Confidentiality policy

1. General provisions
2. Scope and purposes of personal data processing
3. Web analytics tools
4. Legal basis for personal data processing
5. Engagement of third parties in personal data processing
6. Principles of personal data processing
7. Measures to ensure personal data security
8. Rights of personal data subjects and contacts for personal data processing matters
9. Final provisions

1. General provisions

This Personal Data Policy (the “Policy”) sets forth the terms and conditions for processing personal data when using the websites operated by PJSC Cherkizovo Group (registered at: 5B Lesnaya St., Moscow 125047, Russia) (the “Company”).

The Policy has been drafted in line with Federal Law No. 152-FZ On Personal Data dated July 27, 2006.

It defines the general terms of collecting, processing, and storage by the Company of personal data of website visitors, existing and potential customers, consumers of products, as well as other personal data subjects, which may contact the Company by means of its websites. Personal Data means any information related directly or indirectly to a particular or identifiable individual (the “personal data subject”).

Agreement on the use of the websites (the “User Agreement”) is a notice of the beginning of personal data processing and request for consent to it from a personal data subject – a visitor to the Company's website.

The Company processes personal data in line with the Privacy Policy adopted by the Company and internal regulations, as well as applicable laws of the Russian Federation.

2. Scope and purposes of personal data processing

The Company may process personal data solely provided that the purposes, scope and methods of its processing match those of its initial collection and of which the personal data subject has been informed in this Policy, the User Agreement or in any other way permitted by law.

In particular, the Company may process the following personal data in order to achieve the purposes listed below:

ensuring the normal and secure operation of the websites: technical data of website users’ devices automatically collected by the web analytics tools used on the websites in the ways described in this Policy;

interacting with existing and potential customers, consumers of products, promoting products and organizing events, handling complaints about products: full name, mobile and work phone numbers, email addresses, name of the employer and workplace address, position, and other data that may be provided by filling feedback forms on the websites;
recruiting candidates for employment: first and last name, age, education, information on past employment and work experience, professional skills and competencies, and other information that may be provided by candidates in CVs and communications with the Company.

Allowed methods of personal data processing:

collecting, obtaining, recording, systematizing, accumulating, storing, correcting (updating, changing), using, transferring (providing or granting access), blocking, deleting, destroying.

The Company does not process biometric data, as well as data relating to race, ethnicity, political views, religious or philosophical beliefs, intimate life. The Company prohibits making decisions solely on the basis of automated personal data processing, where such decisions have legal consequences for the personal data subjects or otherwise affect their rights and legitimate interests. The Company does not distribute personal data or provide access to it via publicly available sources without a required consent of the personal data subject.

3. Web analytics tools

Web analytics tools are used to ensure the operation of the website and to conduct technical analysis of visitors’ behavior:

Cookies are small files that are created and stored by the browser when a person visits the Company’s website. Cookies are stored on a device for a maximum of 12 months, unless otherwise established by another document of the Company, and help track website quality and usage and conduct marketing activities on the Internet.

Visiting and using websites inherently involves the creation and storage of cookies. However, user can delete cookies from the device at any time in browser settings. User can also refuse to accept cookies, but in this case some functions of the websites may not work.

Tracking pixels are invisible links that help collect analytical information about the user’s surfing through website pages.

The following types of web analytics tools are used on the Company’s websites:

Type	Purpose
Technical and functional cookies	These files generated by website engines are used to ensure that the websites run smoothly, as well as to store website settings selected by the user
Marketing and analytics cookies and pixels	Marketing cookies and pixels from Yandex.Metrica and Google Analytics web analytics services are used to collect and statistically analyze data related to the use of the websites

4. Legal basis for personal data processing

The Company processes personal data for the above purposes in the following cases:

personal data is processed subject to consent of the personal data subject;
personal data processing is required for exercising rights and legitimate interests of the Company or third parties, provided that no rights or legitimate interests of the data subject are affected;
personal data processing is required for the purposes of entering into, executing or terminating a contract, whereto the personal data subject is a party or a beneficiary, in particular, this Policy;
personal data processing is required for exercising the functions, powers, and duties imposed on the Company by applicable Russian laws.

5. Engagement of third parties in personal data processing

In order to achieve the stated purposes of personal data processing and provided there are legal grounds for that, personal data processing involves companies of Cherkizovo Group, contractors, providers of website hosting services and support of information systems in use. It may also involve other third parties.

Third parties are allowed to process the Company’s personal data solely based on an order to process personal data meeting the requirements of applicable Russian laws.

Also, personal data may be provided to state authorities pursuant to applicable federal laws.

The Company may process personal data on behalf of third parties.

Personal data collected by web analytics systems is also processed by third party organizers of such systems (in particular, Yandex LLC, Google, Facebook). In this case, personal data processing in web analytics systems is carried out in pursuance of the User Agreement.

6. Principles of personal data processing

The Company processes personal data based on the following principles:

personal data is processed on a lawful and fair basis;
personal data processing is limited to the achievement of specific, predetermined, and lawful purposes;
no personal data may be processed if it is incompatible with the purposes of its collection;
no databases may be merged if they contain personal data intended for incompatible processing purposes;
we process only personal data that is compatible with the processing purposes;
the content and scope of processed personal data is consistent with the stated purposes of processing. Any processed personal data is limited to what is necessary for the stated purposes of processing;
processed personal data is accurate, sufficient, and, where applicable, kept up to date with regard to the purposes for which it is processed; every reasonable step is taken to erase or correct incomplete or inaccurate data;
personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes of personal data processing unless the retention period is provided for by applicable federal laws, consent to processing or a contract to which the personal data subject is a party, beneficiary, or guarantor;
processed personal data is destroyed after achieving processing purposes or after such purposes become irrelevant, unless otherwise stipulated by the federal laws.

7. Measures to ensure personal data security

The Company takes necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, deletion, modification, blocking, copying, disclosure, or distribution, as well as from any other wrongful acts as regards personal data, and complies with personal data processing principles and rules provided for in the Federal Law On Personal Data and other regulations, including:

developing internal regulations on personal data processing and establishing procedures set to prevent and identify violations in personal data processing and to eliminate the consequences of such violations;
protecting personal data from unauthorized access, unlawful processing or transfer, as well as from loss, distortion or destruction;
determining and implementing technical and organizational measures to ensure personal data protection before the introduction of new procedures in personal data processing and new information systems for personal data;
providing access to personal data only in the cases and in the manner prescribed by applicable Russian laws;
informing employees directly involved in personal data processing of the provisions of Russian laws, including the requirements for personal data protection, this Policy and internal regulations on personal data processing, and/or training these employees.

The Company has appointed a person responsible for organizing personal data processing.

Internal documents binding on all employees of the Company, as well as relevant contracts with partners, counterparties, and other third parties, where these documents relate to them, set out the procedures for personal data processing and protection.

8. Rights of personal data subjects and contacts for personal data processing matters

During personal data processing, subjects have the right to:

request information relating to the processing of the subjects’ personal data, request the clarification, destruction or blocking of personal data if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing,
reject personal data processing in order to make direct contacts (including for the purposes of promoting goods, works, services), if the subjects’ personal data is processed for such purposes,
revoke the consent to personal data processing granted to the Company,
appeal the Company’s actions in administrative or judicial proceedings.

In addition to the above methods, subjects who have subscriptions for information and advertising communications may unsubscribe from such communications by activating the automatic “Unsubscribe” function by clicking the relevant link in the email containing the communication. In this case, communications will no longer be sent to the email address from which the function has been activated.

In case of any questions and requests concerning personal data processing, subjects may send a written request to the address: 5B Lesnaya St., Moscow, 125047.

9. Final provisions

The Policy is subject to revision in case of changes in the purposes, scope, methods, and terms of personal data processing on the Company’s websites. Any changes will be published and will become effective as soon as they are posted on the Company’s website.

Confidentiality policy DOCX, 27 kb