Personal Data Processing Policy of JSC Industrial Assets

The Personal Data Processing Policy of JSC Industrial Assets (hereinafter — the "Policy") establishes the procedure for processing and protecting personal data of various categories of personal data subjects ("Subjects") by Joint-Stock Company Industrial Assets, TIN 4703155125, OGRN 1184704004286, address: 188640, Leningrad Region, Vsevolozhsk District, Vsevolozhsk, Leningradskaya St., 14/1, premises 41 (hereinafter — the "Operator").

Before using the website https://www.btkcompany.ru owned by JSC Industrial Assets (hereinafter — the "Resources"), please read the terms of this Policy. By using the Resources, you confirm that you have read the terms of this Policy in full before use. Any use of the Resources in any form constitutes your acceptance of this Policy and your consent to the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymisation, blocking, deletion, and destruction of personal data using automated or non-automated means.

The Policy may be amended by the Operator. The new version of the Policy takes effect upon its publication on the Resources.

1. Key Definitions

  • Personal data — any information relating directly or indirectly to an identified or identifiable natural person (personal data subject);
  • Personal data permitted by the subject for dissemination — personal data to which unrestricted access has been granted by the personal data subject by giving consent to processing in accordance with the Federal Law;
  • Operator — a state authority, municipal authority, legal entity or individual that independently or jointly with others organises and/or carries out the processing of personal data, and determines the purposes and scope of personal data processing;
  • Processing of personal data — any action (operation) or set of actions performed using automated or non-automated means with personal data, including collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, anonymisation, blocking, deletion, and destruction;
  • Automated processing of personal data — processing of personal data using computer technology;
  • Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons;
  • Provision of personal data — actions aimed at disclosing personal data to a specific person or a defined group of persons;
  • Blocking of personal data — temporary suspension of personal data processing (except where processing is required to clarify personal data);
  • Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in an information system and/or the physical media are destroyed;
  • Anonymisation of personal data — actions as a result of which it becomes impossible to determine the identity of a personal data subject without additional information;
  • Personal data information system — a set of personal data contained in databases together with the information technologies and technical means used to process them.

2. Purposes, Categories and Legal Bases for Processing Personal Data

The Operator may process personal data solely for the purposes for which it was collected or received. In particular, the Operator may process personal data to achieve the purposes listed in Annex No. 1. Personal data may also be processed for other purposes established by the approved List of Personal Data Processed by the Operator (hereinafter — the "List of Personal Data").

For each processing purpose, the List of Personal Data defines, among other things:

  1. categories of Subjects whose personal data is processed by the Operator;
  2. list of categories of personal data being processed;
  3. legal bases for processing personal data;
  4. retention periods for personal data;
  5. procedure for destroying personal data.

The List of Personal Data shall be reviewed by the person responsible for organising personal data processing at least once a year, and as necessary when processing procedures change.

The Operator is entitled to collect, enter personal data into information systems, store and process data by any means not prohibited by law, with or without automated means. Upon achieving the processing purposes or if such purposes are no longer necessary, the personal data shall be destroyed.

The Operator does not process biometric data or information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or the intimate life of personal data subjects. The Operator does not publish personal data in publicly available sources or distribute personal data without the Subject's consent or as required by law.

The Operator processes personal data on the following lawful bases:

  1. conclusion and performance of a contract to which the personal data subject is a party, beneficiary or guarantor, or for the conclusion of a contract at the personal data subject's initiative;
  2. with the consent of the personal data subject, provided in paper form, via web forms, or otherwise;
  3. to perform functions and obligations imposed on the Operator by applicable law;
  4. to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant goals, provided that the rights and freedoms of the personal data subject are not violated.

3. Principles of Personal Data Processing

When processing personal data, the Operator is guided by Federal Law No. 152-FZ of 27 July 2006 "On Personal Data". The Operator processes personal data in accordance with the following principles:

  1. personal data is processed on a lawful and fair basis;
  2. processing is limited to specific, pre-determined and lawful purposes;
  3. processing incompatible with the purposes for which the data was collected is not permitted;
  4. merging databases containing personal data processed for incompatible purposes is not permitted; only personal data that meets the processing purposes shall be processed;
  5. the content and volume of personal data processed must correspond to the stated purposes; excessive processing relative to those purposes is not permitted;
  6. during processing, the accuracy, adequacy, and where necessary the relevance of personal data in relation to the processing purposes must be ensured;
  7. personal data shall be stored in a form that allows identification of the subject for no longer than required by the processing purposes, unless a retention period is established by federal law, consent, or contract;
  8. personal data shall be destroyed upon achieving the processing purposes or when such purposes are no longer necessary, unless otherwise provided by federal law;
  9. personal data processing shall not be used to cause property and/or moral harm to personal data subjects or to hinder the exercise of their rights and freedoms.

4. Conditions for Processing Personal Data

The Operator processes personal data in accordance with this Policy, the Operator's internal regulations, and the legislation of the Russian Federation.

Personal data is processed by the Operator and by third parties engaged by the Operator or to whom personal data is transferred in accordance with Russian legislation. Such third parties may include, in particular:

  1. legal entities belonging to the same group of companies as JSC Industrial Assets pursuant to Art. 9 of Federal Law No. 135-FZ of 26 July 2006 "On Protection of Competition", for intra-group interaction and corporate governance;
  2. the Operator's contractors providing support services for information systems in use (CDP platform Mindbox, CMS 1C-Bitrix, etc.), hosting, access control, legal, audit and other services;
  3. the Operator's contractors providing storage, website hosting, and support for information systems in use;
  4. state/municipal authorities in cases established by law.

The Operator is entitled to engage third parties to process personal data and/or transfer such data to them without additional consent from the Subject, provided those third parties ensure the confidentiality and security of personal data.

Processing of personal data by a third party may only be carried out under a contract that defines the list of actions (operations) with personal data, processing purposes, and provisions for ensuring personal data security.

The Operator prohibits making decisions based solely on automated processing of personal data that produce legal consequences for the Subject or otherwise affect their rights and legitimate interests. The Operator does not publish personal data in publicly available sources without the Subject's written consent.

5. Personal Data Security Measures

The Operator undertakes to implement necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, distribution, or other unlawful actions. The Operator's personal data security measures include, among others:

  1. recording of processed categories and lists of personal data, categories of Subjects, retention periods and destruction procedures;
  2. recording of personal data storage locations and the Operator's information systems;
  3. determination of the required level of protection for personal data processed in information systems;
  4. identification of personal data security threats during processing in information systems;
  5. determination and implementation of technical and organisational protective measures before introducing new processing procedures;
  6. conducting and documenting assessments of potential harm to personal data subjects in the event of a violation of the Personal Data Law;
  7. establishing access rules for personal data processed in information systems and recording actions taken with personal data;
  8. applying information protection tools that have undergone the established conformity assessment procedure;
  9. detecting instances of unauthorised access to personal data and taking measures to address consequences;
  10. restoring personal data modified or destroyed as a result of unauthorised access;
  11. recording positions of the Operator's employees who require access to personal data for their duties;
  12. familiarising the Operator's employees with Russian personal data legislation and conducting employee training;
  13. monitoring and evaluating the effectiveness of security measures prior to commissioning an information system;
  14. conducting regular internal control and audits of personal data processing and security compliance with applicable Russian law.

The Operator has appointed persons responsible for organising personal data processing and ensuring its security. Internal documents and relevant agreements with partners and contractors define procedures for: granting access to information; amending personal data; destroying or blocking personal data; handling personal data subject requests; handling requests from the supervisory authority; obtaining Subject consent; transferring personal data to third parties; working with physical personal data media; and notifying the supervisory authority within prescribed timeframes.

When collecting personal data, the Operator ensures it is processed using databases located within the territory of the Russian Federation.

6. Use of Cookies and Other Web Analytics Tools

Cookies are small files created and stored by your browser when you visit the Operator's websites. Cookies are stored on your device for up to 13 months and are used to track website performance and usage characteristics, as well as to optimise online marketing activities.

Visiting and using websites involves the generation and storage of cookies by default. However, the Subject may delete cookies from their device at any time via browser settings. The Subject may also decline cookies, though this may affect the availability of certain website functions.

The Operator's website uses the following types of web analytics tools:

Technical and functional cookies

Generated by website engines, these files are used to ensure uninterrupted website operation and to remember settings selected by the Subject (such as language preferences and pop-up banner controls).

Marketing and analytical cookies and pixels

Yandex.Metrica, Mindbox, and 1C-Bitrix are used to collect and statistically analyse data related to website usage. Additional pixels from third-party services may also be used. The data obtained through these services does not allow individual users to be identified.

7. Rights of Personal Data Subjects and Contact Information

When their personal data is being processed, Subjects have the right to:

  1. request information regarding the processing of their personal data;
  2. demand clarification, destruction or blocking of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated processing purpose;
  3. withdraw consents provided to the Operator for the processing of personal data;
  4. appeal the Operator's actions through administrative or judicial proceedings.

For any questions or requests regarding the processing of personal data, including withdrawal of consents, Subjects may contact:

  • By email: info@btkcompany.ru
  • By post: 188640, Leningrad Region, Vsevolozhsk District, Vsevolozhsk, Leningradskaya St., 14/1, premises 41

The Operator responds to Subject requests within the timeframes established by Russian law. If additional information is required, the Operator may extend the response period by up to 5 business days, provided that a reasoned notice of the extension is sent to the Subject.

Annex No. 1. List of Personal Data Processing Purposes

Processing Purpose Categories of Personal Data Categories of Subjects Retention Period Destruction Procedure
Recruitment and selection of candidates for vacant positions, including verification of information provided by applicants
  • Full name
  • Gender
  • Date of birth
  • Contact phone numbers
  • Contact email addresses
  • Citizenship
  • Work experience details
  • Employment preferences
  • Other information contained in the CV
 Job applicants Within 12 months from the date the applicant submitted their CV Deletion from information systems
Interaction with contractors and partners, including due diligence procedures
  • Full name
  • Contact email address
  • Contact phone number
 Contractors, representatives and other employees of contractors Within 5 years from the date of termination of the contractual relationship Deletion from information systems, destruction of physical media (shredding and other methods)
Preparation and publication of advertising materials
  • First and last name
  • Photo and video images
 Contractors, representatives and other employees of contractors (models) Within 5 years from the date consent was given, if no contract was concluded Deletion from information systems
Development and maintenance of the Resources, including provision of the Resources, conclusion, performance and termination of contracts for their use, analysis, monitoring and improvement of service quality
  • Full name
  • Date of birth
  • Gender
  • Delivery addresses
  • Contact phone numbers
  • Contact email addresses
  • Information about use of mobile applications or devices
 The Operator's customers Within 5 years from the date of the user's last login to their account Deletion from information systems
Advertising and promotion of goods through direct contact
  • Full name
  • Delivery addresses
  • Contact phone numbers
  • Contact email addresses
 The Operator's mailing list subscribers For the duration of the consent to personal data processing Deletion from information systems
Product quality control, including handling of complaints and claims
  • First and last name
  • Contact phone number or email address
  • Residential address
 The Operator's customers For the duration of processing the customer's application and 3 years thereafter Deletion from information systems, destruction of physical media (shredding and other methods)
Digital marketing, lead generation and targeting, including recording of Subject permissions and consents
  • Full name
  • Registration number
  • Contact phone number
  • Contact email address
  • Pixel and web analytics system IDs
  • Technical device information (IP address, MAC address, system IDs, etc.)
  • Subscription information
  • Social media usernames
 Users of the Operator's Resources Within 1 year from the date of the last website visit Deletion from information systems

Information on the processing of personal data for other purposes and/or other categories of personal data subjects is communicated by the Operator to data subjects through familiarisation with other internal regulatory documents, in particular the Personal Data Processing Regulations, available at the Operator's office, on the website https://www.btkcompany.ru, or provided by the Operator in another manner.

This Policy takes effect upon its publication on the website. Previous versions of personal data processing documents become invalid upon the entry into force of this Policy.

The full version of the Personal Data Processing Policy of JSC Industrial Assets is available at: https://btkcompany.ru/personal-data-policy

Requests from personal data subjects to submit a "Request to Cease Processing of Personal Data" are accepted by email: info@btkcompany.ru

© 2026 JSC Industrial Assets. All rights reserved.