Personal Data Processing Policy

This version is effective as of 17 September 2026

1. General Provisions

This Personal Data Processing Policy (the "Policy") has been prepared in accordance with the requirements of Federal Law No. 152-FZ "On Personal Data" dated 27 July 2006 and defines the procedure for processing personal data and the measures taken to ensure its security by CIS — the Intellectual Property and Crisis Management Center (the "Operator") in connection with the use of the ao-cis.ru website (the "Site").

The Operator regards respect for human and civil rights and freedoms in the processing of personal data, including the protection of privacy and personal and family secrets, as the most important goal and condition of its activities.

This Policy applies to all information the Operator may obtain about visitors to the Site, users of the inquiry form, and persons who have submitted a consultation request through the Site's built-in services.

2. Terms and Definitions

• Personal data — any information relating directly or indirectly to an identified or identifiable individual (the data subject).
• Processing of personal data — any action (operation) or set of actions (operations) performed on personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion and destruction of personal data.
• Operator — CIS, which organizes and/or carries out the processing of personal data, alone or jointly with others, and determines the purposes of processing, the composition of personal data, and the actions performed with it.
• User — any individual who has visited the Site and/or uses its services, including the inquiry form and the chat consultant.
• Cookies — small pieces of data sent by the server and stored on the user's device, which the web client sends back to the web server when attempting to open a page of the relevant site.

3. Legal Grounds for Processing Personal Data

The legal grounds for the Operator's processing of personal data are: Federal Law No. 152-FZ "On Personal Data"; the consent of the data subject to the processing of their personal data, given when filling in forms on the Site; the Operator's constituent documents; and agreements concluded between the Operator and the data subject.

4. Purposes of Processing Personal Data

The Operator processes Users' personal data for the following purposes:

• communicating with a person who has submitted an inquiry via the form on the Site or via the built-in chat consultant, including responding to the request, asking clarifying questions, and offering the Operator's services;
• identifying the party in connection with the provision of the Operator's consulting, legal and other services;
• providing the User with access to services, information and materials posted on the Site;
• improving the quality and usability of the Site and developing new services;
• carrying out statistical and other research based on anonymized data;
• complying with the requirements of the legislation of the Russian Federation.

5. Categories of Data Subjects and Personal Data Processed

The Operator processes the personal data of Site visitors, as well as of persons who have submitted a request via the "Describe your situation" form or via the chat consultant. Depending on the method of contact, the following data may be processed:

• last name, first name;
• company name (if provided);
• telephone number and/or email address;
• the content of the inquiry (description of the situation, question or task);
• technical data, cookies.

The Operator does not process special categories of personal data (concerning racial or ethnic origin, political opinions, health status, etc.), unless such data has been voluntarily provided by the subject on their own initiative in the free-text portion of an inquiry — in which case the Operator recommends not disclosing such information unless necessary.

6. Procedure for Collecting, Storing, Transferring and Otherwise Processing Personal Data

The security of personal data processed by the Operator is ensured through legal, organizational and technical measures necessary to fully comply with the requirements of applicable personal-data-protection legislation.

The Operator ensures the safekeeping of personal data and takes all possible measures to prevent access to personal data by unauthorized persons.

The User's personal data is processed for an indefinite period, by any lawful means, including within personal data information systems, with or without the use of automation tools.

Personal data is not transferred to third parties, except in cases expressly provided for by the legislation of the Russian Federation, or where the transfer is necessary to provide services to the User with their consent (for example, to contractor partners engaged to carry out a specific assignment).

When the inquiry form on the Site is used, data is transmitted to the Operator's server over a secure communication channel. To process the request, the Operator also records service-related technical information (IP address, referring source, device type), used solely for handling the inquiry and for statistical purposes.

7. Rights of the Data Subject

The data subject has the right to:

• receive information relating to the processing of their personal data, except as provided by federal law;
• require the Operator to clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
• withdraw their consent to the processing of personal data by sending appropriate notice to the Operator using the contact details given in Section 9 of this Policy;
• appeal against actions or omissions of the Operator to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.

8. Measures to Ensure the Security of Personal Data

The Operator takes the necessary organizational and technical measures to protect the User's personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful acts by third parties, including:

• appointing persons responsible for organizing the processing of personal data;
• limiting the number of persons with access to personal data;
• using information-security tools that have passed a conformity assessment procedure;
• regularly monitoring the security measures taken in respect of personal data.

9. Final Provisions and Contacts

The User may obtain any clarification on questions relating to the processing of their personal data by contacting the Operator using the details below.

The Operator may amend this Policy. Whenever amendments are made, the current version will indicate the date it was last updated. A new version of the Policy takes effect from the moment it is posted on the Site, unless otherwise provided by the new version of the Policy.