Personal data processing policy

This English translation is provided for convenience only. In the event of any discrepancy, the Russian version prevails.

1. Definitions

1.1. Confidentiality of Personal Data – the obligation of persons who have obtained access to Personal Data not to disclose it to third parties or distribute it without the consent of the Personal Data Subject, unless otherwise provided by the laws of the Russian Federation;

1.2. Processing of Personal Data – any action (operation) or set of actions (operations) performed on Personal Data with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalisation, deletion and destruction of Personal Data;

1.3. Operator – CEO Cases Limited Liability Company (OGRN: 1187746011001, INN/KPP: 9701097974/770101001), registered at: 123112, Moscow, Presnenskaya nab., 6, bld. 2, premises 20/16. Actual address: 123112, Moscow, Presnenskaya nab., 6, bld. 2, entrance 3, floor 44, premises 4404;

1.4. Personal Data – any information relating to a directly or indirectly identified or identifiable individual (the Personal Data Subject);

1.5. User or Personal Data Subject – an individual who accesses the Website (visits the Website) and/or performs other actions using its functionality, including viewing or searching for information posted on the Website, registering on the Website, sending messages through web forms on the Website, etc., and who provides their Personal Data to the Operator;

1.6. Operator's Website – the Operator's official website, operated in the Operator's interests and available on the Internet at: https://www.ccases.ceo/.

1.7. Cookies – small pieces of data sent by a web server and stored in the User's browser that enable effective management of the Website and help configure the user interface.

2. General provisions

2.1. This Personal Data Processing Policy (the "Policy") has been developed by the Operator and is a publicly available document setting out the principles of the Operator's activities in processing and protecting Personal Data and ensuring the security of processing.

2.2. This Policy discloses, among other things, the methods, principles and purposes of the Operator's processing of Personal Data and the rights and obligations of the Operator and the User.

2.3. This Policy is to be published on the Website.

3. Principles, purposes and content of personal data processing

3.4. The above categories of Personal Data may also be processed for statistical and other research based on depersonalised data.

3.5. The Operator does not process special categories of Personal Data relating to nationality, political views, or religious or philosophical beliefs.

3.6. When requests are considered, the User may, on their own initiative, provide the Operator with additional Personal Data (including data contained in documents and messages). The Operator processes such Personal Data to the extent necessary to provide its services.

3.7. The Operator processes Personal Data on a lawful and fair basis.

3.8. Processing of personal data is limited to achieving specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of its collection is not permitted.

3.9. Only Personal Data that meets the purposes of its processing is subject to processing.

3.10. The content and scope of the personal data processed correspond to the stated purposes of processing. The personal data processed is not excessive in relation to the stated purposes of its processing.

4. Processing methods and actions performed by the operator with personal data

4.1. The Operator collects, records, systematises, accumulates, stores, clarifies (updates, modifies), retrieves, uses, transfers (distributes, provides, grants access to), depersonalises, deletes and destroys Personal Data.

4.2. The Operator processes Personal Data both with and without the use of automation tools.

5. Period of personal data processing

5.1. The Personal Data Subject gives consent to the processing of Personal Data for the entire period the Operator needs to achieve the purposes of processing.

5.2. The Personal Data Subject may withdraw consent to the processing of personal data.

5.3. If consent to the Processing of Personal Data is refused, the Operator will have to refuse to perform for the Personal Data Subject the actions provided for by the above purposes of processing.

5.4. Once the purposes of processing Personal Data have been achieved, or if the Personal Data Subject withdraws consent to processing, the Personal Data is to be destroyed within no more than 30 (thirty) business days from the date the purpose is achieved or the date the withdrawal is received, respectively.

5.5. If the Personal Data Subject requests that the processing of Personal Data be stopped, the Operator undertakes to stop processing the Personal Data within 30 (thirty) business days from the date such request is received.

5.6. The Personal Data Subject may withdraw consent to the processing of their Personal Data or request that processing be stopped by notifying the Operator in writing in one of the following ways:

5.6.1. by a written application sent to: 123112, Moscow, Presnenskaya naberezhnaya, 6, bld. 2, entrance 3, floor 44, premises 4404.

5.6.2. by an email sent to: ask@ccases.ceo.

6. Transfer of personal data

6.1. The Operator may engage third parties to process Personal Data by instructing third parties to process Personal Data and/or by transferring Personal Data to third parties without instructing them to process it.

6.2. Third parties may be engaged to process Personal Data only on condition that they process Personal Data to the minimum extent necessary and solely to achieve the stated purposes of processing, and that they ensure the confidentiality and security of Personal Data during processing (if third parties fail to meet these conditions, they will be liable under their contractual obligations to the Operator and/or under applicable personal data legislation). Such persons may include, in particular:

6.2.1. authorised public authorities in cases provided for by federal laws;

6.2.2. the Website's hosting provider;

6.2.3. providers of services for monitoring user actions (behaviour) on the Website.

7. Conditions for ending the processing of personal data

7.1. The Operator stops processing Personal Data and irrevocably deletes it from its information systems (destroys it) within the periods established by Federal Law No. 152-FZ if at least one of the following conditions occurs:

7.1.1. the user has withdrawn consent to the processing of Personal Data or has requested that processing of Personal Data be stopped;

7.1.2. the term of the Consent to the processing of personal data has expired;

7.1.3. the purpose of processing the Personal Data has been achieved;

7.1.4. unlawful processing of personal data has been detected;

7.1.5. the operator has stopped supporting the Website;

7.1.6. the operator has ceased its activities.

7.2. Processing of Personal Data is ended:

7.2.1. by blocking the Personal Data;

7.2.2. by deleting the Personal Data;

7.2.3. by destroying the Personal Data.

8. Measures for the proper organisation and security of personal data processing

8.1. When processing Personal Data, the Operator takes all necessary legal, organisational and technical measures to protect it against unlawful or accidental access, destruction, modification, blocking, copying, provision or distribution, as well as against other unlawful actions in relation to Personal Data.

8.2. The security of Personal Data processing is ensured by the following measures taken by the Operator:

8.2.1. appointing a person responsible for organising the processing of Personal Data;

8.2.2. carrying out internal control and/or audits of the compliance of Personal Data processing with Federal Law No. 152-FZ, the regulations adopted under it and the Operator's internal regulations;

8.2.3. restricting access to Personal Data and granting access only to authorised persons;

8.2.4. familiarising persons engaged (admitted) by the Operator to process Personal Data with the requirements of applicable personal data legislation and the Operator's internal regulations on Personal Data processing;

8.2.5. applying organisational and/or technical measures to ensure the security of Personal Data during processing;

8.2.6. including provisions on ensuring the security of Personal Data in contracts with third parties to whom Personal Data is transferred, including requirements not to disclose or distribute Personal Data without the consent of the Personal Data Subject, unless otherwise provided by the laws of the Russian Federation.

9. Rights and obligations of the personal data subject and the operator

9.1. The Personal Data Subject has the right to:

9.1.1. receive information concerning the Processing of their Personal Data, except in cases provided for by federal laws;

9.1.2. require the Operator to clarify, block or destroy their Personal Data if the Personal Data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of Processing, and to take measures provided for by law to protect their rights;

9.1.3. refuse to give consent to the Processing of Personal Data for the purpose of promoting goods, works and services on the market;

9.1.4. withdraw consent to the Processing of Personal Data;

9.1.5. appeal against unlawful actions or omissions of the Operator in Processing their Personal Data to the authorised body for the protection of the rights of Personal Data Subjects or in court;

9.1.6. exercise other rights provided for by the laws of the Russian Federation.

9.2. The Personal Data Subject must:

9.2.1. provide the Operator with accurate Personal Data;

9.2.2. inform the Operator of any clarification (updating, modification) of their Personal Data.

9.3. A person who has provided the Operator with inaccurate information about themselves is liable in accordance with the laws of the Russian Federation.

9.4. If requests, forms or accompanying documents sent by Users through the Website contain Personal Data of third parties, Users guarantee that they have proper legal grounds for transferring such Personal Data to the Operator. The Operator does not verify the legal grounds on which Users transfer the personal data of third parties, but may at any time request confirmation that the necessary legal grounds exist, and the User undertakes to provide it immediately.

9.5. The Operator has the right to:

9.5.1. receive accurate information containing their Personal Data from the Personal Data Subject;

9.5.2. if the User withdraws consent to the Processing of Personal Data, continue Processing Personal Data without consent where there are grounds established by the laws of the Russian Federation;

9.5.3. independently determine the composition and list of measures necessary and sufficient to fulfil the obligations provided for by personal data legislation and the regulations adopted under it, unless otherwise provided by personal data legislation.

9.6. The Operator must:

9.6.1. provide the User, at their request, with information concerning the Processing of their Personal Data;

9.6.2. organise the Processing of Personal Data in the manner established by the current laws of the Russian Federation;

9.6.3. respond to requests and enquiries from Personal Data Subjects and their legal representatives in accordance with the requirements of personal data legislation;

9.6.4. publish or otherwise ensure unrestricted access to this Policy;

9.6.5. take legal, organisational and technical measures to protect Personal Data against unlawful or accidental access, destruction, modification, blocking, copying, provision or distribution, as well as against other unlawful actions in relation to Personal Data;

9.6.6. perform other obligations provided for by personal data legislation.

10. Information about users collected automatically. Use of cookies.

10.1. The Operator uses cookies to ensure the correct and secure functioning of certain sections of the Website, to simplify navigation and to display information on the Website more effectively. Cookies are also used to recognise the User's computer or device, which makes using the Website easier and more personalised. In addition, the Operator uses cookies to collect statistical information about the use of the Website for analytics and the continuous improvement of its functionality.

10.2. Cookies contain information about how and by whom the Website is used, as well as information about the User's actions on the Website.

10.3. A Website visitor can manage cookies through their browser settings. If cookies are deleted, all data about the Website visitor's preferences will be deleted, including the preference to opt out of cookies.

10.4. If cookies are blocked, the user interface may change and some components of the Website may become unavailable.

10.5. Data collected through cookies: IP address data, media access control (MAC) address, browser and computer type and version, screen resolution, time zone and location, browser plug-in types and versions, other technologies the User uses to access the Website, information about how the User uses the Website, and the device type and identifier if the User accesses the Website from a mobile device.

10.6. When using cookies, the Operator does not use the IP address to identify the User. In addition, cookies do not store the email address or other information that could identify the User. However, they allow the Operator to "recognise" the User when the User visits the Website and to remember the User's preferences.

10.7. The Operator notes that cookies through which no Personal Data is collected do not require consent or any other grounds for their processing.

10.8. The Operator uses the following types of cookies:

10.8.1. Mandatory (strictly necessary) cookies. These cookies are necessary for the Website to function and cannot be switched off. They are usually set in response to a User's request for the Website to perform a certain action, such as setting privacy preferences or filling in a registration form. The User can set their browser to block or warn about these cookies, but some parts of the Website will then not work. Mandatory cookies do not collect or store Personal Data.

10.8.2. Functional cookies. These cookies are used to improve interaction with the Website and allow it to provide enhanced functionality and personalisation. The User may disable functional cookies, but some or all of the services on the Website may then not work properly.

10.8.3. Analytics and statistics cookies. These cookies may be used, among other things, to collect statistics and information about the User's behaviour patterns.

10.9. To stop receiving cookies, it is recommended to consult the instructions provided by the developer of the browser or the manufacturer of the device being used. Disabling some cookies may affect the functionality of the Website, and the User may experience some inconvenience when using it.

11. Final provisions

11.1. This Policy is valid indefinitely until replaced by a new version.

11.2. If changes are made to this Policy, the amended version of the Policy is published on the Website.

11.3. Visiting/using the Website by Personal Data Subjects after the amended version of the Policy takes effect means that the Personal Data Subjects have read its provisions.

11.4. By expressing consent in the relevant forms/banners/checkboxes or by sending a question or request to an email address containing @ccases.ceo, you confirm that you agree to the terms of Personal Data processing set out in the Policy.

11.5. Please note that your consent is not required where other grounds for processing Personal Data apply, for example:

11.5.1. processing of Personal Data is necessary to conclude a contract;

11.5.2. processing of personal data is necessary for statistical or other research purposes, provided that the Personal Data is depersonalised;

11.5.3. personal data must be published or disclosed in accordance with federal laws (for example, when responding to lawful and reasoned requests from law enforcement, prosecution, security and other authorities empowered to request information under the law);

11.5.4. processing of Personal Data is necessary to perform our duties, functions and powers imposed on us by law.

11.6. The current version of the Policy is freely available on the Website.