Personal Data Processing Policy of OAS International LLC (Approved by Order of OAS International LLC No. 51/045, dated 29.03.2018)

1. General Provisions

This document governs the Policy of OAS International LLC on processing the personal data of employees of OAS International LLC and other personal data holders that do not have employment relations with OAS International LLC.

The Personal Data Processing Policy of OAS International LLC stipulates the core principles, targets, terms and conditions, and ways of the personal data protection, lists of persons and personal data processed by OAS International LLC, functions, rights of personal data holders, as well as requirements to the personal data protection applied to by OAS International.

The Policy is developed with regard to the requirements of the Fundamental Law of the Russian Federation, legal and other regulatory acts of the Russian Federation on the personal data.

2. Targets of the Personal Data Processing

OAS International processes the personal data in order to fulfill employment contracts, civil contracts, maintain customer database, promote OAS products and related work and services on the market, incl. notification of the new, promo campaigns and discounts, new OAS production, holding of marketing surveys within the framework of the Service Quality Assessment, and other activities.

3. Legal Substantiation of the Personal Data Processing

OAS International LLC processes the personal data according to articles 23 and 24 of the Fundamental Law of the Russian Federation, articles 85-90 of the Employment Code of the Russian Federation No. 197-ФЗ, dated 30.12.2001, article 6, part 1, paragraphs 1 and 2 of Federal Law No. 152-ФЗ dated 27.07.2006 On the Personal Data, with consent of the personal data holder to processing of their personal data, as well as in order to perform and fulfill the functions, authorities and obligations imposed by the laws of the Russian Federation.

The respective regulatory legal acts and other documents are developed in order to implement the provisions of the Policy by OAS International LLC.

4. List of the Personal Data Categories Subject to Processing

OAS International LLC processes the personal data of the categories, that are necessary and sufficient for performance and fulfillment of the obligations imposed on OAS International LLC by the Russian legislation, as well as that are specified in the forms of consent to the personal data processing, which are filled in by the personal data holders in order to achieve the targets set out in para. 2 hereof. The content and the scope of the personal data processed correspond to the aforementioned processing purposes. OAS International LLC does not process any special categories of the personal data on racial or ethnic origin, political views, religious or philosophical beliefs, private life.

5. Terms and Conditions of the Personal Data Processing

OAS International LLC processes the personal data upon the consent of a personal data holder to processing of their personal data, unless otherwise is provided for by the laws of the Russian Federation on the personal data.

OAS international LLC does not disclose the personal data of a personal data holder to any third parties and does not disseminate their personal data without the consent of the personal data holder, unless otherwise is provided for the federal law. OAS International is entitled to assign the personal data protection to any other person with the consent of the personal data holder under a contract signed with such person. The Contract shall contain a list of actions (transactions) re. the personal data that will be performed by a person processing the personal data, the processing purposes, the obligation of such person to keep the personal data confidential and to ensure safety of the personal data in the course of processing thereof, as well as the requirements to the personal data protection according to article 19 of the Federal Law On the Personal Data Protection.

The personal data of the personal data holders shall be stored in a form that allows identification of the personal data holders not longer than it is required for the processing purposes in line with the storage periods set out by the laws of the Russian Federation and the regulatory documents of OAS International LLC.

The processed personal data are subject to destruction or annonymization upon achievement of the processing targets or in the event it is no more necessary to achieve such targets, unless otherwise is provided for by the applicable legislation.

6. Applicable Organizatory and Technical Measures on the Personal Data Protection

When processing the personal data, OAS International LLC takes necessary and sufficient organizational and technical measures to protect the personal data from any unauthorized or accidental access thereto, destruction, amendment, locking, copying, submission, dissemination of the personal data, as well as from any other unauthorized activities re. the personal data, incl.: appoints a person responsible for setting up the personal data protection; ensures availability of the local executive and regulatory documents on the personal data safety; acknowledges the persons admitted to the personal data use of the local executive and regulatory documents on the personal data safety; keeps account of the persons admitted to the personal data; limits access to the premises, where the personal data are processed and stored; keeps the personal data in hard and soft copy in in designated storage places of lock-up premises; ensures regular control of the measures to ensure the personal data safety; introduces a permit-based access system and limits user access to the personal data IT system; applies secure communications to transmit the personal data via Internet; applies anti-virus protection; ensures availability of the means of control of the information from unauthorized access that are certified by the Federal Technical and Export Control Agency.

7. Rights of the Personal Data Holders

The personal data holders are entitled to receive full information on their personal data processed by OAS International LLC; access their personal data incl. receive copies of any records containing their personal data, unless it is prohibited by the federal law; clarify their personal data, lock or destroy them if the personal data are incomplete, outdated, inaccurate, illegally received or not required for the requested processing purpose; revoke their consent to the personal data processing; take the measures to protect their rights as provided for by the law; file appeals against any action or omission by OAS International LLC in violation of the requirements of the laws of the Russian Federation on the personal data to a competent authority that is responsible for protection of the rights of the personal data holders or to a court; exercise any other rights provided for by the laws of the Russian Federation.

8. Operator’s Obligations

If any unlawful personal data processing is found out upon a claim filed by a personal data holder or their representative, or upon a request of a personal data holder or their representative, OAS International LLC locks the unlawfully processed personal data of such personal data holder or ensures their locking (if the personal data are processed by any other person, who is acting under an assignment given by the Department) from the time of such filing or receipt of such request for the period of investigation. If any inaccurate personal data are found out upon a claim filed by a personal data holder or their representative, or upon a request of such persons, OAS International LLC shall lock the personal data of such personal data holder or ensures their locking (if the personal data are processed by any other person, who is acting under an assignment given by the Department) from the time of such filing or receipt of such request for the period of investigation, if such personal data locking does not violate the rights and legal interests of the personal data holder or any third parties.

If it is confirmed that the personal data are inaccurate, OAS International LLC clarifies the personal data or ensures their clarification based on the information provided by the personal data holder or their representative or any other required documents (if the personal data are processed by any other person, who is acting under an assignment given by the Department) within seven business days from the day of receipt of such data and removes the personal data locking.

If it is found out that OAS International or any other person, who is acting upon an assignment given by OAS International LLC, performed any unlawful personal data processing, OAS International LLC shall terminate such unlawful personal data processing or ensure such termination by the person, who is acting upon an assignment given by OAS International LLC, within max. three business date from identification thereof. If it is impossible to ensure lawful personal data protection, the Department shall destroy such personal data or ensure such destruction within max. ten business days from identification of such unlawful personal data processing. OAS International LLC shall notify the personal data holder or their representative, as well as the competent authority that is responsible for protection of the rights of the personal data holders - if the personal data holder or their representative filed a claim or a request to such competent authority that is responsible for protection of the rights of the personal data holders - of elimination of the committed violations or of the personal data destruction.

If the data processing purpose is achieved, OAS International LLC shall terminate the personal data protection or ensure such termination (if the personal data are processed by any other person, who is acting under an assignment given by the Department) and destroy the personal data or ensure such destruction (if the personal data are processed by any other person, who is acting under an assignment given by the Department) within max. thirty days from the achievement of the purpose of the personal data processing, unless otherwise is provided for by the contract, in which the personal data holder is a party, beneficiary or guarantor, any other agreement entered into by the Department and the personal data holder, or if OAS International is not entitled to process the personal data without consent of the personal data holder for the reasons provided for by the federal laws.

9. Liability for Violation of the Requirements to the Personal Data Processing

Any employees of OAS International LLC, who are found guilty of having violated any requirements of the Federal Law “On the Personal Data” and any regulatory legal acts introduced in accordance therewith, shall bear financial, disciplinary, administrative, civil or criminal liability in the manner provided for by the laws of the Russian Federation.