Personal Data Processing Policy

1.1. This Personal Data Processing Policy (hereinafter the Policy) was prepared in accordance with Federal Law No. 152-FZ of 27.07.2006 'On Personal Data' and establishes the rules for using personal information obtained from website users (hereinafter Users).

1.2. The personal data controller is SOLE PROPRIETOR YURI VLADIMIROVICH TOLSTIKHIN (INN: 246318055902, OGRN 325784700220040).

1.3. The Policy governs the processing and use of Users' personal data.

1.4. The purpose of the Policy is to ensure appropriate protection of information about Users, including their personal data, against unauthorized access and disclosure.

1.5. Matters relating to the collection, storage, dissemination and protection of information about Users are governed by the Policy and the applicable laws of the Russian Federation.

1.6. The current version of the Policy is a public document prepared by the personal data Controller and is accessible to any Internet user.

1.7. The personal data Controller may amend the Policy without the User's consent.

1.8. A new Policy takes effect when it is posted on the Website, unless the new version provides otherwise.

2.1. Website means the Internet resource located at sciente.ru.

2.2. Website Administration means the authorized personnel managing the Website on behalf of SOLE PROPRIETOR YURI VLADIMIROVICH TOLSTIKHIN who organize and/or carry out personal data processing and determine its purposes, the personal data to be processed and the actions (operations) performed on them.

2.3. Personal data means any information relating to an identified or identifiable natural person, directly or indirectly (the personal data subject).

2.4. Cookies are small text files placed on a user's device which, according to the position taken by Russian courts, also constitute personal data.

2.5. Personal data processing means any action (operation) or set of actions (operations) performed on personal data, by automated means or otherwise, including collection, recording, systematization, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (dissemination, provision or access), depersonalization, blocking, deletion and destruction of personal data.

2.6. Personal data confidentiality means the Website Administration's obligation not to disseminate personal data without the data subject's consent or another lawful ground.

2.7. IP address means the unique network address of a node on a computer network using the IP protocol.

2.8. Website behavior data means information about pages viewed, time spent on the website, clicks and other User actions.

3.1. The Policy establishes the procedure and conditions for processing Users' personal data and the measures taken by the Website Administration to ensure their security and confidentiality when the Website is used.

3.2. Personal data authorized for processing under the Policy are provided by the User by completing forms on the Website and include:

• data provided independently by the User while using the online service, including but not limited to surname, first name, patronymic, contact details, email address, telephone number and postal address (when contacting us by post);
• data automatically transmitted to the Controller while the online service is used, through software installed on the User's device, including the IP address, cookie information, information about the User's browser (or other program used to access the online service), time of access and address of the requested page.

3.3. The Website Administration also processes data about the User's behavior on the Website, including:

• information about pages viewed;
• time spent on the Website;
• clicks and other User actions.

3.4. Any other personal information not specified above is subject to secure storage and non-disclosure, except as provided in clauses 5.2 and 5.3 of the Policy.

4.1. The Website Administration may use the User's personal data for the following purposes:

• identifying the User in the relationship between the Controller and the User;
• confirming the accuracy and completeness of the personal data provided by the User;
• providing the User with access to services, tools, information and/or materials available on the sciente.ru online service;
• communicating with the User, including sending notifications and requests concerning use of the online service and provision of services, processing the User's requests and applications, and advising the User on the services offered;
• notifying the User by email;
• providing effective customer and technical support when problems arise in using the online service;
• notifying the personal data subject of changes or additions to services, tools, information and/or materials available on the sciente.ru online service;
• conducting surveys for effective communication with the Controller and with its existing and prospective customers;
• conducting statistical and other research, including research based on depersonalized data;
• ensuring operation of the Website and its services;
• processing user requests;
• analyzing Website traffic and User behavior;
• improving the quality and usability of the Website;
• performing the Controller's contractual obligations.

4.2. The User's personal data are processed for all the purposes listed in clause 4.1 of the Policy on the basis of a single consent given by the User when interacting with forms on the Website.

4.3. For the purposes listed in clause 4.1 of the Policy, the Controller may process the following categories of the User's personal data:

4.3.1. Data knowingly and voluntarily provided by the User when completing forms on the Website: surname, first name, patronymic, contact telephone number, email address, date of birth and other data necessary for a specific purpose (for example, identity document details when applying for a visa service), of which the User is informed directly in the input form.

4.3.2. Data automatically transmitted when the Website is used, to ensure its technical operation and security: the device's IP address, browser information (type and version), time of access to the Website, address of the requested page, and cookies where their processing is necessary for operators of software and information services.

4.4. As a personal data subject, the User has the right to receive information about the processing of their personal data; to access, correct, block or destroy their personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing; to withdraw consent to personal data processing; to challenge the Controller's actions or inaction before the competent authority or in court; and to protect their rights and lawful interests, including obtaining compensation for losses and non-pecuniary harm through the courts.

4.5. To exercise their rights, the User may send the relevant request to the Controller using the methods specified in the Policy.

4.6. The Controller must consider the data subject's request and provide a substantive response within no more than 10 (Ten) calendar days of receiving it.

5.1. Data processed on the basis of consent are retained until the processing purposes stated in the relevant Consent are achieved, but no longer than the period expressly specified in that Consent, or until the User withdraws consent. After consent is withdrawn or expires, the data must be destroyed within the period established by the Policy. Specific retention periods for different processing purposes are stated in the respective Consents presented to the User. Data processed to perform a contract are retained for the period prescribed by Russian Federation law for keeping primary accounting documents (at least 5 (Five) years), unless the contract provides otherwise. Data processed on the basis of the Controller's legitimate interests are retained for as long as necessary to pursue those interests.

5.2. The User's personal data may be transferred to authorized government bodies of the Russian Federation only on the grounds and in the manner established by Russian Federation law.

5.3. The Website Administration takes the necessary organizational and technical measures to protect the User's personal information against unlawful or accidental access, destruction, alteration, blocking, copying or dissemination, and against other unlawful actions by third parties.

5.4. All Users' personal data are stored and processed exclusively within the Russian Federation in accordance with legal requirements.

6.1. The User must:

• provide the personal data necessary to use the Website;
• update or supplement the personal data provided if that information changes.

6.2. The Website Administration must:

• use the information received exclusively for the purposes stated in section 4 of the Personal Data Processing Policy;
• keep confidential information secret, not disclose it without the User's prior written permission, and not sell, exchange, publish or otherwise disclose the User's personal data provided to it, except as provided in clauses 5.2 and 5.3 of the Policy;
• take precautions to protect the confidentiality of the User's personal data in accordance with the procedure normally used to protect this type of information in existing business practice;
• block personal data relating to the relevant User from the time the User, their lawful representative or the authority responsible for protecting personal data subjects' rights makes an application or request, for the duration of verification, if inaccurate personal data or unlawful actions are identified;
• notify the competent authority of a personal data breach within 24 (Twenty-four) hours of becoming aware of the violation.

7.1. The Controller processes personal data on the lawful grounds provided in Articles 6 and 9 of Federal Law No. 152-FZ of 27.07.2006 'On Personal Data', namely:

• with the personal data subject's consent to processing their personal data;
• to perform a contract to which the personal data subject is a party, beneficiary or guarantor, and to conclude a contract at the personal data subject's initiative;
• to exercise the rights and legitimate interests of the Controller or third parties, provided that the personal data subject's rights and freedoms are not infringed.

7.2. The primary lawful ground for processing the User's personal data is their voluntary, specific, informed and conscious consent given in accordance with Articles 6 and 9 of Federal Law No. 152-FZ of 27.07.2006 'On Personal Data'.

7.3. The User gives consent as follows:

• When completing any interactive form on the Website (a feedback form, service application, newsletter subscription, etc.), immediately before sending the data the User is shown the 'Consent to Personal Data Processing' text (hereinafter Consent).
• The Consent text contains all information required by Article 9 of Federal Law No. 152-FZ of 27.07.2006 'On Personal Data', including the Controller's full name and address; the purpose of processing; the personal data covered by consent; the operations to be performed and a general description of the Controller's processing methods; the period for which consent remains valid and how it can be withdrawn; and, where necessary, an indication that data may be transferred to third parties, with a list or categories of such parties.
• To express consent, the User must place a mark (a tick or cross) in the designated checkbox: 'I have read and agree to the terms of the Consent to Personal Data Processing.' Submitting the form without this mark is technically impossible.
• Consent is deemed to have been given in simple written form when the User marks the checkbox and successfully submits the relevant form. Server logs recording the time and fact of submission are retained by the Controller as evidence that consent was received.
• The Controller may request separate Consent for different processing purposes (for example, sending advertising newsletters). The User may independently consent or decline to consent to each purpose.
• These actions constitute the personal data subject's consent in simple written form to the processing of their personal data, including collection, recording, systematization, accumulation, storage, clarification, use, transfer to third parties, depersonalization, blocking and destruction of personal data.

7.4. Personal data may be processed without obtaining the subject's separate consent in cases expressly provided for in Article 6 of Federal Law No. 152-FZ of 27.07.2006 'On Personal Data', including when processing is necessary to perform a contract with the User or pursue the Controller's legitimate interests, provided that the data subject's rights and freedoms are respected.

7.5. The personal data subject independently decides whether to provide their personal data and gives consent to their processing freely, of their own will and in their own interest.

7.6. The personal data subject may withdraw consent to personal data processing at any time. To withdraw consent, the User must email the Controller at legal@sciente.ru. The withdrawal request must state the User's full name, contact details and the data whose processing is to cease. Within no more than 30 (Thirty) calendar days of receiving the request, the Controller must cease processing the personal data provided on the basis of consent and destroy them, except where processing may continue on another lawful ground (for example, compliance with legal requirements).

8.1. If the Website Administration fails to fulfil its obligations, it is liable for losses incurred by the User as a result of the unlawful use of personal data in accordance with Russian Federation law, except in the cases provided in clauses 5.2 and 5.3 of the Policy.

8.2. In the event of loss or disclosure of Confidential Information, the Website Administration is not liable if that confidential information:

• was publicly available before its loss or disclosure;
• was received from a third party before it was received by the Website Administration;
• was disclosed with the User's consent.

9.1. Before bringing court proceedings concerning disputes arising from the relationship between the User and the Website Administration, the User may submit a claim to the Website Administration (a written proposal to settle the dispute voluntarily).

9.2. The Website Administration considers the User's claim and sends a written response on the outcome within no more than 30 (Thirty) working days of receiving it.

9.3. If no agreement is reached, the dispute is subject to court proceedings at the Website Administration's location, unless Russian Federation law provides otherwise.

9.4. The User retains the right to contact the authority responsible for protecting personal data subjects' rights, including the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), regardless of whether a claim has been submitted to the Website Administration.

9.5. The applicable laws of the Russian Federation govern this Policy and the relationship between the User and the Website Administration.

10.1. The Website Administration may amend the Personal Data Processing Policy without the User's consent.

10.2. A new Policy takes effect when posted on the Website, unless the new version provides otherwise.

10.3. Any suggestions or questions about this Policy should be emailed to legal@sciente.ru.

10.4. The current Policy is published at sciente.ru.