Website Personal Data Processing Policy

1. GENERAL PROVISIONS

1.1. This document (hereinafter referred to as the Policy) defines the policy regarding the processing of personal data of users of the website of "Belykh, Sotnikov and Partners" Attorneys at Law, Moscow (operating under the brand E L W I) (hereinafter referred to as the Operator) on the website at: www.elwi.com (hereinafter referred to as the Website).

1.2. This Policy is developed on the basis of Clause 2, Part 1 of Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data", as well as the Recommendations on drafting a document defining the operator's policy regarding the processing of personal data, in accordance with the procedure established by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data".

1.3. Pursuant to the requirements of Part 2 of Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data", this Policy is published in open access on the Operator's Website at: www.elwi.com.

1.4. This Policy applies solely to the Website. The Operator does not control and shall not be liable for any third-party websites to which the User may be redirected via links available on the Website.

1.5. The terms contained in Article 3 of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" shall be used in this Policy with the same meaning.

1.6. The following terms are also used in this Policy: "User" shall mean any person visiting the Website and using the information, materials and services available on the Website. The Website User is a personal data subject within the meaning of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data".

1.7. Rights and Obligations of the Operator

1.7.1. The Operator shall:

• process personal data solely for the purposes specified in this Policy, in accordance with the procedure established by the applicable legislation of the Russian Federation, and take the measures necessary and sufficient to ensure compliance with the obligations stipulated by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" and the regulatory legal acts adopted in accordance therewith;
• not disclose personal data without the User's consent unless otherwise provided for by the applicable laws of the Russian Federation;
• process personal data in compliance with the principles and rules established by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data";
• ensure the protection of personal data in accordance with the requirements of the legislation of the Russian Federation;
• consider requests from the User (or his/her legal representative) regarding the processing of personal data and provide reasoned responses;
• provide the User (or his/her legal representative) with access to his/her personal data free of charge;
• take measures to rectify, block or destroy the User's personal data in the cases established by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data".

1.7.2. The Operator shall have the right to:

• independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations stipulated by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" and the regulatory legal acts adopted in accordance therewith, unless otherwise provided for by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" or other federal laws;
• entrust the processing of personal data to another person with the User's consent, unless otherwise provided for by federal law, on the basis of an agreement concluded with such person, including a state or municipal contract, or by adoption of a relevant act by a state authority or municipal authority;
• where the User withdraws its consent to the processing of personal data, continue processing personal data without the User's consent where the grounds specified in Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" apply;
• receive from the User reliable information and/or documents containing the User's personal data for the processing purposes specified in Clause 2.2 of the Policy;
• require the User to promptly update or clarify the personal data provided.

1.8. Rights and Obligations of the User

1.8.1. The User shall:

• ensure the accuracy of the personal data provided to the Operator which are necessary for the processing purposes specified in Clause 2.2 of the Policy;
• where necessary, provide the Operator with information required to clarify (update or amend) the personal data provided.

1.8.2. The User shall have the right to:

• obtain full information regarding the processing of his/her personal data by the Operator, except in cases provided for by the legislation of the Russian Federation;
• request rectification, blocking or destruction of his/her personal data where the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data;
• take measures provided for by law to protect his/her rights;
• lodge a complaint with the authorised body for the protection of the rights of personal data subjects or challenge in court any unlawful actions or omissions of the Operator in relation to the processing of his/her personal data;

The Operator and the Users also have other rights and obligations as provided for by the laws of the Russian Federation.

2. PURPOSES OF PERSONAL DATA PROCESSING SCOPE AND CATEGORIES OF PERSONAL DATA PROCESSED, CATEGORIES OF PERSONAL DATA SUBJECTS

2.1. The processing of personal data shall be limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of personal data collection shall not be permitted. Personal data processed shall not be excessive in relation to the stated purposes of their processing. Only personal data that correspond to the purposes of their processing shall be processed.

2.2. The Operator processes the User's personal data for the following purposes:

2.3. Processing of applicants' personal data is carried out through the operation of the "Response to Vacancies" form available on the Website in the "Careers" section. Processing of the Operator's employees' personal data is carried out by publishing the relevant information on the Website for informational purposes.

2.4. The Operator does not process biometric personal data or special categories of personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.

3. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

3.1. The legal grounds for the processing of personal data by the Operator are:

• Constitution of the Russian Federation;
• Civil Code of the Russian Federation;
• Federal Law No. 149-FZ dated July 27, 2006 "On Information, Information Technologies and Information Protection"; - Federal Law No. 294-FZ dated December 26, 2008 "On the Protection of the Rights of Legal Entities and Individual Entrepreneurs in the Exercise of State Control (Supervision) and Municipal Control";
• Decree of the President of the Russian Federation No. 188 dated March 6, 1997 "On Approval of the List of Confidential Information";
• Resolution of the Government of the Russian Federation No. 1119 dated November 1, 2012 "On Approval of the Requirements for the Protection of Personal Data during Their Processing in Personal Data Information Systems";
• Order of the Federal Service for Technical and Export Control of Russia No. 21 dated February 18, 2013 "On Approval of the Composition and Content of Organisational and Technical Measures to Ensure the Security of Personal Data during Their Processing in Personal Data Information Systems";
• consent to the processing of personal data given on the Website.

4. PROCEDURE AND CONDITIONS OF PERSONAL DATA PROCESSING

4.1. The Operator processes personal data in accordance with the requirements of the laws of the Russian Federation by the following means:

• non-automated processing of personal data;
• automated processing of personal data, with or without transmission of the information obtained via information and telecommunications networks;
• mixed processing of personal data.

4.2. For the purposes specified in Clause 2.2 of the Policy, the Operator performs the following actions in relation to the User's personal data: collection, recording, systematisation, accumulation, storage, rectification (updating, amendment), retrieval, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction.

4.3. The Operator processes personal data subject to the User's consent (hereinafter referred to as the Consent), obtained in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data", except in cases provided for by the legislation of the Russian Federation where personal data may be processed without such Consent.

4.4. The User decides to provide his/her personal data and gives Consent freely, of his/her own free will and in his/her own interests.

4.5. The period for which personal data are processed shall be determined by the achievement of the purposes for which the personal data were collected, unless a different period is stipulated by a contract with the User or by applicable laws. The processing of personal data may be terminated upon achievement of the purposes of processing or where the necessity for achieving such purposes ceases to exist, upon expiry of the Consent or withdrawal of the Consent by the User, or upon identification of unlawful processing of personal data.

4.6. The User has the right to withdraw consent to the processing of personal data at any time by sending a corresponding request to the Operator's email: info@elwi.com. Withdrawal of consent shall not affect the lawfulness of the processing of personal data carried out prior to such withdrawal.

4.7. The Operator disseminates personal data authorised by the User for dissemination, i.e. performs actions aimed at disclosing such data to an indefinite number of persons, in compliance with the requirements, prohibitions and conditions established by Part 9 of Article 9, Article 10.1 of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data". Disclosure to third parties and dissemination of personal data without the User's consent shall not be permitted unless otherwise provided for by federal law. Consent to the processing of personal data authorised by the User for dissemination shall be executed separately from other consents of the User to the processing of his/her personal data, taking into account the Requirements for the content of consent to the processing of personal data authorised by the personal data subject for dissemination, approved by Order of Roskomnadzor No. 18 dated February 24, 2021. In particular, personal data authorised by personal data subjects for dissemination includes information about the Operator's employees posted on the Website for informational purposes.

4.8. When processing personal data, the Operator shall take, or ensure the taking of, the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination of personal data, as well as against other unlawful actions in relation to personal data.

4.9. Personal data shall be stored in a form that allows the User to be identified for no longer than is required for the purposes of the processing of personal data, except where the retention period for personal data is established by federal law or by a contract to which the User is a party, beneficiary or guarantor.

4.10. When processing personal data, the Operator complies with the requirements of Article 18 of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data".

4.11. When processing personal data, the Operator undertakes to maintain the confidentiality of personal data.

4.12. The Operator does not carry out cross-border transfers of personal data.

4.13. In the event of unlawful or accidental transfer (provision, dissemination or access) of personal data, the Operator shall inform the User thereof within three working days and shall notify Roskomnadzor as well.

4.14. The Operator, together with the User, shall take all necessary measures to prevent losses or other adverse consequences caused by unlawful or accidental transfer (provision, dissemination or access) of the User's personal data.

4.15. When using the Website, the Operator may use cookies necessary for the proper functioning of the Website and to ensure its security. In particular, the Website uses the Yandex SmartCaptcha service provided by Yandex LLC in order to protect forms from automated submissions and abuse. As part of the operation of this service, technical data, including cookies, may be processed in accordance with the privacy policy of Yandex LLC available at: https://yandex.ru/legal/smartcaptcha_notice/ru/. The Operator does not use web analytics services or advertising measurement systems on the Website.

5. BLOCKING, RECTIFICATION AND DESTRUCTION OF PERSONAL DATA. RESPONSES TO USER REQUESTS FOR ACCESS TO PERSONAL DATA

5.1. If unlawful processing of personal data is identified upon an application by the User (his/her representative), or upon a request from the User (his/her representative) or from the authorised body for the protection of the rights of personal data subjects, the Operator shall block the unlawfully processed personal data relating to the relevant User, or ensure such blocking, from the moment of such application or receipt of the said request for the period of verification. If inaccurate personal data are identified upon an application by the User or his/her representative, or upon their request, or upon a request from the authorised body for the protection of the rights of personal data subjects, the Operator shall block the personal data relating to the relevant User, or ensure such blocking, from the moment of such application or receipt of the said request for the period of verification, provided that the blocking of personal data does not infringe the rights and legitimate interests of the User or third parties.

5.2. Where the inaccuracy of personal data is confirmed, the Operator, on the basis of the information provided by the User (his/her representative), the authorised body for the protection of the rights of personal data subjects, or other necessary documents, shall rectify the personal data or ensure their rectification within seven working days from the date such information is provided.

5.3. If unlawful processing of personal data is identified, the Operator shall, within a period not exceeding three working days from the date of such identification, cease the unlawful processing of personal data or ensure the cessation of such unlawful processing, and if it is impossible to ensure the lawfulness of the processing of personal data, shall destroy such personal data or ensure their destruction within a period not exceeding ten working days from the date of identification of the unlawful processing of personal data.

5.4. Upon achievement of the purpose of personal data processing, the Operator shall destroy the personal data or ensure their destruction within a period not exceeding thirty days from the date on which the purpose of personal data processing has been achieved, unless otherwise provided for by a contract to which the User is a party, beneficiary or guarantor, by another agreement between the Operator and the User, or where the Operator is entitled to process personal data without the User's consent on the grounds provided for by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" or other federal laws.

5.5. If the User withdraws consent to the processing of his/her personal data and the retention of personal data is no longer required for the purposes of personal data processing, the Operator shall destroy the personal data or ensure their destruction within a period not exceeding thirty days from the date of receipt of such withdrawal, unless otherwise provided for by a contract to which the User is a party, beneficiary or guarantor, by another agreement between the Operator and the User, or where the Operator is entitled to process personal data without the User's consent on the grounds provided for by Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" or other federal laws.

5.6. Within a period not exceeding seven working days from the date the User (his/her representative) provides information confirming that such personal data were obtained unlawfully or are not necessary for the stated purpose of processing, the Operator shall destroy such personal data.

5.7. Personal data being processed shall be destroyed if the need to achieve the purposes of processing ceases to exist, unless otherwise provided for by federal law.

5.8. The Operator shall respond to requests and enquiries of the User (his/her representative) regarding the processing of personal data carried out by the Operator in the following manner: after receipt of the request or enquiry sent to the email: info@elwi.com.

6. LIABILITY OF THE PARTIES

6.1. The Operator shall be liable for violation of the requirements of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" in accordance with the legislation of the Russian Federation.

6.2. The User has the right to seek compensation for losses and/or compensation for moral harm through the courts. Moral harm caused to the User as a result of a violation of his/her rights, a breach of the rules governing the processing of personal data, as well as the requirements for the protection of personal data established in accordance with Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data", as well as the provisions of this Policy, shall be compensated in accordance with the legislation of the Russian Federation. Compensation for moral harm shall be provided regardless of compensation for property damage and losses incurred by the User.

7. DISPUTE RESOLUTION

7.1. In the event of disputes and/or disagreements arising out of the relationship between the User and the Operator, such matters shall be resolved in accordance with the applicable laws of the Russian Federation.

7.2. The applicable laws of the Russian Federation shall apply to this Policy and to the relationship between the User and the Operator.

8. FINAL PROVISIONS

8.1. The Operator has the right to amend this Policy without the consent of the User.

8.2. A new version of the Policy shall enter into force from the moment it is posted on the Website, unless otherwise provided for by the new version of the Policy. The new version of the Policy shall apply to relations arising after it enters into force.

8.3. Any suggestions or questions regarding the Policy shall be sent to info@elwi.com.