Personal Data Processing Policy

1. General Provisions

1.1. This Personal Data Processing Policy of Ivanovo Mechanical Plant LLC (registered address: Office 203A, 117 Lezhnevskaya Street, Ivanovo, Ivanovo Region, 153035, Russia; INN: 3700006050, KPP: 370001001, OGRN: 1233700004064, OKPO: 56912049) (hereinafter also referred to as the “Company” or the “Policy”) sets out the Company’s position and intentions regarding the processing and protection of personal data, with the purpose of observing and protecting the rights and freedoms of every person and, in particular, the right to privacy, personal and family confidentiality, and protection of honor and reputation.

1.2. This Policy is strictly observed by the managers and employees of all structural divisions, branches and representative offices of the Company.

1.3. This Policy applies to all personal data of data subjects processed by the Company, whether or not automation tools are used.

1.4. This Policy is available to any personal data subject, including through the Internet.

1.5. The Company periodically updates this Policy and may unilaterally change its terms at any time. The Company recommends regularly reviewing this Policy for possible changes.

Unless otherwise provided by the Policy, all amendments to it shall take effect on the date specified in the Policy.

1.6. In all other matters not covered by this Policy, the Company shall be guided by the applicable laws of the Russian Federation.

2. Terms

2.1. Personal data means any information relating to a directly or indirectly identified or identifiable natural person (the data subject). Such information may include, in particular, the person’s full name, year, month, date and place of birth, address, information about their family, social and financial circumstances, education, occupation and income, as well as other information that, taken together, makes it possible to determine or identify the data subject.

2.2. Processing of personal data means any action (operation) or set of actions (operations) performed with or without the use of automation tools in relation to personal data, including collection, recording, systematization, accumulation, storage, clarification (updating and modification), retrieval, use, transfer (disclosure, provision and access), depersonalization, blocking, deletion and destruction of personal data.

2.3. Data subject means a natural person whose personal data are processed.

2.4. Controller means a person who, independently or jointly with other persons, organizes and/or carries out the processing of personal data and determines the purposes of processing personal data, the categories of personal data to be processed, and the actions (operations) performed with personal data. For the purposes of this Policy, the Company is the Controller when processing personal data, unless expressly stated otherwise in the Policy.

2.5. Processor means any person who, under an agreement with the Controller, processes personal data on the Controller’s behalf and acts in the Controller’s name and/or interests when processing personal data. The Controller is responsible to the data subject for the Processor’s acts or omissions. The Processor is responsible to the Controller.

2.6. Other terms used in this Policy shall have the meanings established by the applicable laws of the Russian Federation, unless expressly stated otherwise in the Policy.

3. Procedure and Conditions for Processing Personal Data

3.1. The Company understands personal data security as the protection of personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or disclosure, as well as against other unlawful actions involving personal data, and takes the necessary legal, organizational and technical measures to protect personal data.

3.2. The processing and security of personal data by the Company are carried out in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ “On Personal Data,” subordinate regulations, other laws of the Russian Federation defining the cases and specific features of personal data processing, as well as guidance and methodological documents of the Government of the Russian Federation, the Russian Ministry of Digital Development, Roskomnadzor, FSTEC of Russia and the FSB of Russia.

3.3. When processing personal data, the Company follows the following principles:

• lawfulness and fairness;
• limiting the processing of personal data to the achievement of specific, predetermined and lawful purposes;
• preventing processing of personal data that is incompatible with the purposes for which the personal data were collected;
• preventing the combination of databases containing personal data processed for purposes that are incompatible with one another;
• ensuring that the content and scope of the personal data processed correspond to the stated processing purposes;
• preventing excessive processing of personal data in relation to the stated processing purposes;
• ensuring the accuracy and sufficiency of personal data and, where necessary, their relevance to the purposes of processing, as well as taking measures to delete or clarify incomplete or inaccurate data;
• transparency of personal data processing: the data subject may be provided with relevant information concerning the processing of their personal data;
• storing personal data in a form that makes it possible to identify the data subject for no longer than required by the stated processing purposes.

3.4. The Company processes personal data in the following cases:

• the Company operates as the owner of a website providing information about goods (services) — “iv-mashzavod.ru”;

3.5. The Company processes personal data only if at least one of the conditions below applies, for the following periods:

1. With the data subject’s consent to the processing of their personal data — for the period for which consent to personal data processing was given.
2. To achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise and perform the functions, powers and duties imposed on the Controller by the laws of the Russian Federation — for the period established by the relevant international treaties or laws.
3. Where it is necessary to process personal data that must be published or disclosed under a federal law — for the period established by the relevant laws.
4. To enforce a court judgment or an act of another body or official that must be enforced under the laws of the Russian Federation on enforcement proceedings — for the period necessary to enforce the relevant act.
5. In connection with a person’s participation in constitutional, civil, administrative or criminal proceedings, or proceedings before commercial courts — for the period of participation in the relevant proceedings, including periods for appealing or challenging judicial acts, unless the applicable laws of the Russian Federation establish a longer period for processing personal data.
6. To perform a contract to which the data subject is a party, beneficiary or guarantor, and to enter into a contract at the data subject’s initiative or a contract under which the data subject will be a beneficiary or guarantor — for the term of that contract, unless the applicable laws of the Russian Federation or the contract establish a longer period for processing personal data.
7. To protect the life, health or other vital interests of the data subject where it is impossible to obtain the data subject’s consent — until it becomes possible to obtain consent or until the circumstances threatening life, health or other vital interests cease to exist, whichever occurs first.
8. To exercise the rights and legitimate interests of the Controller or third parties, provided that this does not violate the rights and freedoms of the data subject — for the period necessary to exercise the rights and ensure the legitimate interests.

The specific period is determined by the Company with regard to this Policy, its internal documents and local regulations, as well as the principles of personal data processing and the requirements of the applicable laws of the Russian Federation, including the requirement to stop processing personal data once the specific, predetermined and lawful purposes of such processing have been achieved.

3.6. The Company may entrust the processing of personal data to Processors under agreements concluded with them. This means that the Company delegates part of its functions to a person designated by the Company who acts in the name or interests of the Company.

The Company engages such persons when it does not have the knowledge or resources necessary to achieve the relevant result (for example, when the Company needs additional computing capacity to operate its websites and online services, it may rent dedicated servers from a third party if it does not have its own servers) or when outsourcing certain functions is more efficient in terms of the Company’s own labor costs and quality of operations (for example, if the number of users of the Company’s websites and online services increases sharply, the Company may need to engage a third party to provide customer contact center services).

Processors undertake to comply with the principles and rules for processing personal data established by Federal Law No. 152-FZ “On Personal Data” (including Articles 18.1 and Part 5 of Article 18), other laws and subordinate regulations. The agreement with each Processor shall specify:

• the personal data to be processed;
• the purposes of processing such data;
• the list of actions (operations) to be performed by the Processor with the personal data;
• the Processor’s obligations to maintain confidentiality and ensure the security of personal data during processing, as well as the measures taken by the Processor to protect the personal data it processes, including the requirement to notify the Company of personal data incidents;
• the obligation, at the Company’s request and during the term of the personal data processing assignment, to provide the Company with documents and other information confirming the implementation of measures and compliance, for the purposes of performing the Company’s assignment, with the requirements established by Federal Law No. 152-FZ “On Personal Data.”

A Processor is not required to obtain the data subject’s consent to process their personal data. If processing personal data on the Company’s instructions requires the data subject’s consent, the Company itself obtains that consent.

3.7. Where the relevant legal grounds established by the laws of the Russian Federation exist, the Company may transfer personal data to third parties without entrusting those parties with the processing of personal data.

Such persons may include, for example, banks settling accounts with the Company’s counterparties, carriers and freight forwarders delivering orders in accordance with their own rules, the Company’s counterparties to whom the Company transfers data from powers of attorney of its representatives, government authorities requesting personal data within their competence, and others.

Such persons do not process personal data in the name or interests of the Company because they have their own purposes and legal grounds for processing such data (for example, banks accept payment documents in accordance with banking law, and the Company has no right to interfere with their activities).

The Company transfers personal data to:

• Yandex LLC (Russia), 16 Lev Tolstoy Street, Moscow, 119021, Russia. Web analytics collection (Yandex.Metrica service).

3.8. If a specific person to whom the Company transfers personal data, including without entrusting that person with processing the personal data, is foreign and the transfer is made outside the Russian Federation (for example, to a seller of goods delivered from outside the Russian Federation), the Company carries out a cross-border transfer of personal data. The Company carries out such a transfer where there is an appropriate legal basis for processing personal data and provided that Roskomnadzor has been notified in accordance with Article 22 of Federal Law No. 152-FZ “On Personal Data.”

3.9. Unless otherwise provided by the laws of the Russian Federation, the Company stops processing personal data (in relation to any of the purposes stated above) and destroys it in the following cases:

• liquidation of the Company;
• reorganization of the Company resulting in the termination of its activities;
• the legal grounds for processing personal data cease to exist and/or the purposes of processing personal data are achieved.

The specific procedure for destroying personal data on media containing personal data, including external/removable electronic media, paper media and personal data information systems, is established by the Company in its internal documents and local regulations.

3.10. The Company processes personal data by mixed means: with and without the use of automation tools.

In some cases, as described below, the Company receives and processes personal data automatically using analytics tools used on the Company’s websites and online services. The Company uses cookies to work with such data.

Cookies are small text files containing certain information that are downloaded to a user’s device (PC, smartphone, etc.) while the user is viewing a web page.

Cookies allow websites to recognize user devices, determine user preferences and collect statistics on how users interact with websites in order to improve the experience of using a website or eliminate various errors and bugs that may periodically occur. The list of purposes for which cookies are required is not exhaustive and depends on the specific website that the user visits or otherwise uses.

In particular, the Company’s websites may use the following cookies:

1. Technical cookies. These cookies are necessary for the operation of the Company’s websites and online services; without them, they cannot function properly. Technical cookies allow users to navigate such websites and services, view their different sections, complete forms and select checkboxes.
2. Analytics cookies. These cookies collect information about how often users visit the Company’s websites and online services, which sections they view, which links they click and how they generally navigate such websites and services.
3. Preference cookies. These cookies remember the settings and choices users make on the Company’s websites and online services (language, region, search queries, etc.) and thereby provide users with a personalized experience when using such websites and services.
4. Marketing cookies. These cookies collect information about actions performed by users both on the Company’s websites and online services and on third-party websites in order to display the most relevant advertising, measure the effectiveness of that advertising and limit the number of advertising impressions for such users on the Company’s websites and services.

Users may also independently limit or completely disable the installation of cookies through their web browser settings. However, without technical cookies, the Company’s websites and online services may operate incorrectly and some of their functionality may be unavailable.

When using cookies, the Company does not aim to identify a specific user of the Company’s websites and online services.

3.11. When processing personal data, the Company:

• takes measures that are necessary and sufficient to ensure compliance with the requirements of the laws of the Russian Federation, the Company’s internal documents and local regulations in the area of personal data;
• takes legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or disclosure, as well as against other unlawful actions involving personal data;
• appoints a person responsible for organizing the processing of personal data at the Company;
• issues internal documents defining the Company’s policy regarding personal data processing, local acts on personal data processing, and local acts establishing procedures aimed at preventing and detecting violations of the laws of the Russian Federation and eliminating the consequences of such violations;
• familiarizes employees of the Company, its branches, representative offices and structural divisions who directly process personal data with the provisions of the laws of the Russian Federation, internal documents and local regulations in the area of personal data, including personal data protection requirements, and provides training to those employees;
• conducts regular mandatory training for its employees on personal data matters;
• conducts internal monitoring and/or audits of the compliance of personal data processing with the laws of the Russian Federation and regulatory legal acts adopted under them, other personal data protection requirements, this Policy, internal documents and local regulations of the Company in the area of personal data;
• publishes this Policy or otherwise ensures unrestricted access to it;
• stops processing personal data and destroys it in cases provided for by the laws of the Russian Federation;
• performs other actions provided for by the laws of the Russian Federation in the area of personal data.

3.12. The Company may send users informational and advertising mailings related to the services provided. A user may unsubscribe from such mailings at any time by contacting support.

4. Rights of the Personal Data Subject

A person whose personal data are processed by the Company has:

• the right to withdraw consent to the processing of personal data previously given by that person;
• the right to receive information concerning the processing of personal data;
• the right to request the clarification, blocking or destruction of their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and to request that processing of personal data be stopped if the Company has achieved the purpose of such processing.
  If the relevant document between the Company and the data subject (for example, a contract or the text of consent to personal data processing) does not provide for another procedure for interaction between them, the data subject must send the Company a written, personally signed application to exercise these rights, at the following address: Office 4, 4 Proezd Krasnykh Zor, Ivanovo, Ivanovo Region, 153021, Russia.
  The application must necessarily describe the data subject’s requests and include the following information:
• the full name of the data subject;
• the number of the principal identity document of the data subject or their representative, information about the date of issue of that document and the authority that issued it, OR other information that makes it possible to unambiguously identify the data subject;
• information confirming the data subject’s participation in relations with the Company, OR information otherwise confirming that the Company processes the data subject’s personal data;
• the signature of the data subject or their representative.

The data subject may also challenge acts (omissions) and decisions of the Company that violate their rights in the processing of personal data before the authorized body for protecting the rights of personal data subjects (Roskomnadzor) and in court, in accordance with the procedure established by the laws of the Russian Federation.

5. Information on Implemented Personal Data Protection Requirements

When processing personal data, the Company takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or disclosure, as well as against other unlawful actions involving personal data. The Company regularly reviews and updates the measures it takes to ensure the best possible protection of the personal data processed; such measures are described in this Policy, internal documents and local regulations of the Company.

Such measures include, in particular:

• development of threat models;
• identification of personal data security threats when personal data are processed in personal data information systems;
• implementation of organizational and technical measures to ensure the security of personal data when they are processed in personal data information systems, as required for compliance with personal data protection requirements and to ensure the personal data security levels established by the Government of the Russian Federation;
• use of information security tools that have undergone the prescribed conformity assessment procedure;
• assessment of the effectiveness of measures taken to ensure personal data security before a personal data information system is put into operation;
• detection of unauthorized access to personal data and taking measures in response;
• recovery of personal data modified or destroyed as a result of unauthorized access;
• establishment of access rules for personal data processed in a personal data information system, as well as registration and accounting of all actions performed with personal data in the personal data information system;
• monitoring the measures taken to ensure personal data security and the security level of personal data information systems;
• accounting for machine-readable media containing personal data;
• organization of access-control and internal-site security regimes on the Company’s premises;
• placement of technical means for processing personal data within the protected premises;
• maintaining security and alarm equipment in a constant state of readiness;
• monitoring user actions and conducting investigations into violations of personal data security requirements.