PERSONAL DATA PROCESSING POLICY

This Personal Data Processing Policy (hereinafter the "Policy") has been developed and approved in accordance with Article 18.1 of Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006 and defines the procedures for personal data processing and security measures implemented by ЭТАЖИ ГРУП (ETAZHY GROUP LLC) (hereinafter the "Operator"). The Policy is aimed at ensuring the protection of human and civil rights and freedoms during the processing of personal data, including the right to privacy and personal and family confidentiality.

1. General Provisions

1.1. The personal data operator is ЭТАЖИ ГРУП (ETAZHY GROUP LLC).

1.2. This Policy is a publicly available document of the Operator defining its personal data processing policy and is published on the Operator's website in accordance with Part 2, Article 18.1 of Federal Law No. 152-FZ.

1.3. The Operator processes personal data in compliance with the principles and conditions stipulated by Federal Law No. 152-FZ and ensures that the content and volume of processed personal data correspond to the stated processing purposes.

1.4. The Operator reserves the right to amend this Policy. The updated version takes effect upon publication on the Operator's website, unless otherwise specified.

2. Legal Basis for Personal Data Processing

2.1. The Operator processes personal data on the following legal grounds:

2.1.1. The Constitution of the Russian Federation.

2.1.2. Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006.

2.1.3. The Labor Code of the Russian Federation (regarding the processing of employee and applicant personal data).

2.1.4. The Civil Code of the Russian Federation.

2.2. Personal data processing is permitted in the following cases:

2.2.1. Processing is carried out with the consent of the data subject (Art. 6(1)(1), Art. 9 of Federal Law No. 152-FZ).

2.2.2. Processing is necessary for the performance of a contract to which the data subject is a party, or for pre-contractual measures at the data subject's request (Art. 6(1)(5) of Federal Law No. 152-FZ).

2.2.3. Processing is necessary for compliance with obligations imposed on the Operator by the laws of the Russian Federation (Art. 6(1)(2) of Federal Law No. 152-FZ).

3. Purposes of Personal Data Processing

3.1. The Operator processes personal data for the following purposes:

3.1.1. Identification of data subjects who contact the Operator via the website, telephone, email, or other means.

3.1.2. Conclusion, performance, and termination of civil law contracts with clients and counterparties in the field of construction and interior design.

3.1.3. Providing consultations, commercial proposals, and information about the Operator's services.

3.1.4. Sending notifications, including informational messages related to the provision of services.

3.1.5. Analysis of user activity on the Operator's website, improving website quality and provided services.

3.1.6. Recruitment and evaluation of job applicants for vacant positions.

3.1.7. Compliance with the requirements of Russian Federation legislation.

4. Categories of Data Subjects and Processed Personal Data

4.1. The Operator processes personal data of the following categories of data subjects:

4.1.1. Clients and prospective clients — individuals who contact the Operator for services or submit requests via the website. Data collected: full name; phone number; email address; content of inquiry or request; property address (if applicable).

4.1.2. Website visitors — persons accessing the Operator's website. Data collected: IP address; browser type and version; operating system; pages visited, time and duration of visit; referral source; cookie data.

4.1.3. Job applicants — individuals who submit a resume or respond to a vacancy posted by the Operator. Data collected: full name; phone number; email address; education and work experience details; other data contained in the resume voluntarily provided by the applicant.

4.2. The Operator does not process special categories of personal data relating to race, ethnicity, political views, religious or philosophical beliefs, health status, or intimate life (Art. 10 of Federal Law No. 152-FZ).

4.3. The Operator does not process biometric personal data (Art. 11 of Federal Law No. 152-FZ).

5. Procedures and Conditions of Personal Data Processing

5.1. Personal data is processed by the Operator using automated means (in personal data information systems) and without automated means (on paper).

5.2. Operations with personal data include: collection, recording, systematization, accumulation, storage, updating (modification), retrieval, use, transfer (provision, access), anonymization, blocking, deletion, and destruction.

5.3. The Operator does not carry out cross-border transfer of personal data.

5.4. Transfer of personal data to third parties is permitted solely on the grounds provided by the laws of the Russian Federation or with the consent of the data subject.

5.5. The Operator does not distribute personal data or disclose it to an indefinite number of persons without the consent of the data subject.

6. Personal Data Processing and Retention Periods

6.1. Personal data is processed and retained by the Operator for the period necessary to achieve the processing purposes specified in Section 3 of this Policy, or until the data subject withdraws consent.

6.2. Personal data processed for contract performance purposes is retained for the duration of the contract and for at least three years after its termination, unless a different period is established by Russian Federation legislation.

6.3. Job applicant personal data is retained for the duration of the evaluation period, but no longer than one year from receipt, unless otherwise agreed with the applicant.

6.4. Upon achieving processing purposes or upon expiration of the retention period, personal data is subject to destruction or anonymization in accordance with Section 7 of this Policy.

7. Personal Data Destruction Procedures

7.1. The Operator destroys personal data in the following cases:

7.1.1. Achievement of processing purposes or loss of necessity to achieve those purposes.

7.1.2. Withdrawal of consent by the data subject, if data retention is no longer required for processing purposes.

7.1.3. Detection of unlawful personal data processing where it is impossible to ensure lawful processing.

7.2. Destruction of personal data in information systems is carried out by permanently deleting records from databases. Destruction of personal data on paper is carried out by shredding documents.

7.3. Personal data destruction is carried out within thirty days from the date the relevant grounds arise, unless a different period is established by law. The fact of destruction is recorded in a personal data destruction report.

8. Personal Data Security Measures

8.1. The Operator implements necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions regarding personal data in accordance with Art. 19 of Federal Law No. 152-FZ.

8.2. Organizational measures include:

8.2.1. Appointment of a person responsible for organizing personal data processing.

8.2.2. Issuance of internal regulatory documents governing personal data processing and protection.

8.2.3. Familiarization of the Operator's employees directly involved in personal data processing with relevant legislation and internal documents.

8.2.4. Internal control of compliance of personal data processing with legal requirements and adopted internal regulations.

8.3. Technical measures include:

8.3.1. Access control and restriction to personal data information systems using authentication and authorization systems.

8.3.2. Use of encryption (cryptographic protection) when transmitting personal data via communication channels.

8.3.3. Use of antivirus protection tools and firewalls.

8.3.4. Regular data backup.

8.3.5. Logging of personal data operations in information systems for audit and control purposes.

8.4. The Operator evaluates the effectiveness of personal data security measures before deploying personal data information systems and on a regular basis during their operation.

9. Data Subject Rights

9.1. The data subject has the right to:

9.1.1. Obtain information regarding the processing of their personal data, including: confirmation of processing; legal grounds and purposes of processing; methods of processing; name and location of the Operator; list of processed data and their source; processing and retention periods; procedure for exercising data subject rights (Art. 14 of Federal Law No. 152-FZ).

9.1.2. Request the Operator to rectify, block, or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose (Art. 21 of Federal Law No. 152-FZ).

9.1.3. Withdraw consent to personal data processing at any time by sending a written request to the Operator (Art. 9 of Federal Law No. 152-FZ). Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

9.1.4. Lodge a complaint against the Operator's actions or inaction with the authorized body for the protection of data subject rights — the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), or seek judicial remedy (Art. 17 of Federal Law No. 152-FZ).

9.1.5. Protect their rights and legitimate interests, including seeking compensation for damages and moral harm through judicial proceedings.

9.2. To exercise their rights, the data subject submits a request to the Operator using the contact details specified in Section 10 of this Policy. The Operator reviews the request and provides a response within thirty days of receipt.

10. Person Responsible for Organizing Personal Data Processing

10.1. In accordance with Part 1, Article 22.1 of Federal Law No. 152-FZ, the Operator has appointed a person responsible for organizing personal data processing.

10.2. Inquiries regarding personal data processing can be sent to the following contact details:

Phone: +7 495 266-60-15.

10.3. The responsible person ensures internal control over compliance by the Operator and its employees with personal data legislation, communicates the provisions of this Policy to employees, and reviews data subject inquiries.

11. Final Provisions

11.1. This Policy takes effect upon approval by the Operator and remains in force indefinitely until replaced by a new version.

11.2. Matters not covered by this Policy are governed by Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006 and other regulatory legal acts of the Russian Federation in the field of personal data.

11.3. If any provision of this Policy is found to be invalid, this shall not affect the validity of the remaining provisions.

11.4. The current version of this Policy is publicly available on the Operator's website at: https://etazhy-group.ru/pd-processing.