POLICY REGARDING THE PROCESSING OF PERSONAL DATA

WARNING: The use of the Site implies direct, unambiguous, voluntary and unconditional consent of the individual to this Policy with respect to the processing of personal data and to the terms of processing of the relevant information which the individual provides to the Operator as specified therein. Carefully read the terms set out in this Policy and if you do not agree with these terms, stop using the Site, do not register on the Site and do not give your personal data to the Operator. The Operator has the right not to provide access to the Website or the possibility of using the functionality of the Website to individuals who haven't expressed their consent to this Policy or who haven't confirmed their consent in further cases of its change, including cases of change of the applicable legislation or who have stipulated or withdrawn their consent.
Users consent in particular to any of the actions stipulated in the Policy with respect to their personal data (processing) which are necessary to achieve any of the purposes specified in the Policy. Consent is given by activating the "consent to the processing of personal data" box (tick box)


1. GENERAL PROVISIONS

1.1 O2 Consulting Ltd, OGRN 1107746769283, Taxpayer Identification Number 7736622123 (hereinafter the "Operator") within the scope of its activities, processes personal data of users of the Site, where the Site is a site on the Internet, access which is provided at: o2startup. com/, representing an aggregate of information, texts, graphic elements, design, images, photo-, video materials, commercial designations and other results of intellectual activity and means of individualization, contained in an information system that makes such information available to users (hereinafter - the Website), and is a personal data operator with relevant rights and obligations, defined by Federal Law dated July 27, 2006 No. 152-FZ "On Personal Data" (hereinafter - the Law), other statutory acts and regulations.
Unless otherwise provided below, terms and definitions shall have the meanings prescribed by the Act. The subjects of personal data, who transfer their personal data to the Operator and/or the data of persons whose legal representatives they are, including users of the Website and their legal representatives, hereinafter also referred to as "Users".

1.2 The present policy of the Operator in relation to processing of personal data of Users (hereinafter - Policy) is developed and published in accordance with the requirements of the Law and determines main principles, goals, conditions and methods of processing of personal data of Users, list of processed personal data, main rights and obligations of the operator and Users, as well as measures on protection of personal data, realized by the Operator.


Main terms and definitions used in this Policy:
- Automated processing of personal data - processing of personal data by means of computer equipment;
- Blocking of personal data - temporary termination of processing of personal data (except in cases where the processing is necessary to clarify personal data);
- Information system of personal data - a set of personal data contained in databases of personal data and information technologies and technical means ensuring its processing;
- depersonalization of personal data - actions, as a result of which it becomes impossible, without the use of additional information, to determine the affiliation of personal data to a particular personal data subject;
- Processing of personal data - any action (operation) or a set of actions (operations), performed with or without the use of automation with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), anonymization, blocking, removal, destruction of personal data
- Operator - a state body, municipal authority, legal entity or individual, independently or together with other persons, organizing and (or) carrying out the processing of personal data, as well as defining the purpose of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
- Personal data - any information related to directly or indirectly identified or defined by an individual (personal data subject);
- provision of personal data - actions aimed at disclosure of personal data to a certain person or a certain circle of persons;
- Distribution of personal data - actions aimed at disclosure of personal data to an indefinite circle of persons;
- trans-border transfer of personal data - transfer of personal data to the territory of a foreign state to a foreign authority, a foreign individual or a foreign legal entity;
- Destruction of personal data - actions, as a result of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which tangible carriers of personal data are destroyed
- User registration - registration of the User as a user of the Site in order to access the Site and to be able to use the functionality of the Site, carried out on the Site;
- Services - consulting services provided by the Operator, including those using the functionality of the Website, the content, procedure and terms of which are set by the tariffs published on the Website or sent by the Operator to the User;
- User registration - registration as the User of the Website in order to use the functionality of the Website through the Web-interface or mobile application to receive services, place and use the documents and certain information, including the Content, use of other features and functionality of the Website, carried out through the Website in accordance with the Offer and the Agreement.

1.4 The legal grounds for processing personal data are:


- Federal laws and regulatory legal acts adopted on their basis, regulating relations related to the activities of the Operator, including, without limitation, the Constitution of the Russian Federation, the Civil Code of the Russian Federation;
- Articles of Association of the Operator;
- civil law transactions, contracts concluded between the Operator and the subject of personal data;
- consent to the processing of personal data.
2. PRINCIPLES AND OBJECTIVES OF PERSONAL DATA PROCESSING

2.1 Processing of personal data shall be carried out with due regard to ensuring protection of personal data subjects' (Users') rights based on the following principles

2.1.1 Legality: the processing of personal data shall be carried out by the Operator on a lawful and fair basis and shall be limited to achieving specific, predetermined and lawful purposes.

2.1.2. Sufficiency: only personal data, which by its content and volume correspond to the purposes of its processing, shall be processed, redundancy of the processed data shall not be allowed.

2.1.3 Compliance: the content and volume of the personal data processed by the Operator correspond to the stated processing purposes.

2.1.4 Accuracy: When processing personal data, the Operator shall ensure the completeness and relevance of the provided and processed data in relation to the purpose of personal data processing. The operator ensures that necessary measures are taken to clarify incomplete or inaccurate personal data.

2.1.5 Necessity: The operator shall store personal data in a form that allows to identify the subject of personal data, no longer than required by the purposes of personal data processing (storage period), unless another storage period of personal data is established by federal law, a contract, a party to which, a beneficiary or a guarantor under which the subject of personal data is. Processed personal data shall be destroyed or depersonalized upon attainment of processing goals or if it is no longer necessary to attain those goals, unless otherwise provided for by federal law.

2.2 The Operator processes, including collecting, recording, systematizing, storing, clarifying, updating, modifying, extracting, using, transferring (including distribution, provision, access), depersonalizing, blocking, deleting, destroying personal data of Users for the purposes of:

2.2.1. registration, authorization and identification of the User on the Site in connection with the use of the Site;

2.2.2. maintain, change or delete the User's personal profile on the Site;

2.2.3. enable the User to use the functionality of the Website, including the purchase of Operator's services, as well as monitor their quality;

2.2.4. interacting with Users, including for sending notices, requests and information related to use of the Website, as well as processing messages, appeals, requests and applications of the Users;

2.2.5. For the purposes of conducting civil law relations, including fulfilling the Operator's obligations to the User under the service agreements (hereinafter - the Agreement), concluded through the User's acceptance of the Public Offer, published by the Operator on the Website (hereinafter - the Offer);

2.2.6. confirmation of the accuracy, relevance and completeness of the data provided by the User, the User's rights necessary for the conclusion and execution of the Contract, making transactions, including those on the Website, including the purchase of the Operator's services;

2.2.7. information support of the User, including that necessary for the selection and purchase of the services provided by the Operator, performing contractual obligations of the Users and the Operator;

2.2.8. carrying out of statistical and other researches in relation to the work of the Website, improvement of its quality, identification and realization of the User's needs;

2.2.9. Carrying out of actions and surveys, aimed at improving the quality of services provided by the Operator;

2.2.10. Carrying out marketing activities and advertising of new features of the Website;

2.2.11. Ensuring compliance with the requirements of the current legislation of the Russian Federation.


3. LIST OF PROCESSED PERSONAL DATA. ORDER AND CONDITIONS OF PROCESSING OF PERSONAL DATA

3.1. The operator processes the following personal data of Users:
- Surname, first name, patronymic; including:
- Surname, first name, patronymic of an underage User provided by the User's legal representative;
- Surname, first name, patronymic of the legal representative of an underage User;
- Phone number;
- E-mail address;
- Bank information of the User;
- Login and password of the User for registration on the Site;
- De-personalized data about the User (including cookie files), collected and processed by Internet statistical services ("Yandex-Metrika", "Google Analytics" and others).
3.2 In order to pay for the services provided by the Operator via the Site the User fills in the sections on the Site for payment of his bank card data by entering the card details in the form on the Site.
Payment operations shall be performed by means of appropriate payment systems and money transfer operators. The data of bank cards are encrypted in the User's browser. The operator does not provide money transfer services, does not collect, store and process the data of bank cards (including the number, name of the holder, expiration date, CVC-code).
If the User uses the data of bank cards and bank details of a third party, the User does so only with the proper permission of the person concerned. The Operator is not responsible for the unauthorized use of the data by the User and has the right to take the measures stipulated by the legislation in case of revealing the corresponding facts.

3.3 The Operator collects personal data directly from Users. Users provide personal data, specified in point 3.1. of the Policy, while registering on the Website or filling the special forms, posted on the Website in accordance with the terms of the Offer, as well as when Users give the Operator their personal data by other means of information exchange (electronically or directly).

3.4 The anonymized data of the Users (including "cookie" files), which are collected with the help of Internet statistics services, are used for collecting information about the Users' actions on the Website, improving the quality of the Website and its content. The Operator processes anonymized data about the User if it is allowed in the settings of the User's browser (cookie files saving and JavaScript technology usage are enabled).

3.5 Processing of personal data is carried out with the consent of subjects of personal data to the processing of their personal data, as well as without it in cases stipulated by the legislation of the Russian Federation. The Operator shall process personal data of Users with their consent prior to the conclusion of the Contract, unless otherwise provided by the legislation of the Russian Federation on personal data.

3.6. the Operator's employees, whose job duties include the processing of personal data, shall be allowed to process personal data.

3.7. registering on the Website or providing data by filling in special forms, the User confirms that he is a legally capable person and has all the rights and authority to transfer his data to the Operator and to provide consent to the processing of personal data by the Operator.

3.7.1 If the User is a minor between the ages of 14 and 18 (legally incapacitated), the transfer and consent to the processing of personal data is provided by:
(a) by the User's legal representative, who has fully read and accepted the terms of this Policy,
(b) by an underage User between the ages of 14 and 18 on their own, if they confirm that they have received written consent from their legal representatives to register and to provide the Operator with consent for the processing of personal data.

3.7.2 The transfer and consent to the processing of personal data of a minor under the age of 14 (minor) is provided solely by the legal representatives of the User.
3.7.3 When collecting personal data, the Operator assumes that they are lawfully provided by the relevant subject of this personal data or the subject's legal representative. The operator has the right from time to time to demand from the User to provide information and documents confirming the above mentioned and the reliability of the data provided for registration on the Site, the availability of the User's necessary authority to provide personal data and consent for processing of personal data, including the written consent of legal representatives to provide the operator with consent for processing of personal data, and other confirmation as required by applicable law, and the User is obliged to pre

3.8 Processing of personal data of Users is carried out under the following conditions:

3.8.1 The User's consent to the processing of personal data, provided in the manner prescribed in paragraph 3.5 of the Policy for the established cases is available;

3.8.2 The processing is necessary to achieve the goals stipulated by the Law, to implement and execute the functions, powers and duties imposed on the Operator by the legislation of the Russian Federation;

3.8.3. the Processing is necessary to fulfill the contractual obligations of the Operator to the User under the Agreement concluded by means of the User's acceptance of the Offer, to which the subject of personal data (the User) is a party;

3.8.4 The processing is necessary to fulfill other agreements for the provision of the Operator's services, provided by the Operator through the use of the Website;

3.8.5. Processing of personal data is necessary to exercise the rights and legitimate interests of the Operator or third parties;

3.8.6. Processing of personal data is carried out in accordance with other conditions stipulated by the Law.

3.9 Processing of personal data of Users is carried out in the following ways:

3.9.1. automated processing of personal data with or without transmission of the received information via information and telecommunications networks;

3.9.2. processing of personal data without use of automated means;

3.9.3. mixed processing of personal data.

3.10. Processing shall be carried out by entering personal data into the Operator's logs, registers and information systems, including those in the possession and use of the Operator on any legal basis.

3.11. When collecting personal data, including by means of the information and telecommunications network of the Internet, the Operator ensures recording, systematization, accumulation, storage, clarification (updating, changing), extraction of personal data of citizens of the Russian Federation using databases located in the Russian Federation, except for cases specified in the Law on Personal Data.

3.12. The Operator does not transfer Users' personal data across borders.

3.13. The Operator is entitled to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise stipulated by federal law, on the basis of a contract concluded with that person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing stipulated by the Law and the Policy.

3.14. Users hereby acknowledge and confirm (agree) that the Operator is entitled to disclose the Users' personal data to third parties to the necessary extent and to perform the above actions in compliance with the requirements of the current legislation of the Russian Federation, and such third parties will legally process the personal data of the Website Users by order of the Operator.

3.15. The Operator is entitled to transfer the User's personal data without their consent in cases stipulated by the current legislation.

3.16. The Operator has the right, in addition and separately stated, to transfer the personal data of the User (and the Users hereby express their consent, if necessary) to the following persons

3.16.1. to state authorities, including bodies of inquiry and investigation, and local authorities, in relation to which the Operator is obliged to provide information in accordance with the current legislation upon a reasoned request;

3.16.2. to persons specified in the Law;

3.16.3. persons specified in pp. 3.13 - 3.16 of the Policy.

3.17. The consent of the Website Users for the personal data processing is valid for 5 (five) years from the moment of providing the personal data to the Operator (from the moment of registration on the Website) provided that the Operator has no information about the revocation of such consent, with the possibility of prolongation for every next 5 (five) years if the Operator has not received a notice about the expiration of the consent after the first five years.


3.18. The users of the Website have the right to withdraw their given consent to the processing of personal data by sending a corresponding notice to the Operator at the address: help@o2startup.com not less than 14 (Fourteen) days before the moment when the consent is considered withdrawn. Upon receipt of such notice, the Operator shall stop processing personal data within five (5) days.

3.19. At the same time (a) in case of withdrawal of consent for processing of personal data the Operator shall be entitled not to stop processing of personal data and not to destroy them in cases stipulated by the current legislation of the Russian Federation, (b) the Operator shall be entitled to continue processing personal data in cases, when by virtue of the Law consent for processing is not required and the Operator shall be entitled to process them regardless of availability or withdrawal of consent.

3.20. The Operator stops processing the relevant personal data of Users in the following cases:

3.20.1. upon achievement of the purposes of the processing of the personal data and/or the end of the period for which the consent to the processing has been provided, whichever is applicable;

3.20.2. at the request of the personal data subject, if the personal data processed by the Operator is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated processing purpose;

3.20.3. in the event that the personal data subject withdraws their consent to the processing of their personal data in cases where the processing of personal data is a condition of consent;

3.20.4. in case of detection of the unlawful personal data processing, if it is not possible to ensure the lawfulness of personal data processing.

3.21. Certain categories of personal data.

3.21.1. the Operator does not process special categories of personal data relating to race, ethnicity, political views, religious or philosophical beliefs, health status, intimate life, except in cases provided for by Russian legislation.

3.22. The Operator stores the Users' personal data during the term stipulated by the Policy in the electronic form using the corresponding databases (servers) in compliance with the requirements of the Law for the storage of personal data.

3.23. The period of storage of personal data does not exceed 10 years, unless an event stipulated by the Law or the Policy occurs, upon the occurrence of which the Operator stops processing of personal data earlier.

3.24. If unauthorized processing of personal data is detected when the personal data subject or his/her representative or the federal executive authority responsible for control and supervision over the compliance of personal data processing with Russian Federation legislation on personal data, other authorized bodies contact (request), the Operator shall block the unauthorized processed personal data relating to that personal data subject from the moment of such contact (request).

3.25 Confirmation of the fact of personal data processing, the legal basis and purpose of personal data processing, as well as other information specified in Part 7 of Article 14 of the Act, are provided by the operator to the subject of personal data or his representative in reasonable time upon receipt of written request the personal data subject or his legal (authorized) representative. The operator shall provide the personal data subject or his representative with information (to the extent required by law) about the processing of such personal data subject's personal data in the manner provided by the Policy.

3.25.1 The request must contain the number of the main identity document of the subject of personal data or his/her representative, information about the date of issue of the specified document and the issuing authority;

3.25.2. Information confirming the personal data subject's participation in relations with the Operator, or information otherwise confirming the fact of personal data processing by the Operator;

3.25.3. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the laws of the Russian Federation;

3.25.4. If the personal data subject's application (request) does not reflect all the necessary information in accordance with the requirements of the Law or the subject does not have the rights of access to the requested information, a reasoned refusal shall be sent to him;

3.25.5. The personal data subject's right of access to his personal data may be restricted in accordance with the Article 14, paragraph 8 of the Law, including if the subject's access to his personal data violates the rights and legitimate interests of third parties.


4. RIGHTS OF SUBJECTS OF PERSONAL DATA

4.1 The subjects of personal data (Users) have the right to:

4.1.1. information about their personal data processed by the Operator, except as provided by the Policy and federal laws. Information shall be provided in an accessible form, it shall not contain personal data relating to other subjects of personal data, except in cases where there are legitimate grounds for disclosure of such personal data. The list of information and the procedure for obtaining it are established by law;

4.1.2. clarification of personal data, blocking or destruction of personal data, if personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;

4.1.3. provision and withdrawal of consent to processing of personal data;

4.1.4. taking measures stipulated by the current legislation of the Russian Federation to protect its rights;

4.1.5. Appealing against actions or omissions of the Operator, carried out in violation of the requirements of the legislation of the Russian Federation in the field of personal data, to the competent authority for the protection of the rights of subjects of personal data or to a court;

4.1.6. exercise of other rights provided by the legislation of the Russian Federation.

5. MEASURES TO ENSURE THE OPERATOR'S OBLIGATIONS AND PROTECTION OF PERSONAL DATA

5.1 Processing of personal data shall be carried out in accordance with the requirements of the legislation of the Russian Federation. The operator provides confidentiality of personal data of Users during their processing in the volume, order and conditions provided by the legislation, the Policy, local normative acts and contractual obligations of the Operator.

5.2 When processing personal data on the Website the Operator:

5.2.1. takes measures necessary and sufficient to ensure the fulfillment of obligations by the Law and regulations adopted in accordance with it. The Operator shall independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of such obligations, unless otherwise provided by the Law or other federal laws, in particular

5.2.1.1. take legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data;

5.2.1.2. issue local regulations, determining the policy and issues related to processing and protection of personal data;

5.2.1.3. appoints the person responsible for organization of personal data processing;

5.2.1.4. introduces the provisions of the legislation of the Russian Federation and the local regulations of the Operator in the field of personal data, including requirements to protection of personal data, to the employees directly engaged in processing of personal data, and provides necessary training to the said employees;

5.2.1.5. exercises internal control over compliance with the legislation of the Russian Federation on personal data, including requirements to protection of personal data.

5.2.2 Publish on the Internet or otherwise provide unrestricted access to this Policy.

5.2.3 Take other necessary measures for protection of personal data, determine threats to security of personal data and necessary level of security of personal data during its processing in personal data information systems, evaluate efficiency of applied measures for security of personal data.


6. FINAL PROVISIONS

6.1. In order to receive and transmit information regarding the processing of personal data, as well as in case of questions regarding this Policy, Users are entitled to send the appropriate requests to the Operator at the e-mail address: help@o2startup.com. The subject of the message must indicate that the question concerns the User's personal data.

6.2 The User hereby gives his prior consent to the Operator for processing of personal data for the purpose of promoting the Operator on the market of goods, works and services, including receiving newsletters of information and advertising nature at the e-mail address provided to the Operator. Such consent can be withdrawn by the User by clicking on the link to deactivate the consent to receive promotional newsletters in the relevant email or other electronic message addressed to the User.

6.3 This Policy has been developed in pursuance of the requirements of paragraph 2 of Part II of the Privacy Policy. 2 ч. 1 part 1 of Article 18.1 of the Law, and approved by the sole executive body of the Operator by issuing an order to the organization, and shall apply to the personal data set forth herein. The Policy applies to the relations in the field of personal data processing, which arose with the Operator both before and after the approval of this Policy.

6.4 The Operator has the right to amend this Policy from time to time without the User's prior consent. The new edition of the Policy comes into force from the moment of its approval by the Operator and posting on the Site, unless otherwise stipulated by the new edition of the Policy and the Law. The User is obliged to get acquainted with the amendments of the Policy regularly by means of familiarization with the actual edition of the Policy at the Site. Actual use of the Site by the User means the User's consent to the new version of the Policy. The current version of the Policy is published in unrestricted access and is permanently located at: o2startup.com.

Responsibility for violation of the requirements of the legislation of the Russian Federation and regulations in the field of processing and protection of personal data shall be determined in accordance with the legislation of the Russian Federation.

6.6 The User and the Operator agree that giving consent to the processing of personal data by activating the "Consent to the processing of personal data" checkbox (putting a tick) by electronic means on the Site is considered an appropriate form of giving consent in the meaning of Art. 9 of the Law, whereby the User is not required to make an additional handwritten signature, except as provided by the Law.

6.7. The User and the Operator agree to use the electronic form of written documents, including the exchange of messages by means of the Website and e-mail. The User and the Operator agree that such exchange of documents is sufficient, the written form is respected, and the documents transmitted in this way will have the force of the originals. Legally relevant communications that are required by law to be in writing other than in electronic form shall be transmitted in scanned copies by email, followed by the transmission of the originals in hard copy.


Revision 2021