Personal Data Processing Policy

PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. Introductory Provisions

1.1. This document (hereinafter referred to as the Policy) has been developed by Smep LLC (hereinafter referred to as the Operator) as a fundamental internal document governing the processes of collecting, using, and storing the data of individuals. The Policy is based on the requirements of Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, and aims to ensure the privacy and protection of the personal and family secrets of every citizen.

1.2. This Policy applies to all sets of personal information handled by the Operator, regardless of the source of acquisition or the storage medium.

1.3. The provisions of the Policy are mandatory for all legal relationships involving personal data to which the Operator is a party, whether such relationships arose prior to or after the date of approval of this version of the Policy.

1.4. In compliance with legal requirements (Part 2 of Article 18.1 of Federal Law No. 152-FZ), this document is made publicly available on the Operator’s official website on the Internet for access by an unlimited number of persons.

2. Terms

The following definitions apply within the scope of this Policy:

Personal Data (PD) – a set of information allowing for the direct or indirect identification of a specific natural person (the data subject).

Publicly available PD (authorized for dissemination) – information to which access by an indefinite circle of persons has been authorized by the data subject themselves through the expression of their will (consent).

Operator – a legal entity (Smep LLC) that, independently or in cooperation with third parties, organizes the processing of PD and determines the purposes of such processing, the scope of the data being processed, and the list of operations performed on said data.

Processing – any action or sequence of actions performed on PD, whether using automation tools or otherwise. The list of operations includes: collection, recording, accumulation, systematization, refinement (updating/modification), retrieval, application (use), depersonalization, blocking, deletion, dissemination, provision, and destruction.

Automated processing – the performance of operations on PD using computing resources and software.

Provision of PD – actions that disclose specific information to a specific person or a limited circle of persons.

Cross-border transfer – the transmission of PD outside the Russian Federation to authorities, natural persons, or legal entities of a foreign state.

Blocking of PD – the suspension of all operations involving the data (except in cases where such operations are necessary for data verification).

Destruction of Personal Data – a set of measures rendering it objectively impossible to restore the content of personal data within an information system or on a physical storage medium.

Protection of Personal Data – a set of preventive measures aimed at preventing leaks, unauthorized access, or accidental impact on the protected information.

3. Principles, conditions, and procedures for information processing

3.1. The Operator strictly adheres to the federal legislation of the Russian Federation when performing any actions involving personal data.

3.2. The fundamental condition for initiating processing operations is the voluntary consent of the data subject. In exceptional cases expressly stipulated by law, processing is permitted without obtaining such consent.

3.3. If the data subject grants permission for the dissemination of their personal data, such consent must be executed as a separate document (distinct from the general consent for processing).

3.4. A declaration of intent regarding the dissemination of personal data may be submitted to the Operator via the following channels:

-through a personal declaration of intent (in paper or electronic form);

-via the functionality of the specialized information system of the authorized state body for the protection of data subjects' rights.

3.5. The Operator employs a mixed processing model, combining automated technologies with manual (non-automated) methods.

3.6. Access to personal data is granted exclusively to those employees of the Operator for whom working with such information constitutes a direct job duty as defined in their job description.

3.7. Methods of obtaining and recording data:

-receipt of information in oral or written form directly from the data subject, subject to their voluntary consent;

-entry of the obtained information into internal registers, logs, and corporate information systems;

-other methods not contrary to applicable law.

3.8. Disclosure of personal data to third parties or public dissemination without the data subject's consent is strictly prohibited, except as expressly required by federal laws.

3.9. The provision of data sets to law enforcement agencies (investigative and inquiry bodies), the Federal Tax Service (FNS), the Pension Fund (PFR), the Social Insurance Fund (FSS), and other authorized entities is carried out strictly in accordance with the procedures established by the legislative acts of the Russian Federation.

3.10. The Operator implements a comprehensive security approach that includes legal, organizational, and technical safeguards to prevent accidental or unauthorized access, modification, blocking, or dissemination. In particular, the following measures are implemented:

-regular assessment of current security threats;

-development and updating of internal regulations regarding personal data handling;

-appointment of personnel responsible for security in each department and information system;

-ensuring proper storage conditions for data media;

-maintaining records of all documents and media containing personal data;

-periodic professional development for employees involved in data processing activities.

3.11. Information is stored strictly in a format that allows for the identification of the data subject and only for the duration necessary to achieve the stated purposes (unless otherwise prescribed by law or contractual obligations).

3.12. When collecting data (including via the Internet), the Operator ensures the recording, accumulation, and systematization of personal data of Russian citizens exclusively using databases physically located within the territory of the Russian Federation (except in cases established by Federal Law No. 152-FZ).

3.13. Purpose of data processing:

3.13.1. Only information relevant to achieving the stated objectives shall be processed.

3.13.2. List of primary objectives:

-compliance with constitutional norms and fulfillment of federal legal requirements;

-execution of the Company’s statutory tasks and core business activities;

-maintenance of personnel records and administrative documentation;

-addressing matters related to employee hiring, training, and career advancement, as well as monitoring workplace discipline and the safeguarding of assets;

-conducting recruitment campaigns and candidate selection;

-organizing personalized record-keeping within the pension insurance system;

-preparing and submitting mandatory reports to regulatory authorities;

-concluding and administering civil-law contracts;

-maintaining accounting and tax records;

-enforcing access control measures at the Operator’s premises;

-sending informational and service-related SMS messages to the client’s contact number;

-fulfilling contractual obligations regarding the sale of goods;

-conducting market research and statistical analysis (subject to mandatory data anonymization);

-other lawful purposes not contrary to the provisions of this Policy.

3.13.3. Processing of employees' personal data is conducted exclusively for the purpose of compliance with labor and tax legislation.

3.14. List of categories of data subjects whose data is processed:

3.14.1. Regarding Buyers and Site users, the following data is processed: full name, date of birth, gender, mobile phone number, e-mail address, addresses (registration, work, delivery), cookies, geolocation data, order history, payment methods, reviews, website behavior data (views, items added to cart), and Personal Account ID.

3.14.2. Regarding inquiries concerning rights violations, the following data is processed: full name, identity document details, contact details (phone, e-mail), as well as the content of the inquiries and the results of their review.

3.14.3. Data sources:

-direct completion of feedback forms on the Site, sending of letters or electronic messages;

-automated collection and systematization of data voluntarily provided by data subjects.

3.15. Archiving and storage rules:

3.15.1. Personal data may be stored in either paper or electronic format.

3.15.2. Paper records are kept in lockable cabinets or secured rooms with restricted access.

3.15.3. Electronic data processed for different purposes are strictly segregated into separate directories (folders).

3.15.4. Storing files containing personal data on open file-sharing services or in publicly accessible folders is prohibited.

3.15.5. Personal data must be deleted once the processing purposes have been achieved or are no longer relevant.

3.16 Destruction procedure:

3.16.1. Paper media are disposed of via incineration, shredding, chemical treatment, or recycling (pulping) using a shredder.

3.16.2. Electronic media are sanitized using data wiping or formatting with multiple overwrites.

3.16.3. The fact of destruction is documented in an internal record (report) listing the destroyed media.

4. Security System

4.1. The Operator has established and operates a multi-level personal data protection system (PDPS) that integrates legal, organizational, and technical components.

4.2. The legal component of the system comprises a set of regulations, administrative orders, and internal instructions governing the establishment and development of the PDPS.

4.3. The organizational component governs the security management structure, access control procedures, and policies for interaction with personnel and third-party contractors.

4.4. The technical level is equipped with modern hardware and software systems designed to prevent data leaks and attacks.

4.5. Basic protective measures:

-appointment of an official responsible for coordinating processing activities, staff training, and internal audits;

-updating the threat model and incident response plan;

-maintaining the approved Policy in an up-to-date state;

-strict segregation of access rights with logging of all system actions;

-use of individual passwords for logging into information systems;

-use of certified antivirus software with regular signature updates;

-monitoring and detection of unauthorized access attempts;

-data recovery in the event of damage or loss;

-systematic staff training on the requirements of Federal Law No. 152-FZ and internal regulations;

-conducting regular internal checks and audits of the personal data protection system's effectiveness.

5. Interaction Procedures: Data Subject Rights and Company Obligations

5.1. Guarantees of data subject rights:

Every individual has the legal right to obtain the following information from the Operator:

-confirmation of the fact that personal data is being processed;

-legal basis and purposes of processing;

-list of methods used to process personal data;

-full details of the Operator and information on third parties with access to the data;

-established processing and storage periods;

-procedures for exercising rights provided by law;

-information about any processor engaged on the Operator's behalf.

5.2. Functional obligations of the Operator:

-to inform the data subject of the purposes and procedures of processing at the time of data collection;

-notify the data subject if the data was obtained from third-party sources;

-explain the consequences should the data subject refuse to provide personal data;

-ensure open access to the text of the Policy and information regarding protection measures;

-implement and maintain the necessary set of protection measures against unauthorized access, copying, dissemination, or destruction;

-provide timely and substantiated responses to requests from data subjects and official inquiries from the authorized body (Roskomnadzor).

6. Procedure for updating, blocking, and deleting data

6.1. Provision of information upon request:

Upon receipt of a request from a data subject or their representative, the Operator is obliged to provide—within the established timeframe—confirmation of processing, copies of the data, and other information stipulated by Part 7 of Article 14 of Federal Law No. 152-FZ. Data concerning third parties shall not be disclosed without legal grounds.

The request must be accompanied by a copy of the primary identity document and details confirming the interaction with the Operator (contract number, login, etc.). A request submitted in electronic form must bear a qualified electronic signature. If the necessary details are missing or the right of access is not established, a substantiated refusal shall be issued. Access may be restricted if required to protect the interests of third parties.

6.2. Correction of inaccurate data:

Upon discovery of errors (whether independently, based on a request from the data subject, or pursuant to an order from Roskomnadzor), the Operator shall immediately block such data for the duration of the verification process (provided this does not violate the data subject's rights). Once the error is confirmed, the data shall be corrected within 7 working days of the submission of supporting documents, after which the block shall be lifted.

6.3. Measures regarding unlawful processing:

If the processing is determined to be unlawful (based on a request from the data subject or a government authority), the Operator shall initiate the blocking of such data immediately upon receipt of the request.

6.4. Grounds for complete destruction:

Personal data shall be destroyed upon the achievement of the processing purposes or upon the withdrawal of consent by the data subject (except in cases where data retention is necessary for the performance of a contract, required by law, or where the Operator is legally entitled to process the data without consent).

7. Final Provisions

7.1. Parties found liable for violating the standards established by the legislation of the Russian Federation and the Company’s internal regulations regarding personal data processing shall be held accountable in accordance with the applicable legal framework of the Russian Federation.

7.2. This version of the Policy enters into force upon its signing by the head of the Company and remains legally binding indefinitely until a new version of the document is approved.

7.3. Any amendments or additions to this document shall enter into force only after their approval by the General Director of the Company.