Personal data processing policy

Last updated: 00.00.0000

1. General Provisions

This Personal Data Processing Policy has been developed in accordance with:
- The Constitution of the Russian Federation;
- Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (hereinafter referred to as FZ-152);
- Federal Law No. 149-FZ of July 27, 2006, "On Information, Information Technologies, and Information Protection";
- The Labor Code of the Russian Federation;
- Government Resolution No. 1119 of November 1, 2012, "On Approval of Requirements for the Protection of Personal Data When Processed in Personal Data Information Systems";
- Government Resolution No. 687 of September 15, 2008, "On Approval of the Regulation on the Specifics of Personal Data Processing Carried Out Without the Use of Automation";
- Other regulatory legal acts of the Russian Federation.
The Policy is a publicly available document defining the fundamental principles, purposes, conditions, and methods of processing personal data, as well as the measures taken by the Operator to protect it.
The Policy is published on the Operator's official website at https://altainiva.com.

2. Basic concepts

The following terms and definitions are used in this Policy:
- Automated processing of personal data — the processing of personal data using computer technology.
- Blocking of personal data — the temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify the personal data).
- Confidentiality of personal data — the mandatory requirement for the Operator or another person who has gained access to personal data to prevent its dissemination and not to disclose it to third parties without the consent of the personal data subject, unless otherwise provided by federal law.
- Anonymization of personal data — actions that make it impossible to determine the ownership of personal data by a specific subject without the use of additional information.
- Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automated tools with personal data, including: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction. - Operator — Altai Niva LLC, a legal entity that independently organizes and/or processes personal data, and determines the purposes of processing, the composition of personal data, and the actions taken with it.
- Personal data — any information directly or indirectly relating to a specific or identifiable individual (the personal data subject).
- Provision of personal data — actions aimed at disclosing personal data to a specific individual or a specific group of individuals.
- Dissemination of personal data — actions aimed at disclosing personal data to an unspecified group of individuals.
- Personal data subject — an individual who has contacted the Operator to obtain information, services, or who has other civil law relationships with the Operator (including representatives of counterparties, clients, and partners).
- Destruction of personal data — actions that make it impossible to restore the contents of personal data in the information system and/or that result in the destruction of their tangible media.
- Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to a government body of a foreign state, an individual or a legal entity.

3. Purpose and legal basis for processing personal data

3.1. Purpose of processing
The purpose of processing, including collecting, recording, systematizing, accumulating, storing, clarifying (updating, modifying), retrieving, using, transferring (including cross-border transfer—distribution, provision, access to third parties), depersonalizing, blocking, deleting, and destroying personal data, is to ensure a full cycle of interaction with customers, partners, and stakeholders during the sale of products both within and outside the Russian Federation, including:
- receiving, processing, and fulfilling product supply requests, as well as fulfilling obligations under concluded supply contracts;
- preparing and submitting commercial proposals, technical, and certification documentation;
- organizing logistics, including delivery coordination, customs clearance, and delivery support;
- informing about new products, product range changes, terms of cooperation, and participation in exhibitions and industry events;
- supporting customers and partners at all stages of cooperation—from initial contact to post-sales support.

3.2. Legal basis for processing
Personal data is processed on the following grounds:
- consent of the subject — when voluntarily completing forms on the website (requesting a commercial proposal, subscribing to a newsletter, registering for an event);
- contract execution — when concluding and executing supply contracts, providing logistics, certification, and customs clearance services;
- requirements of Russian Federation legislation — when transferring data to tax, customs, judicial, and other authorized bodies.

4. Composition and sources of personal data

4.1. Composition of personal data subject to processing:
- Last name, first name, and patronymic (if any);
- Position, name of organization (counterparty);
- Contact information: email, phone number;
- Information required to process the delivery: Taxpayer Identification Number (TIN)/Primary State Registration Number (OGRN), bank details, legal and physical addresses;
- Other information voluntarily provided by the subject during interaction with the Operator.

4.2. Source of personal data
The Operator receives all personal data directly from the subject:
- via electronic forms on the website https://altainiva.com;
- via email, telephone, or in person;
- as part of contract execution.
When collecting data through website forms, the following is provided:
- instructions for completing the form;
- a link to this Policy;
- the ability to refuse to provide the data.

5. Categories of subjects and recipients of personal data

5.1 Categories of subjects
- representatives of purchasing companies;
- representatives of distributors, importers, and logistics companies;
- participants in exhibitions, webinars, and other industry events;
- other interested parties seeking information or services.

5.2. Recipients of personal data
Personal data may be transferred to the following parties to the extent necessary to achieve the processing purposes:
- logistics companies and customs brokers — to organize delivery and customs clearance;
- information system operators (CRM, email services, cloud storage) located in the Russian Federation or in countries that ensure adequate protection of personal data;
- authorized government agencies — in cases expressly provided for by Russian legislation (tax service, customs, Rospotrebnadzor, etc.).
For cross-border transfers of personal data:
- the operator ensures that there is adequate protection of the rights of data subjects in the destination country;
- or obtains written consent from the data subject, which specifies the list of recipients, purposes, terms, and methods of processing.

6. Procedure and conditions for processing personal data

Processing is carried out:
- using automated tools (website, CRM systems, email, cloud services);
- without the use of automated tools (working with paper documents, archives).
The operator does not process special categories of personal data (race, nationality, political views, religious beliefs, etc.) and does not conduct profiling for the purpose of making decisions that generate legal consequences.
Personal data is transferred to third parties only if there is a legal basis (consent, agreement, legal requirement). All recipients are obligated to ensure the confidentiality and security of personal data.

7. Personal data storage periods

Personal data is stored:
- until the processing purposes are achieved, but not longer than the periods established by law;
- in the case of processing with consent, until its revocation (unless otherwise required by law);
- in the case of processing for the performance of a contract, for the entire term of the contract and three years after its termination (in accordance with the statute of limitations under the Civil Code of the Russian Federation);
After the expiration of the storage period, personal data is subject to destruction or anonymization.

8. Ensuring the security of personal data

The Operator takes organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other illegal actions, including:
- using SSL encryption on the website;
- restricting access to personal data on a need-to-know basis;
- training employees in the requirements of Federal Law 152;
- using antivirus protection, backups, and access control;
- conducting internal checks and audits.
The Operator's employees with access to personal data are personally responsible for its security and confidentiality.

9. Rights and obligations of the personal data subject

9.1. Rights of the subject:
- Receive confirmation of processing and information about it (purposes, composition, timeframe, recipients);
- Request clarification, blocking, or destruction of personal data if it is incomplete, inaccurate, illegally obtained, or excessive;
- Revoke consent to processing at any time by sending a request to mail@altainiva.com, indicating the full name and contact information used when initially providing the consent. The Operator will cease processing within 30 calendar days;
- Request notification of all recipients of personal data about corrections made to the data;
- Appeal the actions (inaction) of the Operator to Roskomnadzor or in court.

9.2. Responsibilities of the subject:
- provide accurate and up-to-date personal data;
- notify the Operator of any data changes (if a contractual relationship exists);
- if you refuse to provide mandatory personal data, services will not be provided.

10. Rights and obligations of the Operator

The operator is obliged to:
- Process personal data only for the stated purposes and on lawful grounds;
- Ensure the confidentiality and security of personal data;
- Respond to requests from data subjects within 30 days;
- Maintain records of consents granted (if necessary);
- Suspend processing if consent is revoked or if data is found to be inaccurate.

The operator has the right to:
- amend this Policy in the event of changes in legislation or business processes;
- suspend processing if there is a threat to the security of personal data until the risks are eliminated.

11. Notification to the authorized body

Information about the processing of personal data has been sent to the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor).
Notification registration number: 00-00-000000
Information is available in the operator's personal account on the website: https://pd.rkn.gov.ru.
Note: If changes in the content, purposes, or methods of processing require updating the notification, the Operator will make the appropriate adjustments within the timeframe established by law.

12. Final Provisions

- This Policy shall take effect upon its publication on the Operator's website.
- Changes to this Policy are made by the Operator independently. The current version is posted on the website, indicating the date of the update.
- Continued interaction with the Operator after the new version comes into effect constitutes acceptance of its terms.
- Persons found guilty of violating the requirements of Federal Law 152 shall be liable in accordance with Russian law (including administrative liability under Article 13.11 of the Code of Administrative Offenses of the Russian Federation).

13. Contacts

Altai Niva LLC
TIN: 0000000000

Legal address: 000000, Altai Territory, Barnaul, st. Stroiteley 135, office 3

Phone: +79836007978
Email: mail@altainiva.com