Personal Data Processing Policy of JSC Industrial Assets

1. General Provisions

1.1. The Personal Data Processing Policy of JSC Industrial Assets (hereinafter — the "Policy", the "Company") has been developed in accordance with the requirements of Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and is intended to provide unrestricted access to information regarding the processing of personal data, as well as to information about the personal data protection requirements implemented at JSC Industrial Assets.

1.2. The Policy describes the procedure for processing and protecting the personal data of individuals in connection with the implementation of employment relationships, the conclusion of contracts and fulfilment of contractual obligations of JSC Industrial Assets, and the conduct of the Company's statutory activities.

1.3. Personal data is classified as confidential information and is protected against unauthorised, including accidental, access.

2. Key Definitions in the Field of Personal Data

2.1. Personal data — any information relating directly or indirectly to an identified or identifiable natural person (personal data subject);

2.2. Operator — a state authority, municipal authority, legal entity or individual that independently or jointly with others organises and/or carries out the processing of personal data, and determines the purposes, composition and operations performed with personal data;

2.3. Processing of personal data — any action (operation) or set of actions performed using automated or non-automated means with personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymisation, blocking, deletion, and destruction of personal data;

2.4. Automated processing of personal data — processing of personal data using computer technology;

2.5. Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons;

2.6. Provision of personal data — actions aimed at disclosing personal data to a specific person or a defined group of persons;

2.7. Blocking of personal data — temporary suspension of personal data processing (except where processing is required to clarify personal data);

2.8. Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which physical media containing personal data are destroyed;

2.9. Anonymisation of personal data — actions as a result of which it becomes impossible without additional information to determine that personal data belongs to a specific personal data subject;

2.10. Personal data information system — the totality of personal data contained in databases together with the information technologies and technical means used to process them;

2.11. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign natural person, or a foreign legal entity.

3. Purposes and Legal Bases for Processing Personal Data

3.1. JSC Industrial Assets processes personal data for the following purposes:

compliance with the requirements of Russian legislation (including the exercise and fulfilment of the functions, powers and obligations imposed by Russian legislation on JSC Industrial Assets as an operator);
exercising and fulfilling rights and obligations arising from employment relationships, including facilitating employees' employment, education and career advancement, ensuring their personal safety, monitoring the quantity and quality of work performed and safeguarding property, paying wages and other amounts due to employees under Russian law or contract, and making tax and social contributions required by Russian law;
carrying out recruitment (personnel selection), including enabling candidates for vacant positions to undergo selection for relevant vacancies and employing those who are successfully selected;
executing court orders, orders of other authorities or officials subject to enforcement under Russian enforcement proceedings legislation;
conclusion, performance and termination of civil law contracts in cases provided for by Russian legislation and the Charter of JSC Industrial Assets;
exercising and fulfilling the rights and obligations assigned to JSC Industrial Assets by contracts, including for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, as well as for the conclusion of a contract at the personal data subject's initiative or a contract under which the personal data subject will be a beneficiary or guarantor;
exercising the rights and legitimate interests of JSC Industrial Assets as an operator or of third parties;
conducting activities provided for by the Charter of JSC Industrial Assets;
providing personal data subjects with access to the JSC Industrial Assets website and its functionality;
providing paid and free services to personal data subjects;
conducting activities related to the Company's website (user behaviour analytics; improving user experience);
improving the quality of services provided by JSC Industrial Assets;
communicating with personal data subjects when necessary, including sending notifications, information and requests related to JSC Industrial Assets' service activities, as well as processing applications, requests and other messages from personal data subjects;
organising access control on the premises of JSC Industrial Assets;
fulfilling instructions of other personal data operators.

3.2. The legal bases for processing personal data at JSC Industrial Assets are:

the Constitution of the Russian Federation;
the Labour, Civil and Tax Codes of the Russian Federation;
Federal Law No. 27-FZ of 1 April 1996 "On Individual (Personified) Accounting in the Compulsory Pension Insurance System";
Federal Law No. 402-FZ of 6 December 2011 "On Accounting";
Federal Law No. 53-FZ of 28 March 1998 "On Military Duty and Military Service";
Federal Law No. 181-FZ of 24 November 1995 "On Social Protection of Disabled Persons in the Russian Federation";
the exercise and fulfilment of the functions, powers and obligations imposed on JSC Industrial Assets by Russian legislation and its Charter;
a contract to which the personal data subject is a party, beneficiary or guarantor, as well as a contract concluded at the personal data subject's initiative or a contract under which the personal data subject will be a beneficiary or guarantor;
the personal data subject's consent to the processing of their personal data, subject to the requirements of Russian legislation for the relevant category of personal data;
court orders, orders of other authorities or officials subject to enforcement by JSC Industrial Assets under Russian enforcement proceedings legislation;
ensuring and/or protecting the life, health or other vital interests of the personal data subject where obtaining their consent is not possible;
processing of personal data for statistical or other research purposes subject to mandatory anonymisation;
processing of personal data for the purposes of publication or mandatory disclosure of information in accordance with Russian legislation.

4. Principles and Conditions for Processing Personal Data

4.1. JSC Industrial Assets processes personal data in accordance with the following principles and rules:

existence of lawful and fair grounds for processing personal data;
limitation of personal data processing to the achievement of specific, pre-determined and lawful purposes;
prohibition on merging databases containing personal data processed for incompatible purposes;
processing only personal data that meets the purposes of processing;
ensuring that the content and volume of personal data processed corresponds to (and does not exceed) the stated processing purposes;
ensuring the accuracy, adequacy and, where necessary, relevance of personal data in relation to the processing purposes;
personal data shall be stored in a form that allows identification of the personal data subject for no longer than required by the purposes of processing, unless a retention period is established by Russian legislation or a contract to which the personal data subject is a party, beneficiary or guarantor;
personal data being processed shall be destroyed or anonymised upon achieving the processing purposes or when such purposes are no longer necessary, unless otherwise provided by Russian legislation.

4.2. Processing of personal data at JSC Industrial Assets may be carried out in the following cases:

the subject's consent to the processing of their personal data has been obtained;
processing of personal data is necessary for the exercise and fulfilment of the functions, powers and obligations imposed by Russian legislation on the operator;
processing of personal data is carried out in connection with the personal data subject's participation in civil, administrative or arbitration proceedings;
processing of personal data is necessary to execute a court order in accordance with Russian enforcement proceedings legislation;
processing of personal data is necessary for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, as well as for the conclusion of a contract at the personal data subject's initiative;
processing of personal data is necessary to protect the life, health or other vital interests of the personal data subject where obtaining their consent is not possible;
processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant goals, provided that the rights and freedoms of the subject are not violated;
processing of personal data is carried out for statistical or other research purposes subject to mandatory anonymisation;
personal data subject to publication or mandatory disclosure under Russian legislation is being processed.

5. Categories of Personal Data Processed

5.1. JSC Industrial Assets processes personal data of the following subjects:

individuals who are or have been in employment, other contractual or civil law relationships with JSC Industrial Assets, and/or their legal representatives, in particular employees;
former employees;
family members and relatives of employees and/or former employees;
candidates (applicants) for vacant positions;
clients/contractors and their representatives;
employees of contractors (clients);
individuals who have submitted requests.

5.1.1. The personal data processed for individuals who are or have been in employment, other contractual or civil law relationships with JSC Industrial Assets, and/or their legal representatives — in particular employees, former employees, family members and relatives of employees and/or former employees, as well as candidates for vacant positions — includes the following categories:

full name;
year of birth;
month of birth;
date of birth;
place of birth;
address;
marital status;
social status;
financial status;
education;
profession;
income;
health status;
passport details;
citizenship information;
pension and medical insurance data, TIN, SNILS (individual insurance account number);
military registration information;
information about awards, commendations and honorary titles;
health information relevant to the ability to perform work duties;
disability information;
contact details.

5.1.2. The personal data processed for contractors and their representatives, and for individuals who have submitted requests, includes the following categories:

full name;
date and place of birth;
address;
passport details;
contact details (phone, email);
job title;
website user cookies.

5.1.3. The personal data processed for employees of contractors (clients) includes the following categories:

full name;
contact details (phone, work email).

5.2. Health information of employees, former employees, and family members and relatives of employees and/or former employees is processed in specific cases in accordance with Russian legislation on state social assistance, labour law and pension law.

5.3. Biometric personal data is not processed.

6. Personal Data Processed on the JSC Industrial Assets Website and Online Resources

6.1. The following personal data is processed on the JSC Industrial Assets website at https://www.btkcompany.ru:

contact details (full name; phone number; email address);
technical data collected automatically (cookies);
other data provided by the personal data subject when using the website and completing feedback forms.

6.2. Procedure for collecting personal data on the JSC Industrial Assets online resource:

sources of personal data: completion of forms on the website (registration, subscription to mailing lists); contact with the support service; participation in promotions and competitions; automatic collection upon visiting the website;
consent to the processing of personal data is obtained at the moment the User takes actions indicating their consent; confirmed by checking the relevant boxes in forms; may be withdrawn at any time by submitting a written request.

6.3. Cookie processing:

technical (essential) cookies — required for website functionality and authentication; no consent required; retention period — session;
analytical cookies (Yandex.Metrica) — collection of visitor statistics; user behaviour analysis; user consent required; retention period — up to 2 years;
identification cookies — content personalisation; remembering preferences; user consent required; retention period — up to 1 year;
advertising cookies — displaying relevant advertisements; retargeting; separate consent required; retention period — up to 13 months;
cookie management: on first visiting the website, a consent banner is displayed; the user may select the types of cookies to allow; technical cookies are enabled by default and cannot be disabled; settings may be changed at any time via the website interface;
data localisation: all cookies are processed on servers located in the territory of the Russian Federation; transfer of cookies to third parties is made only to Russian operators;
cross-border transfer is not carried out.

7. Collection of Personal Data

7.1. Personal data is collected directly from the personal data subject. Where the provision of personal data is mandatory under Russian legislation, the personal data subject is informed of the legal consequences of refusing to provide such data.

7.2. Personal data may be obtained from other persons only where there are lawful grounds for doing so. Where personal data is obtained from other persons, the subject is notified accordingly.

7.3. When collecting personal data, including via the Internet, the recording, systematisation, accumulation, storage, clarification (updating, modification) and retrieval of personal data of Russian citizens is ensured using databases located within the territory of the Russian Federation.

8. Processing of Personal Data

8.1. When processing personal data, JSC Industrial Assets performs the following operations: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), blocking, deletion, and destruction.

8.2. Personal data is processed both on physical (paper) media and in electronic form (in personal data information systems, on machine-readable media) with transmission over the legal entity's internal network.

8.3. The processing of personal data may be entrusted to a third party with the consent of the personal data subject or on grounds provided for by Russian legislation. A person processing personal data under a commission is not required to obtain the subject's consent for the processing of their personal data.

8.4. Where the inaccuracy of personal data is confirmed, such personal data shall be updated.

8.5. Where unlawful processing of personal data is identified, such personal data shall be destroyed within three days.

9. Storage of Personal Data

9.1. Personal data is stored in a form that allows identification of the personal data subject for no longer than required by the purposes of processing, unless a retention period is established by Russian legislation or a contract to which the personal data subject is a party.

9.2. Personal data is stored with due regard for maintaining confidentiality.

9.3. Personal data is transferred to archival storage in accordance with Russian archiving legislation, and is destroyed or anonymised upon achieving the processing purposes or when such purposes are no longer necessary, unless otherwise provided by Russian legislation or a contract to which the personal data subject is a party.

10. Transfer of Personal Data

10.1. Personal data is transferred to a third party only with the consent of the personal data subject or in cases expressly provided for by Russian legislation.

10.2. The transfer of personal data to a state authority, local government authority, security or law enforcement authority, state institution or fund, or other authorised authority is permitted on grounds provided for by Russian legislation.

10.3. Disclosure of personal data to a third party without the consent of the relevant subject is not permitted, except where it is necessary to protect the life, health or other vital interests of the personal data subject.

10.4. Disclosure of personal data to a third party for commercial purposes without the consent of the relevant subject is prohibited. Processing of personal data for the purposes of promoting goods, works or services on the market, or for political campaigning, may only be carried out subject to the prior consent of the subject.

10.5. Cross-border transfer of personal data to foreign territories is not carried out.

11. Conditions and Procedure for Ceasing to Process Personal Data

11.1. Upon achievement of the purpose for which personal data was processed, processing of such data must cease and the personal data must be destroyed within thirty days of the date on which the processing purpose is achieved, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, another agreement between the operator and the personal data subject, or where the operator is not permitted to process personal data without the subject's consent on grounds provided for by Russian legislation.

11.2. Where the personal data subject withdraws consent to the processing of their personal data, processing of such data must cease and, if the personal data is no longer required for the processing purposes, the data must be destroyed within thirty days of receipt of the withdrawal, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, another agreement between the operator and the personal data subject, or where the operator is not permitted to process personal data without the subject's consent on grounds provided for by Russian legislation.

11.3. Where unlawful processing of personal data is identified, processing of such data must cease within three business days. If it is not possible to ensure the lawfulness of processing, the personal data must be destroyed within ten business days of the date on which the unlawful processing was identified.

11.4. Where it is not possible to destroy personal data within the period specified in clauses 11.1–11.3 of this Policy, such personal data must be blocked and destroyed within no more than six months, unless a different period is established by Russian legislation.

12. Access to Personal Data

12.1. The following persons have the right to access personal data processed at JSC Industrial Assets:

persons authorised to act on behalf of the legal entity without a power of attorney;
employees of JSC Industrial Assets for whom the processing of personal data is necessary in connection with the performance of their job duties.

12.2. Access of JSC Industrial Assets employees to personal data is granted by management through a separate internal instrument.

13. Interaction with Personal Data Subjects

13.1. Any subject whose personal data is processed at JSC Industrial Assets has the right to access their personal data, including the following information:

confirmation that personal data is being processed;
legal bases and purposes of personal data processing;
purposes and methods of personal data processing;
name and location of the operator, information about persons (other than operator employees) who have access to personal data or to whom personal data may be disclosed under a contract with the operator or under Russian legislation;
list of personal data being processed that relates to the relevant subject and the source from which it was obtained;
processing periods for personal data and their retention periods;
procedure for the subject to exercise the rights provided for by Russian legislation;
information on any cross-border transfer of data that has taken place or is planned;
name of the person processing personal data under commission from the operator, where processing has been entrusted to a third party.

13.2. JSC Industrial Assets provides the information specified in clause 13.1 of this Policy upon request from the subject or their legal representative in an accessible form, and such information must not contain personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such data.

13.3. A request from the subject or their representative must contain:

the number of the primary identity document of the subject or their representative;
information about the date of issue of the said document and the issuing authority;
information confirming the subject's participation in a relationship with JSC Industrial Assets (contract number, date of conclusion of the contract or other information), or information otherwise confirming that personal data is being processed by JSC Industrial Assets;
signature of the personal data subject or their representative.

13.4. The subject may resubmit a request to JSC Industrial Assets for the information specified in clause 13.1 of this Policy no earlier than thirty days after the initial request was submitted or sent.

13.5. The subject has the right to demand the clarification, blocking or destruction of their personal data where the personal data processed at JSC Industrial Assets is incomplete, outdated, inaccurate, unlawfully obtained, or is no longer necessary for the processing purpose stated by JSC Industrial Assets.

13.6. The subject has the right to withdraw their consent to the processing of personal data where such consent was given. Withdrawal of consent is submitted by the subject to JSC Industrial Assets and must contain the information specified in clause 13.3 of this Policy. Where the subject withdraws consent to the processing of personal data, JSC Industrial Assets is entitled to continue processing personal data without the subject's consent where there are grounds provided for by Russian legislation or a contract to which the personal data subject is a party, beneficiary or guarantor.

14. Fulfilment of Statutory Obligations

In order for JSC Industrial Assets to fulfil its obligations under Russian personal data legislation, the following measures are taken:

appointment of a person responsible for organising the processing of personal data;
preparation of documents defining the personal data processing policy, internal instruments on personal data processing matters, and internal instruments establishing procedures aimed at preventing and detecting violations of Russian legislation and remedying the consequences of such violations;
implementation of legal, organisational and technical measures to ensure the security of personal data;
internal monitoring of the compliance of personal data processing with the requirements of Russian legislation;
assessment of the harm that may be caused to personal data subjects in the event of a violation of Russian legislation;
familiarising JSC Industrial Assets employees with the provisions of Russian legislation and JSC Industrial Assets internal instruments;
protection of personal data.

14.1. When processing personal data, the necessary legal, organisational and technical measures are taken to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions in relation to personal data.

14.2. To ensure the security of personal data, JSC Industrial Assets implements the following measures:

identification of personal data security threats during processing in information systems;
implementation of organisational and technical measures to ensure the security of personal data during processing in information systems, meeting the requirements for the established protection levels;
assessment of the effectiveness of measures taken to ensure the security of personal data processed in personal data information systems;
recording of machine-readable personal data media;
detection of instances of unauthorised access to personal data and response to such incidents;
restoration of personal data modified or destroyed as a result of unauthorised access;
establishing access rules for personal data processed in personal data information systems;
recording and logging of actions performed with personal data in personal data information systems;
monitoring of measures taken to ensure the security of personal data in accordance with the established level of protection.

15. Liability

For violations of the requirements established by Russian legislation, this Policy and other internal instruments of JSC Industrial Assets, employees and other persons who have been granted access to personal data shall bear disciplinary, administrative, civil and criminal liability in accordance with the Federal Laws of the Russian Federation.

16. Final Provisions

16.1. This Policy is made freely accessible to all interested parties, including personal data subjects and regulatory authorities exercising supervisory functions in the field of personal data.

16.2. The Policy takes effect from the date of its approval and is valid for an indefinite period. Amendments to the Policy are made by separate instruments of JSC Industrial Assets. The current version of the Policy and notices of changes to the Policy are published on the official website of JSC Industrial Assets.

17. Company Details and Contact Information

Full name: Joint-Stock Company Industrial Assets.

Short name: JSC Industrial Assets.

TIN: 4703155125

KPP: 470301001

Address (registered office): 188640, Leningrad Region, Vsevolozhsk District, Vsevolozhsk, Leningradskaya St., 14/1, premises 41