Personal Data Processing Policy

The following key terms and definitions are used in the Policy:

• a)personal data processing means any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), blocking, deletion and destruction of personal data;
• b)personal data means any information relating to a directly or indirectly identified or identifiable natural person;
• c)data subject means a natural person to whom personal data directly or indirectly relate;

Other terms used in the Policy have the meaning given to them by the Personal Data Law.

The Operator collects, records, systematises, accumulates, stores, clarifies (updates, modifies), retrieves, uses, anonymises, blocks, deletes, transfers and destroys personal data. The Operator processes personal data using automation tools.

Personal data of citizens of the Russian Federation are processed only using databases located in the territory of the Russian Federation. The Operator does not transfer personal data across borders to foreign states.

When transferring personal data of data subjects to third parties, the Operator ensures that the following conditions are met:

• a)the necessary measures to protect personal data have been taken;
• b)the transfer is reasonably necessary to achieve the processing purposes set by the Operator;
• c)personal data are transferred in the minimum scope necessary to achieve the processing purposes;
• d)the third parties receiving personal data ensure the confidentiality and protection of personal data.

The Operator stops processing and destroys personal data in the cases and within the periods established by the legislation of the Russian Federation.

When the purposes of processing personal data have been achieved, or the need to achieve them has ceased, the Operator destroys the relevant personal data within a period not exceeding 30 days, unless a different retention period is established by law.

A data subject may withdraw their consent to the processing of personal data by contacting the Operator at the email address info@lmpgpartners.com. If a data subject withdraws consent to the processing of personal data, the Operator stops processing the personal data and, if their retention is no longer required for the purposes of processing and there are no other legal grounds for continued processing, destroys the personal data or ensures their destruction within a period not exceeding 30 days from the date the withdrawal is received.

The Operator destroys personal data by methods that make it impossible to restore the content of personal data in personal data information systems and, in respect of tangible media, by physically destroying them or by another method that rules out subsequent restoration and use of personal data.

To analyse traffic and visitor behaviour, assess effectiveness and improve the operation and content of the Website, the Operator uses the Yandex Metrica web analytics service provided by YANDEX LLC (TIN 7736207543).

When the Yandex Metrica service is used, information collected by means of metric programs may be processed, including the visitor’s IP address, cookies, the address of the page visited and of the page from which the visitor came, the date and time of the visit, the duration of the visit, information about the browser and its version, the operating system, device type, screen resolution, browser language and time zone, as well as information about page views and the visitor’s actions on the Website.

The Website and the Yandex Metrica service use cookies that are necessary for the operation of that web analytics service and for collecting the statistical information referred to in clause 4.2 of the Policy.

In respect of the personal data of Website visitors, Joint-Stock Company “LMPG - Consulting” is the personal data operator, and YANDEX LLC processes personal data on behalf of the Operator under the agreement published online at https://yandex.ru/legal/metrica_termsofuse/ru/.

Personal data are processed using Yandex Metrica on the basis of the Website visitor’s consent. Until consent is given, the Yandex Metrica code is not loaded and no information is collected by means of that service.

A visitor gives consent by clicking the “Allow analytics” button, the “I agree” button or another corresponding button shown in the information banner on the Website. Refusing to give consent does not restrict the visitor’s access to the Website and its main functions.

A visitor may withdraw consent at any time by changing the analytics settings on the Website. A visitor may also restrict the collection of information by the Yandex Metrica service using the functions of their browser.

In compliance with the Personal Data Law, the Operator has approved a procedure for handling requests and enquiries from personal data subjects, which provides for the following:

• a)a data subject has the right to receive information concerning the processing of their personal data within the periods set by the Personal Data Law;
• b)a data subject may require the Operator to clarify, block or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and may take the measures provided for by the Personal Data Law to protect their rights;
• c)a data subject may appeal against the actions or omissions of the Operator to the authorised body for the protection of the rights of personal data subjects or in court;
• d)a data subject has the right to protect their rights and legitimate interests, including compensation for losses and (or) moral damage, in court.

The Operator does not make decisions that give rise to legal consequences for data subjects or otherwise affect their rights and legitimate interests on the basis of solely automated processing of their personal data.

The Operator shall:

• a)provide a data subject, at their request, with information concerning the processing of their personal data;
• b)organise the processing of personal data in accordance with the procedure established by law;
• c)respond to requests and enquiries from data subjects and their legal representatives in accordance with the Personal Data Law;
• d)provide the authorised body for the protection of the rights of personal data subjects, at its request, with the necessary information within 10 days of receiving such a request;
• e)publish this Policy on the Website or otherwise ensure unrestricted access to it;
• f)take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, and against other unlawful actions in respect of personal data;
• g)stop the transfer (dissemination, provision, access) of personal data, stop processing and destroy personal data in the manner and cases provided for by the Personal Data Law;
• h)perform other obligations provided for by the Personal Data Law.