Terminal Network

1. General Provisions

1.1. This Personal Data Processing and Privacy Policy (hereinafter referred to as the "Policy") has been developed in accordance with the Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as the "PD Law") and serves as a fundamental internal regulatory act of LLC "OTT," defining key directions in the field of processing and ensuring the security (confidentiality) of personal data, including the protection of human and citizen rights and freedoms during the processing of personal data in the Company. For the purposes of this Policy, the Company / OTT / Operator refers to LLC "OTT" as the Personal Data Operator.

1.2. The Policy uses the following key concepts:

Personal Data Security – the state of protection of personal data from unlawful actions, characterized by the ability of users, technical means, and information systems to ensure the confidentiality, integrity, and availability of personal data during its processing, regardless of the form of its presentation.
Confidentiality of Personal Data – a requirement that must be adhered to by the Operator or any other person who has access to personal data, not to disclose it to third parties and not to allow its distribution without the consent of the personal data subject or any other legal grounds.
Processing of Personal Data – any action (operation) or a combination of actions (operations) performed with personal data, using automated means or without such means, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion, destruction of personal data.
Personal Data Operator – a person who independently or jointly with other persons organizes and/or carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed with personal data.
Personal Data (PD) – any information relating to an identified or identifiable individual (personal data subject).
Personal Data Subjects – employees of the Company, employees of clients and service providers, and other categories of personal data subjects established in the local regulatory acts of the Company, whose personal data are processed in the Company.

2. Rights of Personal Data Subjects

Personal data subjects have the following rights:

2.1. To receive information regarding the processing of their personal data in the Company, as well as personal data processed on behalf of the Company, to the extent and in the manner provided by the PD Law;

2.2. To designate representatives for the protection of their personal data;

2.3. To require the Company to notify all persons to whom incorrect or incomplete personal data were previously communicated about all exclusions, corrections, or additions made to them;

2.4. To receive free access to their personal data, including the right to obtain copies of any record containing personal data, except in cases provided for by law;

2.5. To withdraw consent to the processing of personal data;

2.6. The right to cease processing of personal data;

2.7. To object to decisions made solely on the basis of automated processing of personal data, as well as to receive explanations from the Operator regarding the procedure for protecting personal data subjects' rights and legitimate interests;

2.8. To appeal in court against any unlawful actions or inactions of the Company regarding the processing and protection of their personal data;

2.9. Other rights provided by the legislation of the Russian Federation.

3. Principles and Purposes of Personal Data Processing

3.1. Personal data processing in the Company is carried out on a lawful and fair basis and is limited to achieving specific, predetermined, and legitimate purposes. Only personal data that correspond to the purposes of processing are subject to processing. The content and scope of personal data processed in the Company correspond to the stated purposes of processing, and the processing of excessive personal data is not allowed.

3.2. When processing personal data in the Company, their accuracy, sufficiency, and relevance to the purposes of processing are ensured. The Company takes necessary measures to delete or clarify incomplete or inaccurate personal data.

3.3. Personal data in the Company is stored in a form that allows identifying the personal data subject, for no longer than is necessary for the purposes of processing unless the storage period is established by federal law or a contract to which the personal data subject is a party, beneficiary, or guarantor. Processed personal data is destroyed upon achieving the purposes of processing or when there is no longer a need to achieve these purposes unless otherwise provided by federal law.

3.4. The purposes of processing, the composition and content of personal data, as well as the categories of personal data subjects whose data are processed in the Company, are contained in the Company’s Notification on Personal Data Processing, sent to the authorized body for the protection of personal data subjects' rights (Roskomnadzor), and are updated in case of changes. Additionally, the Company may process special categories of personal data, in accordance with the legislation of the Russian Federation on personal data processing, only with the written consent of the personal data subjects or other grounds provided by the legislation of the Russian Federation.

3.5. In the course of its activities, the Company may provide and/or delegate the processing of personal data to another party with the consent of the personal data subject, unless otherwise provided by federal law. A mandatory condition for providing and/or delegating the processing of personal data to another party is the obligation of the parties to maintain confidentiality and ensure the security of personal data during processing. The Company does not place the personal data of subjects in publicly accessible sources without their prior consent.

3.6. In the course of its activities, the Company may carry out cross-border transfer of personal data in accordance with the Federal Law "On Personal Data" and international treaties of the Russian Federation, provided that this information is included in the Company’s Notification on Personal Data Processing sent to the authorized body for the protection of personal data subjects' rights (Roskomnadzor).

3.7. The Company prohibits making decisions based solely on automated processing of personal data that produce legal consequences for the personal data subject or otherwise affect their rights and legitimate interests, except in cases provided by federal laws or with the written consent of the personal data subject.

4. Categories of Personal Data Subjects

4.1. In the course of fulfilling its core activities, the Company processes personal data of various categories of subjects, including:

Employees of the Company, their family members, and close relatives; individuals entitled to social security in accordance with the Company’s local regulatory acts; individuals authorized to sign on behalf of the Company (contracts, agreements, acts, etc.); candidates for election to the management bodies of the Company and members of such bodies; beneficiaries of the Company.
Applicants for vacant positions (including in the personnel reserve), recommenders of applicants for vacant positions, employees, relatives of employees, and individuals with whom employment contracts have been terminated.
Visitors to the Company’s offices and events.
Employees of clients and suppliers (counterparties), other subjects of counterparties whose personal data are processed in the course of providing services under the contract, as well as potential clients and suppliers.
Users of websites and mobile applications functioning in the interests of the Company.

5. Main Measures for Ensuring Personal Data Security

5.1. To ensure the security of personal data during processing, the Company independently determines the composition and list of measures necessary and sufficient to fulfill the obligations provided by the legislation on personal data. Such measures include, in particular:

Appointment of a person responsible for organizing the processing of personal data.
Issuance of documents defining the Operator’s policy regarding personal data processing, local acts on personal data processing issues, defining for each purpose of processing the categories and list of processed personal data, categories of subjects whose personal data are processed, methods, terms of processing and storage, the procedure for destroying personal data upon achieving the purposes of processing or upon the occurrence of other legal grounds, as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation, eliminating the consequences of such violations. The Company's documents and local acts do not contain provisions limiting the rights of personal data subjects and do not impose on the Company powers and obligations not provided by the legislation of the Russian Federation.
Application of legal, organizational, and technical measures to ensure the security of personal data.
Conducting internal control of compliance of personal data processing with the legislation and regulatory legal acts adopted in accordance with it, requirements for personal data protection, the Operator’s policy regarding personal data processing, and local acts of the Operator.
Assessment of the harm that may be caused to personal data subjects in case of violation of legal requirements, correlation of such harm with the security measures taken by the Operator.
Familiarization of employees of the Company directly involved in the processing of personal data with the provisions of the legislation of the Russian Federation on personal data.
Organization of the reception and processing of requests and inquiries from personal data subjects or their representatives and/or control over the reception and processing of such requests and inquiries (in accordance with the local regulatory acts adopted in the Company).
Obtaining consent from personal data subjects for the processing of their personal data, except in cases provided by the legislation of the Russian Federation.
Other measures to ensure the security of personal data applied by the Company.

5.2. The management of the Company recognizes the importance and necessity of ensuring the security of personal data (PD) and encourages the continuous improvement of the personal data protection system processed in the course of the Company's core activities.

6. Response to Personal Data Subjects' Requests

6.1. In the course of fulfilling its core activities, the Company processes personal data of various categories of subjects, including:

a) Requests for information regarding the processing of personal data, including:

Confirmation of the fact of personal data processing.
Legal grounds and purposes for processing personal data.
Methods of personal data processing used.
Name and location of the Company, information about individuals (except for Company employees) who have access to personal data or to whom personal data may be disclosed based on a contract with the Company or under federal law.
Processed personal data related to the respective personal data subject, the source of their acquisition, unless otherwise stipulated by federal law.
Duration of personal data processing, including storage periods.
Procedure for exercising the rights of personal data subjects as provided by the Federal Law on Personal Data.
Information about any completed or anticipated cross-border transfer of data.
Name or surname, first name, patronymic, and address of the person processing personal data on behalf of the Company, if the processing is delegated to such a person.
Information about how the Company fulfills its obligations to take necessary and sufficient measures to ensure compliance with the obligations set forth in the Federal Law on Personal Data.
Other information provided by the Federal Law on Personal Data or other federal laws.

b) Requests for clarification/blocking/termination of processing/destroying personal data if the data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing, or if the purpose of processing has been achieved.

c) Objections to decisions made solely based on automated processing of personal data.

d) Withdrawal of consent for personal data processing.

e) Requests to cease personal data processing.

6.2. Requests from personal data subjects (or their representatives) may be submitted to the Company in writing via Russian Post, electronically in accordance with current Russian legislation, in person by the personal data subject, or by phone.

6.3. All requests from personal data subjects (or their representatives) received in paper and electronic form, as well as actions taken to consider such requests, are registered by the Company on the day of receipt (if the request is received on a working day) or on the first working day following the day of receipt (if the request is received on a non-working day) or on the day actions are taken to consider the request.

6.4. If personal data subjects (or their representatives) contact the Company by phone, they should be informed that requests must be made in person or sent in writing to the Company via Russian Post, or electronically in compliance with Russian legislation. The personal data subject must also be provided with the address to which they should send their written request.

Requirements for the Content of Requests from Personal Data Subjects

6.5. When contacting, the subject or their representative must provide the following information:

The number of the primary document verifying the identity of the personal data subject or their legal representative.
Information about the date of issuance of the specified document and the issuing authority.
Information confirming the personal data subject's involvement with the Company (contract number, contract date, conditional verbal designation, or other information), or other information confirming the fact of personal data processing by the Company.
The handwritten signature of the personal data subject or their legal representative (if the request is submitted electronically, it must be formatted as an electronic document and signed with an electronic signature in accordance with Russian legislation).

6.6. If necessary, the Company has the right to request additional information from the personal data subject (or their representative).

6.7. If the request from the personal data subject does not include all the necessary information as required by the Federal Law on Personal Data, or if the subject does not have the rights to access the requested information, a reasoned refusal will be sent to them.

6.8. The right of the personal data subject to access their personal data may be restricted in accordance with part 8 of Article 14 of the Federal Law on Personal Data, including if access to the personal data by the subject violates the rights and legitimate interests of third parties.

7. Transfer of Personal Data to Third Parties

7.1 The Company does not transfer personal data (PD) to third parties, except in cases where it is necessary for the purposes of compliance with legislation, professional and business interests, processing requests, and/or as required or permitted by law or professional standards.

7.1.1 PD may be involuntarily transferred to service providers, such as IT system providers or consulting services (e.g., legal consultants). The Company works with service providers that it trusts to process PD. The Company transfers PD to providers on the condition that their activities comply with the requirements of Russian legislation regarding the processing of PD and ensuring their security. PD may only be transferred to the extent necessary to provide services to clients.

7.1.2 The Company may be compelled by law to disclose PD to the necessary extent in connection with the reorganization of the Company, sale, assignment, or other form of transfer of any component of the Company's business to which such PD relates.

7.1.3 The Company may be required to disclose personal information to courts of general jurisdiction, arbitration courts, law enforcement, or regulatory authorities in order to prepare responses to requests from courts of general jurisdiction, arbitration courts, or law enforcement, or if it is necessary or deemed appropriate in compliance with applicable legislation, decisions, or rulings of courts of general jurisdiction, arbitration courts, or regulatory documents of government authorities or bodies regulating professional activities.

7.1.4 The Company may be compelled to disclose PD to ensure the confidentiality of PD or to verify protection measures and/or to investigate or prepare an adequate response to a claim or threat to information security.

7.1.5 The rules and requirements governing the professional and business activities of the Company provide for sufficient liability insurance coverage in relation to the Company’s professional activities. This measure is intended to help the Company cover expenses related to the resolution of claims and lawsuits that may be filed by clients if they believe that services were not provided in full or that their quality was unsatisfactory. To ensure maximum effectiveness of the insurance coverage, the Company collaborates with various participants in the insurance market (brokers, insurers, and reinsurers, as well as their professional consultants and other third parties involved in the event of a claim).

Some of these participants in the insurance market may require the disclosure of PD necessary for the purpose of filing a claim against the Company or its counterparties (their employees), as well as for fulfilling their own obligations as provided by regulatory acts.