Personal Data Processing Policy

Article 1. GENERAL PROVISIONS

        In the course of carrying out its statutory activities, the Limited Liability Company "Laboratory of Models" (hereinafter referred to as the Company) processes personal data. By processing personal data (hereinafter also referred to as PD). The Company considers compliance with the principles of legality, fairness and confidentiality in the processing of personal data to be its most important tasks. The Company is responsible for maintaining the confidentiality and security of the processed personal data.
        This Personal Data Protection Policy at Laboratory of Models LLC (hereinafter referred to as the Policy) ensures the implementation of the requirements of the legislation of the Russian Federation in the field of personal data processing of personal data subjects. The Policy discloses the main categories of personal data processed by the Company, the purposes, methods and principles of personal data processing by the Company, the rights and obligations of the Company when processing personal data, the rights of personal data subjects, as well as measures applied by the Company to ensure the security of personal data during their processing.
        This Policy applies to all cases of personal data processing by the Company, regardless of whether the processing of personal data is automated or non-automated, it is performed manually or automatically.
        This Policy is an internal local regulatory act of the Company and is mandatory for all divisions and Employees of the Company.
Every employee who is re-employed by the Company must be familiar with this Policy during the first introductory briefing.
        This Policy is approved by the General Director and monitors compliance with the Policy in the Company.
The validity period of this Policy is two years after its approval. The Policy is subject to review at least once every two years. The new version of the revised Policy is approved by the General Director of the Company.
        Responsibility for updating this Policy and current control over the implementation of the Policy norms is assigned to the authorized employee appointed by the order of the Company responsible for organizing the processing and protection of PD.
Based on the requirements of this Policy, the Company develops all internal local acts and other documents of the Company related to the processing of PD.
        This Policy is a publicly available document. To ensure unrestricted access to the document, the text of this Policy is posted on the website publicly accessible to an indefinite circle of people: www.lab-model.com .

Article 2. BASIC CONCEPTS

        Policy – an internal local regulatory act approved by the General Director of the Company - "Policy on the protection of personal data in the Limited Liability Company "Laboratory of Models".
Personal data (PD) is any information related directly or indirectly to a certain or identifiable individual - the subject of personal data.
        Personal data processing is any action with personal data performed with or without the use of automation tools.
        The subject of personal data is an identified or unidentified individual in respect of whom personal data is being processed.
        An employee is an individual (subject of personal data) who has concluded an employment contract with the Company.
        The applicant is an individual (subject of personal data) who has submitted his personal data to the Company with a proposal to conclude an employment contract.
        Partner – a legal entity or an individual entrepreneur, a personal data operator with whom the Company has contractual relations, in fulfillment of obligations under which the Partner entrusts the Company as a third party with the processing of personal data of Clients.
        Client - a natural person - a customer of non–food goods and services (a subject of personal data) who has concluded an agreement with the Company or a Partner formed by the Company; or a natural person - a buyer (a subject of personal data) on whose behalf the customer of goods and services has concluded an agreement with the Company or a Partner, which is formed by the Company.
        Other natural person – an individual (subject of personal data) who has concluded a contract with the Company for the provision of a certain type of services or works, or an employee of a Partner.
        A visitor is an individual (subject of personal data) who is not an Employee and has been legally admitted to the premises of the Company.
        Authorized employee – An employee appointed by the order of the General Director of the Company responsible for ensuring information security and protection of personal data.
Distribution of personal data - personal data to an indefinite circle of persons.
Provision of personal data - actions directed by personal data to a certain person or a certain circle of persons.

Article 3. BASIC PROVISIONS

1. Legal grounds for PD processing
The Company is obliged to process personal data only on a legal and fair basis.
The Company's policy in the field of personal data processing is determined in accordance with the following regulatory legal acts of the Russian Federation:
The Constitution of the Russian Federation
The Labor Code of the Russian Federation
The Civil Code of the Russian Federation
The Tax Code of the Russian Federation
Federal Law No. 160-FZ of 19.12.2005 "On Ratification of the Council of Europe Convention on the Protection of Individuals with Automated Processing of Personal Data"
Federal Law No. 152-FZ of 27.07.2006 "On Personal Data"
Federal Law No. 149-FZ of 27.07.2006 "On Information, Information Technologies and Information Protection"
Federal Law No. 2300-1 of 07.02.1992 "On Consumer Rights Protection"
Federal Law No. 326-FZ of 29.11.2010 "On Compulsory Medical Insurance in the Russian
Federation Federal Law No. 167-FZ of 15.12.2001 "On Compulsory Pension Insurance in the Russian Federation"
Federal Law No. 165-FZ of 16.07.1999 "On the Basics of Compulsory Social Insurance"
Federal Law No. 14-FZ dated 08.02.1998 "On Limited Liability Companies"
Decree of the Government of the Russian Federation dated November 01, 2012 No. 1119 "On Approval of the requirements for the protection of personal Data during their Processing in Personal Data Information Systems"
Decree of the Government of the Russian Federation dated September 15, 2008 No. 687 "On Approval of the Regulations on the features of processing of personal data carried out without the use of automation tools".
The processing of personal data cannot be used by the Company or its Employees for the purpose of causing property and moral harm to the subjects of personal data, hindering the exercise of their rights and freedoms.
The processing of personal data in the Company should be limited to the achievement of legitimate, specific and predetermined goals. Only those personal data are subject to processing, and only to the extent that they meet the purposes of their processing.
All local regulations adopted by the Company regulating the processing of personal data in the Company are developed on the basis of this Policy.

2. Purposes of PD processing
The Company processes personal data solely for the purposes of:
a) performing the functions assigned to the Company by the Charter and the legislation of the Russian Federation in accordance with the regulations specified in paragraph 1. of Article 3. of the Policy;
b) organization of accounting of the Company's Employees in accordance with the requirements of laws and other regulatory legal acts, assistance to them in career growth and employment, in training, for the implementation of medical insurance and for providing them with other benefits and compensations;
c) making a decision on concluding an employment contract with the Applicant;
d) fulfillment of the Company's obligations and exercise of the Company's rights under contracts concluded with Clients in accordance with the legislation of the Russian Federation;
e) fulfillment of the Company's obligations and exercise of the Company's rights under concluded agreements to which the Client is a party or beneficiary or guarantor, as well as for concluding agreements on the Client's initiative or agreements under which the Client will be a beneficiary or guarantor;
g) fulfillment of the Company's obligations and exercise of the Company's rights under contracts concluded with Partners in accordance with the legislation of the Russian Federation;
h) fulfillment of the Company's obligations and exercise of the Company's rights under contracts concluded with other individuals or legal entities in accordance with the norms of the Civil Code of the Russian Federation;
i) to fulfill the Company's obligations and exercise the Company's rights in the course of legal proceedings against the Company's Employees, Clients or Partners, or the Company's claims against Employees, Clients or Partners within the framework of the Civil Procedure Code of the Russian Federation, the Arbitration Procedure Code of the Russian Federation, the Code of Administrative Offences of the Russian Federation;
j) to fulfill the obligations of the Company and exercise the rights of the Company in the implementation of claims management on complaints to the Company of Employees, Clients or Partners, or claims of the Company to Employees, Clients and Partners under the Civil Code of the Russian Federation; the Civil Procedure Code of the Russian Federation, the Arbitration Procedure Code of the Russian Federation, the Code of Administrative Offences of the Russian Federation;
k) processing of personal data, access of an unlimited number of persons to which is provided by an Employee or Client or at their request;
m) performing marketing and advertising actions in order to establish and further develop relationships with Customers and Partners;