APPROVED
By Order of FORMI LLC
dated May 26, 2025 No. 9-2/25

Privacy Policy of FORMI Limited Liability Company with respect to the processing of personal data (new version)

1. General Provisions

1.1. This Privacy Policy of FORMI Limited Liability Company with respect to the processing of personal data (hereinafter — the Policy) has been developed in compliance with the requirements of Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" (hereinafter — the Personal Data Law) in order to ensure the protection of human and civil rights and freedoms when processing their personal data, including the protection of the rights to privacy, personal and family secrets.

1.2. The Policy applies to all personal data processed by FORMI Limited Liability Company, address: 199004, St. Petersburg, Sredniy V.O. Prospekt, building 2, letter B, floor 1, premises 1-N (hereinafter — the Operator).

1.3. The Policy applies to legal relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.

1.4. In compliance with the requirements of Part 2, Article 18.1 of the Personal Data Law, this Policy is published in the public domain on the Operator's website on the Internet information and telecommunications network.

1.5. Basic concepts used in the Policy:

personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
personal data operator (operator) — a legal entity that, independently or jointly with other persons, organizes and/or carries out the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data;
processing of personal data — any action (operation) or set of actions (operations) performed with personal data using automation means or without their use. Processing of personal data includes, among other things:
- collection;
- recording;
- systematization;
- accumulation;
- storage;
- clarification (updating, modification);
- retrieval;
- use;
- transfer (provision, access);
- depersonalization;
- removal;
- destruction;
automated processing of personal data — processing of personal data using computer technology;
dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons;
provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons;
blocking of personal data — temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify personal data);
destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the physical media of personal data are destroyed;
depersonalization of personal data — actions as a result of which it becomes impossible without using additional information to determine the ownership of personal data to a specific personal data subject;
personal data information system — a set of personal data contained in databases and information technologies and technical means ensuring their processing.

1.6. Basic rights and obligations of the Operator.

1.6.1. The Operator has the right:

to independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the duties provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with such person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law, maintain the confidentiality of personal data, and take necessary measures aimed at ensuring the fulfillment of the duties provided for by the Personal Data Law;
in the event of revocation by the personal data subject of consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Personal Data Law.

1.6.2. The Operator is obliged:

to organize the processing of personal data in accordance with the requirements of the Personal Data Law;
to respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
to notify the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)), upon request of this body, of the necessary information within 10 working days from the date of receipt of such request. This period may be extended, but by no more than five working days. To do this, the Operator must send a reasoned notification to Roskomnadzor indicating the reasons for extending the deadline for providing the requested information;
in accordance with the procedure determined by the federal executive body authorized in the field of security, to ensure interaction with the state system for the detection, prevention and elimination of the consequences of computer attacks on the information resources of the Russian Federation, including informing it about computer incidents that resulted in unlawful transfer (provision, dissemination, access) of personal data.

1.7. Basic rights of the personal data subject. The personal data subject has the right:

to receive information relating to the processing of his/her personal data, except for cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
to demand from the operator clarification of his/her personal data, their blocking or destruction if the personal data are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect his/her rights;
to give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
to appeal to Roskomnadzor or in court against the unlawful actions or inaction of the Operator when processing his/her personal data.

1.8. Control over the implementation of the requirements of this Policy is carried out by the authorized person responsible for organizing the processing of personal data at the Operator.

1.9. Responsibility for violation of the requirements of the legislation of the Russian Federation and regulations in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2. Purposes of Personal Data Processing

2.1. Processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of collecting personal data is not permitted.

2.2. Only personal data that meet the purposes of their processing are subject to processing.

2.3. The Operator processes personal data for the following purposes:

Maintenance of personnel and accounting records;
Preparation, conclusion and execution of a contract to which the personal data subject is a party, beneficiary or guarantor;
Promotion of goods, works and services on the market.

2.4. Processing of employees' personal data may be carried out exclusively for the purpose of ensuring compliance with laws and other regulatory legal acts.

3. Legal Grounds for Personal Data Processing

3.1. The legal basis for the processing of personal data is the set of regulatory legal acts, in execution of and in accordance with which the Operator carries out the processing of personal data, including:

The Constitution of the Russian Federation;
The Civil Code of the Russian Federation;
The Labor Code of the Russian Federation;
The Tax Code of the Russian Federation;
Federal Law No. 14-FZ dated February 8, 1998 "On Limited Liability Companies";
Federal Law No. 402-FZ dated December 6, 2011 "On Accounting";
Federal Law No. 167-FZ dated December 15, 2001 "On Compulsory Pension Insurance in the Russian Federation";
Federal Law No. 323-FZ dated November 21, 2011 "On the Fundamentals of Protecting the Health of Citizens in the Russian Federation";
Law of the Russian Federation No. 2300-1 dated February 7, 1992 "On Protection of Consumer Rights";
other regulatory legal acts regulating relations related to the activities of the Operator.

3.2. The legal basis for the processing of personal data is also:

contracts concluded between the Operator and personal data subjects;
consents of personal data subjects to the processing of their personal data.

4. Scope and Categories of Processed Personal Data,
Categories of Personal Data Subjects

4.1. The content and scope of the processed personal data must correspond to the stated purposes of processing provided for in Section 2 of this Policy. The processed personal data must not be excessive in relation to the stated purposes of their processing.

4.2. The Operator may process personal data of the following categories of personal data subjects.

4.2.1. Employees and former employees of the Operator — for the purpose of maintaining personnel and accounting records:

last name, first name, patronymic;
year of birth;
month of birth;
date of birth;
place of birth;
marital status;
email address;
residential address;
registration address;
phone number;
SNILS (Individual Personal Account Insurance Number);
TIN (Taxpayer Identification Number);
citizenship;
identity document data valid on the territory of the Russian Federation;
bank card details;
current account number;
profession; position;
information about education;
photo-video image of the face.

4.2.2. Clients (individuals), beneficiaries under contracts; personal data subject who has given consent to cross-border transfer of personal data — for the purpose of preparation, conclusion and execution of a contract to which the personal data subject is a party, beneficiary or guarantor:

last name, first name, patronymic;
year of birth;
month of birth;
date of birth;
place of birth;
marital status;
email address;
residential address;
registration address;
phone number;
SNILS (Individual Personal Account Insurance Number);
TIN (Taxpayer Identification Number);
citizenship;
identity document data valid on the territory of the Russian Federation;
bank card details;
current account number;
profession; position;
information about education;
photo-video image of the face;
Special categories of personal data: information about health status, nationality.

4.2.3. Counterparties, representatives of the Operator's counterparties (legal entities) — for the purpose of preparation, conclusion and execution of a contract:

last name, first name, patronymic;
year of birth;
month of birth;
date of birth;
place of birth;
marital status;
email address;
residential address;
registration address;
phone number;
SNILS (Individual Personal Account Insurance Number);
TIN (Taxpayer Identification Number);
citizenship;
identity document data valid on the territory of the Russian Federation;
bank card details.

4.2.4. Website visitors — for the purpose of promoting goods, works and services on the market:

first name;
phone number.

4.3. The Operator's processing of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which their identity can be established) is carried out in accordance with the legislation of the Russian Federation.

4.4. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs.

4.5. The Operator processes special categories of personal data relating to health status in accordance with the legislation of the Russian Federation in the field of healthcare, including Federal Law No. 323-FZ dated November 21, 2011 "On the Fundamentals of Protecting the Health of Citizens in the Russian Federation", and other regulatory legal acts.

5. Procedure and Conditions for Personal Data Processing

5.1. Processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. Processing of personal data is carried out with the consent of the personal data subjects to the processing of their personal data, but may be carried out without the consent of the personal data subject in cases provided for by the legislation of the Russian Federation.

5.3. The Operator processes personal data for each purpose of their processing in the following ways:

non-automated processing of personal data;
automated processing of personal data with or without transfer of the received information via information and telecommunications networks;
mixed processing of personal data.

5.4. Employees of the Operator whose job responsibilities include the processing of personal data are allowed to process personal data.

5.5. Processing of personal data for each purpose of processing specified in clause 2.3 of the Policy is carried out by:

receiving personal data in oral and written form directly from personal data subjects;
entering personal data into journals, registers, unified forms of documents and information systems of the Operator;
using automated and non-automated processing of personal data.

5.6. Disclosure to third parties and dissemination of personal data without the consent of the personal data subject is not permitted, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the personal data subject for dissemination is formalized separately from other consents of the personal data subject to the processing of his/her personal data.

The requirements for the content of consent to the processing of personal data permitted by the personal data subject for dissemination are approved by Order of Roskomnadzor No. 18 dated February 24, 2021.

5.7. The transfer of personal data to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia, banks and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

5.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, dissemination and other unauthorized actions, including:

identifies threats to the security of personal data during their processing;
adopts local regulations and other documents regulating relations in the field of processing and protection of personal data;
appoints persons responsible for ensuring the security of personal data in structural divisions and information systems of the Operator;
creates the necessary conditions for working with personal data;
organizes the recording of documents containing personal data;
organizes work with information systems in which personal data are processed;
stores personal data under conditions that ensure their safety and exclude unlawful access to them;
organizes training for employees of the Operator who process personal data.

5.9. The Operator stores personal data in a form that allows the identification of the personal data subject for no longer than required by each purpose of personal data processing, unless the storage period for personal data is established by federal law or contract.

5.9.1. Personal data on paper media are stored by the Operator for the storage periods of documents for which such periods are provided for by the legislation on archival affairs in the Russian Federation (Federal Law No. 125-FZ dated October 22, 2004 "On Archival Affairs in the Russian Federation", the List of Standard Managerial Archival Documents Generated in the Course of Activities of State Bodies, Local Self-Government Bodies and Organizations, Indicating Their Storage Periods (approved by Order of Rosarkhiv No. 236 dated December 20, 2019)).

5.9.2. The storage period for personal data processed in personal data information systems corresponds to the storage period for personal data on paper media.

5.10. The Operator terminates the processing of personal data in the following cases:

a fact of their unlawful processing has been identified;
the purpose of their processing has been achieved;
the consent period has expired or the consent of the personal data subject to the processing of such data has been revoked, when under the Personal Data Law the processing of these data is allowed only with consent.

5.11. Upon achieving the purposes of processing personal data, as well as in the event of revocation by the personal data subject of consent to their processing, the Operator terminates the processing of these data if:

otherwise is not provided for by the contract to which the personal data subject is a party, beneficiary or guarantor;
the Operator is not entitled to process without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
otherwise is not provided for by another agreement between the Operator and the personal data subject.

5.12. When a personal data subject contacts the Operator with a request to terminate the processing of personal data, within a period not exceeding 10 working days from the date the Operator receives the corresponding request, the processing of personal data is terminated, except for cases provided for by the Personal Data Law. This period may be extended, but by no more than five working days. To do this, the Operator must send a reasoned notification to the personal data subject indicating the reasons for extending the period.

5.13. When collecting personal data, including via the Internet information and telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for the cases specified in the Personal Data Law.

6. Updating, Correction, Removal, Destruction of
Personal Data, Responses to Requests from Subjects for Access
to Personal Data

6.1. Confirmation of the fact of processing of personal data by the Operator, the legal grounds and purposes of processing personal data, as well as other information specified in Part 7, Article 14 of the Personal Data Law, are provided by the Operator to the personal data subject or his/her representative within 10 working days from the moment of the request or receipt of the request from the personal data subject or his/her representative. This period may be extended, but by no more than five working days. To do this, the Operator should send a reasoned notification to the personal data subject indicating the reasons for extending the deadline for providing the requested information.

The information provided does not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.

The request must contain:

the number of the main identity document of the personal data subject or his/her representative, information on the date of issue of the said document and the authority that issued it;
information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and/or other information), or information otherwise confirming the fact of processing of personal data by the Operator;
signature of the personal data subject or his/her representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator provides the information specified in Part 7, Article 14 of the Personal Data Law to the personal data subject or his/her representative in the form in which the relevant request or inquiry was sent, unless otherwise specified in the request or inquiry.

If the request (inquiry) of the personal data subject does not reflect all the necessary information in accordance with the requirements of the Personal Data Law or the subject does not have the rights of access to the requested information, a reasoned refusal is sent to him/her.

The right of the personal data subject to access his/her personal data may be limited in accordance with Part 8, Article 14 of the Personal Data Law, including if the access of the personal data subject to his/her personal data violates the rights and legitimate interests of third parties.

6.2. In case of detection of inaccurate personal data upon a request from the personal data subject or his/her representative, or upon their request or upon a request from Roskomnadzor, the Operator blocks the personal data relating to that personal data subject from the moment of such request or receipt of the said request for the period of verification, if blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

In case of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the personal data subject or his/her representative or by Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of personal data.

6.3. In case of detection of unlawful processing of personal data upon a request (inquiry) from the personal data subject or his/her representative or Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to that personal data subject from the moment of such request or receipt of the inquiry.

6.4. Upon detection by the Operator, Roskomnadzor or another interested person of the fact of unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that resulted in a violation of the rights of personal data subjects, the Operator:

within 24 hours — notifies Roskomnadzor of the incident that occurred, the suspected causes that led to the violation of the rights of personal data subjects, the suspected harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
within 72 hours — notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information about the persons whose actions caused it (if any).

6.5. Procedure for the destruction of personal data by the Operator.

6.5.1. Conditions and deadlines for the destruction of personal data by the Operator:

achievement of the purpose of processing personal data or loss of the need to achieve this purpose — within 30 days;
achievement of the maximum storage periods for documents containing personal data — within 30 days from the date of recognition of documents subject to destruction;
submission by the personal data subject (his/her representative) of confirmation that the personal data were obtained illegally or are not necessary for the stated purpose of processing — within seven working days;
revocation by the personal data subject of consent to the processing of his/her personal data, if their storage for the purpose of their processing is no longer required — within 30 days.

6.5.2. Upon achieving the purpose of processing personal data, as well as in the event of revocation by the personal data subject of consent to their processing, the personal data are subject to destruction if:

otherwise is not provided for by the contract to which the personal data subject is a party, beneficiary or guarantor;
the Operator is not entitled to process without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
otherwise is not provided for by another agreement between the Operator and the personal data subject.

6.5.3. The destruction of personal data is carried out by a commission established by order of the sole executive body of the Operator.

6.5.4. Methods for the destruction of personal data are established in the local regulations of the Operator.