Personal Data Processing Policy

1. GENERAL PROVISIONS

1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) of AvtoGazTrans Limited Liability Company has been developed in accordance with Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (hereinafter referred to as the “Personal Data Law”), in order to protect human and civil rights and freedoms in the processing of personal data, including the rights to privacy and to personal and family confidentiality.

1.2. This Policy applies to all personal data processed by AvtoGazTrans Limited Liability Company (hereinafter referred to as the “Operator” or “AvtoGazTrans LLC”).

1.3. This Policy applies to relationships involving the processing of personal data that arose both before and after the approval of this Policy.

1.4. In accordance with Part 2, Article 18.1 of the Personal Data Law, this Policy is published and made freely accessible on the Operator’s website on the Internet.

1.5. Key terms used in this Policy:

Personal data means any information relating to an identified or identifiable individual (personal data subject), whether directly or indirectly.

Personal data operator (Operator) means a state authority, municipal authority, legal entity, or individual that, independently or jointly with other persons, organizes and/or carries out the processing of personal data and determines the purposes of personal data processing, the categories of personal data to be processed, and the actions (operations) performed with personal data.

Processing of personal data means any action (operation) or set of actions (operations) performed with personal data, whether or not using automated means, including:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating or modification);
• retrieval;
• use;
• transfer (including dissemination, provision, or granting access);
• depersonalization;
• blocking;
• deletion;
• destruction.

Automated processing of personal data means the processing of personal data using computer technology.

Dissemination of personal data means actions intended to disclose personal data to an indefinite group of persons.

Provision of personal data means actions intended to disclose personal data to a particular person or a defined group of persons.

Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify personal data.

Destruction of personal data means actions that make it impossible to restore the contents of personal data in a personal data information system and/or result in the destruction of physical media containing personal data.

Depersonalization of personal data means actions that make it impossible to determine, without additional information, which particular personal data subject the data relates to.

Personal data information system means a combination of personal data contained in databases and the information technologies and technical means used to process such data.

1.6. Main rights and obligations of the Operator.

1.6.1. The Operator has the right to:

1) independently determine the composition and list of measures necessary and sufficient to fulfill the obligations established by the Personal Data Law and the regulations adopted pursuant to it, unless otherwise provided for by the Personal Data Law or other federal laws;

2) entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided for by federal law, under an agreement concluded with that person. A person processing personal data on the Operator’s behalf must comply with the principles and rules of personal data processing established by the Personal Data Law, maintain the confidentiality of personal data, and take the measures necessary to meet the requirements established by the Personal Data Law;

3) continue processing personal data without the consent of the personal data subject after such subject has withdrawn consent, where grounds specified in the Personal Data Law exist.

1.6.2. The Operator is obliged to:

1) organize the processing of personal data in accordance with the Personal Data Law;

2) respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;

3) provide the authorized body responsible for protecting the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media, or Roskomnadzor), upon request, with the necessary information within 10 business days of receiving such request. This period may be extended by no more than five business days, provided that the Operator sends Roskomnadzor a reasoned notice explaining the extension;

4) ensure interaction, in accordance with the procedure established by the federal executive authority responsible for security, with the Russian Federation’s state system for detecting, preventing, and mitigating computer attacks against information resources, including notification of computer incidents resulting in the unlawful transfer (provision, dissemination, or granting of access) of personal data.

1.7. Main rights of personal data subjects. A personal data subject has the right to:

1) obtain information concerning the processing of their personal data, except in cases provided for by federal laws. The Operator must provide the information in an accessible form. It must not include personal data relating to other personal data subjects unless there are lawful grounds for disclosure. The list of information and the procedure for obtaining it are established by the Personal Data Law;

2) require the Operator to correct, block, or destroy their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, and take measures prescribed by law to protect their rights;

3) give prior consent to the processing of personal data for the purpose of promoting goods, works, and services on the market;

4) appeal against the Operator’s unlawful actions or omissions in processing their personal data to Roskomnadzor or in court.

1.8. Compliance with this Policy is monitored by the person authorized and responsible for organizing the Operator’s personal data processing.

1.9. Liability for violations of the requirements of Russian Federation law and the internal regulations of AvtoGazTrans LLC concerning personal data processing and protection is determined in accordance with Russian Federation law.

2. PURPOSES OF PERSONAL DATA PROCESSING

2.1. Personal data processing is limited to achieving specific, predetermined, and lawful purposes. Processing that is incompatible with the purposes for which personal data was collected is not permitted.

2.2. Only personal data relevant to the purposes of processing may be processed.

2.3. The Operator processes personal data for the following purposes:

• conducting activities in accordance with the charter of AvtoGazTrans LLC, including entering into and performing contracts with counterparties;
• complying with labor legislation in the context of employment and other directly related relationships, including assisting employees with employment, education, and career advancement; recruiting and selecting candidates for employment with the Operator; ensuring employees’ personal safety; monitoring the quantity and quality of work performed; safeguarding property; maintaining personnel and accounting records; preparing and submitting required reporting forms to authorized bodies; and arranging individual (personalized) registration of employees in the compulsory pension insurance and compulsory social insurance systems;
• implementing access-control procedures.

2.4. Employees’ personal data may be processed solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

3. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

3.1. The legal grounds for processing personal data comprise the regulatory legal acts under which and in accordance with which the Operator processes personal data, including:

• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Labor Code of the Russian Federation;
• the Tax Code of the Russian Federation;
• Federal Law No. 14-FZ dated February 8, 1998, “On Limited Liability Companies”;
• Federal Law No. 402-FZ dated December 6, 2011, “On Accounting”;
• Federal Law No. 167-FZ dated December 15, 2001, “On Compulsory Pension Insurance in the Russian Federation”;
• other regulatory legal acts governing relationships associated with the Operator’s activities.

3.2. The legal grounds for processing personal data also include:

• the charter of AvtoGazTrans LLC;
• agreements concluded between the Operator and personal data subjects;
• personal data subjects’ consent to the processing of their personal data.

4. SCOPE AND CATEGORIES OF PERSONAL DATA PROCESSED; CATEGORIES OF PERSONAL DATA SUBJECTS

4.1. The content and scope of personal data processed must correspond to the stated purposes of processing set out in Section 2 of this Policy. The personal data processed must not be excessive in relation to those purposes.

4.2. The Operator may process personal data concerning the following categories of personal data subjects.

4.2.1. Applicants for employment with the Operator — for compliance with labor legislation in the context of employment and other directly related relationships and for access-control purposes:

• surname, first name, and patronymic;
• sex;
• citizenship;
• date and place of birth;
• contact details;
• education, work experience, and qualifications;
• other personal data provided by applicants in their CVs and cover letters.

4.2.2. Current and former employees of the Operator — for compliance with labor legislation in the context of employment and other directly related relationships and for access-control purposes:

• surname, first name, and patronymic;
• sex;
• citizenship;
• date and place of birth;
• image (photograph);
• passport details;
• registered residential address;
• actual residential address;
• contact details;
• taxpayer identification number (INN);
• individual insurance account number (SNILS);
• information on education, qualifications, vocational training, and continuing professional development;
• marital status, children, and family relationships;
• employment history, including incentives, awards, and/or disciplinary sanctions;
• marriage registration details;
• military registration information;
• disability information;
• information on alimony deductions;
• income information from previous employment;
• other personal data provided by employees in accordance with labor legislation.

4.2.3. Family members of the Operator’s employees — for compliance with labor legislation in the context of employment and other directly related relationships:

• surname, first name, and patronymic;
• degree of kinship;
• year of birth;
• other personal data provided by employees in accordance with labor legislation.

4.2.4. Clients and counterparties of the Operator who are individuals — for conducting activities in accordance with the charter of AvtoGazTrans LLC and for access-control purposes:

• surname, first name, and patronymic;
• date and place of birth;
• passport details;
• registered residential address;
• contact details;
• position held;
• taxpayer identification number (INN);
• bank account number;
• other personal data provided by clients and counterparties who are individuals that is necessary to conclude and perform agreements.

4.2.5. Representatives (employees) of the Operator’s clients and counterparties that are legal entities — for conducting activities in accordance with the charter of AvtoGazTrans LLC and for access-control purposes:

• surname, first name, and patronymic;
• passport details;
• contact details;
• position held;
• other personal data provided by representatives (employees) of clients and counterparties that is necessary to conclude and perform agreements.

4.3. The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health, or intimate life, except in cases provided for by Russian Federation law.

5. PROCEDURE AND CONDITIONS FOR PROCESSING PERSONAL DATA

5.1. The Operator processes personal data in accordance with the requirements of Russian Federation law.

5.2. Personal data is processed with the consent of personal data subjects, as well as without such consent in cases provided for by Russian Federation law.

5.3. For each processing purpose, the Operator uses the following methods:

• non-automated processing of personal data;
• automated processing of personal data, with or without transmission of the resulting information over information and telecommunications networks;
• mixed processing of personal data.

5.4. Only employees of the Operator whose job responsibilities include personal data processing are permitted to process personal data.

5.5. For each purpose specified in Clause 2.3 of this Policy, personal data is processed by:

• obtaining personal data directly from personal data subjects orally or in writing;
• entering personal data into the Operator’s logs, registers, and information systems;
• using other methods of personal data processing.

5.6. Disclosure of personal data to third parties and dissemination of personal data without the consent of the personal data subject are prohibited unless otherwise provided for by federal law. Consent to the processing of personal data that the subject has authorized for dissemination must be obtained separately from any other consent to personal data processing.

5.7. Personal data is transferred to inquiry and investigative authorities, the Federal Tax Service, the Social Fund of Russia, and other authorized executive authorities and organizations in accordance with the requirements of Russian Federation law.

5.8. The Operator takes the necessary legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, dissemination, and other unauthorized actions, including:

• identifying threats to the security of personal data during processing;
• adopting internal regulations and other documents governing personal data processing and protection;
• appointing persons responsible for personal data security in the Operator’s structural units and information systems;
• creating the conditions necessary for working with personal data;
• organizing recordkeeping for documents containing personal data;
• organizing the operation of information systems in which personal data is processed;
• storing personal data in conditions that ensure its preservation and prevent unlawful access;
• organizing training for employees of the Operator who process personal data.

5.9. The Operator stores personal data in a form that permits identification of the personal data subject for no longer than is necessary for each purpose of processing, unless a retention period is established by federal law or an agreement.

5.9.1. Personal data on paper media is stored by AvtoGazTrans LLC for the document-retention periods established by Russian Federation archival legislation (Federal Law No. 125-FZ dated October 22, 2004, “On Archiving in the Russian Federation,” and the List of Standard Administrative Archival Documents Generated in the Activities of State Bodies, Local Government Bodies, and Organizations, with Their Retention Periods, approved by Order No. 236 of the Federal Archival Agency dated December 20, 2019).

5.9.2. The retention period for personal data processed in personal data information systems corresponds to the retention period for personal data on paper media.

5.10. The Operator ceases processing personal data in the following cases:

• unlawful processing has been identified — within three business days of identification;
• the purpose of processing has been achieved;
• the consent of the personal data subject to the processing of such data has expired or been withdrawn, where the Personal Data Law permits processing only on the basis of consent.

5.11. Upon achievement of the purposes of processing personal data, or if a personal data subject withdraws consent to its processing, the Operator ceases processing such data if:

• the agreement to which the personal data subject is a party, beneficiary, or guarantor does not provide otherwise;
• the Operator has no right to continue processing without the personal data subject’s consent on grounds provided for by the Personal Data Law or other federal laws;
• no other agreement between the Operator and the personal data subject provides otherwise.

5.12. If a personal data subject requests the Operator to cease processing personal data, processing is terminated within no more than 10 business days after the Operator receives the relevant request, except in cases provided for by the Personal Data Law. This period may be extended by no more than five business days, provided that the Operator sends the personal data subject a reasoned notice explaining the extension.

5.13. When collecting personal data, including through the Internet, the Operator ensures that the recording, systematization, accumulation, storage, clarification (updating or modification), and retrieval of personal data of citizens of the Russian Federation are carried out using databases located within the Russian Federation, except in cases specified in the Personal Data Law.

6. UPDATING, CORRECTING, DELETING, AND DESTROYING PERSONAL DATA; RESPONDING TO DATA SUBJECT ACCESS REQUESTS

6.1. The Operator provides the personal data subject or their representative with confirmation that it processes personal data, the legal grounds and purposes of processing, and other information specified in Part 7, Article 14 of the Personal Data Law within 10 business days of receiving an inquiry or request from the personal data subject or their representative. This period may be extended by no more than five business days, provided that the Operator sends the personal data subject a reasoned notice explaining the extension. The information provided must not include personal data relating to other personal data subjects unless there are lawful grounds for disclosure.

The request must contain:

• the number of the primary identity document of the personal data subject or their representative, the date of issue, and the issuing authority;
• information confirming the personal data subject’s relationship with the Operator (agreement number, date of conclusion, reference designation, and/or other information), or other information confirming that the Operator processes the personal data subject’s data;
• the signature of the personal data subject or their representative.

The request may be submitted as an electronic document signed with an electronic signature in accordance with Russian Federation law.

The Operator provides the information specified in Part 7, Article 14 of the Personal Data Law to the personal data subject or their representative in the same form in which the relevant inquiry or request was submitted, unless the inquiry or request specifies otherwise.

If an inquiry (request) from a personal data subject does not contain all the information required by the Personal Data Law, or the subject has no right of access to the requested information, the Operator sends a reasoned refusal.

A personal data subject’s right of access to their personal data may be restricted in accordance with Part 8, Article 14 of the Personal Data Law, including where such access would infringe the rights and legitimate interests of third parties.

6.2. If inaccurate personal data is identified following an inquiry or request from the personal data subject or their representative, or a request from Roskomnadzor, the Operator blocks the personal data relating to that subject from the time of the inquiry or receipt of the request for the duration of verification, provided that blocking does not infringe the rights and legitimate interests of the personal data subject or third parties.

If the inaccuracy is confirmed, the Operator corrects the personal data on the basis of information provided by the personal data subject, their representative, or Roskomnadzor, or other necessary documents, within seven business days of receiving such information, and removes the block on the personal data.

6.3. If unlawful processing of personal data is identified following an inquiry (request) from the personal data subject, their representative, or Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to that subject from the time of the inquiry or receipt of the request.

6.4. If the Operator, Roskomnadzor, or another interested party identifies an unlawful or accidental transfer (provision or dissemination) of personal data (or access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator:

• within 24 hours, notifies Roskomnadzor of the incident, the presumed causes that resulted in the violation of personal data subjects’ rights, the presumed harm to those rights, and measures taken to mitigate the consequences of the incident, and provides information about the person authorized by the Operator to communicate with Roskomnadzor regarding the incident;
• within 72 hours, notifies Roskomnadzor of the results of its internal investigation of the identified incident and provides information about the persons whose actions caused it, if any.

6.5. Procedure for destruction of personal data by the Operator.

6.5.1. Conditions and time limits for the destruction of personal data by the Operator:

• achievement of the purpose of processing or loss of the need to achieve that purpose — within 30 days;
• expiration of the maximum retention periods for documents containing personal data — within 30 days;
• provision by the personal data subject (or their representative) of confirmation that the personal data was obtained unlawfully or is unnecessary for the stated purpose of processing — within seven business days;
• withdrawal of consent to personal data processing by the personal data subject, if retention is no longer necessary for the purpose of processing — within 30 days.

6.5.2. Upon achievement of the purpose of processing personal data, or upon withdrawal of the personal data subject’s consent to processing, the personal data must be destroyed if:

• the agreement to which the personal data subject is a party, beneficiary, or guarantor does not provide otherwise;
• the Operator has no right to continue processing without the personal data subject’s consent on grounds provided for by the Personal Data Law or other federal laws;
• no other agreement between the Operator and the personal data subject provides otherwise.

6.5.3. Personal data is destroyed by a commission established by order of the Director of AvtoGazTrans LLC.

6.5.4. Methods of personal data destruction:

6.5.4.1. Physical destruction of data media:

• destruction of paper documents by shredding or incineration;
• destruction of magnetic and optical media (hard drives, memory cards, USB flash drives, CDs/DVDs).

6.5.4.2. Software-based destruction of data:

• use of certified software to overwrite data repeatedly on hard drives and other electronic media;
• zeroing or overwriting information so that it cannot be recovered.

Consent to Personal Data Processing