POLICY
OF LLC “SHAPENKO AND PARTNERS” LAW FIRM
ON THE PROCESSING OF PERSONAL DATA

Revision No. 2 of 29 July 2026

1. General provisions

1.1. This Policy on the Processing of Personal Data (hereinafter, the PD Processing Policy) has been developed and is applied by Limited Liability Company “Shapenko and Partners” Law Firm (hereinafter, the Operator) in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter, the Personal Data Law) in relation to the processing of personal data of the Operator’s clients.

1.2. The PD Processing Policy defines the procedure and conditions for the collection, processing and storage by the Operator of clients’ personal data, including the purposes of collecting personal data, the categories and list of personal data processed, the categories of personal data subjects, the rights and obligations of the Operator and of personal data subjects, the methods of processing personal data, the periods of processing and storage, and the procedure for destroying personal data, in order to identify and prevent violations of the legislation of the Russian Federation related to the processing and protection of personal data.

1.3. The principal terms used in the Policy are:

1. 1) personal data (hereinafter, PD) – any information relating directly or indirectly to an identified or identifiable natural person;
2. 2) PD subject – a natural person who has transferred his or her PD to the Operator, with or without the use of automation tools, for processing;
3. 3) processing of PD – any action (operation) or set of actions (operations) performed on PD, with or without the use of automation tools. The processing of PD includes, among other things:

• – collection;
• – recording;
• – systematization;
• – accumulation;
• – storage;
• – clarification (updating, modification);
• – extraction;
• – use;
• – transfer (dissemination, provision, access);
• – depersonalization;
• – blocking;
• – deletion;
• – destruction;

1. 4) PD information system – a set of PD contained in databases and of the information technologies and technical means that ensure their processing;

1.4. The PD Processing Policy applies to all information transferred by natural persons to the Operator, with or without the use of automation tools, for the processing of personal data.

1.5. The PD Processing Policy applies to relations in the field of PD processing that arose for the Operator both before and after the approval of this PD Processing Policy.

1.6. This PD Processing Policy enters into force upon its approval by the General Director of the Operator and remains in effect until a new revision of the PD Processing Policy is introduced.

1.7. Amendments to the PD Processing Policy are made by order of the General Director of the Operator. Amendments enter into force upon the signing of the relevant order.

1.8. In compliance with the requirements of the Personal Data Law, this PD Processing Policy is published for free access on the information and telecommunications network “Internet” on the Operator’s website.

1.9. The security of PD processed in the Operator’s information systems is ensured by preventing unauthorized, including accidental, access to PD.

1.10. Compliance with the requirements of this Policy is monitored by an authorized person responsible for organizing the processing of PD at the Operator and appointed by order of the General Director of the Operator.

1.11. The Operator does not process special categories of PD concerning racial or ethnic origin, political views, religious or philosophical beliefs, health or the intimate life of Users, except in cases provided for by the legislation of the Russian Federation.

1.12. The Operator does not transfer PD to the territory of a foreign state, to an authority of a foreign state, or to a foreign natural or legal person, that is, it does not carry out the cross-border transfer of PD.

1.13. All matters relating to the processing and protection of PD that are not regulated by this Policy are resolved in accordance with the current legislation of the Russian Federation in the field of PD.

2. Purposes of collecting personal data

2.1 The processing of PD is limited to the achievement of specific, predetermined and lawful purposes. The processing of PD that is incompatible with the purposes of collecting PD is not permitted.

2.2 The Operator processes PD for the following purposes:

2.3 The purposes of processing PD may also arise from an analysis of the legal acts governing the Operator’s activities, the purposes of the activities actually carried out by the Operator, the activities provided for in the Operator’s constituent documents, and the Operator’s specific business processes in specific PD information systems.

3. Legal grounds for the processing of personal data

3.1. The legal ground for the processing of PD is the body of regulatory legal acts provided for by the legislation of the Russian Federation in the field of PD, and the Operator’s local documents, in pursuance of which and in accordance with which the Operator processes PD.

3.2. The Operator processes personal data in compliance with the principles and rules provided for by:

1. 1) the Constitution of the Russian Federation;
2. 2) the Personal Data Law;
3. 3) Federal Law No. 14-FZ of 8 February 1998 “On Limited Liability Companies”;
4. 4) other current regulatory legal acts of the Russian Federation governing relations connected with the Operator’s activities.

3.3. The legal grounds for the processing of PD also include:

1. 1) the Operator’s Charter;
2. 2) contracts concluded between the Operator and PD subjects;
3. 3) the consent of PD subjects to the processing of their PD;
4. 4) other local documents of the Operator that contain PD.

4. Scope and categories of personal data processed,
categories of personal data subjects

4.1. The content and scope of the PD processed must correspond to the stated purposes of processing provided for in clause 2.2 of this PD Processing Policy. The PD processed must not be excessive in relation to the stated purposes of their processing.

4.2. The Operator processes the PD of the following categories of PD subjects:

1. 1) applicants for vacancies at the Operator;
2. 2) the Operator’s counterparties, including their representatives;
3. 3) the Operator’s clients, including their representatives;
4. 4) the Operator’s employees;

4.3. The processing of the PD of the Operator’s employees is governed by a local act of the Operator, the Regulation of Limited Liability Company “Shapenko and Partners” Law Firm on the Processing and Protection of Employees’ PD.

4.4. The Operator does not process special categories of PD concerning racial or ethnic origin, political views, religious or philosophical beliefs, health or intimate life, except in cases provided for by the legislation of the Russian Federation.

5. Principal rights and obligations.
Procedure by which the Operator ensures the rights of a personal data subject

5.1. Principal rights and obligations of the Operator.

5.1.1. The Operator has the right:

1. 1) to determine independently the composition and list of measures necessary and sufficient to ensure the performance of the duties provided for by the Personal Data Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
2. 2) to entrust the processing of PD to another person with the consent of the PD subject, unless otherwise provided by a federal law, on the basis of a contract concluded with that person. A person processing PD on the Operator’s instructions must comply with the principles and rules of PD processing provided for by the Personal Data Law, maintain the confidentiality of PD, and take the necessary measures aimed at ensuring the performance of the duties provided for by the Personal Data Law;
3. 3) if a PD subject withdraws consent to the processing of PD, the Operator may continue to process the PD without the PD subject’s consent where the grounds specified in the Personal Data Law exist.

5.1.2. The Operator must:

1. 1) organize the processing of PD in accordance with the requirements of the Personal Data Law;
2. 2) respond to applications and requests of PD subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
3. 3) explain to the PD subject the procedure for making a decision based solely on the automated processing of his or her PD and the possible legal consequences of such a decision, provide an opportunity to object to such a decision, and explain the procedure for the PD subject to protect his or her rights and lawful interests within 30 (thirty) calendar days from the date of receipt of the relevant objection, in accordance with part 3 of Article 16 of the Personal Data Law;
4. 4) provide the PD subject or his or her representative, free of charge, with an opportunity to review the PD relating to that PD subject, at the Operator’s location during business hours;
5. 5) cease, at the request of the PD subject, the processing of his or her PD;
6. 6) notify the PD subject or his or her representative of the changes made and the measures taken within 30 (thirty) calendar days from the correction or destruction of PD at the request of the PD subject or his or her representative, and take reasonable measures to notify third parties to whom that subject’s PD were transferred;
7. 7) provide the authority responsible for the protection of the rights of PD subjects, at that authority’s request, with the necessary information within 10 (ten) business days from the date of receipt of such a request. This period may be extended, but by no more than 5 (five) business days;
8. 8) in the manner determined by the federal executive authority authorized in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing it of computer incidents that have resulted in the unlawful transfer (provision, dissemination or access) of PD.

5.2. PD subjects or their representatives have the rights provided for by the Personal Data Law and other regulatory legal acts governing the processing of PD.

5.2.1. A PD subject has the right:

1. 1) to give consent to the processing of his or her PD;
2. 2) to receive information concerning the processing of his or her PD, except in cases provided for by federal laws. The information is provided to the PD subject by the Operator in an accessible form and must not contain PD relating to other PD subjects, except where there are lawful grounds for disclosing such PD. The list of information and the procedure for obtaining it are established by the Personal Data Law;
3. 3) to require the Operator to clarify his or her PD, or to block or destroy them, if the PD are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing, and to take the measures provided for by law to protect his or her rights;
4. 4) to appeal to the authority responsible for the protection of the rights of PD subjects or to a court against unlawful actions or omissions of the Operator in the processing of his or her PD.

5.3. A representative’s authority to represent the interests of each PD subject is confirmed by a power of attorney executed in accordance with Articles 185 and 185.1 of the Civil Code of the Russian Federation or part 2 of Article 53 of the Civil Procedure Code of the Russian Federation, or certified by a notary in accordance with Article 59 of the Fundamentals of Legislation of the Russian Federation on Notaries. A copy of the representative’s power of attorney, made from the original, is kept by the Operator for at least 3 (three) years, and if the PD retention period exceeds 3 (three) years, for at least the PD retention period.

5.4. A PD subject’s right of access to his or her PD may be restricted in accordance with federal laws.

5.5. The processing of PD for the purpose of promoting the Operator’s services on the market by means of direct contact with a potential consumer using means of communication is permitted only with the prior consent of the PD subject.

5.6. Where information is documented as an audio recording on a digital voice recorder or an audio cassette by a natural person on his or her own initiative, covertly, and also for the purpose of artificially creating evidence, such evidence is deemed inadmissible and without legal force on the basis of part 2 of Article 50 of the Constitution of the Russian Federation.

5.7. A simple written form is sufficient for written consent to the processing of PD. Such processing of PD is deemed to be carried out without the prior consent of the PD subject if the Operator does not prove that such consent was obtained.

6. Procedure and conditions for the processing of personal data

6.1. PD are processed by the Operator with the consent of the PD subjects to the processing, and also without such consent in the cases provided for by the legislation of the Russian Federation.

6.2. The Operator processes PD for each purpose of processing by the following methods:

1. 1) non-automated processing of PD;
2. 2) automated processing of PD with or without the transfer of the information obtained via information and telecommunications networks;
3. 3) mixed processing of PD.

6.3. Employees of the Operator whose official duties include the processing of PD are admitted to the processing of PD.

6.4. PD are processed for each purpose of processing by:

1. 1) obtaining PD orally and in writing directly from the PD subject;
2. 2) entering PD into the Operator’s information systems;
3. 3) using other methods of processing PD.

6.5. PD may not be disclosed to third parties or disseminated without the consent of the PD subject, unless otherwise provided by a federal law. Consent to the processing of PD that the PD subject has permitted to be disseminated or transferred to third parties is executed together with the PD subject’s other consents to the processing of his or her PD.

6.6. PD are transferred to bodies of inquiry and investigation, to the Federal Tax Service and to other authorized executive authorities and organizations in accordance with the requirements of the legislation of the Russian Federation.

6.7. The Operator takes the necessary legal, organizational and technical measures to protect PD from unlawful or accidental access, destruction, modification, blocking, dissemination and other unauthorized actions.

6.8. The Operator ensures the confidentiality regime and the storage of PD in accordance with the Operator’s Confidentiality Policy and other local regulatory acts.

6.9. The Operator stores PD in a form that makes it possible to identify the PD subject for no longer than is required by each purpose of their processing. The retention period for PD processed in PD information systems corresponds to the retention period for PD on paper media, and vice versa.

6.10. If a PD subject requests the Operator, by available means of communication, to cease the processing of PD (withdrawal of consent), the Operator ceases their processing and destroys them within a period not exceeding 30 (thirty) calendar days from the date of receipt of the said withdrawal. If a User withdraws consent to the processing of PD, the Operator may continue to process the PD without the User’s consent only where the grounds specified in the Personal Data Law exist.

6.11. When collecting PD, including via the information and telecommunications network “Internet”, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification) and extraction of the PD of citizens of the Russian Federation using databases located in the territory of the Russian Federation.

6.12. The Operator processes PD under the following conditions:

1. 1) the PD subject has consented to the processing of his or her PD;
2. 2) performance of a contract to which the PD subject is a beneficiary or a guarantor, and also for the conclusion of a contract on the initiative of the PD subject;
3. 3) the PD subject’s participation in constitutional, civil, administrative or criminal proceedings, or in proceedings in commercial courts;
4. 4) enforcement of a judicial act, or of an act of another body or official, that is subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings;
5. 5) exercise of the rights and lawful interests of the Operator or of third parties, including in the cases provided for by Federal Law No. 230-FZ of 3 July 2016 “On the Protection of the Rights and Lawful Interests of Individuals Engaged in Activities to Recover Overdue Debts and on Amendments to the Federal Law ‘On Microfinance Activities and Microfinance Organizations’”, or achievement of socially significant purposes, provided that the rights and freedoms of the PD subject are not thereby violated;

6.13. The Operator may, on the basis of a contract, entrust the processing of PD to a third party. An essential term of such a contract is that this person has the right to process PD, is obliged to comply with the principles and rules of PD processing provided for by the Personal Data Law, to maintain the confidentiality of PD, and to take the necessary measures aimed at ensuring the performance of the duties provided for by the Personal Data Law.

7. Interaction with other operators
in the processing of personal data using an electronic interaction system

7.1. On the basis of bilateral and multilateral agreements, the Operator processes PD within the framework of electronic information interaction using an electronic interaction system.

7.2. Termination of an agreement with another operator is a ground for the Operator to destroy the PD processed under that agreement.

8. Updating, correction, deletion and destruction
of personal data, and responses to data subjects’ requests for access
to personal data

8.1. Confirmation of the fact of PD processing by the Operator, the legal grounds and purposes of PD processing, and the other information specified in part 7 of Article 14 of the Personal Data Law are provided by the Operator to the PD subject or his or her representative within 10 (ten) business days from the date of the application or of receipt of the request of the PD subject or his or her representative. This period may be extended, but by no more than 5 (five) business days, with a reasoned notice sent to the PD subject stating the reasons for extending the period for providing the requested information.

8.2. A PD subject’s request for access to personal data must contain:

1. 1) the number of the principal identity document of the PD subject or his or her representative, information on the date of issue of that document and the authority that issued it;
2. 2) information confirming the PD subject’s participation in relations with the Operator (contract number, date of conclusion of the contract and/or other information), or information otherwise confirming the fact of PD processing by the Operator;
3. 3) the signature of the PD subject or his or her representative.

8.3. The Operator provides the information specified in part 7 of Article 14 of the Personal Data Law to the PD subject or his or her representative in the form in which the relevant application or request was sent, unless otherwise stated in the application or request. If the PD subject’s application (request) does not reflect all the necessary information in accordance with the requirements of the Personal Data Law, or the subject does not have the right of access to the requested information, a reasoned refusal is sent to him or her.

8.4. A PD subject’s right of access to his or her PD may be restricted in accordance with part 8 of Article 14 of the Personal Data Law, including where the PD subject’s access to his or her PD violates the rights and lawful interests of third parties.

8.5. If inaccurate PD are discovered upon an application by the PD subject or his or her representative, or upon their request or a request of the authority responsible for the protection of the rights of PD subjects, the Operator blocks the PD relating to that PD subject from the moment of such application or receipt of the said request for the period of verification, if blocking the PD does not violate the rights and lawful interests of the PD subject or of third parties.

8.6. If the inaccuracy of PD is confirmed, the Operator, on the basis of information submitted by the PD subject or his or her representative or by the authority responsible for the protection of the rights of PD subjects, or of other necessary documents, clarifies the PD within 7 (seven) business days from the date such information is submitted and lifts the blocking of the PD.

8.7. If unlawful processing of PD is discovered upon an application (request) of the PD subject or his or her representative or of the authority responsible for the protection of the rights of PD subjects, the Operator blocks the unlawfully processed PD relating to that PD subject from the moment the request is received, within 3 (three) business days.

8.8. If the Operator, the authority responsible for the protection of the rights of PD subjects, or another interested person discovers an unlawful or accidental transfer (provision or dissemination) of PD (access to PD) that has resulted in a violation of the rights of PD subjects, the Operator:

1. 1) within 24 (twenty-four) hours, notifies the authority responsible for the protection of the rights of PD subjects of the incident, the presumed causes that led to the violation of the rights of PD subjects, the presumed harm caused to the rights of PD subjects, and the measures taken to eliminate the consequences of the incident, and also provides information on the person authorized by the Operator to interact with the authority responsible for the protection of the rights of PD subjects on matters related to the incident;
2. 2) within 72 (seventy-two) hours, notifies the authority responsible for the protection of the rights of PD subjects of the results of the internal investigation of the identified incident and provides information on the persons whose actions caused it (if available).

8.9. Periods within which the Operator destroys PD:

1. 1) the purpose of processing PD is achieved, or the need to achieve that purpose ceases, within 30 (thirty) calendar days;
2. 2) the maximum retention periods for documents containing PD are reached, within 30 (thirty) calendar days;
3. 3) the PD subject or his or her representative provides confirmation that the PD were obtained unlawfully or are not necessary for the stated purpose of processing, within 7 (seven) business days;
4. 4) the PD subject withdraws consent to the processing of his or her PD, if their retention is no longer required for the purpose of their processing, within 30 (thirty) calendar days.

8.10. When the purpose of processing PD is achieved, and also if the PD subject withdraws consent to their processing, the PD are subject to destruction if:

1. 1) otherwise is not provided for by a contract to which the PD subject is a beneficiary or a guarantor;
2. 2) the Operator is not entitled to process the PD without the PD subject’s consent on the grounds provided for by the Personal Data Law or other federal laws;
3. 3) otherwise is not provided for by another agreement between the Operator and the PD subject.

8.11. The methods of destroying PD are established in the Operator’s local regulatory acts.