PERSONAL DATA PROCESSING POLICY

1. GENERAL PROVISIONS

1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") defines the procedures for processing and measures to ensure the security of personal data by the Joint Stock Company "Engineering and Technical Center 'JET'" (address: Russian Federation, 117335, Moscow, Nakhimovsky Ave., 58, 9th floor, room XXVI, office 16).

1.2. The action of this Policy applies to all personal data of subjects (users of the website, as listed in section 3.3 below), processed by the Company using automated means or without such means.

1.3. The Policy is accessible to any personal data subject. The current version of the Policy is published on the website http://app.repeatlab.ru (hereinafter referred to as the "Website").

2. DEFINITIONS

2.1. Automated personal data processing – processing of personal data using computing technology;

2.2. Blocking of personal data – temporary cessation of personal data processing (except when processing is required for clarification of personal data);

2.3. Personal data information system – a set of personal data contained in databases and ensuring their processing with information technologies and technical means.

2.4. Anonymization of personal data – actions that make it impossible to identify personal data without using additional information;

2.5. Personal data processing – any action (operation) or set of actions (operations) performed with personal data using automation tools or without them, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, usage, transmission (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data;

2.6. Personal data – any information related to a directly or indirectly identified or identifiable individual (subject of personal data);

2.7. Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific circle of persons;

2.8. Dissemination of personal data – actions aimed at disclosing personal data to an indefinite number of persons.

2.9. Destruction of personal data – actions that make it impossible to restore the content of personal data in the personal data information system and/or result in the destruction of physical carriers of personal data;

3. CONSENT TO PERSONAL DATA PROCESSING

3.1. The Website user freely, at their own will and in their own interest, provides the Company with their personal data and consents to their processing. This consent applies only to the Website. The Company does not control and is not responsible for third-party websites to which the Website user may be directed via links available on the Website.

3.2. The Company processes personal data of the user only when they are filled out and/or submitted by the user through special forms located on the website http://app.repeatlab.ru. By filling out the relevant forms and/or submitting their personal data to the Company, the user expresses their consent to this Policy.

3.3. The Company may process the following personal data of the user (client and counterparty of the operator (individuals)):

• Last name, first name, patronymic;
• Email address;
• Phone numbers;
• IIN (Individual Taxpayer Number);
• OGRNIP (Primary State Registration Number of an Individual Entrepreneur);
• Postal address (in the case of the home address of an individual entrepreneur).

3.4. By accepting the terms of this Policy, the Website user confirms that the personal data they have provided is accurate. The Company assumes that the Website visitor provides accurate personal data and keeps it up-to-date.

3.5. The user can change (update, supplement) part of their provided personal data at any time by using the function to edit their data in their account.

3.6. By accepting the terms of this Policy, the Website user confirms that they are aware of their rights and obligations under the current legislation of the Russian Federation on personal data, particularly the right to access their personal data, and the right to withdraw their consent.

3.7. If the Website user does not intend to provide personal data or does not accept this Policy, they should stop using the Website. In this case, the Company will not be able to provide the user with access to the Website

4. COLLECTION OF INFORMATION ABOUT WEBSITE VISITS

4.1. The Company may collect information about the visits to the Website by users without the users providing such information themselves. Such information may be obtained using various methods, tools, and instruments of internet statistics and settings (in particular, Cookies, Yandex.Metrica services). The Company may use such methods, tools, and instruments to collect information about users' actions on the Website and improve the quality of the Website and its content. However, these methods, tools, and instruments are not used to identify unregistered users.

4.2. If the Website user does not agree with the use of Cookies on their device, they can disable this option in the browser settings. The saved Cookies can also be deleted at any time in the browser's system settings. The Website user can modify their browser settings to accept or reject all Cookies by default or only Cookies from certain websites, including the Website.

4.3. Disabling some Cookies may make it impossible to use certain sections or features of the Website.

4.4. If the Website user disagrees with the use of internet statistics and settings tools, they should stop using the Website. In this case, the Company will not be able to provide the user with access to the Website.

5. LEGAL BASIS FOR PERSONAL DATA PROCESSING

5.1. The legal bases for processing personal data are:

• Contracts concluded between the Company and the personal data subject;
• Federal laws, other regulatory acts in the field of personal data protection;
• Consent of the Website users for processing their personal data.

6. PURPOSES OF PERSONAL DATA PROCESSING

6.1. The purpose of processing the user's personal data is:

• Registration and service of the client's account (personal cabinet) on the Website;
• Informing the user about new materials, products, and services by sending emails;
• Providing the user with access to services, information, and/or materials contained on the Website http://app.repeatlab.ru;
• Establishing feedback with the client;
• Conducting statistical and other research by the Company through the Website and client services of the Company based on anonymized data, forming statistical reports.

6.2. The user can always opt out of receiving informational messages by sending an email to YuPStepanov@rusatomservice.ru with the subject line "Unsubscribe from the newsletter" or by clicking the corresponding button in the email body. Partial refusal to receive newsletters on specific topics is not possible.

7. PROCEDURE FOR PERSONAL DATA PROCESSING

7.1. As part of the goals outlined in section 6 of this Policy for collecting personal data, the Company has the right to perform any actions (operations) or a set of actions (operations), using automation tools or without them, as specified in clause 3, part 1 of Article 3 of the Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, anonymization, blocking, deletion, destruction, transmission (distribution, provision, access) of personal data to third parties while ensuring measures to protect personal data from unauthorized access, within the scope necessary to achieve the purposes of the consent given by the personal data subject.

7.2. Information related to personal data, which becomes known to the Company, is confidential and protected by law.

8. MEASURES TO PROTECT PERSONAL DATA

8.1. The Company takes necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions regarding personal data. In particular, the Company takes the following measures:

• Identifying threats to the security of personal data during their processing in personal data information systems;
• Applying organizational and technical measures to ensure personal data security during their processing in information systems;
• Using means of protection that have passed the established procedure for compliance assessment;
• Evaluating the effectiveness of security measures before putting into operation personal data information systems;
• Detecting cases of unauthorized access to personal data and taking measures, including detection, prevention, and liquidation of the consequences of computer attacks on personal data information systems and responding to computer incidents;
• Restoring personal data modified or destroyed due to unauthorized access;
• Monitoring the security measures and the level of protection of personal data information systems;
• Appointing responsible persons for coordinating actions to ensure the security of personal data within the Company.

8.2. The Company is not responsible for the acquisition of personal data by third parties through unauthorized access to the registered users' personal accounts. Registered users are responsible for ensuring the safety of their data for accessing their personal accounts.

9. PROCESSING REQUESTS

9.1. Personal data subjects may request clarifications on issues regarding personal data processing, including checking their personal data or withdrawing consent to process their personal data, by sending a written request to the Joint Stock Company "Engineering and Technical Center 'JET'" at the following address: Moscow, Nakhimovsky Ave., 58, 9th floor, room XXVI, office 16. The request should specify:

• Last name, first name, patronymic (if applicable) of the personal data subject;
• Details of the document confirming the authority of the personal data subject's representative (if the subject addresses the Company through a representative);
• The number of the primary identity document of the personal data subject or their representative, as well as information about the issue date of the specified document and the issuing authority;
• Information confirming the participation of the personal data subject in relations with the Company or other information confirming the fact of personal data processing by the Company;
• The signature of the personal data subject or their representative.

9.2. The request specified in section 9.1 of this Policy may be signed with an electronic signature and sent as an electronic document to the email address YuPStepanov@rusatomservice.ru.

9.3. The Company responds to requests from personal data subjects in accordance with the procedure and within the time frames established by the Federal Law of the Russian Federation No. 152-FZ "On Personal Data" dated July 27, 2006.

10. FINAL PROVISIONS

10.1. This Policy is subject to change or addition in cases of amendments or additions to the applicable legislation of the Russian Federation on personal data. It may also be changed at any time at the discretion of the Company. The current version of the Policy is always available for review by an unlimited number of people on the Website at the permanent address: http://app.repeatlab.ru/assets/privacy-policy-ru.pdf.

10.2. The Company is not obligated to notify personal data subjects about the changes made. The Company recommends that personal data subjects independently monitor this Policy for possible changes.

10.3. The date of the last update of the Policy: January 16, 2023.