1.1. The Policy regarding the Processing of personal data of Customers and Users (hereinafter referred to as the Policy) was issued and published by PROMINTEСHMASH Joint — Stock Company (hereinafter referred to as the Operator) pursuant to Clause 1, Part 1, Article 18.1 of Federal Law No. 152‑FZ of 27.07.2006 "On Personal Data".

1.2. The Policy regulates the processing of personal data on the Operator's websites and services, including the purposes, composition, sources, methods of processing, transmission, retention periods, rights of subjects and protection measures.

2.1. Personal data — any information related directly or indirectly to a specific individual (subject of personal data).

2.2. Operator — a legal entity that organizes and / or performs the processing of personal data, determines the purposes, composition of personal data and operations with them.

2.3. Processing of personal data — actions with or without automation tools: collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

2.4. Automated processing of personal data — processing of personal data using computer technology.

2.5. Dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons.

2.6. Provision of personal data — actions aimed at disclosing personal data to a certain person or a certain group of persons.

2.7. Blocking of personal data — temporary termination of the processing of personal data, except in cases where the processing is necessary to clarify the PD.

2.8. Destruction of personal data — actions that exclude the possibility of restoring the content of PD in the ISPDn and/or destroy the material media of PD.

2.9. Depersonalization of personal data — actions that make it impossible to determine whether the PD belongs to a specific subject without additional information.

2.10. Personal Data Information System (ISPDn) — a set of PD databases and information technologies and technical means that ensure their processing.

2.11. Cross-border transfer of personal data — transfer of PD on the territory of a foreign state to a foreign authority, individual or legal entity.

2.12. Website — the Operator's official website: https://promintechmash.ru/

2.13. Mobile application — a computer program for the Operator's mobile devices.

2.14. Date of birth — year, month, date of birth.

3.1. Name: Joint-Stock Company "PROMINTEСHMASH "(JSC "PROMINTEСHMASH").

3.2. Address: 199004, St. Petersburg, 7th line V.O., house 62, facility 2, letter A

3.4. TIN / KPP: 7801735747 / 780101001; OGRN: 1247800081693

3.5. Contacts:
e-mail: info@promintechmash.ru
website: https://promintechmash.ru/en

4.1. Legality and fairness of processing; limiting processing to the achievement of specific, pre-defined and legitimate goals.

4.2. Prohibition of processing that is incompatible with the purposes of collection; prohibition of combining databases with incompatible purposes.

4.3. Compliance of the content and scope of the PD with the goals; prohibition of redundancy; ensuring the accuracy and relevance of the PD.

4.4. Storage of personal data for no longer than it is required for the purposes or terms established by law, with subsequent destruction or depersonalization.

4.5. Application of federal legislation and local acts; in case of conflict, the norms of federal legislation take precedence.

5.1. Users of the Operator's websites and online services.

5.2. Users of the Operator's mobile applications.

5.3. Individuals who have applied through the support/feedback channels.

5.4. Individuals who have given their consent to marketing communications.

6.1. Preparation, conclusion and execution of contracts, provision of services and maintenance of interaction.
Personal data: Full name; User ID; contact information; data about registrations and actions in the services; information about payment and payment instruments; information about the device; information about the car.[FSA1]
PD subjects: users of the mobile app.

6.2. Ensuring the functioning of online services and applications.
Personal data: full name, mobile phone, e-mail, geolocation data for functions with geoservices, information about the mobile device; push tokens; session and error logs.
PD subjects: users of online services and applications.

6.3. Ensuring the functioning of the sites.
Personal data: cookies; online identifiers; technical parameters of the device / browser.
PD subjects: users of the Operator's websites.

6.4. Promotion of the Operator's services and goods on the market (marketing).
Personal data: full name; contact details; usage events; cookies.
PD subjects: persons who have given consent to marketing communications.

6.5. Personalization of offers.
Personal data: User ID; contact details; history of interaction with the services.
PD subjects: service users.

7.1. Preparation, conclusion and execution of contracts — Article 6, Part 1, clause 5,152 of the Federal Law.

7.2. Ensuring the functioning of online services/applications — Article 6, Part 1, clause 5,152 of the Federal Law.

7.3. Ensuring the functioning of websites — Article 6, Part 1, clause 1,152 of the Federal Law.

7.4. Fulfillment of obligations imposed by the legislation of the Russian Federation — Article 6, Part 1, clause 2 152 of the Federal Law.

7.5. Exercising the rights and legitimate interests of the Operator/third parties — Article 6, Part 1, clauses 5 and 7 of 152 FZ.

7.6. Statistics and research — Article 6, Part 1, clauses 1 and 5 of 152 FZ.

7.7. Consideration of appeals — Article 6, Part 1, clauses 1, 2, and 5 of 152 FZ.

7.8. Support assessment/surveys — Article 6, Part 1, clause 1,152 of the Federal Law.

7.9. Marketing — Article 6, Part 1, clause 1,152 of the Federal Law.

7.10. Personalization — Article 6, Part 1, clause 5,152 of the Federal Law.

7.11. Consent of the PD subject — Article 9 152 of the Federal Law (including marketing, optional analytics, background functions).

7.12. Special / biometric personal data are not processed without a separate consent / reason under Article 10-11 of 152 FZ.

8.1. Processing with and without automation tools; operations: collection, recording, systematization, accumulation, storage, refinement, extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction.

8.2. Transfer of PD to third parties/processors — to the minimum necessary extent and in compliance with the legislation and contractual requirements.

8.3. Recording, systematization, accumulation, storage, clarification and extraction of personal data of citizens of the Russian Federation — using databases on the territory of the Russian Federation.

8.4. Decisions that give rise to legal consequences are not made solely on the basis of automated processing.

9.1. The provisions of this section apply to all purposes of personal data processing and are implemented to the extent necessary to achieve them and fulfill the obligations assigned to the operator.

9.2. The processing of personal data is carried out by the operator until one of the following events occurs: the stated processing goals are achieved or they are no longer necessary to be achieved; the deadline specified in the consent of the PD subject (if the processing is based on consent); the consent of the PD subject is withdrawn (if the processing is based on consent), or and in accordance with the procedure provided for by law.

9.3. In cases where the processing of personal data is related to the performance of a contractual relationship, personal data is processed during the term of the relevant relationship.

9.4. Storage periods by category:
Contractual, identification and credential data (account, information about registration and actions in the services, information about the car), as well as information about the provision of services and the fulfillment of obligations: during the term of the contractual relationship and 4 (four)years of use. years after their termination for the purposes of claims settlement and rights protection.
Payment information, accruals, information on fines and settlements: during the term of the contractual relationship and 4 (four)months of the contract period. years after their termination; if there are requirements of archival / tax legislation — within the terms and procedure established by such norms, including transfer to archival storage.
Data on the functioning of applications and online services (device technical parameters, notification tokens, interaction data), as well as event and error logs: for the period of using the corresponding functions and up to 3 (three)days years after the logs were generated for sustainability and security.
Geolocation data when using the corresponding functions: for the duration of providing the functionality and up to 3 (three)days years in terms of technical logs, if this is necessary for security, incident investigation, and dispute resolution.
Support requests, communications, and related materials: for the review period and up to 3 (three)days years after closing the application for protection of rights and interests within the limitation period.
Personalization of offers (interaction history, preferences within the service): for the account validity period and no more than 3 (three)days years from the last activity or until the corresponding settings/consent are revoked, whichever is earlier.
Marketing communications: up to 3 (three)people years from the date of granting consent or until its withdrawal/objection to receiving messages, which is earlier.
Site visit data (cookies, online identifiers, and browser/device technical parameters): up to 18 (eighteen) months, depending on the cookie category, with the ability to manage settings via the browser or the site interface.
Materials on traffic safety violations/incidents and results of internal investigations: at least 3 (three) years for the purpose of protecting the rights and fulfilling the obligations to notify and interact with the authorized body.
Note: if other terms are directly established by law, contract or consent of the PD subject, such terms are applied, and after their expiration, the data is destroyed/depersonalized or transferred for archival storage under the legislation on archival affairs.

10.1. The right to information about processing (Article 14), clarification, blocking or destruction of PD; the right to request termination of processing for direct marketing; the right to withdraw consent.

10.2. The right to appeal the Operator's actions/omissions to Roskomnadzor or to a court, to protect the rights and legitimate interests, and to demand compensation for losses/non-pecuniary damage.

10.3. To exercise rights, the Operator fulfills the requirements of Articles 7, 15, 18-21 of 152 FZ; requests are sent to: promitechmash@gmail.com.

11.1. Access to the PD is restricted and granted to employees/contractors strictly according to their needs and roles.

11.2. The Operator does not disclose/distribute PD without the consent of the subject, unless otherwise provided by law; third parties undertake to observe confidentiality and security.

12.1. A responsible person is appointed (Article 22.1 of 152 FZ) and persons responsible for the security of PD.

12.2. Local acts have been adopted: policies, regulations for the purposes/composition/timing/destruction of PD, procedures for preventing/detecting / eliminating violations.

12.3. Legal, organizational and technical measures are implemented: threat/harm assessment; determination of the level of security in accordance with RF Law No. 1119; application of SPI; access control; registration of actions; media accounting; protection against VPO; protected channels; backup/recovery; physical protection; incident response; training; internal / external checks evaluation of the effectiveness of measures.

12.4. When processing PD without automation tools, the requirements of RF Law No. 687 are met.

13.1. When transferring PD outside the Russian Federation, the recipient's jurisdiction regime is evaluated, contractual guarantees and notification under Article 12 152 of the Federal Law are applied.

13.2. In case of insufficient protection, the transfer is not carried out or is carried out on the basis of a separate informed consent with special reservations (if allowed by law).

14.1. Recording, systematization, accumulation, storage, clarification and extraction of personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation.

14.2. When using cloud services, database instances and critical processing components are located in the Russian Federation and cross-border data flow is controlled.

15.1. The transfer of PD to third parties is allowed if there is a legal basis (Article 6 152 FZ), consent or direct prescription of the law, with the purpose, scope and status of the recipient fixed.

15.2. Orders to handlers are issued in contracts with instructions from the Operator, confidentiality and security requirements, prohibition of sub-instructions without consent, audit and the obligation to notify about incidents.

16.1. The Operator ensures identification, registration, classification of incidents, internal investigation and implementation of corrective and preventive measures in relation to violations of personal data security.

16.2. When establishing the fact of illegal or accidental transfer (provision, distribution, access) of personal data that resulted in a violation of the rights of personal data subjects, the Operator is obliged to notify the authorized body for the protection of the rights of personal data subjects: 1) within twenty — four hours — about the fact of the incident, alleged causes, alleged harm, measures taken and contact person; 2) within seventy-two hours-about the results of the internal investigation and (if any) about the persons whose actions caused the incident.

17.1. Operator: JSC PROMINTEСHMASH

TIN 7801735747
OGRN 1247800081693
address: 199004, St. Petersburg, 7th line V.O., house 62, facility 2, letter A
tel.num.: +7 775 404 29 66
e-mail: info@promintechmash.ru
site: https://promintechmash.ru/en

18.1. The Policy is approved by the Operator, comes into force from the date of publication and is subject to updating when processes or legislation change; the public page indicates the date of the last update.

18.2. The priority of interpretation belongs to the norms of 152 FZ and other mandatory norms; local acts are applied insofar as they do not contradict the legislation.