1.1. Purpose of This Policy

This document (the Policy) establishes the purposes and general principles of personal data processing and the personal data protection measures implemented by MOYA GAVAN LIMITED LIABILITY COMPANY (the Company).

The Company is a personal data operator. This Policy is a publicly available Company document that anyone may review.

1.2. Key Rights of the Company

Personal data is processed lawfully and fairly, in compliance with the principles and rules established by Federal Law No. 152-FZ of July 27, 2006, On Personal Data (Federal Law No. 152-FZ), based on consent from the data subject, except in cases provided by Federal Law No. 152-FZ.

The Company reserves the right to verify the completeness, accuracy, and adequacy of the personal data provided and, where necessary, whether it is current in relation to the processing purposes. If incorrect or incomplete personal data is identified, the Company may terminate all relations with the data subject.

If consent to personal data processing is obtained from a representative of the data subject, the Company verifies the authority of that representative to consent on behalf of the data subject.

The Company may obtain personal data from someone other than the data subject, provided the Company supplies confirmation of grounds specified in clauses 2–11 of part 1 of Article 6, part 2 of Article 10, and part 2 of Article 11 of Federal Law No. 152-FZ.

If the data subject withdraws consent to personal data processing, the Company may continue processing without consent where grounds specified in clauses 2–11 of part 1 of Article 6, part 2 of Article 10, and part 2 of Article 11 of Federal Law No. 152-FZ apply.

With consent from the data subject, unless otherwise provided by federal law, the Company may entrust personal data processing to third parties under an agreement or contract or by adopting an appropriate instrument (a Company instruction). A person processing personal data under a Company instruction must comply with the principles and rules of Federal Law No. 152-FZ. The instruction must specify the personal data, the actions or operations to be performed, and the processing purposes. It must require the processor to maintain confidentiality, comply with part 5 of Article 18 and Article 18.1 of Federal Law No. 152-FZ, and, at Company request throughout the instruction period, including before processing begins, provide documents and other information confirming measures taken and compliance with requirements established under Federal Law No. 152-FZ to carry out the instruction. It must require secure processing and specify data protection requirements under Article 19 of Federal Law No. 152-FZ, including notification of the Company in the cases provided by part 3.1 of Article 21 of that law.

A person processing personal data under a Company instruction is not required to obtain consent from the data subject.

When the Company entrusts personal data processing to a third party, the Company remains liable to the data subject for the actions of that party. The processor acting under a Company instruction is liable to the Company.

If the Company entrusts personal data processing to a foreign individual or legal entity, both the Company and the processor acting under its instruction are liable to the data subject for the actions of those persons.

1.3. Key Obligations of the Company

The Company does not collect or process personal data or transfer it to third parties without consent from the data subject, unless otherwise provided by Russian law.

If unlawful processing is identified following an inquiry or request from the data subject, their representative, or the authorized personal data protection authority, the Company blocks the personal data concerned, or ensures it is blocked if processed by another person acting on Company instructions, from receipt of the inquiry or request for the duration of the review.

If inaccurate personal data is identified following an inquiry or request from the data subject or their representative, or a request from the authorized personal data protection authority, the Company blocks the personal data concerned, or ensures it is blocked if processed by another person acting on Company instructions, from receipt of the inquiry or request for the duration of the review, provided blocking does not infringe the rights and lawful interests of the data subject or third parties.

If the inaccuracy is confirmed, the Company corrects the personal data, or ensures its correction where processed by another person acting on Company instructions, within 7 business days after receiving information from the data subject, their representative, the authorized personal data protection authority, or other necessary documents, and removes the block.

If unlawful personal data processing by the Company or a person acting on its instructions is identified, the Company stops the unlawful processing, or ensures that the person acting on its instructions stops it, within 3 business days after identification.

If the processing cannot be made lawful, the Company destroys the personal data or ensures its destruction within 10 business days after identifying the unlawful processing. The person responsible for organizing personal data processing at the Company determines whether processing is unlawful and destruction is necessary, and informs management. The Company notifies the data subject or their representative that the violations have been remedied or the data destroyed. If the inquiry from the data subject or representative, or the request from the authorized personal data protection authority, was forwarded by that authority, the Company also notifies the authority.

If an unlawful or accidental transfer of personal data (provision, dissemination, or access) is found to have infringed the rights of one or more data subjects, the Company must notify the authorized personal data protection authority after the incident is identified by the Company, that authority, or another interested person:

1. within 24 hours, of the incident, its suspected causes and the expected harm to the rights of data subjects, and the measures taken to address its consequences, and provide information about the person authorized by the Company to communicate with the personal data protection authority about the incident;

2. within 72 hours, of the results of the internal investigation, and provide information about the persons whose actions caused the incident, if known.

When the purpose of personal data processing has been achieved, the Company stops processing and destroys the data, or ensures that a person processing on its instructions does so, within 30 days after the purpose is achieved. This applies unless otherwise provided by a contract to which the data subject is a party, beneficiary, or guarantor, or another agreement between the Company and the data subject, or unless the Company may process the data without consent under Federal Law No. 152-FZ or other federal laws.

If the data subject withdraws consent, the Company stops processing, or ensures that a person processing on its instructions does so. If retention is no longer necessary for the processing purposes, the Company destroys the data or ensures its destruction within 30 days after receiving the withdrawal. This applies unless otherwise provided by a contract to which the data subject is a party, beneficiary, or guarantor, or another agreement between the Company and the data subject, or unless the Company may process the data without consent under Federal Law No. 152-FZ or other federal laws.

If the data subject requests that the Company stop processing personal data, the Company stops processing or ensures that its processor does so within 10 business days after receiving the request, except in the cases provided by clauses 2–11 of part 1 of Article 6, part 2 of Article 10, and part 2 of Article 11 of Federal Law No. 152-FZ. This period may be extended by no more than 5 business days if the Company sends the data subject a reasoned notice explaining the extension of the period for providing the requested information.

The Company makes the necessary changes within 7 business days after the data subject or their representative provides information confirming that personal data is incomplete, inaccurate, or outdated.

The Company destroys personal data within 7 business days after the data subject or their representative provides information confirming that it was obtained unlawfully or is unnecessary for the stated processing purpose. The Company notifies the data subject or their representative of the changes and measures taken and makes reasonable efforts to notify third parties to whom the data was transferred.

If personal data cannot be destroyed within the periods specified above, the Company blocks the data, or ensures it is blocked where processed by another person acting on its instructions, and ensures destruction within no more than 6 months, unless federal law establishes another period.

Destruction of personal data is confirmed in accordance with requirements established by the authorized personal data protection authority.

Under Order No. 179 of October 28, 2022, of the Federal Service for Supervision of Communications, Information Technology and Mass Media, On Approval of Requirements for Confirmation of Personal Data Destruction (the Requirements), where the Company processes personal data without automation, destruction is confirmed by a personal data destruction report.

Where the Company processes personal data using automation, destruction is confirmed by a destruction report meeting clauses 3 and 4 of the Requirements and an export from the event log of the personal data information system (the log export).

If the log export cannot include certain information required by clause 5 of the Requirements, the missing information is entered in the destruction report.

Where the Company processes personal data both with and without automation, destruction is confirmed by a destruction report meeting clauses 3 and 4 of the Requirements and a log export meeting clause 5 of the Requirements.

The destruction report and log export must be retained for 3 years after personal data destruction.

1.4. Key Rights of Personal Data Subjects

The data subject decides whether to provide personal data and gives consent to processing freely, voluntarily, and in their own interest. Where required by federal law, processing requires written consent from the data subject. Consent in an electronic document signed with an electronic signature in accordance with federal law is equivalent to written consent on paper bearing the handwritten signature of the data subject.

To protect their lawful interests, data subjects or their representatives have the right to:

1. receive complete information about their personal data and its processing, including automated processing;

2. access their personal data freely and at no charge, including obtaining copies of any record containing their personal data, except in the cases provided by part 8 of Article 14 of Federal Law No. 152-FZ;

3. request correction, blocking, or destruction of personal data that is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose, and take legally available measures to protect their rights. If the Company refuses to remove, correct, block, or destroy the data, the data subject may submit a written objection with appropriate reasons;

4. require the Company to notify all persons previously provided with incorrect, incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary personal data of all changes or removals, including blocking or destruction by those third parties;

5. challenge unlawful acts or omissions of the Company in processing and protecting their personal data in court or before the authorized personal data protection authority if the data subject believes the Company is violating Federal Law No. 152-FZ or otherwise infringing their rights and freedoms. The data subject has the right to protect their rights and lawful interests, including seeking damages and/or compensation for moral harm through the courts.

The data subject has the right to obtain information about processing of their personal data, including:

1. confirmation that the Company processes personal data;

2. the legal grounds and purposes for processing;

3. the purposes and methods of processing used by the Company;

4. the Company name and location, and information about persons other than Company employees who have access to personal data or to whom it may be disclosed under a contract with the Company or federal law;

5. the personal data being processed relating to the data subject and its source, unless federal law provides a different procedure for supplying that data;

6. the processing periods, including retention periods;

7. the procedure for exercising rights under Federal Law No. 152-FZ;

8. information about completed or planned cross-border data transfers;

9. the name, or last name, first name, and patronymic, and address of any person entrusted or to be entrusted with processing personal data on Company instructions;

10. information about how the Company fulfills its obligations under Article 18.1 of Federal Law No. 152-FZ;

11. other information provided for by Federal Law No. 152-FZ or other federal laws.

If the data subject has been given access to the personal data being processed at their request, they may submit a further inquiry or request to the Company for information and access no earlier than 30 days after the original inquiry or request, unless a shorter period is established by federal law, a regulation adopted under it, or a contract to which the data subject is a party, beneficiary, or guarantor.

The data subject may submit a further inquiry or request before the 30-day period expires if the information and/or personal data being processed was not provided in full in response to the original inquiry. The repeat request must explain why it is being submitted.

The Company may refuse a repeat request that does not meet the conditions in parts 4 and 5 of Article 14 of Federal Law No. 152-FZ. The refusal must be reasoned. The Company bears the burden of proving that its refusal is justified.

The right of a data subject to access their personal data may be restricted under federal laws, including where:

1. personal data, including data obtained through operational investigative, counterintelligence, and intelligence activities, is processed for national defense, state security, and law enforcement;

2. personal data is processed by authorities that detained the data subject on suspicion of a crime, charged them in criminal proceedings, or imposed a preventive measure before charges were filed, except where Russian criminal procedure law allows a suspect or accused person to review that data;

3. personal data is processed under laws combating money laundering and terrorist financing;

4. access by the data subject would infringe the rights and lawful interests of third parties;

5. personal data is processed in cases provided by Russian transportation security law to ensure stable and safe operation of the transportation system and protect individuals, society, and the state from unlawful interference in that system.

5.1. Personal Data Operations Performed by the Company

The Company performs the following personal data operations:

1. For compliance with Russian labor law: transfer (access), recording, blocking, organization, transfer (provision), use, deletion, anonymization, accumulation, collection, storage, clarification (updating or modification), destruction, and retrieval;

2. For establishing and performing contractual relationships: transfer (dissemination), transfer (access), recording, blocking, organization, transfer (provision), use, deletion, anonymization, accumulation, collection, storage, clarification (updating or modification), destruction, and retrieval.

5.2. Personal Data Processing Methods

The Company uses the following personal data processing methods:

1. For compliance with Russian labor law, combined automated and nonautomated processing is used, without transmission over an internal network but with transmission over the Internet;

2. For establishing and performing contractual relationships, automated processing is used, with transmission over both the internal network and the Internet.

5.3. Transfer of Personal Data to Third Parties

Third party: Domain Name Registrar REG.RU LLC, taxpayer identification number (INN) 7733568767.

Third-party location: 72 Leningradsky Avenue, Building 3, Moscow, Moscow Region, 125315, Russia.

Transfer conditions: instructions from the Operator.

Cross-border personal data transfers: none.

Method of transfer to the third party: automated transmission over the Internet.

Purpose of transfer: outsourcing information processing in the system.

Data subjects and personal data transferred:

1) individuals, including foreign nationals, who request services:

Publicly available personal data: contact details (phone number and email address), last name, first name, patronymic, and photograph.

Third-party processing methods: automated processing with transmission over the internal network and without transmission over the Internet.

Operations permitted for the third party: blocking, recording, retrieval, use, accumulation, transfer (access), transfer (provision), transfer (dissemination), collection, organization, deletion, destruction, clarification (updating or modification), and storage.

5.4. Security Measures for Personal Data Processing

When processing personal data, the Company takes and ensures the necessary legal, organizational, and technical measures to protect it against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions.

The Company ensures personal data security through measures including:

1. assessing potential harm to data subjects from violations of the Law On Personal Data, in accordance with requirements of the authorized personal data protection authority, and comparing that harm with protective measures intended to fulfill obligations under that law;

2. conducting internal monitoring and/or audits of compliance with the Law On Personal Data and internal Company documents governing personal data processing;

3. familiarizing employees directly involved in processing with Russian personal data law, the Company personal data processing policy, and internal processing regulations, and/or training those employees;

4. issuing a Company personal data processing policy and internal regulations specifying, for each processing purpose, the categories and list of personal data, categories of data subjects, processing methods and processing and retention periods, and procedures for destroying data once the purposes are achieved or other lawful grounds arise; and issuing internal regulations establishing procedures to prevent and detect violations of Russian law and address their consequences;

5. maintaining an inventory of electronic media containing personal data;

6. appointing a person responsible for organizing personal data processing;

7. restoring personal data altered or destroyed through unauthorized access;

8. using information security tools that have passed the prescribed conformity assessment procedure;

9. identifying personal data security threats during processing in personal data information systems;

10. assessing the effectiveness of personal data security measures before a personal data information system is put into operation;

11. establishing access rules for personal data processed in an information system and ensuring that all operations involving that data are recorded and tracked;

12. detecting unauthorized access to personal data and taking action, including detecting and preventing computer attacks on personal data information systems, addressing their consequences, and responding to computer security incidents;

13. monitoring personal data security measures and the protection level of personal data information systems;

14. implementing organizational and technical security measures necessary to meet personal data protection requirements and achieve the protection levels established by the Government of the Russian Federation;

15. cooperating with the state system for detecting, preventing, and addressing the consequences of computer attacks on information resources of the Russian Federation, including reporting computer security incidents that result in unlawful access, provision, dissemination, or transfer of personal data.

5.5. Company Personal Data Databases Are Located Entirely Within the Russian Federation.

5.6. Personal Data Processing Periods

Personal data processed by the Company must be destroyed or anonymized if:

1. the processing purposes have been achieved or are no longer necessary;

2. the data subject withdraws consent to processing;

3. consent to processing expires;

4. lawful processing cannot be ensured;

5. the Company ceases operations.

5.7. Conditions for Personal Data Processing Without Automation

When processing personal data without automation, the Company complies with Government of the Russian Federation Resolution No. 687 of September 15, 2008, On Approval of the Regulation on Specific Features of Personal Data Processing Without Automation.

In such processing, personal data is separated from other information, including by recording it on separate physical media or in designated sections or fields of forms.

Personal data is retained in a form that allows identification of the data subject for no longer than the processing purposes require.