Extract from the Personal Data Processing Policy of IBS Expertise LLC

1. General Provisions.

1.1. This extract from the Personal Data Processing Policy of IBS Expertise Limited Liability Company (hereinafter referred to as the “Policy extract”) regulates the processing of personal data on the official website of IBS Expertise Limited Liability Company on the Internet at https://ibs.ru/.

1.2. The Policy extract is drawn up in accordance with the provisions of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter referred to as No. 152-FZ), and other regulations of the Russian Federation governing the relations in the field of personal data protection.

1.3. The Policy extract defines the purpose of personal data processing, the categories and list of personal data processed, the categories of personal data subjects, the principles and conditions of personal data processing, as well as the measures to protect personal data aimed at ensuring that IBS Expertise Limited Liability Company as the personal data operator (hereinafter referred to as the Operator) fulfills its obligations under the current legislation exclusively for the purpose of processing personal data on the Operator’s official website.

1.4. The Policy extract applies to any information containing personal data that the Operator processes on the official website at https://ibs.ru/.

1.5. The Policy extract is subject to review during the Operator’s periodic analysis, as well as in cases where the Russian laws in the field of personal data are changed. The Operator has the right to unilaterally make changes to this Policy extract without prior notice to the User, and any changes will take effect as soon as they are published on the official website at https://ibs.ru/.

1.6. The use of the website https://ibs.ru/ shall mean agreement with this Policy extract. In case of disagreement with the terms of this Policy, it is necessary to stop using the website.

1.7. The current full version of the Personal Data Processing Policy of IBS Expertise Limited Liability Company is available to an unlimited number of persons and is located on the Operator’s official website at https://ibs.ru/disclosure/.

2. Main Definitions

2.1. Personal data means any information related to a directly or indirectly identified or identifiable individual (subject of personal data).

2.2. Operator means a legal entity that independently or jointly with other persons organizes and/or performs the processing of personal data, as well as determines the purpose of personal data processing, the composition of personal data to be processed, and actions (operations) performed with personal data.

2.3. Personal data subject means an individual who owns personal data and can be identified thereby.

2.4. Personal data processing means any action (operation) or a set of actions (operations) performed using automation tools or without using such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.

2.5. Automated processing of personal data means processing of personal data using computer equipment.

2.6. Provision of personal data means the actions aimed at disclosing personal data to a specific person or a specific group of people.

2.7. Personal data blocking means temporary suspension of personal data processing (other than processing to clarify personal data).

2.8. Destruction of personal data means actions that make it impossible to restore the content of personal data in the personal data information system and (or) destroy the physical media of personal data.

2.9. Personal data anonymization means actions that make it impossible to identify a specific personal data subject without using additional information.

2.10. Personal Data Information System is a set of personal data contained in databases and the information technologies and technical means that ensure processing thereof.

2.11. Cross-border transfer of personal data means transfer of personal data to a foreign government agency, a foreign individual, or a foreign legal entity in a foreign country.

2.12. User is a personal data subject who visits the website https://ibs.ru/.

2.13. Cookie files mean a small piece of data sent by a web server and stored on the user's computer.

3. Purpose of Processing, Legal Grounds, Processing Timeframes and Personal Data Scope

3.1. The processing of personal data is limited to achieving specific, predefined, and legitimate purposes. No personal data shall be processed that is incompatible with the purpose of collecting personal data.

3.2. The Operator processes the following personal data for the following purposes:

3.2.1. Information about products, services and facilities (name of the organization), including information and marketing communications with all stakeholders.

3.2.2. Management and ensuring the correct operation (functioning) of the Operator’s website on the Internet.

3.3. Information that describes a person’s physiological and biological characteristics, on the basis of which their identity can be established (biometric personal data), and which is used by the Operator to establish the User’s identity, is not processed.

3.4. The Operator does not process special categories of personal data related to the User’s race, nationality, political views, religious and philosophical beliefs, health status, or intimate life.

3.5. Personal data of minors are not processed.

3.6. The Operator does not make decisions that have legal consequences for the User or otherwise affect their rights and legitimate interests based solely on automated processing of personal data.

4. Procedure and Conditions of Personal Data Processing.

4.1. Personal data are processed by the Operator in accordance with the following principles:

• personal data are processed on a legal and fair basis;
• personal data processing is limited to achieving specific, predefined, and legitimate goals;
• personal data processing that is incompatible with the purpose of personal data collection is not performed;
• no integration of databases containing personal data that are processed for incompatible purposes;
• only personal data that meet the purpose of processing are subject to processing;
• the content and scope of the personal data processed comply with the stated processing purposes;
• personal data processed are not excessive in relation to the stated purposes of processing;
• when processing personal data, its accuracy, sufficiency, and, if necessary, relevance to the purposes of personal data processing are ensured. The Operator shall take the necessary measures or ensure that they are taken to delete or clarify incomplete or inaccurate personal data;
• personal data shall be stored in a form that allows the User to be identified, and for no longer than necessary for the purposes of personal data processing, unless a federal law, contract requires otherwise, where the personal data subject is a beneficiary or a surety;
• personal data processed shall be destroyed upon achievement of the processing purposes or upon loss of necessity to achieve these purposes, unless otherwise provided by federal law.

4.2. Personal data are processed using automation tools.

4.3. The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, the expiration of the consent period, or the withdrawal of the User’s consent to the processing of their personal data, as well as the detection of illegal processing of personal data.

4.4. In the course of its activities the Operator ensures the confidentiality of the personal data processed, in particular by not disclosing or disseminating personal data to third parties without the User’s consent, unless otherwise required by the current legislation of the Russian Federation.

4.5. The Operator may transfer personal data to third parties with the User’s prior consent, except in cases specified by the legislation of the Russian Federation. The list of third parties to whom personal data of the personal data subjects are transferred is posted on the official website of the Company at: https://ibs.ru/disclosure/constitutive-documents/.

4.6. The Operator may transfer personal data to the investigative and enforcement authorities, and other authorized bodies, under the grounds provided for by the current legislation of the Russian Federation.

4.7. The Operator does not carry out cross-border transfer of personal data.

4.8. The Operator uses exclusively databases located in the Russian Federation to store personal data.

5. Ensuring the Security of Personal Data.

5.1. When processing personal data, the Operator takes the necessary legal, organizational, and technical measures or ensures that they are taken to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, and disclosure of personal data, as well as from other unauthorized actions in relation to personal data, in accordance with Article 18, Article 18.1, and Article 19 of the Federal Law No. 152-FZ.

5.2. Measures to ensure the security of personal data during its processing in the Operator’s personal data information systems are established in accordance with the Operator’s local regulations governing the security of personal data during its processing in the Operator’s personal data information systems.

6. Rights of the User of Personal Data

6.1. The User has the right to receive information regarding the processing of his/her personal data in the manner, form, and within the time limits established by the legislation of the Russian Federation in the field of personal data, including the right to:

• access his/her personal data;
• clarify his/her personal data;
• block and delete his/her personal data;
• appeal against the Operator’s actions or inaction;
• appeal against decisions made solely based on the automated processing of his/her personal data;
• withdraw the consent to the processing of personal data.

6.2. To exercise the rights to receive information regarding the processing of personal data, the User or his/her legal representative can write a request to the Operator at the following address: 9b Dmitrovskoye Shosse, 5th floor, premise XIII, room 6, Moscow, 127434, specifying the information about the User’s identity document or the identity of the User’s representative (type of document, series and number, issued by whom and when), information confirming the User’s participation in the relationship with the Operator, or information otherwise confirming the fact of personal data processing by the Operator, and the signature of the User or his/her representative. The request can also be sent by email to: ibs@ibs.ru, in this case, the request must be in the form of an electronic document signed in accordance with the provisions of the Russian Federation's legislation on electronic signature.

7. Rights and Obligations of the Personal Data Operator.

7.1. Personal Data Operator has the right to:

• assign the processing of personal data to another person with the User’s consent, unless otherwise provided by federal law;
• process the personal data without the User’s consent in cases specified in clauses 2 to 11 of Part 1 of Article 6, Part 2 of Article 10, and Part 2 of Article 11 of the Federal Law No. 152-FZ;
• refuse the User to make a second request for information related to the processing of their personal data that does not meet the conditions specified in parts 4 and 5 of Article 14 of Federal Law No. 152-FZ;
• determine the composition and the list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Federal Law No. 152-FZ and the regulations adopted in accordance therewith, unless otherwise provided for by other federal laws.

7.2. Personal Data Operator is obliged to:

• provide the User with information regarding his/her personal data processing upon request, in accordance with the procedure, form, and deadlines established by the Federal Law No. 152-FZ;
• organize the processing of personal data in accordance with the Federal Law No. 152-FZ;
• provide the authorized body for the protection of the rights of personal data subjects with the necessary information within 10 business days upon request from that body;
• publish or otherwise provide unlimited access to a document defining its policy on personal data processing, as well as information on the implemented requirements for the protection of personal data;
• take legal, organizational, and technical measures to ensure the protection of personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, and disclosure of personal data, as well as from other illegal actions involving personal data;
• stop the transmission (distribution, transfer or access) of personal data, stop processing, and destroy personal data in accordance with the Federal Law No. 152-FZ.

8. Final Provisions

8.1. The User may obtain any clarifications on the matters of interest regarding the processing of his/her personal data by contacting the Operator via email: ibs@ibs.ru, or by sending an email to the Operator’s postal address: 9b Dmitrovskoye Shosse, 5th floor, premise XIII, room 6, Moscow, 127434.

8.2. The User may withdraw his/her consent to the processing of personal data at any time by sending a notification via email to the Operator’s email address: ibs@ibs.ru, or to the Operator’s postal address: 9b Dmitrovskoye Shosse, 5th floor, premise XIII, room 6, Moscow, 127434, with the note “Withdrawal of consent to the processing of personal data.”