Policy
and Terms

2.1. Principles of Personal Data Processing

The Operator processes personal data based on the following principles:

• Legality and fairness;

• Restriction of personal data processing to achieving specific, pre-defined, and legitimate purposes;

• Prevention of processing personal data incompatible with the purposes of data collection;

• Prevention of merging databases containing personal data processed for purposes incompatible with each other;

• Processing only personal data that meets the purposes of its processing;

• Compliance of the content and volume of processed personal data with the declared processing purposes;

• Prevention of excessive personal data processing in relation to the declared processing purposes;

• Ensuring the accuracy, sufficiency, and relevance of personal data concerning the purposes of its processing;

• Destruction or anonymization of personal data upon achieving the purposes of processing or in case of loss of necessity in achieving these purposes, unless otherwise provided by federal law.

2.2. Conditions for Processing Personal Data

The Operator processes personal data under at least one of the following conditions:

• Processing is carried out with the consent of the personal data subject;

• Processing is necessary to achieve the objectives established by an international treaty of the Russian Federation or by law, to fulfill the functions, powers, and responsibilities imposed by the legislation of the Russian Federation on the Operator;

• Processing is necessary for the administration of justice, execution of a court decision, or other regulatory act subject to execution in accordance with Russian Federation legislation;

• Processing is necessary for the execution of a contract to which the personal data subject is a party, beneficiary, or guarantor, as well as for concluding a contract at the request of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;

• Processing is necessary for the realization of the rights and legitimate interests of the Operator or third parties, or for achieving socially significant goals, provided that this does not infringe upon the rights and freedoms of the personal data subject;

• Processing is carried out for publicly available personal data;

• Processing is carried out for personal data that must be disclosed or published in accordance with federal law.

2.3. Confidentiality of Personal Data

The Operator and other persons who have obtained access to personal data must not disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law.

2.4. Publicly Available Sources of Personal Data

For informational purposes, the Operator may create publicly available sources of personal data, including directories and address books. With the written consent of the personal data subject, the following information may be included in such sources: full name, date and place of birth, position, contact phone numbers, email address, and other personal data provided by the subject. At any time, the personal data subject may request the removal of their information from publicly available sources.

2.5. Special Categories of Personal Data

Processing special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, or personal life is allowed only in the following cases:

• The personal data subject has given written consent;

• The personal data has been made publicly available by the subject;

• Processing is carried out in accordance with laws related to state social assistance, labor legislation, pension legislation, or other state benefits;

• Processing is necessary to protect the life, health, or other vital interests of the personal data subject or other persons when obtaining consent is impossible;

• Processing is conducted for medical and preventive purposes, for establishing a medical diagnosis, or for providing medical or social services, provided that such processing is carried out by medical professionals required to maintain confidentiality by law;

• Processing is necessary for the establishment or exercise of the legal rights of the personal data subject or third parties, or in connection with judicial proceedings;

• Processing is conducted in accordance with insurance legislation.

2.6. Biometric Personal Data

Information that characterizes physiological and biological features of a person and enables their identification—biometric personal data—may be processed only with the written consent of the personal data subject.

2.7. Delegation of Personal Data Processing to a Third Party

The Operator has the right to delegate personal data processing to a third party with the consent of the personal data subject, unless otherwise provided by federal law, under a contract with the third party. The third party must comply with the principles and rules of personal data processing established by FZ-152 and this Policy.