The Personal Data processing policy is developed in order to comply with the legislation of the Russian Federation in relation to processing and ensuring the security of personal data at JSC OIS-BRIGHT in accordance with the Constitution of the Russian Federation, Federal Law No.152 “On Personal Data” dated July 27, 2006 and other regulatory legal acts, and is aiming to protect human rights and freedoms when processing the Personal Data.

1.1. Scope of application of the Personal Data Processing Policy (hereinafter referred to as the “Policy”) in JSC OIS-BRIGHT (hereinafter referred to as the “Company”) establishes the basic principles, goals, conditions and methods for processing Personal Data, the lists of Personal Data subjects and the Personal Data processed in the Company, the list of actions carried out by the Company during Personal Data processing, the rights of Personal Data subjects, as well as the requirements for the protection of Personal Data implemented in the Company.

1.2. The Policy provisions shall serve the basis for the development of local regulations regulating the processing of personal data of the Company’s employees and other Personal Data subjects.

1.3. The provisions of this Policy come into force from the moment of its approval and are valid until the updated version of the Policy is approved or this document is canceled.

1.4. The provisions of this Policy are intended to be implemented by all divisions of the Company.

1.1 Following local terms and abbreviations are used in this document:

• automated processing of Personal Data: processing of personal data using computer technology.
• blocking of Personal Data: suspension of personal data processing (except for cases where processing is necessary to clarify personal data).
• Personal Data information system: a set of personal data contained in databases, and information technologies and technical means that ensure personal data processing.
• information: any information (communications, data), irrespective of its transformation format.
• the Company: JSC OIS-BRIGHT.
• depersonalization of Personal Data: actions as a result of which it becomes impossible, without the use of additional information, to attribute the ownership of Personal Data to a specific Personal Data subject.
• processing of Personal Data: any action (operation) or set of automated or non-automated actions (operations) with Personal Data, including collection, recording, systematization, accumulation, storage, improvement (updating, modifying), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
• operator: state authority, municipal authority, legal entity or individual, who independently or jointly with other persons arranges and/or performs Personal Data processing, as well as defines the purposes of Personal Data processing, the volume of Personal Data subject to processing and actions (operations) performed towards Personal Data.
• Personal Data: any information related to directly or indirectly identified or identifiable natural person (Personal Data subject).
• Personal Data authorized by the subject of Personal Data for distribution: Personal Data, which is provided to an unlimited number of persons by the subject of Personal Data by giving consent to the processing of Personal Data, and which is authorized by the subject of Personal Data for distribution in the manner prescribed by the current legislation of the Russian Federation.
• provision of Personal Data: actions to disclose Personal Data to a specific person or a specific group of persons.
• dissemination of Personal Data: actions aimed at disclosing Personal Data to an indefinite number of persons. special categories of Personal Data: Personal Data concerning race, nationality, political views, religious or philosophical beliefs, health status, intimate life. cross-border transfer of Personal Data: disclosure of Personal Data to a foreign country, foreign government body, foreign individual or foreign legal entity.
• destruction of Personal Data: actions making it impossible to restore personal data volume in the personal data information system and/or resulting in the elimination of tangible media.

3.1 The Personal Data Processing Policy in the Company is determined in accordance with the following regulatory legal acts:

• Labor Code of the Russian Federation;
• Federal Law No.152 “On Personal Data” dated July 27, 2006;
• Decree of the President of the Russian Federation No.188 “On Approval of the List of Information of Confidential Nature” dated March 6, 1997;
• Resolution of the Government of the Russian Federation No.687 “On Approval of the Regulations on Special Aspects of Non-Automatic Personal Data Processing” dated September 15, 2008;
• Resolution of the Government of the Russian Federation No.512 “On Approval of the Requirements for Material Carriers of Biometric Personal Data and Technologies for Storing Such Data Outside of Information Systems of Personal Data” dated July 6, 2008;
• Regulation of the Government of the Russian Federation No. 1119 “On Approval of the Requirements to Personal Data Protection in the course of Its Processing in Personal Data Information Systems” dated November 1, 2012;
• Federal Service for Technical and Export Control of Russian Federation (FSTEC) Order No. 21 “On Approving the Scope and Content of Organizational and Technical Measures to Ensure the Personal Data Security during Processing in Personal Data Information Systems” dated 18 February 2013;
• Federal Service for Supervision of Communications, Information Technology and Mass Media of Russian Federation (Roskomnadzor) Order No. 996 “On Approval of Requirements and Methods for Depersonalization of Personal Data” dated September 5, 2013;
• other regulatory legal acts and regulatory documents of authorized regulatory authorities of the Russian Federation.

4.1. The Company, being the operator of Personal Data, processes the Personal Data of its employees and other Personal Data subjects which are not in labor relations with it.
4.2. The processing of Personal Data by the Company is conducted taking into account the necessity to ensure the protection of rights and freedoms of the Company’s employees and other Personal Data subjects, including the protection of privacy right, personal and family secrets, based on the following principles:

• Personal Data processing is carried out with the consent of the Personal Data subject on a legal and fair basis;
• Personal Data processing is limited to the achievement of specific, predetermined and legal purposes;
• Personal Data processing that is incompatible with the collecting Personal Data purposes is not allowed;
• it is not allowed to combine databases containing Personal Data, the processing of which is conducted for purposes incompatible with each other;
• only Personal Data that meet the purposes of their processing are subject to processing;
• content and volume of processed Personal Data correspond to the stated processing purposes. The processed Personal Data redundancy in relation to the declared purposes of their processing is not allowed;
• when processing Personal Data, confidentiality, accuracy of Personal Data, their sufficiency, and, if necessary, relevance in relation to the Personal Data processing are ensured. The Company undertakes necessary measures to remove or to clarify incomplete or inaccurate Personal Data;
• Personal Data storage is conducted in a form that allows to determine the Personal Data subject, no longer than it’s required by the Personal Data processing purpose, if the Personal Data storage period is not fixed by the federal law, agreement, a party to which, beneficiary or the guarantor of which is the Personal Data subject;
• processed Personal Data are destroyed or depersonalized upon the achievement of the processing purposes or in case of loss of the necessity in achieving these purposes, unless otherwise provided by the current legislation.

4.3. Personal Data are processed by the Company aimed at:
- ensuring compliance with the Constitution of the Russian Federation, legislative and other regulatory legal acts of the Russian Federation, local regulatory acts of the Company;

• performing functions, powers and obligations imposed on the Company by the legislation of the Russian Federation, including the provision of personal data to state authorities, to the Pension Fund of the Russian Federation, to the Social Insurance Fund of the Russian Federation, to the Federal Fund of Compulsory Medical Insurance, as well as to other state authorities;
• regulating labor relations with Company’s employees (assistance to candidates in employment, training and promotion, ensuring personal safety, monitoring the quantity and quality of job performed, ensuring the property safety);
• providing the Company’s employees and their family members additional guarantees and compensations, including non-state pension benefits, voluntary medical insurance, medical care and other types of social security;
• protecting life, health or other vital interests of Personal Data subjects;
• preparing, concluding, fulfilling and terminating agreements with counterparties;
• ensuring access and intra-facility modes at the Company’s facilities;
• forming reference materials for internal information support of the Company’s activities, its subsidiaries, JSC OIS-BRIGHT, as well as its branches, representative offices and affiliated organizations;
• implementing management functions and ensuring the activities of the Company's subsidiaries and organizations, including those located in foreign countries;
• implementing social and charitable projects;
• ensuring the functioning of the Company’s Internet resources, including those providing services and monitoring user behavior;
• executing judicial acts, acts of other bodies or officials subject to execution in accordance with the legislation of the Russian Federation regarding enforcement proceedings;
• exercising the rights and legitimate interests of the Company within the framework of the implementation of types of activities provided for by the Charter and other local regulations, or third parties, or the achievement of socially significant objectives;
• for other lawful purposes.

5.1. The Company processes Personal Data of the following categories of subjects:

• employees of the Company's divisions;
• employees of the Company's subsidiaries;
• other subjects of Personal Data (to ensure the implementation of the processing purposes specified in Section 4 of the Policy).

6.1. The list of Personal Data processed by the Company is determined in accordance with the legislation of the Russian Federation, as well as the Company’s regulations with consideration of the purposes of processing of Personal Data specified in Section 4 of the Policy.
6.2. The Company does not process special categories of personal data related to race, political views, religious or philosophical beliefs, intimate life.
6.3. The processing of biometric Personal Data conducted by the Company is permitted only with the written consent of the Personal Data subject, except for cases stipulated by the legislation of the Russian Federation.
6.4. The processing of Personal Data, which is permitted by the Personal Data subject for distribution, is conducted by the Company on the basis of the consent of the Personal Data subject to distribute it in compliance with the prohibitions and conditions for the processing of Personal Data established by the Personal Data subject.

7.1. While the personal data processing the Company:

• undertakes measures necessary for ensuring compliance with the requirements of the legislation of the Russian Federation and local regulations of the Company in the field of Personal Data;
• undertakes legal, organizational and technical measures to protect Personal Data from unauthorized or accidental access to them, destruction, alteration, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to Personal Data;
• appoints persons responsible for organizing the processing and protection of Personal Data in the Company;
• publishes internal regulations defining the Policy and issues of processing and protecting Personal Data in the Company;
• provides acquaintance of the Company’s employees who directly process Personal Data with the provisions of the legislation of the Russian Federation and local regulations of the Company in the field of Personal Data, including requirements for the Personal Data protection, and training of the indicated employees;
• publishes or otherwise provides unrestricted access to the present Policy;
• according to the established procedure, to inform the Personal Data subjects or their representatives on the information about the Personal Data availability relative to the relevant subjects, to provide an option to acquaint themselves with these Personal Data when contacting and (or) obtaining requests from these Personal Data subjects or their representatives, unless otherwise provided by the legislation of the Russian Federation;
• terminates processing and destroys personal data in cases provided for by the legislation of the Russian Federation in the field of Personal Data;
• performs other actions provided for by the legislation of the Russian Federation in the field of personal data.

8.1. The processing of Personal Data in the Company is conducted with the consent of the subject of Personal Data to the processing of his Personal Data, unless otherwise provided by the legislation of the Russian Federation in the field of Personal Data.
8.2. The Company doesn’t provide personal data to third parties and doesn’t distribute personal data without the consent of the personal data subject, unless otherwise provided by the Federal law.
8.3. The Company has the right to entrust the Personal Data processing to another person with consent of the Personal Data subject on the basis of an agreement concluded with this person. The agreement should provide for the list of actions (operations) with Personal Data, their processing purposes, as well as the obligation to respect the Personal Data confidentiality and ensure their safety during processing, as well as requirements for the protection of processed Personal Data in accordance with Article 19 of the Federal Law “On Personal Data”.
8.4. For the purposes of internal information support, the Company may create directories, address books and other sources, which, with the written consent of the subject of Personal Data, unless otherwise provided by the legislation of the Russian Federation, may include his Personal Data.
8.5. Access to Personal Data processed by the Company is permitted only to employees holding positions included in the list of positions of the Company, the replacement of which involves the processing of Personal Data.
8.6. When interacting with subsidiaries and organizations located in foreign countries, as well as with foreign authorities, individuals and legal entities, the cross-border transfer of Personal Data to foreign states is conducted in accordance with Article 12 of the Federal Law “On Personal Data”.

9.1. The Company collects, records, systematizes, accumulates, stores, clarifies (updates, changes), extracts, uses, transfers (distributes, provides, accesses), depersonalizes, blocks, deletes and destroys Personal Data.
9.2. The Company processes Personal Data in the following ways:

• non-automated processing of Personal Data;
• automated processing of Personal Data with or without the transfer of the received information via information and telecommunications networks;
• mixed processing of personal data.

10.1. Personal Data subjects have the following rights:

• to receive full information about their Personal Data processed by the Company;
• to get access to their Personal Data, including the right to obtain a copy of any record containing their Personal Data, except as provided by federal law, and to access medical data relating to them through a medical professional of their choice.
• to clarify their Personal Data, to block or to destroy their Personal Data in case it is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;
• to withdraw the consent to the processing of Personal Data;
• to take measures provided by law to protect one’s rights;
• to appeal against the actions or inactions of the Company, conducted in violation of the requirements of the legislation of the Russian Federation in the field of Personal Data, to the authorized body for the protection of the rights of Personal Data subjects or to the court;
• to exercise other rights provided for by law.

12.1. The arrangement and implementation of internal control over compliance by the Company's divisions with the legislation of the Russian Federation, local regulations in the field of Personal Data, including requirements for the protection of Personal Data, shall be ensured by the person responsible for the processing of Personal Data in the Company.
12.2. Internal control of compliance of Personal Data processing with the Federal Law “On Personal Data”, regulatory legal acts adopted in accordance with them, requirements for the protection of Personal Data, this Policy, and local regulatory acts of the Company is conducted by the CEO of the Company.
12.3. Personal responsibility for compliance with the requirements of the legislation of the Russian Federation, local regulations of the Company in the field of Personal Data, as well as for ensuring the confidentiality and security of Personal Data in the Company's divisions is assigned to their executive managers.