I. General Provisions

1. This Personal Data Processing Policy (hereinafter referred to as the Policy) defines the basic principles, goals, conditions and methods of personal data processing by the Federal State Budgetary Institution "Russian Academy of Sciences", 14, Leninsky Prospekt, Moscow, 119991 (hereinafter referred to as the Operator).

2. This Policy has been developed in compliance with the requirements of 2. This Policy has been developed in compliance with the requirements of Paragraph 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data" (hereinafter referred to as the Law on Personal Data), taking into account the requirements of the Law on Personal Data and other regulatory legal acts of the Russian Federation in the field of personal data.

3. This Policy applies to all operations performed by the Operator with personal data with or without the use of automation tools. The Operator processes the personal data of the Personal Data Subject only if they are filled out and (or) sent by the Personal Data Subject independently through the forms on the website in the Internet network https://heraldras.ru, where user data will be collected (hereinafter referred to as the Website). By filling out the appropriate forms and/or sending their personal data to the Operator, the Personal Data Subject agrees to this Policy.

4. The Personal Data Subject independently decides on the provision of his personal data and gives consent freely, voluntarily and in his/her own interest.

5. This Policy is subject to updating at the initiative of the Operator, as well as in the event of changes in the legislation of the Russian Federation in the field of personal data.

II. Basic Concepts

1. For the purposes of this Policy, the following terms are used in the following meaning:

▪ Personal data is any information related directly or indirectly to a specific or identifiable natural person (Personal Data Subject).

▪ Biometric personal data is information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his/her identity.

▪ Personal data processing is any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

▪ Automated personal data processing is processing of personal data using computer technology.

▪ Dissemination of personal data are actions aimed at disclosing personal data to an unspecified group of people.

▪ Personal data providing are actions aimed at disclosing personal data to a specific person or a specific group of people.

▪ Blocking of personal data is the temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data).

▪ Destruction of personal data are actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.

▪ Depersonalization of personal data is an action that makes it impossible to determine whether personal data belongs to a specific Personal Data Subject without using additional information

▪ Personal Data Subject (Subject) is an individual who can be directly or indirectly identified using personal data.

▪ Consent to the processing of personal data (Consent) is a written or digital document that confirms the Subject's voluntary decision to transfer personal data to the Operator in the amount, on the terms and for the purposes defined by this Policy and agreements concluded between the Subject and the Operator.

III. Principles and Purposes of Personal Data Processing

1. The processing of personal data by the Operator is carried out taking into account the need to ensure the protection of the rights and freedoms of Personal Data Subjects, including the protection of the right to privacy, personal and family secrets, based on the following principles:

▪ personal data is processed legally;

▪ the processing of personal data is limited to the achievement of specific, pre-defined and legitimate purposes;

▪ processing of personal data incompatible with the purposes of personal data collection is not allowed;

▪ the content and volume of personal data processed correspond to the stated purposes of processing. Redundancy of the processed personal data in relation to the stated purposes of their processing is not allowed;

▪ when processing personal data, the accuracy of personal data, their sufficiency, and, if necessary, relevance to the purposes of personal data processing are ensured;

▪ personal data is stored in a form that makes it possible to identify the Subject of Personal Data for no longer than the purposes of personal data processing require, unless the period of personal data storage is established by federal law, an agreement to which the Personal Data Subject is a party, beneficiary or guarantor;

▪ the personal data being processed is destroyed or depersonalized upon achievement of the processing objectives or in case of loss of the need to achieve these objectives, unless otherwise provided by federal law.

2. The processing of personal data by the Operator is carried out for the following purposes:

▪ identification of the Subject in order to conclude any contracts with the Operator and their further execution;

▪ the Operator conducts promotions, surveys, interviews, tests and research on the Website;

▪ establishing feedback with the Subject, including, but not limited to: sending newsletters, notifications in the form of SMS, emails, oral and written requests, processing requests from the Subject;

▪ confirmation of the accuracy and completeness of the personal data provided by the Subject;

▪ statistical and other research and (or) analytical purposes, on condition of depersonalization of the Subject's personal data.

IV. Scope and Categories of Personal Data Processed, Categories of Personal Data Subjects

1. The Operator may process the personal data of the following Subjects:

▪ counterparties — individuals and representatives of legal entities;

▪ Website visitors.

2. Personal data processed by the Operator includes:

▪ last name, first name, patronymic (if any) of the Personal data Subject;

▪ the address specified by the Subject when concluding contracts with the Operator;

▪ Mobile phone number;

▪ E-mail address;

▪ the history of requests and views on the Website and its services;

▪ cookies, information about the user's location, information about the user's actions on the Website, information about the user's equipment, date and time of the session.

3. The Operator ensures that the content and volume of personal data being processed correspond to the stated purposes of processing and, if necessary, takes measures to eliminate their redundancy in relation to the stated purposes of processing.

V. Procedure and Conditions of Personal Data Processing

1. The processing of personal data by the Operator is carried out in the following ways:

▪ non-automated processing of personal data;

▪ automated processing of personal data with or without transmission of the information received via information and telecommunication networks, including processing using automated database management systems and other software tools;

▪ Mixed processing of personal data.

2. The list of actions performed by the Operator with personal data: collection, systematization, accumulation, storage, clarification (updating, modification), use, distribution (including transfer), depersonalization, blocking, destruction on the territory of the Russian Federation in accordance with the legislation of the Russian Federation.

3. The personal Data Subject decides on the provision of his personal data and gives Consent freely, voluntarily and in his/her own interest.

4. The Operator does not process biometric personal data.

5. The Operator does not transfer personal data across borders.

6. The Operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, or intimate life.

7. The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, the expiration of Consent or withdrawal of Consent by the Personal data Subject, as well as detection of unlawful processing of personal data.

8. The period of personal data processing is unlimited. The Subject may revoke his Consent to the processing of personal data at any time by sending an e-mail notification to the Operator to the Operator's e-mail address specified in the Operator's details of this Policy, marked "Revocation of consent to the processing of personal data".

9. The Operator undertakes to stop processing the Subject's personal data within 30 (thirty) days from the date of receipt of the notification in accordance with Paragraph 8 of this section.

VI. Basic Rights and Obligations

1. The Operator has the right to:

▪ receive reliable information and/or documents containing personal data from the Personal Data Subject;

▪ require the Personal Data Subject to provide timely clarification of the personal data provided.

2. The operator is obliged to:

▪ process personal data in accordance with the procedure established by the legislation of the Russian Federation;

▪ consider the requests of the Personal Data Subject (his legal representative) regarding the processing of personal data and provide motivated answers;

▪ provide the Subject of personal data (his legal representative) with the opportunity to freely access his personal data free of charge;

▪ take measures to clarify and destroy the personal data of the Personal Data Subject in connection with his (his legal representative's) handling of legitimate and reasonable demands;

▪ organize the protection of personal data in accordance with the requirements of the legislation of the Russian Federation.

3. Subjects of personal data have the right to:

▪ full information about their personal data processed by the Operator;

▪ the right to access their personal data, including the right to receive a copy of any record containing their personal data, except in cases provided for by federal law;

▪ to clarify their personal data, block it or destroy it in cases where the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;

▪ revocation of Consent to the processing of personal data;

▪ to take legal measures to protect their rights;

▪ to exercise other rights provided for by the legislation of the Russian Federation.

4. Subjects of personal data are obliged to:

▪ provide the Operator with reliable personal information;

▪ provide documents containing personal data to the extent necessary for the purpose of processing;

▪ inform the Operator about the clarification (updating, modification) of their personal data.

5. Persons who have provided the Operator with false information about themselves or information about another Personal Data Subject without the latter's consent are liable in accordance with the legislation of the Russian Federation.

VII. Dispute Settlement Procedure

1. All disputes and disagreements that may arise between the Operator and the Subjects on issues that have not been resolved in the text of the Policy should be resolved through negotiations.

2. The parties are obliged to comply with the claims procedure for dispute settlement. Before filing a claim with the court for disputes arising from the relationship between the Entity and the Operator, a claim is submitted (a written proposal for a voluntary settlement of the dispute). The claim review period is 30 (thirty) calendar days from the date of receipt of the claim, unless another procedure for pre-trial settlement is established by the legislation of the Russian Federation.

3. If disputes are not resolved during the negotiation process, disputes arising from the Policy are resolved in a court of general jurisdiction at the Operator's location. The legislation of the Russian Federation applies to this Policy and the relations between the Entity and the Operator.

VIII. Final Provisions

The Operator has the right to make changes to this Policy. When making changes to the current version, the date of the last update is indicated. The new version of the Policy comes into force from the date of its posting on the Website, unless otherwise provided by the new version of the Policy. The current version is always available on the Website.

Operator's Details

Federal State Budgetary Institution "Russian Academy of Sciences"

14, Leninsky Prospekt, Moscow, 119991

+7 (495) 938-1500

info@pran.ru