Personal Data Processing Policy

This English version is provided for informational purposes only. The legally binding version is the Russian original.

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter — the Policy) has been developed in accordance with Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data" (hereinafter — FZ-152), Government Decree No. 687 dated 15.09.2008, Government Decree No. 1119 dated 01.11.2012, FSTEC Order No. 21 dated 18.02.2013, and other applicable regulations of the Russian Federation in the field of personal data.

1.2. The Policy defines the procedures for processing personal data and the security measures undertaken by the Operator.

1.3. Personal Data Operator (hereinafter — the Operator):

1.4. The Policy applies to all personal data that the Operator receives from data subjects through the website rtatex.ru (hereinafter — the Website).

1.5. The Operator ensures protection of processed personal data from unauthorized access, disclosure, misuse, or loss in accordance with the requirements of FZ-152.

2. Principles of Personal Data Processing

Personal data processing is based on the following principles:

• lawfulness and fairness;
• limitation of processing to specific, pre-defined, and legitimate purposes;
• prevention of processing incompatible with the purposes of data collection;
• prevention of combining databases containing personal data processed for incompatible purposes;
• processing only data that meets the purposes of processing;
• ensuring accuracy, sufficiency, and relevance of personal data;
• destruction or anonymization of personal data upon achieving the purposes of processing.

3. Categories of Processed Personal Data

3.1. When using the Website and the contact form, the Operator may process the following categories of personal data:

• full name;
• email address;
• phone number;
• organization name;
• message content;
• IP address;
• cookie data;
• browser data (type, version, language);
• operating system data;
• date and time of visit;
• URLs of requested pages;
• referrer source.

3.2. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health, or intimate life.

3.3. The Operator does not process biometric personal data.

4. Purposes of Processing

Personal data is processed for the following purposes:

• handling inquiries and providing informational and consulting support;
• entering into, performing, and terminating civil law contracts;
• sending informational and promotional messages (with separate consent);
• improving the quality and usability of Website services;
• conducting statistical and analytical research;
• compliance with the legislation of the Russian Federation.

5. Legal Basis for Processing

The Operator processes personal data on the following legal grounds:

• Article 6 of FZ-152 — consent of the data subject (para. 1, part 1);
• Article 6 of FZ-152 — performance of a contract to which the data subject is a party (para. 5, part 1);
• Article 6 of FZ-152 — processing necessary for purposes provided by law (para. 2, part 1);
• Article 22 of FZ-152 — processing without notification to the supervisory authority (contract-related processing).

User consent for personal data processing in the contact form and consent for analytical cookies are collected separately.

6. Cookies and Analytics

6.1. The Website uses essential technical cookies required for proper functioning (language, theme, consent state).

6.2. Analytical cookies and scripts are loaded only after explicit consent is obtained through the cookie consent banner. Users can change their preferences at any time via the privacy settings in the Website footer.

6.3. Yandex Metrica

Website traffic analysis is performed using Yandex Metrica, provided by:

Data processing is carried out by Yandex LLC under a data processing entrustment agreement (Art. 6 FZ-152). Privacy policy: yandex.ru/legal/confidential.

Contact forms are configured with analytics restrictions: user-entered values (name, email, phone, message text) are excluded from Webvisor and form analytics tools.

6.4. VK Pixel

Advertising campaign effectiveness is measured using VK Pixel, provided by:

Privacy policy: vk.com/privacy.

6.5. Yandex Maps

The Contacts page uses an embedded map widget from Yandex Maps to display the office location. When the widget loads, the service receives the user's IP address and technical browser data. The widget loads automatically on page visit without additional consent, as processing is carried out by a Russian operator within the Russian Federation.

Privacy policy: yandex.ru/legal/confidential. Maps API terms: yandex.ru/legal/maps_api.

7. Third-Party Data Transfers

7.1. The Operator does not transfer personal data to third parties without the data subject's consent, except as required by the legislation of the Russian Federation (Art. 6, Part 1; Art. 9 FZ-152).

7.2. The Operator may entrust data processing to third parties under data processing entrustment agreements (Part 3, Art. 6 FZ-152). Currently entrusted to:

• Yandex LLC (Yandex Metrica) — traffic analytics;
• VKontakte LLC (VK Pixel) — advertising effectiveness;
• Yandex LLC (Yandex Maps) — map widget on the Contacts page.

7.3. Cross-border transfer of personal data is not performed. All data is stored and processed within the territory of the Russian Federation (Art. 18, Part 5 FZ-152).

8. Data Storage and Protection

8.1. Personal data is stored on servers located in the Russian Federation, in the secure cloud infrastructure of Timeweb Cloud "152-FZ Cloud":

8.2. Data is transmitted over secure communication channels (TLS/SSL) and stored in a database with cryptographic protection measures applied.

8.3. The Operator takes necessary and sufficient organizational and technical measures to protect personal data, including:

• identification of security threats during processing in information systems;
• application of organizational and technical security measures per Government Decree No. 1119;
• use of certified information protection tools;
• assessment of measure effectiveness prior to ISPD deployment;
• accounting for personal data storage media;
• detection of unauthorized access incidents and response;
• recovery of personal data modified or destroyed due to unauthorized access;
• establishment of personal data access rules;
• monitoring of security measures.

9. Processing and Storage Terms

9.1. Personal data is processed and stored for the period necessary to achieve the purposes of processing.

9.2. Data obtained through the contact form is stored for no less than 3 (three) years from the date of the last interaction with the data subject.

9.3. Consent records (consent type, date and time, IP address, user-agent) are logged in the Operator's consent journal and stored for the duration of data processing and no less than 3 (three) years after processing ceases.

9.4. Upon achieving processing purposes or expiration of storage terms, personal data shall be destroyed unless otherwise required by the legislation of the Russian Federation.

10. Data Subject Rights

In accordance with Articles 14–17 of FZ-152, the data subject has the right to:

• obtain information regarding the processing of their personal data, including confirmation of processing, legal grounds and purposes, methods of processing, and the Operator's name and location;
• request correction, blocking, or destruction of their personal data if the data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose;
• withdraw consent to personal data processing by submitting a written request to the Operator;
• appeal the Operator's actions or inaction to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or through the courts;
• seek protection of rights and legitimate interests, including compensation for damages and moral harm through the courts.

To exercise these rights, submit a written request to rt_info@rtatex.ru or the Operator's postal address. The request must include: full name, primary identity document number, date of issue and issuing authority, address, and the basis for the request. Processing time: no more than 10 business days from receipt.

11. Operator Obligations

The Operator is obligated to:

• provide data subjects with information regarding their personal data processing upon request;
• organize data processing in compliance with applicable Russian legislation;
• respond to inquiries from data subjects and their legal representatives per FZ-152;
• provide necessary information to the supervisory authority within 10 business days of receiving such request;
• publish or otherwise ensure unrestricted access to this Policy;
• take legal, organizational, and technical measures to protect personal data;
• cease processing and destroy personal data in cases provided by FZ-152.

12. Consent Withdrawal Procedure

12.1. Consent to personal data processing may be withdrawn by the data subject by sending a written request to the Operator's email: rt_info@rtatex.ru.

12.2. Consent to analytical cookies may be withdrawn at any time through the privacy settings interface in the Website footer.

12.3. Upon consent withdrawal, the Operator shall cease processing and destroy personal data within 30 (thirty) business days from the date of receipt, except where processing may continue under applicable law.

13. Final Provisions

13.1. This Policy is a publicly available document and shall be published on the Operator's Website.

13.2. The Operator reserves the right to amend this Policy. The new version takes effect upon publication on the Website unless otherwise specified.

13.3. The legislation of the Russian Federation shall apply to this Policy and the relationship between the user and the Operator.

13.4. For all questions related to personal data processing, contact: