information provided for by Law No. 152-FZ or other federal laws.

5.3. The Data Subject has the right to receive information regarding the processing of his/her PD, unless this right is restricted in accordance with federal laws. The data subject has the right to demand that the Operator clarify his/her PD, block or destroy it if it is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect his/her rights.

5.3.1. The Operator assumes that the PD subject agrees that, upon his written request, notification of the destruction of PD will be sent/delivered to his e-mail addresses or place of residence specified in the consent to PD processing, or to his representative personally or at the address of the place of residence.

5.3.2. The PD subject's request for information, withdrawal of consent to PD processing, a request to stop processing or transferring PD, or an appeal for the destruction of PD (hereinafter referred to as the Request) contains:

• surname, name, patronymic name (if any) of the PD subject and its representative;
• the number of the main identity document of the PD subject or its representative, information on the date of issue of the specified document and the issuing authority;
• information confirming the participation of the PD subject in relations with the Operator (contract number, date of conclusion of the contract, conditional verbal designation and / or other information), or information otherwise confirming the fact of PD processing by the Operator;
• signature of the PD subject or his representative.

5.3.3. The request to terminate the transfer of PD also contains contact information (phone number, e-mail address or postal address) of the PD subject, as well as a list of PD whose processing is subject to termination.

5.3.3.1. Requests may be sent in the form of a corresponding notification by e-mail from the e-mail address provided by the PD subject to the Operator's e-mail address (mail@lsrgroup.ru ) or in the form of a written document by sending to the Operator by registered mail with a notification of delivery with an inventory of the attachment to the address: 36 Kazanskaya Street, letter B, floor 4, room 32-N (18), room 404, Saint Petersburg, the Russian Federation, 190031.

5.4. The Information is provided by the Operator to the PD subject or his representative within 10 (ten) business days from the date of the Request or receipt by the Operator of the Request. The specified period may be extended, but not more than 5 (five) business days if the Operator sends a reasoned notification to the PD subject indicating the reasons for extending the period for providing the requested information.

5.5. If the information concerning the PD processing of the PD subject, as well as the PD being processed, were provided to the PD subject for review upon his request, the PD subject has the right to contact the Operator again or send a repeated request for PD receipt no earlier than 30 (thirty) days after the initial request or sending the initial request.

5.6. If the PD subject withdraws consent to PD processing, the Operator has the right to continue PD processing without the PD subject's consent if there are grounds provided for by the legislation of the Russian Federation.

6. Safety of PD processing

6.1. The main task of ensuring the safety of PD during their processing by the Operator is to prevent unauthorized access to them by third parties, to prevent deliberate software, technical and other influences in order to steal PD, destroy or distort them during processing.

6.2. The Operator takes necessary and sufficient technical and organizational measures to ensure information security and protect PD from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, as well as from other illegal actions with them by third parties.

6.3. The Operator does not process PD that is incompatible with the purposes of their collection. Unless otherwise provided by federal law, upon completion of PD processing by the Operator, including upon achievement of the goals of their processing or loss of the need to achieve these goals, the PD processed by the Operator will be destroyed or depersonalized.

6.4. When processing PD, their accuracy, sufficiency, and, if necessary, relevance in relation to the purposes of processing are ensured. The Operator takes the necessary measures to remove or clarify incomplete or inaccurate PD.

7. Miscellaneous

7.1. The Operator has the right to make changes to the Policy. The changes take effect from the moment specified in the new version of the Policy.

7.2. The Policy is a publicly available document and is subject to placement in places accessible to PD subjects.