Personal Data Processing Policy

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter — the Policy) defines the procedure and conditions for processing personal data, measures to ensure the security of personal data, as well as the rights of personal data subjects when interacting with the Operator.

1.2. The Policy applies to all information that the Operator may receive about visitors to the website https://eurovent.ru, users of website services/forms, as well as representatives of counterparties and other persons whose personal data is processed by the Operator.

1.3. The Policy applies to personal data processed with and without the use of automation tools.

1.4. The Operator processes personal data on a lawful and fair basis and limits processing to the achievement of specific, predetermined and legitimate purposes.

1.5. The Policy has been developed in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" (as amended) to ensure protection of the rights and freedoms of individuals when processing their personal data.

1.6. Control over compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing personal data processing by the Operator.

1.7. The person responsible for organizing personal data processing at STC EUROVENT LLC is the General Director. Contact e-mail for personal data processing inquiries: info@ntc-eurovent.ru

1.8. The Operator has submitted a notification (registration) to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) in accordance with the established legal procedure.

1.9. Liability for violation of the requirements of the legislation of the Russian Federation in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2. Terms and Definitions

2.1. Personal data — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).

2.2. Personal data subject — a natural person to whom personal data relates.

2.3. Operator — STC EUROVENT LLC, a legal entity that independently or jointly with other persons organizes and (or) carries out personal data processing, as well as determines the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data.

2.4. Personal data processing — any action (operation) or set of actions (operations) with personal data, including: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

2.5. Automated processing of personal data — processing using computer technology.

2.6. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.7. Distribution of personal data — actions aimed at disclosing personal data to an indefinite group of persons.

2.8. Blocking of personal data — temporary suspension of personal data processing (except for cases when processing is necessary for clarification of personal data).

2.9. Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed.

3. Processing Principles

3.1. The Operator is guided by the following principles when processing personal data:

• Lawfulness and fairness of processing.
• Limitation of processing to the achievement of specific, predetermined and legitimate purposes.
• Prevention of processing of personal data incompatible with the purposes of collection.
• Correspondence of the content and volume of processed personal data to the stated purposes of processing.
• Accuracy, sufficiency and relevance of personal data in relation to the purposes of processing.
• Storage of personal data in a form that allows identification of the personal data subject for no longer than required by the purposes of processing.
• Ensuring confidentiality and security of personal data during processing.

4. Categories of Subjects and Data

4.1. The Operator may process personal data of the following categories of subjects:

• Website visitors who submit applications/requests/inquiries through website forms.
• Clients (individuals) and representatives of clients/counterparties (legal entities and individual entrepreneurs).
• Representatives of suppliers/contractors/partners.
• Persons contacting regarding warranty/service maintenance, technical support.
• Applicants (when submitting resumes/responses to vacancies).
• Other persons sending inquiries to the Operator.

4.2. Depending on the situation and purpose of processing, the Operator may process the following categories of personal data:

• Last name, first name, patronymic (or last name and first name).
• Contact phone number.
• Email address.
• Position, name of organization (for representatives of legal entities).
• City/region of location or registration.
• Content of the inquiry/application.
• Passport data (for concluding contracts).
• Delivery/facility address (if necessary).
• Technical data when visiting the website: IP address, browser information, cookies.

4.3. The Operator does not process special categories of personal data relating to racial, national origin, political views, religious or philosophical beliefs, health status, intimate life.

5. Purposes of Personal Data Processing

5.1. The Operator processes personal data for the following purposes:

5.1.1. Communications and Application Processing

• Processing incoming inquiries, applications, requests for consultations, equipment selection, cost calculations.
• Organizing callback, email correspondence.

5.1.2. Pre-contractual Work and Contract Execution

• Preparation, conclusion and execution of contracts.
• Identification of the contract party and/or party representative.
• Conducting negotiations, agreeing on terms, exchanging documents.

5.1.3. Order Fulfillment and Logistics

• Picking, shipping, delivery, transfer of products.
• Organizing interaction with transport/courier companies.

5.1.4. Service and Warranty Maintenance

• Processing requests for warranty service, repairs, claims.
• Maintaining a history of requests and service applications.

5.1.5. Financial Operations, Accounting and Tax Accounting

• Issuing invoices, making payments, refunds.
• Fulfilling requirements of the legislation of the Russian Federation in the field of accounting and tax accounting.

5.1.6. Marketing and Information

• Sending informational messages (with consent).
• Sending advertising/marketing mailings (with consent).

5.1.7. Website Improvement and Security

• Ensuring the operability and functioning of the website.
• Ensuring information security, preventing fraud.

6. Legal Grounds for Processing

6.1. The Operator processes personal data in the presence of at least one of the following legal grounds:

• Consent of the personal data subject to the processing of their personal data.
• Necessity of processing for the conclusion and (or) execution of a contract.
• Necessity of fulfilling obligations imposed on the Operator by the legislation of the Russian Federation.
• Other grounds provided by Federal Law No. 152-FZ.

7. Procedure and Conditions of Processing

7.1. Personal data processing includes the following actions: collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, depersonalization, blocking, deletion, destruction.

7.2. The Operator carries out both automated and non-automated processing of personal data.

7.3. Personal data may be processed using information systems: CRM systems, email systems, document management systems.

7.4. The Operator ceases processing and destroys personal data upon achievement of processing purposes or upon withdrawal of consent by the subject.

7.5. Personal data is stored by the Operator for no longer than required by the purposes of their processing.

7.6. The personal data subject may update data by sending a notification to info@ntc-eurovent.ru with the note "Personal Data Update".

7.7. The personal data subject may withdraw consent by sending a notification to info@ntc-eurovent.ru with the note "Withdrawal of Consent to Personal Data Processing".

8. Transfer to Third Parties

8.1. The Operator has the right to entrust personal data processing to third parties in the presence of legal grounds and conclusion of an appropriate agreement.

8.2. Such third parties may include:

• Hosting and cloud storage service providers.
• IT contractors and software developers.
• Courier delivery services and transport companies.
• Email and mass mailing service providers.
• Accounting and legal support organizations.

8.3. The Operator does not distribute personal data to an indefinite group of persons without the subject's consent.

8.4. Transfer of personal data to government authorities is carried out in accordance with the requirements of the legislation of the Russian Federation.

9. Cross-border Transfer and Localization

9.1. When collecting personal data, the Operator ensures the storage of personal data of citizens of the Russian Federation on the territory of the Russian Federation.

9.2. Cross-border transfer of personal data is carried out in compliance with the requirements of the legislation of the Russian Federation.

10. Cookies and Technical Data

10.1. The Operator's website may use cookies to ensure proper website functioning, analyze traffic, and improve service quality.

10.2. The user may restrict the use of cookies in browser settings.

10.3. The Operator may use web analytics services (Yandex.Metrica, Google Analytics).

11. Personal Data Protection Measures

11.1. The Operator takes necessary legal, organizational and technical measures to protect personal data.

11.2. Such measures include:

• Identifying current threats to personal data security.
• Developing internal documents on personal data processing and protection.
• Restricting physical access to premises.
• Differentiating access rights to information systems.
• Applying information protection tools.
• Using HTTPS protocol for the website.
• Data backup.
• Training Operator employees.

12. Rights of Personal Data Subject

12.1. The personal data subject has the right to:

• Receive information regarding the processing of their personal data.
• Require clarification, blocking or destruction of personal data.
• Withdraw consent to personal data processing.
• Receive information about provision of data to third parties.
• Appeal the Operator's actions to Roskomnadzor or in court.
• Protect their rights, including compensation for damages.

13. Procedure for Personal Data Subject Inquiries

13.1. Inquiries should be sent to: info@ntc-eurovent.ru with the note "Personal Data".

13.2. The inquiry must contain: full name, identity document number, information confirming participation in relations with the Operator, signature.

13.3. If information is incomplete, the Operator sends a reasoned refusal within 30 days.

13.4. Upon receipt of consent withdrawal, the Operator ceases processing within 30 days.

14. Final Provisions

14.1. This Policy is valid indefinitely from the moment of its approval.

14.2. The current version of the Policy is posted on the website https://eurovent.ru.

14.3. Please send all questions to: info@ntc-eurovent.ru

14.4. Relations not regulated by this Policy are governed by Federal Law No. 152-FZ.