PERSONAL DATA PROCESSING POLICY

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter referred to as the Policy) of Starliner LLC, registered address: 191119, St. Petersburg, Dostoevsky Street, Building 40-44, Lit. E, Pom. 14-N, Office 602 (hereinafter referred to as the Operator) is an official document that defines the general principles, purposes, and procedures for processing the personal data of users of the starliner.ru website and its subdomains (hereinafter referred to as the Website), as well as information about the personal data protection measures implemented.

1.2. This Policy has been developed in accordance with Russian Federation legislation on personal data.

1.3. This Policy applies exclusively to the Website and its subdomains. The Operator does not control and is not responsible for third-party websites that the User may access via links available on the Website.

1.4. The personal data subject independently decides to provide their personal data and gives consent voluntarily, of their own free will, and in their own interests.

1.5. Using the Website and/or providing the Operator with their personal data constitutes the User’s unconditional consent to this Policy and the terms of personal data processing. If the User disagrees (in whole or in part) with the terms of this Policy, they must stop using the Website.

1.6. The Operator does not verify the veracity of the personal data provided. All information provided by the User that allows them to be directly or indirectly identified is considered by the Operator to be correct personal data.

1.7. The User confirms that all data provided by them belongs to them personally and that if the information provided by the User refers to other persons, they confirm that they are transferring their personal data to the Operator with the consent of these persons, in accordance with Part 8 of Article 9 and Clause 5 of Part 1 of Article 6 of Federal Law No. 152-FZ “On Personal Data” of July 27, 2006.

1.8. The Operator uses cookies to generate statistical reports. For more information on the use of cookies, see Section 7 of this Policy.

1.9. This Policy shall enter into force upon its approval and shall remain in effect indefinitely until replaced by a new Policy.

2. KEY TERMS AND DEFINITIONS

2.1. The following terms are used in this Policy:

2.1.1. Personal data information system – the set of personal data contained in databases and the information technologies and technical means that support their processing.

2.1.2. Personal data processing – any action (operation) or set of actions (operations) performed with personal data, with or without the use of automated tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

2.1.3. Personal data operator (operator) – a government agency, municipal body, legal entity, or individual that, independently or jointly with other entities, organizes and/or processes personal data, and determines the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed with personal data.

2.1.4. Personal data – any information related to a directly or indirectly identified or identifiable individual (personal data subject);

2.1.5. Website user – any person visiting the website and using the information, materials, and services provided on the website.

2.1.6. Website – a collection of interconnected web pages hosted on the Internet at a unique address (URL), as well as its subdomains.

2.1.7. Cookies are small pieces of data sent by a web server and stored on the User’s computer. The web client or web browser sends these cookies to the web server in an HTTP request each time the user attempts to open a page on the corresponding website.

2.1.8. IP address – the unique network address of the node in the computer network through which the User accesses the website.

3. PURPOSES OF PERSONAL DATA PROCESSING

The Operator processes personal data for the following purposes:

3.1. Compliance with the requirements of Russian labor legislation, Russian tax legislation, Russian legislation on compulsory social insurance and compulsory pension insurance; to achieve the goals stipulated by law, to fulfill and discharge the duties imposed on the Operator by Russian legislation, and to comply with other obligations established by law;

3.2. Carrying out the activities stipulated by the Operator’s charter;

3.3. Carrying out the Operator’s commercial activities;

3.4. Concluding personal gift agreements with the User, the subject of which is the Operator, regarding the provision of services;

3.5. Providing the User with access to the personalized resources of the Operator’s website;

3.6. Maintaining statistics and analyzing the performance of the Operator’s Website and its subdomains, creating statistical reports, and standard web server logs to count the number of visitors and evaluate the technical capabilities of the Operator’s Website using cookie technology.

3.7. Providing the Personal Data Subject with information about the Services provided by the Operator and the development of new products and Services by the Operator.

3.8. Conducting statistical, marketing, and other research based on anonymized data, generating statistical reports, identifying (confirming the identity) of the User, and concluding agreements with the User regarding the provision of services by the Operator.

3.9. Provision of services to the User by the Operator, including providing the User with personalized access to the Information Resource and its services.

3.10. Promotion of the Operator’s work and services. Sending informational and/or advertising messages to the personal data subject about the Services, Events, and developments in the Operator’s activities, events organized by the Operator and/or Partners for clients and/or potential clients, as well as the Operator’s services (if applicable), and about the goods, works, and services of Partners and third parties.

3.11. Sending information to users, including advertising, about the Operator’s events/goods/services/work, and the procedures and rules for their provision.

3.12. Informing consumers of services about the procedures for the provision of third-party services, the rules for their provision, and changes to the procedures for the provision of third-party services.

3.13. Interacting with the User, including sending them advertising and informational messages (about ongoing promotions, personal offers, etc.), notifications, requests, surveys (questionnaires), and other messages.

3.14. Recruiting personnel (applicants) for vacant positions at the Operator;

3.15. Assisting employees in career advancement;

3.16. Record keeping;

3.17. Monitoring the quantity and quality of work performed;

3.18. Ensuring the safety of the Operator’s property and that of its employees;

3.19. Maintaining personnel records, completing personnel documentation, accounting records, and military registration;

3.20. Ensuring the personal safety of employees;

3.21. Preparing and sending responses to user inquiries;

3.22. Concluding transportation contracts, booking, issuing, and selling air tickets, train tickets, and Aeroexpress tickets, as well as flight check-in;

3.23. Organizing hotel accommodations (reserving hotel rooms); organizing services through airport VIP lounges;

3.24. Executing contracts for organizing business trips and related services, organizing events, agency agreements, and licensing agreements;

3.25. Fulfilling personal data processing orders;

3.26. Providing technical support services to Users;

3.27. Providing visa and migration support services, obtaining exit visas; organizing training and other events, transfer services, and organizing transportation services (transfers, car rentals);

3.28. Providing travel consulting services, concluding insurance contracts, issuing travel insurance policies for persons traveling abroad; providing related services and performing other travel-related activities;

3.29. Other purposes specified in Appendix No. 1 to this Policy (see column 2).

4. LEGAL BASIS FOR PROCESSING PERSONAL DATA

The Operator’s processing of the personal data of Website users is based on:

4.1. The Constitution of the Russian Federation;

4.2. The Labor Code of the Russian Federation of December 30, 2001, No. 197-FZ;

4.3. The Civil Code of the Russian Federation of November 30, 1994, No. 51-FZ, January 26, 1996, No. 14-FZ, November 26, 2001, and No. 230-FZ of December 18, 2006;

4.4. Tax Code of the Russian Federation of July 31, 1998, No. 146-FZ, of August 5, 2000, No. 117-FZ;

4.5. Federal Law of December 6, 2011, No. 402-FZ “On Accounting”;

4.6. Law of the Russian Federation of November 27, 1992, No. 4015-1 “On the Organization of Insurance Business in the Russian Federation”;

4.7. Federal Law of December 15, 2001, No. 167-FZ “On Compulsory Pension Insurance in the Russian Federation”;

4.8. Federal Law of November 29, 2010, No. 326-FZ “On Compulsory Medical Insurance in the Russian Federation”;

4.9. Resolution of the Government of the Russian Federation of November 27, 2006 No. 719-PP “On Approval of the Regulation on Military Registration”;

4.10. Order of the Federal Archive Service of Russia of December 20, 2019 No. 236 “On Approval of the List of Standard Management Archival Documents Generated in the Course of Activities of State Bodies, Local Governments, and Organizations, Indicating Their Storage Periods”;

4.11. Unified Form No. T-2;

4.12. Federal Law of December 29, 2006 No. 255-FZ “On Compulsory Social Insurance in Case of Temporary Disability and in Connection with Maternity”;

4.13. Federal Law of May 31, 1996 No. 61-FZ “On Defense”;

4.14. Federal Law No. 31-FZ of February 26, 1997, “On Mobilization Preparation and Mobilization in the Russian Federation”;

4.15. Resolution of the Government of the Russian Federation No. 719 of November 27, 2006, “On Approval of the Regulations on Military Registration”;

4.16. Order of the Minister of Defense of the Russian Federation No. 700 of November 22, 2021, “On Approval of the Instructions for Organizing Work to Ensure the Functioning of the Military Registration System”;

4.17. Agreements on the organization of business trips and related services; on the organization of events; on the provision of visa support services, and other agreements between the Operator and the User, and between the Operator and the personal data subject;

4.18. Consent to the Processing of Personal Data;

4.19. Other grounds provided for in Appendix No. 1 to this Policy (see column 3). 4.2. By placing a special mark—a “check mark” or “web tag”—in a designated field on the website when filling out the personal data collection form and clicking the corresponding button, the personal data subject is deemed to unambiguously accept the terms of this Policy and consent to the processing of personal data to the extent, for the purposes, and in the manner specified in the text provided for review before placing the special mark.

5. CATEGORIES OF PERSONAL DATA SUBJECTS THAT ARE OR MAY BE PROCESSED BY THE OPERATOR

— Employees of the Operator;

— Relatives of employees of the Operator;

— Former employees of the Operator;

— Applicants (candidates) for vacant positions at the Operator;

— Relatives of applicants (candidates) for vacant positions;

— Previous employers (individuals) of applicants for vacant positions;

— Counterparties to civil contracts (civil law contracts) (individuals);

— Representatives of counterparties to civil contracts;

— End recipients of the Operator’s services (individuals);

— Potential clients of the Operator (individuals);

— Company management, company members, and beneficiaries of the Operator;

— Website visitors who completed the feedback form.

— Users of the Starliner order management system;

— Other categories specified in Appendix No. 1 to this Policy (see column No. 1).

6. CONTENT AND SCOPE OF PROCESSED PERSONAL DATA

6.1. Categories of personal data processed by the Operator in relation to candidates for vacant positions with the Operator: last name, first name, patronymic; year of birth, month of birth, date of birth; place of birth; email address; contact telephone number; registered address of residence; actual residential address; profession; length of service; education details; employment history; education and/or qualifications or specialized knowledge (including the name of the educational and/or other organization, year of graduation, level of education, qualifications, details of the education or training document); information on professional retraining and/or advanced training.

6.2. Categories of personal data processed by the Operator in relation to the Operator’s employees, former employees of the Operator: – last name, first name, patronymic, previous last name, first name, patronymic (if any), date and place of their change (if any); – date and place of birth, gender, citizenship, address and other passport data, photograph; – TIN (taxpayer identification number), SNILS (individual personal account insurance number); – telephone number, email address; – profession, information about education and (or) qualifications or the presence of special knowledge (including the name of the educational and (or) other organization, year of graduation, level of education, qualifications, details of the document on education, training); – information on professional retraining and (or) advanced training; information on awards; – information on annual paid leaves, educational leaves and leaves without pay; — information on places of work, including previous ones, period and length of service, knowledge of foreign languages, if such data affects the employment relationship with the employee; — information on social status; — information on the attitude to military service, military registration and details of military registration documents (series, number, date of issue of the document, name of the issuing authority); — details of certificates of state registration of civil status acts and the information contained therein; — information on marital status and family members (degree of kinship, surnames, first names, patronymics (if any), dates (day, month, year) and places of birth), their place of work or study, details of documents on deprivation of parental rights; details of guardianship documents, if such data affects the employment relationship with the employee; — income, obligations under executive documents; bank card number; details of bank accounts and cards, if such data affects the employment relationship with the employee; — information about disability, information about health status related to the ability to perform work functions; information contained in documents granting the right to stay and work in the Russian Federation (for foreign citizens residing in the Russian Federation); — information contained in a temporary residence permit, a temporary residence permit for educational purposes (for foreign citizens temporarily residing in the Russian Federation), or a residence permit (for foreign citizens permanently residing in the Russian Federation); — information about business and other personal qualities of an evaluative nature; — signature; — other information related to the employee’s professional activities, if such data affects the employment relationship with the employee.

6.3. Categories of personal data processed by the Operator in relation to relatives of employees and former employees of the Operator: — last name, first name, patronymic; — degree of relationship to the employee or former employee; — date, month, year of birth, and place of birth; — registered address (actual address); — place of work, study, position.

6.4. Categories of personal data processed by the Operator in relation to clients, customers, contractors of the Operator – individuals, end recipients of services, for whose benefit the services have been purchased: – last name, first name, patronymic, date and place of birth, gender, citizenship; – bank account details, including (recipient, bank name, account currency, international bank account number (IBAN) and SWIFT code); – email address; – image (photograph); – registration and actual residence address; – general civil passport details (series, number, by whom and when issued); – passport certifying the identity of a citizen of the Russian Federation outside the Russian Federation (foreign passport details) (series, number, by whom and when issued); – mobile phone number; – taxpayer identification number; – compulsory pension insurance certificate number. – employment history, including employer and position held; – information on received visas, previously taken trips, travel dates; – details of the insurance policy (medical, travel cancellation and other risks, etc.), – signature; – details of the vehicle registration certificate.

vehicle; driver’s license details; – for foreign end recipients of services, additionally: migration status and information contained in migration documents (visa, migration card, notification of migration registration; documents permitting employment in the Russian Federation – work permit, patent, temporary residence permit, residence permit). For visa support purposes, the following data may also be processed: – income data, real estate data, family member data, criminal record data, military registration data, bank account balance data.

6.5. Categories of personal data processed by the Operator in relation to users of the Starliner order management system, representatives, employees of clients, and the Operator’s counterparties (legal entities): – last name, first name, patronymic; – place of work, position; – telephone number; – email address; — passport details (series, number, issuer, and date).

6.6. Categories of user personal data processed on the Website via the feedback form using automated tools, depending on the volume of information provided in accordance with the user’s wishes: — last name, first name, patronymic; — telephone number; — email address; — company name; — field of activity; — other information the user has chosen to provide.

7. COOKIE PROCESSING

7.1. The Operator processes anonymized data about the User if this is permitted in the User’s browser settings.

7.2. In order to maintain statistics and analyze the Site’s operation, the Operator processes the following data about the User, collected through the Yandex.Metrica metric service (YANDEX LLC, located at 16 Leo Tolstoy St., Moscow, 119021. Privacy Policy: https://yandex.ru/legal/confidential/ru/) and/or VK Limited Liability Company (OGRN 1027739850962, INN 7743001840), located at 39, Bldg. 79, Leningradsky Prospekt, Moscow, 125167: — IP address; — Information about the browser and its version; — Data from cookies; — Access time; — Referrer (address of the previous page). — Page URL; — Page title; — Operating system and its version; — Device; — Screen height and width; — Flash version; — Silverlight version; — Java availability; — Cookies availability; — JavaScript availability; — Time zone; — Browser language; — Screen color depth; — Width and height of the browser window’s client area; — Visitor interests; — Geographic data; — JavaScript events (tracking user interactions with the Site, including the use of JavaScript API methods on the site); — Page load parameters; — Page view; — External link click; — File download; — Refusal; — Time on Site; — Browsing depth and other anonymous data about the Site visit.

7.3. The Site uses the following types of cookies: – strictly necessary cookies / technical cookies: these cookies are required for the Site to function and for the Services to be provided to the User; among other things, they allow Yandex to identify hardware and software, including the browser type; — statistical/analytical cookies: these cookies allow us to recognise users, count their number and collect information such as the transactions performed by the User on the Websites and Services, including information about the web pages visited by the User and the content the User accesses; — technical cookies: these cookies collect information about how users interact with the Websites and/or Services, which allows us to identify errors and test new features to improve the performance of the Websites and Services; — functional cookies: these cookies help provide certain features to make your use of the Websites easier, for example, by storing your preferences (such as language and location); — (third-party) tracking/advertising cookies: these cookies collect information about users, traffic sources, pages visited and the advertisements displayed to the User, as well as the one that led the User to the advertised page. They allow us to display advertisements that may be of interest to the User based on the analysis of the Personal Information collected about the User. They are also used for statistical and research purposes.

7.4. The information contained in cookies is not personal data, as it does not contain the User’s email address or any personal information about the User.

7.5. Upon first visiting the Websites, the User may be asked to consent to the use of cookies. The basis for processing data by Yandex.Metrica is such consent or continued use of the Website despite the presence of a corresponding notice on the Website.

7.6. If, after the User has approved the use of cookies, they have the right to change their mind and delete cookies stored in their browser (this can usually be done in the browser settings – please refer to the browser manual or the browser developer’s website). After this, the pop-up window requesting the User’s consent may be displayed again, and the User may make a different choice.

7.7. If the User refuses to accept cookies, they must stop using the Website or disable cookies in their browser settings.

7.8. If the User refuses to accept cookies, this may result in some features of the Website being unavailable and may impact their ability to use the Website.

8. PERSONAL DATA PROCESSING TERMS AND CONDITIONS

8.1. To achieve the purposes of personal data processing, the Operator performs the following operations with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), transfer (distribution, provision, access), retrieval, use, depersonalization, blocking, deletion, and destruction.

8.2. The Operator processes personal data with and without automation tools, complying with the requirements for automated and non-automated processing of personal data stipulated by Federal Law of the Russian Federation No. 152-FZ “On Personal Data” of July 27, 2006, and the regulatory legal acts adopted in accordance therewith.

8.3. The feedback form provides access to the User’s personal data collected by it directly to the Operator.

8.4. The Operator protects personal data by restricting access to it.

8.5. Access to the personal data of Website Users is permitted only to specially authorized employees of the Operator’s structural divisions. These individuals are authorized to process only the personal data necessary to perform their job responsibilities and for the purposes for which it was provided.

8.6. The Operator reserves the right to engage third parties in the processing of Users’ personal data, including hosting providers, server owners, parties sending advertising and newsletters, parties conducting surveys and research, and other third parties in accordance with Russian legislation or based on the User’s consent to the processing of personal data and for the purposes of processing specified in this Policy.

8.7. Website Users consent to the processing of their personal data in the following cases: – by filling out the feedback form/ordering a callback on the Website; – by subscribing to the newsletter; – by submitting feedback; – by filling out the consultation form.

8.8. An alternative basis for processing personal data, in addition to the consent of the personal data subject to the processing of their personal data, according to paragraph 5, part 1, article 6 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data,” is the need to process personal data for the performance of an agreement to which the personal data subject is a party, beneficiary, or guarantor, as well as for concluding an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor.

8.9. Furthermore, an alternative basis for processing personal data, in addition to the consent of the personal data subject to the processing of their personal data, according to paragraph 7, part 1, article 6 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data,” is the need to process personal data to exercise the rights and legitimate interests of the operator or third parties.

8.10. The Operator may transfer Personal Information to third parties in order to achieve the purposes specified in Section 6 of this Policy. Such third parties may include: — Partners, counterparties of the Operator – service consolidators, booking systems; carriers, companies providing transportation services, transfer services, temporary accommodation services, vehicle rental services, catering services, hotels, airport VIP lounges, insurance companies, visa centers, centers providing translation services into foreign languages, embassies and consulates of foreign states, agents and subagents of the Operator; — persons involved in organizing the acceptance of payments and conducting payment transactions using the Sites and Services (payment systems, payment instrument providers, banks and other financial institutions), etc. — persons providing information to identify security threats to the Sites and Services, users, the Operator and/or third parties, including during due diligence when concluding contracts using the Sites and Services; — persons with respect to whom the User has consented to the transfer of Personal Information, or the transfer of Personal Information is required to provide the User with the relevant Service or to fulfill a specific agreement or contract concluded with the User or for which the User is a beneficiary.

8.11. The Operator is obliged to transfer personal data to inquiry and investigative bodies and other authorized bodies on the grounds stipulated by the current legislation of the Russian Federation.

8.12. The processing of biometric personal data and special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, or intimate life is not performed on the Website.

8.13. The termination of the processing of personal data may be conditional upon

The achievement of the personal data processing purposes, the expiration of the personal data processing period, the revocation of the Website user’s consent to the processing of their personal data, the detection of unlawful personal data processing, and the liquidation of the Operator.

8.14. Personal data shall be stored in a form that allows for the identification of the personal data subject for no longer than required for the purposes of personal data processing. The processing period for personal data is determined by the achievement of the purposes for which the personal data was collected, unless another period is provided for by agreement or applicable law.

9. PERSONAL DATA SECURITY MEASURES

9.1. The security of personal data processed by the Operator is ensured by the implementation of legal, organizational, technical, and software measures necessary and sufficient to meet the requirements of the legislation of the Russian Federation.

9.2. The Operator takes the following measures to ensure the security of personal data: – appointing persons responsible for organizing the processing and ensuring the protection of personal data; – limiting the number of the Operator’s employees who have access to personal data; – determining the level of security of personal data when processed in personal data information systems; – establishing rules for restricting access to personal data processed in personal data information systems and ensuring the registration and accounting of all actions performed with personal data; – restricting access to premises where the main technical equipment and systems of personal data information systems are located and where manual processing of personal data is carried out; – maintaining records of machine-readable media containing personal data; — organizing the backup and restoration of personal data information systems and personal data modified or destroyed due to unauthorized access; — establishing password complexity requirements for access to personal data information systems; — implementing duly completed information security compliance assessment procedures; — implementing anti-virus monitoring, preventing the introduction of malware (viruses) and backdoors into the corporate network; — organizing the timely updating of software used in personal data information systems and information security tools; — regularly assessing the effectiveness of measures taken to ensure the security of personal data;

— detecting instances of unauthorized access to personal data and taking measures to establish the causes and eliminate possible consequences; — monitoring the measures taken to ensure the security of personal data and the levels of protection of personal data information systems.

10. RIGHTS OF SITE USERS. PROCESSING REQUESTS FROM PERSONAL DATA SUBJECTS

10.1. The Website User has the right to: — access their personal data; — rectify their personal data; — block or delete their personal data; — appeal our actions or inactions; — appeal decisions made solely on the basis of automated processing of their personal data; — revoke consent to the processing of personal data; — receive information regarding the processing of their personal data, including: — confirmation of the fact that the Operator is processing their personal data; — the legal basis and purposes of processing their personal data; — the purposes and methods of processing their personal data used by the Operator; — the name and location of the Operator, information about persons (except for the Operator’s employees) who have access to their personal data or to whom their personal data may be disclosed under an agreement with the Operator or under federal law; — the processed personal data relating to the relevant personal data subject, the source of their receipt, unless another procedure for submitting such data is provided for by federal law; — the terms for processing personal data, including the storage periods; — the procedure for the exercise by the personal data subject of the rights stipulated by the Federal Law “On Personal Data”; — information on the completed or proposed cross-border transfer of personal data; — the name or last name, first name, patronymic, and address of the person processing the personal data on behalf of the Operator, if the processing is or will be entrusted to such person; — other information stipulated by the Federal Law “On Personal Data” or other federal laws.

10.2. All questions regarding the processing of personal data should be reported to the address: or write a request to our address: 191119, St. Petersburg, Dostoevsky St., 40-44, lit. E, pom. 14-N, of. 602, specifying information about the identity document of the personal data subject or the identity of the personal data subject’s representative (document type, series and number, by whom and when issued), the full name of the personal data subject or the full name of the personal data subject’s representative, information confirming the personal data subject’s involvement in the relationship with the Operator (contract number, contract date, code wording, and/or other information), or information otherwise confirming the processing of personal data by the Operator, and information about the relationship between the Operator and the personal data subject during which the Operator obtained the personal data of the personal data subject. Please be sure to sign your request. Requests may also be delivered in person to the Operator’s representative against signature.

10.3. The Operator’s employees are not authorized to verbally answer questions related to the provision of personal data over the telephone, as in such cases it is impossible to identify the person making the request.

10.4. You can send your request by email to info@starliner.ru. In this case, the request must be in the form of an electronic document signed in accordance with the provisions of Russian Federation legislation on electronic signatures. 10.5. You can also call +7 (812) 603-7-603. 10.6. The personal data subject may appeal the actions of the Personal Data Operator to the territorial office of Roskomnadzor.

11. LIABILITY

11.1. The Operator, if it fails to fulfill its obligations, is liable for any losses incurred by the User, in accordance with the current legislation of the Russian Federation.

11.2. The User is fully responsible for compliance with the requirements of the current legislation of the Russian Federation, including, but not limited to, laws on advertising, copyright and related rights protection, and trademark and service mark protection, including full liability for the content and form of materials, in the event of citation or other use of information obtained in connection with the use of the Website services.

11.3. Persons found guilty of violating the rules governing the processing and protection of personal information shall bear financial, disciplinary, administrative, civil, or criminal liability in accordance with the legislation of the Russian Federation.

12. FINAL PROVISIONS

12.1. The Operator reserves the right to amend this Policy unilaterally in the event of changes in the regulatory legal acts of the Russian Federation, as well as at its own discretion.

12.2. Compliance with the requirements of this Policy is monitored by the person responsible for organizing the processing of personal data.