Russian
Infrastructure
Company

APPROVED
By Order of the General Director
JSC "RIC"

No. 21 dated "01" June 2023

REGULATIONS

on processing and protection of site visitors personal data

Joint Stock Company "Russian Infrastructure Company

1. General information.
1.1. Regulations on the processing and protection of personal data of site visitors www.ric-telecom.com published and applied by the Joint Stock Company "Russian Infrastructure Company" (hereinafter - the Company) in accordance with paragraph 2, part 1 of Article 18.1 of the Federal Law of 27.07.2006 N 152-FZ "On Personal Data" (hereinafter-the Law).
This Regulation on the processing and protection of personal data of visitors to the Company's website (hereinafter referred to as the Regulation) defines the policy, procedure and conditions for receiving, protecting, storing, processing and transmitting personal data of visitors to the website, establishes procedures aimed at preventing and detecting violations of the legislation of the Russian Federation, eliminating the consequences of such violations related to the processing and protection of personal data and applies to all information that the site administration may receive about visitors during their use of the site.
This Provision does not apply to other sites and does not apply to third-party sites. The site administration is not responsible for third-party sites to which visitors can click on links available on the site.
All issues related to the processing and protection of personal data that are not regulated by this Regulation are resolved in accordance with the current legislation of the Russian Federation in the field of personal data.
1.2. Processing is organized by the Company on the principles of:
• legality of the purposes and methods of personal data processing, integrity and fairness in the Company's activities;
• restrictions on the processing of personal data to achieve specific, predetermined and legitimate goals;
• the reliability of personal data, their sufficiency for the purposes of processing, the inadmissibility of processing personal data that are redundant in relation to the purposes stated when collecting personal data;
• processing only personal data that meet the purposes of their processing. Processing of personal data incompatible with the purposes of personal data collection is unacceptable;
• compliance of the content and volume of the processed personal data with the stated purposes of processing;
• ensuring the accuracy of personal data, their sufficiency, and, if necessary, relevance in relation to the purposes of personal data processing;
• storing personal data in a form that allows you to identify the subject of personal data for no longer than the purposes of personal data processing require.
1.3. Personal data of the general category within the meaning of this Regulation may include: surname, first name and patronymic, passport data, citizenship, photos, gender, date of birth, marital status, education, work information, phone number, email address, as well as other identification data about the subject of personal data in accordance with By law. Processing of special categories of personal data concerning race, nationality, political views, religious or philosophical beliefs, health status, intimate life is not allowed.
1.4. A personal data subject is an individual who uses the Company's website, or who has registered on the website by subscribing to the Company's newsletter, creating an account, or who has left his personal data for feedback from the Company (including using personal accounts in social networks), or a person who has consented to public posting his personal data on the website (hereinafter referred to as the "Visitor").
1.5. Consent to the posting of personal data may be given in any form, including in writing, by e-mail belonging to the Visitor, or by performing specific actions on the Company's website by entering their personal data or by using it.
1.6. The site administration can receive all personal data about the Visitor only from them.
Personal data of Visitors is confidential information and cannot be used by the site administration or any other person for personal purposes.

2. Processing of personal data.
2.1. The processing of personal data in relation to this Regulation means any action or set of actions performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use (placement), transmission (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
2.2. The Company also processes other information about Visitors, which includes:
• standard data automatically received by the server when accessing the site and subsequent actions of the Visitor (IP address of the host, type of operating system, visited pages of the site, information from which Internet resource the Visitor went to the site);
• information automatically received when accessing the site using bookmarks (cookies) and automatically received when login and use from personal accounts in social networks;
• information obtained as a result of the Visitor's actions on the Company's website and/or as a result of the actions of other Visitors on the Company's website.
2.3. By submitting their personal data on the website, the Visitor consents to their processing by the Company for an unlimited period.
2.4. The processing of personal data is carried out for the following purposes:
identification of the Visitor who has registered on the site;
making direct contacts with the Site Visitor via e-mail and/or telephone, including for the purpose of establishing feedback and sending notifications, information and requests related to the provision of services by the Company;
processing of applications, requests and requests of the Site Visitor;
promotion of goods, works, and services of the Company through direct contacts with the Visitor, conclusion and execution of civil contracts, including on the terms of a public offer (if this is assumed);
conducting marketing research based on depersonalized personal data;
quality control of the fulfillment of the working conditions of the Company's website;
determining the location of the Visitor to ensure security, fraud prevention;
providing the Visitor with effective customer and technical support in case of problems related to the use of the site;
implementation of advertising activities with the consent of the Visitor.
2.5. Processing of personal data that does not meet the purposes of processing is not allowed.

3. Access to personal data and storage.
3.1. When processing personal data, the necessary legal, organizational and technical measures are taken to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions with respect to the Visitor's personal data in accordance with the requirements of the Law.
3.2. Personal data posted on the Company's website are closed from an indefinite circle of persons (individuals and legal entities) visiting the Company's website. Personal data may be transferred to third parties in order to fulfill the instructions of the subject of personal data, as well as in cases where this is permitted by the legislation of the Russian Federation.
3.3. The personal data specified by the Visitor when registering on the Company's website may be available to the Company's employees as the operator of personal data, as well as to other persons who, by virtue of their duties, must process personal data.
3.4. Personal data is stored in the form of electronic databases, except in cases when non-automated processing of personal data is necessary in connection with the fulfillment of the requirements of the legislation of the Russian Federation.
3.5. With respect to the Visitor's personal information, its confidentiality is maintained, except in cases where the Visitor voluntarily provides information about himself for general access to an unlimited number of persons. When using certain services, the Visitor agrees that a certain part of his personal information becomes publicly available.

4. The Rights of Visitors.
4.1. The Visitor has the right to:
• receive full information about their personal data, their processing, storage and transfer;
• identification of their representatives to protect their personal data;
• clarification of their personal data, their blocking or destruction if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing;
• withdrawal of consent to the processing of personal data;
• the requirement from the site administration to notify all persons who have previously been informed of incorrect or incomplete personal data of Visitors about all exceptions, corrections or additions made in them.
• exercise of other rights provided for by the legislation of the Russian Federation in the field of personal data.
4.2. In order to exercise their rights and legitimate interests, the Site Visitor can contact the Company, which considers appeals and complaints from the personal data subject, thoroughly investigates the facts of violations and takes all necessary measures to eliminate them immediately.
4.3. Each Visitor has the right to request the deletion of his/her personal data from the Company's website. The Company undertakes to delete the Visitor's personal data within ten working days of receiving the relevant request from him.
4.4. The Visitor has the right to make changes to personal data, if this does not violate private and public interests.
4.5. The Visitor has the right to appeal against the actions or inaction of the Company by contacting the authorized body for the protection of the rights of personal data subjects.
4.6. The Visitor has the right to protect his rights and legitimate interests, including compensation for damages and/or compensation for moral damage in court.

5. The order of destruction, blocking of personal data.
5.1. In case of detection of unlawful processing of personal data when contacting a Visitor, the site administration blocks the unlawfully processed personal data related to this Visitor from the moment of such request for the verification period.
5.2. If inaccurate personal data is detected during the Visitor's request, the site administration blocks personal data related to this Visitor from the moment of such request for the verification period, if the blocking of personal data does not violate the rights and legitimate interests of the Visitor or third parties.
5.3. In case of confirmation of the fact of inaccuracy of personal data, the site administration, based on the information provided by the Visitor or other necessary documents, clarifies personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
5.4. In case of detection of illegal processing of personal data carried out by the site administration, the site administration, within a period not exceeding three working days from the date of this detection, stops the illegal processing of personal data.
5.5. If it is impossible to ensure the legality of the processing of personal data, the site administration, within a period not exceeding ten working days from the date of detection of unlawful processing of personal data, destroys such personal data.
5.6. The site administration notifies the Visitor about the elimination of violations or the destruction of personal data.
5.7. If the purpose of personal data processing is achieved, the site administration stops processing personal data and destroys personal data within a period not exceeding thirty days from the date of achievement of the purpose of personal data processing.
5.8. If the Visitor withdraws his consent to the processing of his personal data, the site administration stops processing them and, if the storage of personal data is no longer required for the purposes of processing personal data, destroys personal data within a period not exceeding thirty days from the date of receipt of the specified recall.
5.9. If a Visitor applies to the site administration with a request to terminate the processing of personal data, the site administration, within a period not exceeding ten working days from the date of receipt of the relevant request, stops processing them, except in cases provided for by the Law on Personal Data.
The specified period may be extended, but not for more than five working days if the site administration sends a reasoned notification to the Visitor indicating the reasons for extending the period for providing the requested information.
5.10. If there is no possibility of destruction of personal data within the period specified in paragraphs 6.4-6.10 of these Regulations, the site administration blocks such personal data and ensures the destruction of personal data within a period of no more than six months, unless another period is established by federal laws.
5.11. After the expiration of the period of normative storage of documents containing the Visitor's personal data, or upon the occurrence of other legal grounds, the documents are subject to destruction.
5.12. The site administration creates an expert commission for these purposes and conducts an examination of the value of the documents.
5.13. According to the results of the examination, documents containing the Visitor's personal data and subject to destruction:
• on paper - are destroyed by shredding in a shredder;
• in electronic form - erased from information media or physically destroyed the media on which the information is stored.

6. Responsibility for violation of the rules governing the processing and protection of personal data of users of the site. Dispute resolution procedure.
6.1. The Company and Website Visitors are responsible for non-fulfillment or improper fulfillment of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".
6.2. The Company is not responsible for false data posted by the Visitor about himself. The Company is not responsible for the actions of third parties who, as a result of using the Internet or the Company's website, have access to information about the Visitor, including information provided to them in a publicly accessible form and with his consent, and for the consequences of using information by third parties, which, due to the nature of the site, is available to any Internet visitor.
6.3. The Visitor is solely responsible for posting false information about himself, misleading third parties about his identity, and other identification information.
6.4. Persons guilty of violating the norms governing the receipt, processing and protection of the Visitor's personal data are brought to disciplinary, material, civil, administrative and criminal liability in accordance with the procedure established by the current legislation of the Russian Federation.
6.5. Moral damage caused to the Visitor as a result of violation of his rights, violation of the rules for processing personal data established by the Law on Personal Data, as well as requirements for the protection of personal data established in accordance with the said Federal Law, is subject to compensation in accordance with the legislation of the Russian Federation. Compensation for moral damage is carried out regardless of compensation for property damage and losses incurred by the Visitor.
6.6. In case of disputes, the Visitor and the Company seek to resolve them through negotiations. If it is impossible to resolve disputes through negotiations, they are subject to consideration at the location of the Company.
6.7. The Company is obliged to immediately report the loss (leakage) of personal data to the Visitor, as well as to the authorized body for the protection of the rights of personal data subjects.

7. Final provisions.
7.1. This Regulation in its legal meaning is a public offer, available to any Visitor of the Company's website and posted on the official website at: www.ric-telecom.ru .
7.2. The Company has the right to unilaterally change the text of this Regulation. All new changes will apply to legal relations arising after the relevant changes are made. Suggestions or questions related to this Regulation can be reported in any convenient way on the Company's website.
7.3. The Company recommends that Website Visitors take a responsible approach to resolving the issue of the amount of personal information about themselves transmitted from the Company's website.
7.4. In all other matters not regulated by this Regulation, the legislation of the Russian Federation is subject to application.

8. Information about the personal data Operator.
8.1. Name: Joint Stock Company "Russian Infrastructure Company"
Legal and post address: 115114, Moscow, ext. ter., Zamoskvorechye Municipal District, 2 Letnikovskaya st., bld. 1/D, office 401-403, Moscow, 115114
PSRN 1227700647613
ITN 9705179882