Personal Data Processing Policy

Last update date: 14<em> </em>“Jul<em>I</em>»<em> </em>2026<em>year</em>

1. GENERAL PROVISIONS<strong><br/></strong>

1.1. This policy regarding the processing of personal data (hereinafter referred to as the Policy) defines the basic principles, goals, conditions and methods of processing personal data of the Kaluga Region Development Corporation JSC (OGRN 1074027007780, INN 4027083322, legal address: 248001, Kaluga region, Kaluga city, Kirova St., 17) (hereinafter referred to as the Operator).

1.2. This Policy has been developed in accordance with the requirements of clause 2, part 1, art. 18.1 of the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data” (hereinafter referred to as the Law on Personal Data), taking into account the requirements of the Law on Personal Data and other regulatory legal acts of the Russian Federation in the field of personal data.

1.3. This Policy applies to all operations performed by the Operator with personal data with or without the use of automation tools. The operator processes personal data of the subject of personal data only if they are filled out and (or) sent by the subject of personal data independently through forms on the website https://en.invest.kaluga.ru/ (hereinafter referred to as the Site). By filling out the appropriate forms and (or) sending his personal data to the Operator, the subject of personal data agrees with this Policy.

1.4. The subject of personal data independently decides to provide his personal data and gives consent freely, of his own free will and in his own interest.

1.5. This Policy is subject to updating at the initiative of the Operator, as well as in the event of changes in the legislation of the Russian Federation on personal data.

2. BASIC CONCEPTS<strong><br/></strong>

2.1. For the purposes of this Policy, the following terms are used in the following meaning:

Personal data<strong> </strong>- any information relating directly or indirectly to a specific or identifiable individual (subject of personal data).

Processing of personal data<strong> </strong>- any action (operation) or set of actions (operations) performed using automation tools or without the use of such means with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

Automated processing of personal data<strong> </strong>— processing of personal data using computer technology.

Dissemination of personal data<strong> </strong>— actions aimed at disclosing personal data to an unknown number of persons.

Providing personal data<strong> </strong>— actions aimed at disclosing personal data to a certain person or a certain circle of persons.

Blocking personal data<strong> </strong>— temporary cessation of processing of personal data (except for cases where processing is necessary to clarify personal data).

Destruction of personal data<strong> </strong>— actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material media of personal data are destroyed.

Depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the ownership of personal data to a specific subject of personal data.

Subject of personal data, Subject<strong> </strong>- an individual who can be directly or indirectly identified using personal data.

Consent to the processing of personal data, Consent<strong> </strong>— a written or digital document that confirms the Subject’s voluntary decision to transfer personal data to the Operator in the amount, on the terms and for the purposes defined by this Policy and the agreements concluded between the Subject and the Operator.

3. PRINCIPLES AND<strong> </strong>PURPOSES OF PROCESSING PERSONAL DATA<strong><br/></strong>

3.1. The processing of personal data by the Operator is carried out taking into account the need to ensure the protection of the rights and freedoms of personal data subjects, including the protection of the right to privacy, personal and family secrets, based on the following principles:

• processing of personal data is carried out on a legal basis;
• the processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes;
• Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted;
• the content and volume of personal data processed correspond to the stated purposes of processing. Redundancy of the processed personal data in relation to the stated purposes of their processing is not allowed;
• when processing personal data, the accuracy of personal data, their sufficiency, and, where necessary, relevance in relation to the purposes of processing personal data are ensured;
• storage of personal data is carried out in a form that makes it possible to identify the subject of personal data, no longer than required by the purposes of processing personal data, unless the period for storing personal data is established by federal law, an agreement to which the Personal Data Subject is a party, beneficiary or guarantor;
• The processed personal data is destroyed or anonymized upon achievement of the processing goals or in the event of the loss of the need to achieve these goals, unless otherwise provided by federal law.

3.2. The processing of personal data by the Operator is carried out for the following purposes:

• identification of the Subject for the purpose of concluding any contracts with the Operator and their further execution;
• the Operator conducting promotions, surveys, interviews, testing and research on the Site;
• establishing feedback with the Subject, including, but not limited to: sending mailings, notifications in the form of SMS, emails, oral and written requests, processing requests and applications from the Subject;
• confirmation of the accuracy and completeness of the personal data provided by the Subject;
• statistical and other research and (or) analytical purposes, subject to the depersonalization of the Subject’s personal data.

4. OB<strong>Yo</strong>M I<strong> </strong>CATEGORIES OF PERSONAL DATA PROCESSED, CATEGORIES OF PERSONAL DATA SUBJECTS<strong><br/></strong>

4.1. The Operator may process personal data of the following Subjects:

• counterparties – individuals and representatives of counterparties – legal entities;
• Site visitors

4.2. Personal data processed by the Operator includes:

• last name, first name, patronymic of the Personal Data Subject;
• address of residence/stay or other address specified by the Subject when concluding agreements with the Operator;
• mobile phone number;
• email address (email);
• IP address, data about user actions on the Site, technical characteristics of the device, information about pages visited, obtained using web analytics services (in particular, Yandex.Metrica);
• User location determined using the built-in Yandex.Maps;
• cookies, information about the user’s location, information about the user’s actions on the Site, information about the user’s equipment, session date and time.

4.3. The operator ensures that the content and volume of processed personal data corresponds to the stated purposes of processing and, if necessary, takes measures to eliminate their redundancy in relation to the stated purposes of processing.

5. ORDER AND<strong> </strong>CONDITIONS FOR PROCESSING PERSONAL DATA<strong><br/></strong>

5.1. The processing of personal data by the Operator is carried out in the following ways:

• non-automated processing of personal data;
• automated processing of personal data with or without transmission of the received information via information and telecommunication networks, including processing using automated database management systems and other software;
• mixed processing of personal data.

5.2. List of actions performed by the Operator with personal data: collection, systematization, accumulation, storage, clarification (updating, changing), use, distribution (including transfer), depersonalization, blocking, destruction on the territory of the Russian Federation in accordance with the current legislation of the Russian Federation.

5.3. The subject of personal data decides to provide his personal data and gives Consent freely, of his own free will and in his own interest.

5.4. The operator does not process biometric personal data.

5.5. The Operator does not carry out cross-border transfer of personal data.

5.6. The Processing of special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, intimate life is not carried out by the Operator.

5.7. The condition for terminating the processing of personal data may be the achievement of the purposes of processing personal data, the expiration of the Consent or withdrawal of Consent by the Personal Data Subject, as well as the identification of unlawful processing of personal data.

5.8. The period for processing personal data is unlimited. The subject may at any time withdraw his Consent to the processing of personal data by sending a notification to the Operator via email to the Operator’s email address specified in Section 10 of this Policy, marked “Withdrawal of consent to the processing of personal data.”

5.9. The Operator undertakes to stop processing the Subject’s personal data within 5 (five) business days from the date of receipt of the notification in accordance with clause 5.8 of this Policy.

6. FUNDAMENTAL RIGHTS AND<strong> </strong>RESPONSIBILITIES<strong><br/></strong>

6.1. The operator has the right:

6.1.1. receive from the Subject reliable information and (or) documents containing personal data;

6.1.2. require the Personal Data Subject to timely clarify the provided personal data.

6.2. The operator is obliged:

6.2.1. process personal data in the manner established by the current legislation of the Russian Federation;

6.2.2. consider requests from the Personal Data Subject (his legal representative) regarding the processing of personal data and give reasoned answers;

6.2.3. provide the Personal Data Subject (his legal representative) with the opportunity to freely access his personal data;

6.2.4. take measures to clarify, destroy the personal data of the subject of personal data in connection with his (his legal representative) handling of legal and reasonable demands;

6.2.5. organize the protection of personal data in accordance with the requirements of the legislation of the Russian Federation.

6.3. Subjects of personal data have the right:

6.3.1. to complete information about their personal data processed by the Operator;

6.3.2. to access their personal data, including the right to receive a copy of any record containing their personal data, except as otherwise provided by federal law;

6.3.3. to clarify their personal data, block it or destroy it in cases where the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;

6.3.4. to withdraw consent to the processing of personal data;

6.3.5. to take measures provided by law to protect your rights;

6.3.6. to exercise other rights provided for by the legislation of the Russian Federation.

6.4. Subjects of personal data are obliged to:

6.4.1. provide the Operator with reliable information about yourself;

6.4.2. provide documents containing personal data to the extent necessary for the purpose of processing;

6.4.3. inform the Operator about clarification (updating, changing) of your personal data.

6.5. Persons who provided the Operator with false information about themselves or information about another Personal Data Subject without the latter’s consent are liable in accordance with the legislation of the Russian Federation.

7. PROCEDURE FOR CONSIDERATION OF DISPUTES

7.1. All disputes and disagreements that may arise between the Operator and the Subjects on issues that are not resolved in the text of the Policy must be resolved through negotiations.

7.2. The parties are obliged to comply with the claims procedure for resolving disputes. Before going to court with a claim on disputes arising from the relationship between the Subject and the Operator, a claim (a written proposal for a voluntary settlement of the dispute) is filed. The period for consideration of a claim is 30 (thirty) calendar days from the date of receipt of the claim, unless a different procedure for pre-trial settlement is established by the current legislation of the Russian Federation.

7.3. If controversial issues are not resolved during negotiations, disputes arising from the Policy are resolved in a court of general jurisdiction at the location of the Operator. The current legislation of the Russian Federation applies to this Policy and the relationship between the Subject and the Operator.

8. FINAL PROVISIONS<strong><br/></strong>

8.1. The operator has the right to make changes to this Policy. When changes are made to the current edition, the date of the last update is indicated. The new version of the Policy comes into force from the moment it is posted on the Site, unless otherwise provided by the new version of the Policy. The current edition is constantly available on the Site.

8.2. This Policy approves the form of Consent for the processing of personal data of Site users (Appendix No. 1 to this Policy), which is posted on the Site in public access at the link: https://en.invest.kaluga.ru/consent-to-personal-data-processing/

9. OPERATOR DETAILS

Kaluga Region Development Corporation JSC

Address: 248001, Kaluga region, Kaluga city, st. Kirova, 17

OGRN: 1074027007780

INN: 4027083322

Email address: web@invest.kaluga.ru

Phone: +7 (4842) 79-04-10

Appendix No. 1

To the Policy regarding the processing of personal data

FORM OF CONSENT FOR PROCESSING OF PERSONAL DATA

FOR SITE VISITORS

Staying on the site https://en.invest.kaluga.ru/ (hereinafter referred to as the Site), I express my consent to the Kaluga Region Development Corporation JSC (OGRN 1074027007780, INN 4027083322, legal address: 248001, Kaluga region, Kaluga city, Kirova St., 17) (hereinafter referred to as the Operator), for the automated processing of my personal data (files cookies, information about the user’s location, information about the user’s actions on the site, information about the user’s equipment, date and time of the session), including using programs for automatic collection of analytical data (Yandex Metrica, Yandex Maps), with the performance of actions: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, depersonalization, blocking, deletion, destruction, transfer (provision, access) to counterparties The operator providing services regarding the use of the above programs.

The processing of personal data is carried out in order to ensure and improve the functioning of the Site, provide the User with information about goods, services, promotions and special offers of the Company, conduct statistical and other studies based on anonymized data, and comply with the requirements of the legislation of the Russian Federation.

This Consent is valid from the moment it is provided and during the period of my use of the Site. In the event that I refuse to process personal data by the programs specified in this Consent, I am informed of the need to stop using the Site or disable cookies in my browser settings.