# PERSONAL DATA PROCESSING POLICY

## 1. GENERAL PROVISIONS

1.1. This policy of LLC "INT FIN LOGISTIC" (TIN 9909697628) and LLC "INT FACTORING" (TIN 9909697635), hereinafter referred to as the "Operator", describes the procedure for processing personal data and is aimed at protecting the rights and legitimate interests of data subjects. The document has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006 "On Personal Data".

1.2. The Policy defines the procedure and measures to ensure the security of personal data processing on the website this website, with the goal of protecting human and civil rights and freedoms, including the right to privacy, personal and family secrets.

1.3. The document covers all processes carried out by the Operator relating to the processing of personal data.

1.4. The Policy is mandatory for study and compliance by all persons authorized to process personal data.

1.5. It applies to all actions related to the processing of personal data on the website this website and in the Operator's information systems.

1.6. A User who places an order, opens a personal account, or otherwise interacts with the Operator expresses consent to the processing of their personal data in accordance with the Policy and the legislation of the Russian Federation. Continued use of the website indicates agreement with the provisions of the Policy. A User who is not willing to agree to the terms should refrain from using the resource.

Additionally: This Policy applies to personal data collected both before and after the document comes into force.

## 2. TERMS AND DEFINITIONS

The following main terms and definitions are used in this Policy:

Personal Data (PD) — any information directly or indirectly related to a specific individual (personal data subject).

Personal Data Information System (PDIS) — a set of personal data stored in databases, as well as technologies and means for their processing.

Automated Processing of PD — data processing using computer means.

Blocking of PD — temporary suspension of data processing (except in cases of data clarification).

Depersonalization of PD — actions leading to the impossibility of determining the ownership of data to a specific person without additional information.

Internet Website (Website) — an automated information system available on the Internet at: this website.

Processing of PD — any actions with personal data, including collection, recording, storage, updating, use, transfer, destruction, and other operations.

Operator — a state or private body that independently or jointly organizes the processing of personal data.

Provision of PD — transfer of data to a specific person or group of persons.

Distribution of PD — disclosure of data to an indefinite number of persons, including publication in the media or on the Internet.

Cross-border Transfer of PD — transfer of data to foreign authorities, companies, or individuals.

Destruction of PD — actions leading to the loss of the ability to recover data or destruction of material carriers.

PD Subject — an individual whose information is being processed.

Confidentiality of PD — the Operator's obligation to protect data from distribution without the consent of the subject or a legal basis.

Seller (Contractor) — a person offering goods or services on the website this website.

User — a person visiting or using resources managed by the Operator, including the website this website.

Order — an order for goods or services placed by the User on the website.

Cookies — small files saved on the user's device to remember preferences and actions during subsequent visits to the website.

## 3. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

3.1. The legal basis for PD Processing, depending on the purposes of the process involving PD Processing, may be:

### 3.1.1. The Constitution of the Russian Federation, as well as a set of legal acts:

- Tax Code of the Russian Federation;
- Civil Code of the Russian Federation;
- Articles 86–90 of the Labor Code of the Russian Federation;
- Federal Law No. 115-FZ of August 7, 2001 "On Countering the Legalization (Laundering) of Proceeds of Crime and the Financing of Terrorism";
- Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
- Federal Law No. 39-FZ of April 22, 1996 "On the Securities Market";
- Federal Law No. 208-FZ of December 26, 1995 "On Joint-Stock Companies";
- Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and the Protection of Information";
- Federal Law No. 27-FZ of April 1, 1996 "On Individual (Personified) Accounting in the Mandatory Pension Insurance System";
- Federal Law No. 63-FZ of April 6, 2011 "On Electronic Signatures";
- Federal Law No. 402-FZ of December 6, 2011 "On Accounting";
- Federal Law No. 161-FZ of June 27, 2011 "On the National Payment System";
- Decree of the Government of the Russian Federation No. 687 of September 15, 2008 "On Approval of the Regulation on the Specifics of Personal Data Processing Carried Out Without the Use of Automation";
- Decree of the Government of the Russian Federation No. 1119 of November 1, 2012 "On Approval of the Requirements for the Protection of Personal Data During Their Processing in Personal Data Information Systems";
- other regulatory legal acts of the Russian Federation and regulatory documents of executive authorities.

3.1.2. The Operator's Charter.

3.1.3. Contracts concluded between the Operator and the Personal Data Subject, including in cases where the Operator exercises its right to assign rights (claims) under such contracts, between the Operator and another person who has entrusted the Operator with PD Processing, as well as for the conclusion of contracts of which Personal Data Subjects are parties.

3.1.4. Consent to PD Processing (in cases not directly provided for by the legislation of the Russian Federation, but corresponding to the Operator's powers), including the consent of applicants for vacant positions to PD Processing, the consent of interns to PD Processing, the consent of employees to PD Processing; the consent of clients to PD Processing, the consent of Users of the relevant Website, the consent of other Personal Data Subjects.

3.1.5. A contract between the operator and a third party, in which the latter entrusts the Operator with the processing of personal data of the Personal Data Subject or transfers personal data of the Personal Data Subject on the basis of a concluded contract.

## 4. CATEGORIES OF PERSONAL DATA SUBJECTS WHOSE PERSONAL DATA IS PROCESSED BY THE OPERATOR

4.1. The Operator processes PD obtained in accordance with the law, belonging to:

- Job candidates and employees of the Operator;
- Former employees of the Operator;
- Close relatives/family members of the Operator's employees, interns;
- Potential clients, individual clients, individual entrepreneur clients (individuals registered in the established manner and carrying out entrepreneurial activities without forming a legal entity), individuals engaged in private practice in accordance with the legislation of the Russian Federation (self-employed), individual beneficiaries, beneficial owners, representatives;
- Individuals who have entered into civil law contracts with the Operator, including purchase and sale, for the provision of services and/or performance of work for the Operator;
- Users of the Operator's Websites, Order recipients (if the User has specified another person as the Order recipient);
- Clients of other legal entities, the Processing of Personal Data for which is carried out on behalf of the said legal entities in accordance with the legislation of the Russian Federation;
- Owners of the Operator;
- Other subjects who have entered or intend to enter into contractual relations with the Operator and/or who apply to the Operator with applications/appeals.

## 5. CATEGORIES OF PERSONAL DATA PROCESSED BY THE OPERATOR

5.1. The Operator processes the following categories of PD of Users and Order recipients:

- Information obtained during registration and/or placing an Order (surname, first name, actual address, phone number, email address, cookies);
- Information obtained during interaction with Users (surname, first name, patronymic, gender, place of birth, date of birth, passport data (series, number, issuing authority, department code, issue date, registration address), actual address, phone number, email address);
- Information about the Order delivery method, payment method and payment status, and if the final Order recipient differs from the User, also the surname, first name, patronymic, gender, place of birth, date of birth, passport data, delivery address, and phone number of the Order recipient;
- Information about User complaints (submitted by the User via the Websites or otherwise);
- Geolocation (location) information.

5.2. The Operator processes the following categories of PD of Personal Data Subjects who contact the Operator with claims of alleged violation of their rights: surname, first name, actual address, contact information (phone number and/or email address) of the rights holder or other person whose right was allegedly violated, and/or the applicant, if acting as an authorized representative of the rights holder or other person whose right was allegedly violated, information about received claims, the progress and results of their consideration.

5.3. Personal data specified in the paragraphs of this section above may be obtained by the Operator in one of the following ways:

- Provided by Personal Data Subjects by filling in the appropriate forms on one of the Websites, by sending correspondence or emails to the Operator's email addresses;
- Obtained from third parties in cases provided for in this section. In particular, Users' PD may be obtained by the Operator directly from Sellers or other counterparties of the Operator in connection with the execution of the Seller's instructions and/or the performance of other actions provided for by the current legislation of the Russian Federation.

## 6. PRINCIPLES, PROCEDURE AND CONDITIONS OF PERSONAL DATA PROCESSING

### 6.1. Principles of Personal Data Processing

PD Processing by the Operator is carried out on the basis of the following principles:

- legality and fairness;
- limitation of PD Processing to the achievement of specific, predetermined and legitimate purposes;
- prevention of PD Processing incompatible with the purposes of PD collection;
- prevention of combining databases containing PD, the Processing of which is carried out for purposes incompatible with each other;
- Processing only such PD that correspond to the purposes of their Processing;
- compliance of the content and volume of Processed PD with the stated purposes of Processing;
- prevention of PD Processing that is excessive in relation to the stated purposes of their Processing;
- ensuring the accuracy, sufficiency and relevance of PD in relation to the purposes of PD Processing;
- storage of PD in a form that allows identifying the Personal Data Subject for no longer than required by the purposes of PD Processing;
- destruction or depersonalization of PD upon achieving the purposes of their Processing, upon withdrawal of consent to their Processing by the Personal Data Subject, or in the event of loss of the need to achieve these purposes.

### 6.2. Obligations of the Operator's Employees

Employees of the Operator authorized to Process Personal Data are obliged to:

- Know and strictly comply with the provisions of the legislation of the Russian Federation in the field of PD;
- Know and comply with the provisions of this Policy;
- Know and comply with the Operator's local acts on PD Processing and security;
- Process PD only within the scope of their job duties;
- Not disclose PD processed by the Operator;
- Report actions of other persons that may lead to violation of the provisions of this Policy.

6.3. The Operator is obliged to ensure that the Operator's employees who directly carry out the Processing of Personal Data are familiarized with the provisions of Russian legislation on Personal Data, including the requirements for PD protection, local acts on the Processing and protection of Personal Data, and training of the Operator's employees.

### 6.4. Conditions for Personal Data Processing

The Operator processes PD if at least one of the following conditions is met:

- PD Processing is carried out with the consent of the PD Subject to the Processing of their PD;
- PD Processing is necessary to achieve the goals provided for by an international treaty of the Russian Federation or by law;
- PD Processing is necessary for the administration of justice, execution of a judicial act;
- PD Processing is necessary for the performance of a contract to which the PD Subject is a party, beneficiary, or guarantor;
- PD Processing is necessary for the exercise of the rights and legitimate interests of the Operator or third parties;
- Processing of PD to which the PD Subject has provided access to an unlimited number of persons is carried out;
- Processing of PD subject to publication or mandatory disclosure in accordance with FZ-152 is carried out.

6.5. The Operator carries out PD Processing using automated and non-automated means, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (Distribution, Provision, access), Depersonalization, Blocking, deletion, Destruction of Personal Data within the timeframes necessary to achieve the purposes of Personal Data Processing.

6.6. The Operator is prohibited from making decisions based solely on the Automated Processing of Personal Data that produce legal consequences with respect to the Personal Data Subject, or otherwise affect their rights and legitimate interests, except in cases and conditions provided for by the legislation of the Russian Federation in the field of Personal Data.

6.7. Representatives of state authorities (including controlling, supervisory, law enforcement, inquiry, investigation, and other authorized bodies on grounds provided for by the current legislation of the Russian Federation) obtain access to PD Processed by the Operator in the scope and manner established by the legislation of the Russian Federation.

6.8. The Processing of Personal Data by the Operator is carried out with the consent of the Personal Data Subject, except in cases established by the legislation of the Russian Federation, in compliance with the requirements for PD Confidentiality established by Art. 7 of FZ-152, as well as the adoption of measures aimed at ensuring the fulfillment of obligations for the Processing and protection of Personal Data established by the legislation of the Russian Federation.

6.9. The condition for the termination of Personal Data Processing may be the achievement of Personal Data Processing purposes, the expiration of the consent of the Personal Data Subject to the Processing of their PD, or the withdrawal of consent by the Personal Data Subject to the Processing of their PD, as well as the identification of unlawful PD Processing.

6.10. Personal Data is stored in a form that allows identifying the Personal Data Subject for no longer than required by the purposes of Personal Data Processing, except in cases where the storage period of Personal Data is established by FZ-152, a contract to which the Personal Data Subject is a party, beneficiary, or guarantor.

6.11. In the event of confirmation of the fact of inaccuracy of Personal Data or unlawfulness of their Processing, the Personal Data is subject to updating by the Operator, and the Processing must be terminated, respectively.

6.12. The Operator does not verify and, as a rule, does not have the ability to verify the relevance and reliability of the information provided by Personal Data Subjects obtained through each of the Operator's Websites. The Operator assumes that Personal Data Subjects, acting reasonably and in good faith, provide reliable and sufficient PD and maintain them in an up-to-date state.

### 6.13. Procedure for Obtaining Clarifications

The Operator provides the Personal Data Subject or their representative with information regarding the Processing of their Personal Data upon the appropriate request or inquiry of the Personal Data Subject or their representative in an accessible form.

6.14. The request of the Personal Data Subject for obtaining information regarding the Processing of their PD by the Operator must contain:

- surname, first name, phone number, email address, and actual residential address of the Personal Data Subject or their representative, and, in the case of a representative's inquiry, the details of the power of attorney or other document confirming the representative's authority;
- Information confirming the participation of the Personal Data Subject in relations with the Operator (contract number, contract date, etc.);
- Signature of the Personal Data Subject or their representative.

6.15. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

6.16. The appeal of the Personal Data Subject or their legal representative to the Operator for the purpose of exercising their rights established by FZ-152 is carried out in writing in the form established by the Operator or in free form at the Operator's registered address.

6.17. The Operator considers the appeal of the Personal Data Subject/withdrawal of consent to PD Processing and provides a response to it in accordance with the legislation of the Russian Federation. The form for the appeal of the Personal Data Subject/withdrawal of consent to PD Processing is posted on the Internet at this website.

### 6.18. Confidentiality of Personal Data

Personal data is not disclosed to third parties and is not distributed otherwise without the consent of the Personal Data Subject, unless otherwise provided by the legislation of the Russian Federation. When disclosing (providing) Personal Data to third parties, the requirements for the protection of Processed Personal Data are observed.

### 6.19. Publicly Available Sources of Personal Data

For information purposes, the Operator may create publicly available sources of PD of PD Subjects, including directories and address books. With the written consent of the PD Subject, their surname, first name, place of birth, contact phone number, email address, and other Personal Data communicated by the PD Subject may be included in publicly available PD sources.

Information about the PD Subject must be excluded from publicly available PD sources at any time at the request of the PD Subject, the authorized body for the protection of PD Subjects' rights, or by court order.

### 6.20. Special Categories of Personal Data

Processing of special categories of PD by the Operator is permitted in the cases specified in Article 10 of FZ-152. Processing of PD about criminal records may be carried out by the Operator exclusively in cases and in the manner determined in accordance with the legislation of the Russian Federation.

### 6.21. Biometric Personal Data

Information that characterizes the physiological and biological features of a person, on the basis of which their identity can be established — biometric Personal Data — may be processed by the Operator only with the written consent of the PD Subject.

### 6.22. Entrusting Personal Data Processing to Another Person

The Operator has the right to entrust PD Processing to another person with the consent of the PD Subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person. The person carrying out PD Processing on behalf of the Operator is obliged to comply with the principles and rules of PD Processing provided for by FZ-152 and this Policy.

### 6.23. Processing of Personal Data of Citizens of the Russian Federation

In accordance with Article 2 of Federal Law No. 242-FZ of July 21, 2014, when collecting PD, including through the information and telecommunications network "Internet", the Operator is obliged to ensure the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of PD of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases established by legislation.

### 6.24. Cross-border Transfer of Personal Data

The Operator is obliged to ensure that the foreign state to whose territory PD is intended to be transferred provides adequate protection of the rights of PD Subjects before carrying out such transfer.

Cross-border transfer of PD to the territories of foreign states that do not provide adequate protection of the rights of PD Subjects may be carried out in the following cases:

- the written consent of the PD Subject to the cross-border transfer of their PD;
- performance of a contract to which the PD Subject is a party.

## 7. RIGHTS OF THE PERSONAL DATA SUBJECT

### 7.1. Consent of the Personal Data Subject

The PD Subject makes the decision to provide their PD and gives consent to their Processing freely, of their own will and in their own interest. Consent to PD Processing may be given by the PD Subject or their representative in any form that allows confirmation of the fact of receiving it, unless otherwise established by FZ-152.

Processing of PD for the purpose of promoting goods, works, services on the market by making direct contacts with the PD Subject (potential consumer) using communication means, as well as for political campaigning, is permitted only upon prior consent of the PD Subject.

### 7.2. Rights of the Personal Data Subject

The PD Subject has the right to obtain from the Operator information regarding the Processing of their PD, if such a right is not restricted in accordance with the legislation of the Russian Federation, including information containing:

- confirmation of the fact of PD Processing by the Operator;
- legal grounds and purposes of PD Processing;
- methods of PD Processing used by the Operator;
- information about the name and location of the Operator;
- list and categories of Processed PD;
- periods of Personal Data Processing, including storage periods;
- the name or surname, first name, patronymic, and address of the person carrying out PD Processing on behalf of the Operator;
- clarification of their PD, their Blocking or Destruction if the PD is incomplete, outdated, or inaccurate;
- other information provided for by FZ-152 or other federal laws of the Russian Federation.

The Operator is obliged to immediately cease Processing of PD at the request of the PD Subject.

If the PD Subject believes that the Operator is Processing their PD in violation of the requirements of FZ-152 or otherwise violates their rights and freedoms, the PD Subject has the right to appeal the actions or inaction of the Operator to the authorized body for the protection of PD Subjects' rights or in court.

The PD Subject has the right to protect their rights and legitimate interests, including compensation for losses and/or moral damages.

The PD Subject has the right to demand correction of their Personal Data if inaccuracies are found in the PD processed by the Operator, as well as to supplement the PD, including by providing an additional statement.

The PD Subject has the right to withdraw their Consent to Personal Data Processing and to demand the deletion of their PD from the Operator's systems if the PD is no longer required for the purposes for which it was obtained. You can withdraw your consent to Personal Data Processing at any time by sending an electronic message with an electronic signature to the email address: the Contacts page, or by sending a written notice to the Operator's registered address.

The Personal Data Subject has the right to demand the restriction of Processing of their Personal Data for the purposes of the Operator's advertising offers.

The Personal Data Subject also has other rights established by FZ-152.

The Personal Data Subject whose PD is Processed by the Operator has the right at any time to change (update, supplement) the PD they have provided by logging into their personal account in cases where the functionality of the relevant Website allows this.

## 8. OBLIGATIONS OF THE OPERATOR

8.1. In cases established by the legislation of the Russian Federation in the field of Personal Data, the Operator is obliged to provide the Personal Data Subject or their representative, upon request or upon receipt of a request from the Personal Data Subject or their representative, with the information provided for in clause 7.2 of this Policy.

8.2. When collecting Personal Data, including through the information and telecommunications network "Internet", the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of Personal Data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, except in cases provided for by Federal Law No. 152-FZ.

8.3. The Operator bears other obligations established by Federal Law No. 152-FZ.

## 9. ENSURING PERSONAL DATA SECURITY

9.1. The Operator independently determines the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by Federal Law No. 152-FZ and regulatory legal acts adopted in accordance with it.

9.2. The security of PD Processed by the Operator is ensured by the implementation of legal, organizational, and technical measures necessary to meet the requirements of federal legislation in the field of PD protection.

9.3. To prevent unauthorized access to PD, the Operator applies the following organizational and technical measures:

- appointment of officials responsible for organizing PD Processing and protection;
- limitation of the number of persons authorized to Process PD;
- familiarization of PD Subjects with the requirements of federal legislation and the Operator's regulatory documents on PD Processing and protection;
- organization of accounting, storage, and handling of carriers containing information with Personal Data;
- development and approval of local acts on PD Processing and protection;
- identification of PD security threats during their Processing, forming threat models based on them;
- development of a PD protection system based on the threat model;
- verification of the readiness and effectiveness of information protection tools;
- differentiation of User access to information resources and hardware and software tools for information Processing;
- registration and recording of User actions in information systems;
- use of antivirus tools;
- conducting activities to detect facts of unauthorized access to PD and taking appropriate measures;
- compliance with conditions that exclude unauthorized access to material carriers of Personal Data;
- application, when necessary, of firewalling, intrusion detection, security analysis, and cryptographic information protection tools;
- organization of access control to the Operator's territory, protection of premises with technical means of Personal Data Processing;
- monitoring of measures taken to ensure PD security.

## 10. LIABILITY

10.1. Persons guilty of violating the norms regulating the Processing of Personal Data and the protection of Personal Data Processed by the Operator bear liability as provided by the legislation of the Russian Federation.

## 11. PURPOSES OF PERSONAL INFORMATION PROCESSING

11.1. The Operator always Processes PD for specific purposes and only the PD that is relevant to the achievement of such purposes. In particular, the Operator processes PD for the following purposes:

- Providing the User with access to the relevant Website;
- Providing access to the User's account (personal cabinet) on the relevant Website;
- For the execution of a purchase and sale agreement, a service agreement, or other agreement between the Seller and the User;
- Delivery of goods of the Seller and/or the Operator to Users;
- Assistance in settling claims between the User and the Seller;
- Settlement of claims between the User and the Operator;
- Execution of instructions of the Seller and/or the Operator regarding the collection and transfer of funds received for goods and/or services;
- Improving the quality of User service, market study and analysis, studying User needs;
- Receiving feedback regarding goods and/or services posted on the Websites;
- Execution of instructions of Sellers and Users in connection with the refusal to accept services and/or return of goods;
- Posting User reviews of goods and/or services;
- Analysis of the quality of the service provided by the Operator and improvement of customer service quality;
- For the implementation of labor agreements in accordance with the legislation of the Russian Federation;
- Making a decision on hiring a candidate;
- Fulfillment of obligations arising from the conclusion of contractual relations between the Operator and third parties;
- Providing responses to requests from individuals;
- Conducting marketing and other research;
- Sending advertising and informational messages about goods and/or services of Sellers, as well as goods and/or services of the Operator and advertising personalization;
- In any other cases directly provided for by the current legislation of the Russian Federation.

## 12. AUTOMATICALLY COLLECTED INFORMATION

12.1. The Operator has the right to collect and Process, including information that is not PD:

- information about User interests on the Websites based on search queries entered by Website Users in order to provide relevant information to Users when using the Websites;
- information that forms the system rating of the Seller/Operator: User reviews of the Seller/Operator, information on Order fulfillment, other information;
- The Operator processes and stores search queries of Website Users for the purpose of generalizing and creating customer statistics on the use of Website sections.

12.2. The Operator automatically receives certain types of information obtained in the process of User interaction with the Websites. This refers to technologies and services such as web protocols, cookies, web beacons, as well as third-party applications and tools. At the same time, web beacons, cookies, and other monitoring technologies do not allow the automatic collection of PD.

12.3. If the Operator can reasonably associate the information specified in this section with the personal account of a specific User, then such information may be processed together with the PD and other personal information of such User.