Personal Data Processing Policy

General Provisions and Information About the Document
Responsibility and Scope
Key Terms
Principles of Personal Data Processing
Purposes of Personal Data Processing
Legal Grounds, Procedure and Conditions for Personal Data Processing
Storage and Destruction of Personal Data
Collection, Transfer and Entrusting the Processing of Personal Data
Procedure for Handling Requests and Inquiries from Personal Data Subjects
Rights of Personal Data Subjects
Obligations of the Company
Personal Data Protection Measures Implemented by the Company
Cookie Processing Rules
Operator Details and Regulatory References

1. General Provisions and Information About the Document

1.1. This Personal Data Processing Policy of Limited Liability Company “LUCH” (ООО «ЛУЧ») (hereinafter referred to as the “Policy”) defines the key principles, purposes, procedures and conditions for the processing of personal data, the rights of personal data subjects, the obligations of LLC “LUCH” (hereinafter referred to as the “Company” or the “Operator”), as well as the key requirements for personal data protection.

1.2. This Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”, and other regulatory legal acts of the Russian Federation governing personal data protection.

1.3. This Policy is a publicly available document. The Company ensures unrestricted access to the Policy, including when personal data is collected through the Internet.

1.4. This Policy applies to all personal data received by the Company directly from personal data subjects or from third parties on lawful grounds, as well as to personal data processed when using the Company’s online resources.

1.5. Access to this Policy is not restricted.

2. Responsibility and Scope

2.1. This Policy is binding on the Company’s employees and other persons duly authorized to process personal data.

2.2. The Company appoints a person responsible for organizing personal data processing and, where necessary, persons responsible for ensuring the security of personal data in information systems.

2.3. Persons responsible for violating the requirements of the legislation of the Russian Federation and the Company’s internal regulations in the field of personal data processing and protection shall be held liable in accordance with the legislation of the Russian Federation.

3. Key Terms

3.1. Automated processing of personal data means personal data processing using computer technology.

3.2. Biometric personal data means information describing physiological and biological characteristics of an individual that may be used to establish their identity and is used by the Operator for the purpose of identifying the personal data subject.

3.3. Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify such personal data.

3.4. Personal Data Information System (PDIS) means a set of personal data contained in databases and the information technologies and technical means used to process such data.

3.5. Processing of personal data means any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer, anonymization, blocking, deletion and destruction.

3.6. Personal data means any information relating directly or indirectly to an identified or identifiable individual.

3.7. Personal data subject means the individual to whom the personal data relates.

3.8. Special categories of personal data means personal data relating to race and nationality, political opinions, religious or philosophical beliefs, health, intimate life, as well as information regarding criminal convictions.

3.9. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to a foreign state authority, foreign individual or foreign legal entity.

3.10. Destruction of personal data means actions that make it impossible to restore the contents of personal data in a PDIS and/or result in the destruction of physical media containing personal data.

3.11. Cookie means a small piece of data stored on a user’s device when visiting a website and used to ensure website functionality, analytics and other stated purposes.

4. Principles of Personal Data Processing

4.1.1. Personal data shall be processed lawfully and fairly.

4.1.2. Personal data processing shall be limited to the achievement of specific, predetermined and lawful purposes.

4.1.3. Personal data shall not be processed in a manner incompatible with the purposes for which it was collected.

4.1.4. Databases containing personal data shall not be combined where the purposes of processing such data are incompatible.

4.1.5. Only personal data relevant to the stated purposes of processing shall be processed.

4.1.6. The content and scope of personal data being processed shall correspond to the stated purposes and shall not be excessive in relation to those purposes.

4.1.7. The accuracy, sufficiency and, where necessary, relevance of personal data shall be ensured.

4.1.8. Personal data shall not be stored for longer than required for the purposes of processing, unless a different retention period is established by law or contract.

4.1.9. Upon achievement of the purposes of processing or when the need to achieve such purposes ceases to exist, personal data shall be destroyed or anonymized unless otherwise provided by the legislation of the Russian Federation.

5. Purposes of Personal Data Processing

5.1. The Company processes personal data solely for specific, predetermined and lawful purposes.

5.2. The main purposes of personal data processing, categories of personal data subjects, categories of personal data processed, legal grounds, retention periods and processing methods are specified in Appendix 1 to this Policy.

5.3. The list of purposes of personal data processing shall be updated whenever the Company’s business processes, information systems, methods of interaction with personal data subjects or requirements of the legislation of the Russian Federation change.

5.4. The Company does not process special categories of personal data or biometric personal data, except where such processing is expressly provided for by the legislation of the Russian Federation or where another appropriate legal basis exists.

6. Legal Grounds, Procedure and Conditions for Personal Data Processing

6.1. The legal grounds for personal data processing include the Constitution of the Russian Federation, the Civil Code of the Russian Federation, the Labour Code of the Russian Federation, the Tax Code of the Russian Federation, Federal Law No. 14-FZ dated February 8, 1998 “On Limited Liability Companies”, Federal Law No. 402-FZ dated December 6, 2011 “On Accounting”, Federal Law No. 167-FZ dated December 15, 2001 “On Mandatory Pension Insurance in the Russian Federation”, Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”, other regulatory legal acts of the Russian Federation, as well as the Company’s Charter and internal regulations.

6.2. Depending on the purpose of processing, the legal basis may also include: consent of the personal data subject; a contract to which the personal data subject is a party, beneficiary or guarantor; the need to perform duties and exercise powers imposed on the Company by the legislation of the Russian Federation; and other grounds provided for by the legislation of the Russian Federation.

6.3. Personal data may be processed using automated means, without using automated means, or by a combination of both methods.

6.4. Only employees and other persons who require access to personal data in order to perform their employment or contractual duties and who have been granted such access in accordance with the Company’s established procedures may process personal data.

6.5. When collecting personal data of citizens of the Russian Federation, including via the Internet, the Company ensures that such personal data is recorded, systematized, accumulated, stored, updated and retrieved using databases located within the territory of the Russian Federation, except in cases expressly provided for by law.

6.6. The Company does not make decisions that produce legal consequences for a personal data subject or otherwise affect their rights and legitimate interests solely on the basis of automated processing of personal data, unless otherwise provided for by law or by the written consent of the personal data subject.

7. Storage and Destruction of Personal Data

7.1. Personal data shall be stored in a form that makes it possible to identify the personal data subject for no longer than required for the purposes of processing, unless another retention period is established by the legislation of the Russian Federation, a contract or another agreement with the personal data subject.

7.2. Upon achievement of the purpose of personal data processing, the Company shall cease processing and destroy the personal data or ensure its destruction within the period established by the legislation of the Russian Federation, unless other lawful grounds for continued processing exist.

7.3. If consent to personal data processing is withdrawn, the Company shall cease processing and destroy the personal data within the periods established by law, provided that further storage is no longer required for the purposes of processing and there are no other legal grounds for continued processing.

7.4. Upon receipt of a request from a personal data subject to cease processing their personal data, the Company shall consider such request and cease processing within the time limits and in the cases provided for by Federal Law No. 152-FZ.

7.5. Where it is not possible to destroy personal data within the prescribed period, the Company shall block such data or ensure its blocking and shall destroy it within a period not exceeding six months, unless another period is established by federal law.

7.6. The destruction of personal data shall be documented in accordance with the legislation of the Russian Federation and the Company’s internal regulations.

8. Collection, Transfer and Entrusting the Processing of Personal Data

8.1. As a general rule, the Company obtains personal data directly from personal data subjects. Personal data may be obtained from third parties where there is a lawful basis for doing so.

8.2. For the purpose of achieving the stated processing objectives, the Company may engage third parties and entrust them with the processing of personal data, provided that the requirements of the legislation of the Russian Federation are complied with and the confidentiality and security of personal data are ensured.

8.3. Depending on the specific purpose of processing, such third parties may include telecommunications operators, banks, insurance companies, electronic document management service providers, hosting and IT service providers, courier and postal services, auditors, educational institutions, recruitment services and other contractors of the Company.

8.4. Personal data may be transferred to government authorities and other authorized persons in the cases and to the extent provided for by the legislation of the Russian Federation.

8.5. The Company shall not disclose personal data to third parties or otherwise distribute personal data without the consent of the personal data subject, unless otherwise provided for by federal law. Where required by law, consent to the distribution of personal data shall be obtained separately.

8.6. Cross-border transfers of personal data are permitted only in compliance with the requirements of Article 12 of Federal Law No. 152-FZ, including completion of the preliminary procedures prescribed by law and notification of the competent authority prior to commencing such transfer.

9. Procedure for Handling Requests and Inquiries from Personal Data Subjects

9.1. A personal data subject or their representative may contact the Company with a request for information regarding the processing of their personal data, as well as with a request to clarify, block, delete or cease processing personal data.

9.2. The request must contain information sufficient to identify the applicant and confirm their right to obtain the requested information in cases provided for by the legislation of the Russian Federation.

9.3. The Company shall consider requests and inquiries in accordance with the procedure and within the time limits established by Federal Law No. 152-FZ. Where permitted by law, the response period may be extended, provided that the personal data subject is sent a reasoned notice of such extension.

9.4. Information shall be provided in the same form in which the relevant request or inquiry was submitted, unless otherwise specified by the applicant and provided that this does not conflict with the legislation of the Russian Federation.

9.5. Where lawful grounds exist, the Company may refuse to satisfy a request by providing a reasoned response.

10. Rights of Personal Data Subjects

10.1. A personal data subject has the right to obtain information regarding the processing of their personal data by the Company, except in cases established by federal law.

10.2. A personal data subject has the right to request clarification, blocking or destruction of personal data where such data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing.

10.3. A personal data subject has the right to withdraw their consent to personal data processing in whole or in part.

10.4. A personal data subject has the right to request that the processing of personal data be discontinued in cases provided for by law.

10.5. A personal data subject has the right to challenge the actions or omissions of the Company before the competent authority responsible for protecting the rights of personal data subjects or before a court.

10.6. A personal data subject may exercise any other rights provided for by the legislation of the Russian Federation.

11. Obligations of the Company

11.1. The Company shall appoint a person responsible for organizing personal data processing.

11.2. The Company shall adopt internal regulations and other documents necessary for organizing the processing and protection of personal data.

11.3. The Company shall carry out internal control and/or audits to ensure that personal data processing complies with applicable legislation and the Company’s internal regulations.

11.4. The Company shall assess the potential harm that may be caused to personal data subjects in the event of a violation of personal data legislation and shall correlate such potential harm with the protection measures implemented.

11.5. The Company shall familiarize employees directly involved in personal data processing with the requirements of applicable legislation and the Company’s internal regulations.

11.6. The Company shall provide unrestricted access to this Policy in cases prescribed by law.

11.7. The Company shall take legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or distribution.

11.8. The Company shall ensure compliance with data localization requirements when collecting personal data of citizens of the Russian Federation.

11.9. Where incidents involving unlawful or accidental transfer of personal data are identified, the Company shall take the measures required by law and submit the required notifications to the competent authority.

11.10. The Company shall perform all other obligations imposed on personal data operators by Federal Law No. 152-FZ and other regulatory legal acts.

12. Personal Data Protection Measures Implemented by the Company

12.1. Identification of threats to the security of personal data processed in PDIS.

12.2. Implementation of organizational and technical measures necessary to ensure the security of personal data and compliance with applicable protection requirements.

12.3. Use of information security tools that have undergone conformity assessment where the use of such tools is required by law.

12.4. Assessment of the effectiveness of personal data security measures prior to commissioning PDIS and during their operation.

12.5. Registration and safeguarding of physical and electronic media containing personal data and restriction of access to such media.

12.6. Detection of unauthorized access and implementation of measures aimed at preventing, detecting and mitigating the consequences of cyberattacks and security incidents.

12.7. Restoration of personal data modified or destroyed as a result of unauthorized access where such restoration is possible and necessary.

12.8. Establishment of rules governing access to personal data and logging of actions performed with such data where required by the rules applicable to the relevant information systems.

12.9. Monitoring of implemented protection measures and the level of security of personal data.

12.10. Restriction of access to personal data based on employees’ job responsibilities.

12.11. Implementation of security arrangements for premises and workplaces where personal data is processed, where applicable.

12.12. Data backup and other measures aimed at ensuring the availability and integrity of data in accordance with the Company’s internal requirements and the legislation of the Russian Federation.

13. Cookie Processing Rules

13.1. The Company’s websites may use cookies and other similar technologies.

13.2. Depending on their purpose, the following categories of cookies may be used:

• technical cookies — cookies required for the correct operation of the website and its individual functions;

• analytics cookies — cookies used to evaluate website traffic and users’ interaction with website pages;

• functional cookies — cookies used to remember settings and preferences selected by the user;

• other cookies — where there is an appropriate purpose and lawful basis for their use.

13.3. The retention period for cookies depends on their type and purpose and is limited to the period necessary to achieve the relevant purpose.

13.4. Where the use of cookies requires the user’s consent, the Company provides users with the opportunity to give such consent or refuse the relevant processing using the mechanisms provided on the website. Users may also change cookie settings in their browser.

13.5. Technical cookies that are necessary for the proper functioning of the website may be used to the extent required to provide the website’s functionality to the user.

14. Operator Details and Regulatory References

14.1. Personal Data Operator:

• Full legal name: Limited Liability Company “LUCH” (Общество с ограниченной ответственностью «ЛУЧ»).

• Abbreviated legal name: LLC “LUCH” (ООО «ЛУЧ»).

• Primary State Registration Number (OGRN): 1253500003833.

• Taxpayer Identification Number (INN): 3500014575.

• Tax Registration Reason Code (KPP): 350001001.

• Address: Premises 4, 3 Rabochaya St., Sosnovka Settlement, Vologodsky Municipal District, Vologda Region, 160523, Russian Federation.

• Telephone: +7 (495) 258-04-88.

• Email: info@luch.energy.

14.2. The principal regulatory act governing personal data processing is Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”.

14.3. Matters relating to the legal status of the Company are governed by Federal Law No. 14-FZ dated February 8, 1998 “On Limited Liability Companies”.

14.4. This Policy shall remain in effect until replaced by a new version. The Company may amend this Policy in the event of changes to applicable legislation, business processes or methods of personal data processing.