Online Personal Data Processing Policy

1.1 This Online Personal Data Processing Policy has been prepared pursuant to Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and sets out the position of the Interregional Public Organisation “Licensing Executives Society” regarding the processing and protection of personal data and the observance of the rights and freedoms of every personal data subject, in particular the right to privacy and to personal and family confidentiality, in connection with the operation of the website www.les-russia.org, as well
as where personal data subjects contact LES Russia using the email addresses, telephone numbers or feedback forms provided on the Website.

1.2 The Interregional Public Organisation “Licensing Executives Society,” established under the laws of the Russian Federation (Primary State Registration Number (OGRN): 1047746002182; Taxpayer Identification Number (INN): 7713048223) and having its registered office at 25 Bolshaya Spasskaya Street, Building 3, Moscow 129010, is the personal data operator.

1.6 As the Data Operator, LES Russia may process Data only in the circumstances, for the purposes and subject to the other conditions established by the Law.

1.5 Rights of Personal Data Subjects Personal data subjects have the following principal rights:
(a) to obtain information concerning the processing of their Data; (b) to require the clarification, blocking or destruction of their Data where the Data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing;
(c) to challenge the actions or omissions of LES Russia before the competent authorities, including before a court;
(d) to protect their rights and legitimate interests, including by claiming damages and/or compensation for non-pecuniary damage before
a court or through another procedure provided for by applicable law;
(e) to require the processing of Personal Data to cease in the circumstances prescribed by law; and
(f) to exercise any other rights provided for by applicable law.

1.4 Definitions
For the purposes of this Online Personal Data Processing Policy, the following terms, whether capitalised or not, shall have the meanings set out below:
“Updating Personal Data” means actions to clarify, update and amend personal data in order to ensure that such personal data remains relevant to the purposes for which it is processed.
“Blocking Personal Data” means the temporary suspension of personal data processing, except where processing is required to clarify or update personal data.
“Data” means personal data processed by LES Russia under this Policy.
“Law” means Federal Law No. 152-FZ of 27 July 2006 “On Personal Data.”
“Personal Data Information System” or “PDIS” means a set of personal data contained in databases, together with the information technologies and technical means used to process such data.
“LES Russia” means the Interregional Public Organisation “Licensing Executives Society,” acting as the Data Operator.
“Confidentiality of Personal Data” means the obligation imposed on any person who has obtained access to personal data not to disclose such information to third parties without the consent of its holder.
“Processing of Personal Data” means any action (operation), or set of actions (operations), performed on personal data with or without the use of automated means, including collection, recording, organisation, accumulation, storage, clarification (updating or modification), retrieval, use, dissemination, transfer (provision or access), blocking, anonymisation, deletion and destruction of personal data.
“Operator” means a state authority, municipal authority, legal entity or individual that, independently or jointly with other persons, organises and/or carries out the processing of personal data and determines the purposes of personal data processing, the personal data to be processed, and the actions (operations) performed on personal data.
“Personal Data” means any information relating to an identified or identifiable individual (personal data subject), whether directly or indirectly.
“Users” means all personal data subjects whose Data is collected or otherwise processed through the Website.
“Policy” means this Online Personal Data Processing Policy.
“Provision of Personal Data” means actions aimed at disclosing personal data to a particular person or a particular group of persons.
“Roskomnadzor” means the authorised authority responsible for protecting the rights of personal data subjects.
“Website” means the website www.les-russia.org owned by LES Russia.
“Collection of Personal Data” means the deliberate process of obtaining personal data from a personal data subject.
“Personal Data Subject” means an individual to whom personal data relates.
“Cross-Border Transfer of Personal Data” means the transfer of personal data to the territory of a foreign state and to a foreign operator.
“Event Participants” means personal data subjects, including Society Members and other persons, who participate in webinars, seminars, conferences and other events held by LES Russia.
“Destruction of Personal Data” means actions that make it impossible to restore the contents of personal data in a PDIS and/or that result in the destruction of physical media containing personal data.
“Storage of Personal Data” means the process whereby personal data is held by LES Russia in a structured form.
“Society Members” means personal data subjects who are members of LES Russia.

1.3 The personal data processing policy of the Interregional Public Organisation “Licensing Executives Society” is based on the principle that personal data must be processed only in the circumstances and in the manner prescribed by applicable law, lawfully and fairly. Observance and protection of the rights and legitimate interests of personal data subjects are our highest priority.

1.7 Obligations of LES Russia
LES Russia has the following principal obligations:

(a) when collecting Data, to provide the personal data subject, at their request, with the information specified in Part 7, Article 14 of the Law;

(b) where the provision of Data is mandatory under the law, to explain to the personal data subject the legal consequences of refusing to provide their Data;

(c) to take measures necessary and sufficient to ensure compliance with the obligations imposed by the Law and the regulations adopted pursuant thereto;

(d) to publish this Policy and information on the personal data protection requirements implemented by LES Russia on those pages of the Website through which personal data is collected, and to ensure access to this document;

(e) when processing personal data, to take or ensure the taking of the necessary legal, organisational and technical measures to protect Data against unlawful or accidental access, destruction, alteration, blocking, copying, provision and dissemination, as well as against other unlawful actions involving Data;

(f) to notify Roskomnadzor, in accordance with the Law and the internal regulations of LES Russia, if an unlawful or accidental transfer of personal data—including its provision, dissemination or unauthorised access—has resulted in a violation of the rights of personal data subjects;

(g) to respond to requests from personal data subjects and Roskomnadzor and provide information relating to Data processing in the manner prescribed by the Law;

(h) to remedy violations of law committed in the course of Data processing and to clarify, block and destroy Data, or ensure that these actions are performed by a person processing Data on behalf of LES Russia;

(i) before commencing personal data processing, to notify Roskomnadzor of its intention to process personal data, except
in the circumstances prescribed by law;

(j) to appoint a person responsible for organising the processing of personal data; and

(k) to perform any other obligations relating to Data processing prescribed by law.

5.1 LES Russia processes Data both with the use of automated means, including computers, and without the use of automated means, including on paper. LES Russia may perform the following actions (operations), and/or any combination thereof, in relation to Data: collection; recording; organisation; accumulation; storage; clarification (updating or modification); retrieval; use; transfer (provision or access); blocking; anonymisation; deletion; and destruction.

5.Procedure and Conditions for Data Processing

5.2 LES Russia proceeds on the basis that:
(a) all Data belongs personally to the personal data subject or to the person identified in the relevant enquiry or web form;
(b) every personal data subject visiting the Website has full legal capacity and has reached the age of majority; and
(c) the personal data subject provides accurate and up-to-date Data.

5.6 Pursuant to Part 2, Article 18.1 of the Law, LES Russia publishes this Policy and information on the Data protection requirements it has implemented, as set out in the Appendix to this Policy, on the Website and ensures permanent, unrestricted and free access thereto for all personal data subjects.

5.5LES Russia treats Data as strictly confidential information. LES Russia and any other persons who have obtained access to Data shall not disclose Data to third parties or disseminate it without the consent of the relevant personal data subject, unless otherwise provided by federal law.

5.4 LES Russia transfers Data to courts, law-enforcement and supervisory authorities, other competent public authorities and officials where grounds for such transfer exist under applicable law.

5.3 Data is processed until the purpose of processing has been achieved or until the personal data subject withdraws consent to the processing of their Data, provided that there are no other legal grounds for continuing to process the Data.

5.7 LES Russia takes or ensures the taking of the necessary legal, organisational and technical measures to protect Data against unlawful or accidental access, destruction, alteration, blocking, copying, provision and dissemination, as well as against other unlawful actions involving Data. Data security is achieved, in particular, by:

(a) identifying threats to Data security during its processing in personal data information systems;

(b) applying the organisational and technical measures necessary to meet Data protection requirements when Data is processed in personal data information systems, thereby ensuring the levels of personal data security established by the Government of the Russian Federation;

(c) using information-security tools that have undergone the prescribed conformity assessment procedure;

(d) using information-security tools incorporating a data-destruction function and having undergone the prescribed conformity assessment procedure for the destruction of Data;

(e) assessing the effectiveness of Data security measures before a personal data information system is commissioned;

(f) maintaining records of machine-readable Data media;

(g) detecting unauthorised access to Data and taking appropriate measures, including measures to detect, prevent and remedy the consequences of cyberattacks against PDISs and to respond to computer incidents occurring therein;

(h) restoring Data that has been altered or destroyed as a result of unauthorised access;

(i) establishing access rules for Data processed in a personal data information system and ensuring the registration and recording of all actions performed on Data within that system; and

(j) monitoring the measures taken to ensure Data security and the security level of personal data information systems.

5.8 Data processing may cease when the purposes of processing have been achieved, consent has expired or has been withdrawn by the personal data subject, where applicable, or unlawful Data processing has been identified.

5.9 Data shall be stored in a form that permits identification of the personal data subject for no longer than is necessary for the purposes of processing, unless a different storage period is prescribed by federal law or by an agreement to which the personal data subject is a party, beneficiary or guarantor.

5.10 When Data is collected, the recording, organisation, accumulation, storage, clarification (updating or modification) and retrieval of personal data of citizens of the Russian Federation using databases located outside the Russian Federation are not permitted.

5.11 For the purpose of applying for membership of LES Russia, a User provides their Data by completing the “Application
for Membership” form. If LES Russia decides to admit the User as a member of LES Russia, LES Russia will thereafter treat that person as a Society Member and process their Data through the Website in accordance with this Policy and outside the Website
in accordance with the Society’s internal regulations. If LES Russia decides not to admit the User as a member, LES Russia will notify the User and subsequently destroy their Data in the manner prescribed by the laws of the Russian Federation.

5.12 For the purpose of handling Users’ enquiries, LES Russia collects Data through feedback forms, during telephone communications using the numbers specified on the Website, and upon receipt of emails sent by Users to the email addresses specified on the Website. In such cases, LES Russia processes the Data and maintains its confidentiality in accordance with this Policy. LES Russia considers the purpose of Data processing to have been achieved if, following the most recent communication with the User on a particular matter by any of the means listed above, no further messages and/or calls are received from the User for 90 days. “Most recent communication” means the most recent message or call received from the User.

5.13 Data relating to Society Members who participate in the governing bodies of LES Russia, serve on the Audit Commission, act as international representatives of LES Russia, serve as contact persons on various matters, or have prepared academic or business publications is made publicly available on the Website, provided that such Society Members have consented to the processing of personal data authorised by the personal data subject for dissemination in accordance with Article 10.1 of the Law.

5.14 For events held in person or online, LES Russia registers Event Participants through the completion of the relevant web forms on the Website. At the discretion of LES Russia, registration may also be completed by contacting LES Russia using the telephone numbers or email addresses specified on the Website. LES Russia may also receive information about Event Participants from other event organisers, provided that the Event Participants have consented thereto or that other lawful grounds exist for obtaining and subsequently processing their Data.

5.15 Data relating to Event Participants, including Society Members and other persons such as invited speakers and guests, is made publicly available on the Website. In particular, their Data may be published in event announcements, news items, reports on past events, post-event publications and similar materials. Event Participant Data is published provided that the relevant Event Participants have consented to the processing of personal data authorised by the personal data subject for dissemination in accordance with Article 10.1 of the Law. Where photographs of Event Participants are published, LES Russia obtains consent to the use of the individual’s image in accordance with Article 152.1 of the Civil Code of the Russian Federation.

5.16 In their consent to the processing of personal data authorised by the personal data subject for dissemination, Society Members and Event Participants may prohibit LES Russia from transferring Data, other than by providing access, to an unlimited number of persons, and may also prohibit or impose conditions on the processing, other than obtaining access, of Data by an unlimited number of persons. LES Russia may not refuse to recognise the prohibitions and conditions provided for in Article 10.1 of the Law.

5.17 In their consent to the processing of personal data authorised by the personal data subject for dissemination, Society Members and Event Participants may prohibit LES Russia from transferring Data, other than by providing access, to an unlimited number of persons, and may also prohibit or impose conditions on the processing, other than obtaining access, of Data by an unlimited number of persons. LES Russia may not refuse to recognise the prohibitions and conditions provided for in Article 10.1 of the Law.

5.18 Pursuant to the preceding clause, LES Russia states that, as at the date of adoption of this Policy, all Society Members and Event Participants whose Data is published on the Website:

• have not prohibited LES Russia from transferring their Data to an unlimited number of persons;
• have not prohibited the processing of their Data by an unlimited number of persons;
• have not imposed conditions on the processing of their Data by an unlimited number of persons; and
• have not imposed conditions requiring the Data obtained to be transferred by LES Russia solely through its internal network, accessible only to specifically authorised employees, or through information and telecommunications networks, or not to be transferred at all.

7.1Where it is confirmed that Data is inaccurate or is being processed unlawfully, LES Russia shall update the Data or cease processing it, as appropriate.

7.Updating, Correcting, Deleting and Destroying Data; Responding to Data Subjects’ Access Requests

7.2 When the purposes of Data processing have been achieved, or where a personal data subject withdraws consent to processing, the Data shall be destroyed unless:
(a) otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
(b) LES Russia is entitled to process the Data without the personal data subject’s consent on the grounds provided for by the Law or other federal laws; or
(c) otherwise provided by another agreement between LES Russia and the personal data subject.

7.3 At the request of a personal data subject or their representative, LES Russia shall provide information concerning its processing of that subject’s personal data.

8. Procedure for Responding to Requests and Enquiries from Personal Data Subjects, Their Representatives and Competent Authorities Concerning Inaccurate Personal Data, Unlawful Processing, Withdrawal of Consent and Access to Personal Data

8.1 Personal data subjects are entitled to obtain information concerning the processing of their Data, including:
(a) confirmation that LES Russia processes their Data;
(b) the legal grounds and purposes of Data processing;
(c) the purposes and methods of Data processing applied by LES Russia;
(d) the name and address of LES Russia, and information about persons, other than LES Russia employees, who have access to the Data or to whom the Data may be disclosed under an agreement with LES Russia or pursuant to federal law;
(e) the Data being processed in relation to the relevant personal data subject and the source from which it was obtained, unless another procedure for providing such Data is prescribed by federal law;
(f) the Data processing periods, including storage periods;
(g) the procedure by which the personal data subject may exercise the rights provided for by Russian personal data legislation;
(h) information about any completed or proposed cross-border transfer of Data;
(i) the name of the organisation, or the surname, first name, patronymic and address of the person, processing Data on behalf of LES Russia, where such processing has been or will be entrusted to that organisation or person;
(j) information about the manner in which LES Russia fulfils the obligations imposed by Article 18.1 of the Law; and
(k) other information provided for by the personal data legislation of the Russian Federation.
To obtain this information, personal data subjects may contact LES Russia using the contact details specified in Clause 8.14 below.

8.2 Personal data subjects may require LES Russia to clarify, block or destroy their Data where the Data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and may take any other measures provided by law to protect their rights.

8.3 The information specified above must be provided by LES Russia to the personal data subject in an accessible form and must not contain Data relating to other personal data subjects, unless lawful grounds exist for disclosing such Data.

8.4 The information specified in this section shall be communicated to the personal data subject or their representative, and they shall be given an opportunity to review the relevant Data, upon contacting LES Russia or within 10 business days after LES Russia receives a request from the personal data subject or their representative. This period may be extended by no more than five business days if LES Russia sends the personal data subject a reasoned notice stating the grounds for the extension.
The request must contain:
(a) the number of the principal identity document of the personal data subject or their representative, its date of issue and the issuing authority; and
(b) information confirming the personal data subject’s legal relationship with LES Russia, or other information confirming that LES Russia processes the relevant personal data, together with the signature of the personal data subject or their representative.
A request may be submitted as an electronic document signed with an electronic signature in accordance with the laws of the Russian Federation.

8.5 If the information specified in this section and the Data being processed were provided to a personal data subject for review at their request, the personal data subject may contact LES Russia again or submit a repeat request to obtain that information and review the Data no earlier than 30 days after the initial contact or request, unless a shorter period is established by federal law, a regulation adopted pursuant thereto, or an agreement to which the personal data subject is a party, beneficiary or guarantor.

8.6 A personal data subject may contact LES Russia again or submit a repeat request before the expiry of the period specified in the preceding clause if the information and/or Data was not provided in full following the initial request. The repeat request must state the reasons for submitting it.

8.7 LES Russia may refuse to comply with a repeat request that does not meet the statutory requirements. Any such refusal must state the reasons on which it is based.

8.8 A personal data subject’s right of access to their Data may be restricted in accordance with federal law, including where granting access would infringe the rights and legitimate interests of third parties.

8.9 At the request of Roskomnadzor, LES Russia shall provide the necessary information within the time limits prescribed by the laws of the Russian Federation.

8.10 All incoming enquiries and requests shall be registered as incoming correspondence and recorded in the relevant LES Russia registers.

8.11 Enquiries and requests shall be considered by the person responsible for organising the processing of personal data. If questions arise or clarification of the request is required, that person shall contact the sender using the contact details provided in the enquiry or request.

8.12 A response shall be provided in the same form in which the relevant enquiry or request was received, for example by email or in writing, unless otherwise expressly prescribed by the laws of the Russian Federation or requested by the sender.

8.13 A response to an enquiry from a personal data subject may be signed by the person responsible for organising the processing of personal data or by the President of LES Russia. A response to a request from Roskomnadzor shall be signed by the President of LES Russia or by a person acting on the President’s instructions under a power of attorney issued on behalf of LES Russia. Responses to enquiries and requests shall be entered in the relevant LES Russia registers.

8.14 Requests and enquiries may be submitted in free form to:
Interregional Public Organisation “Licensing Executives Society”
Email: les@gorodissky.com
Postal address: 25 Bolshaya Spasskaya Street, Building 3, Moscow 129010, Russian Federation

Appendix: Information on the Personal Data Protection Requirements Implemented

Where necessary and taking into account the threats relevant to the PDISs used by LES Russia to process Data, LES Russia implements the Data protection requirements listed below, corresponding to Personal Data Security Level 3, and/or ensures their implementation by persons engaged by LES Russia to process Data:

1. establishing a security regime for the premises in which the PDIS is located, preventing uncontrolled entry into or presence in those premises by persons who do not have authorised access;
2. ensuring the safekeeping of personal data media;
3. approval by the head of the Operator of a document specifying the persons whose access to personal data processed in the PDIS is necessary for the performance of their official or employment duties;
4. using information-security tools that have undergone a conformity assessment against the requirements of Russian information-security legislation, where such tools are necessary to neutralise current threats; and
5. appointing an officer or employee responsible for ensuring the security of personal data within the PDIS.

Sections

Interregional Public Organization “Licensing Society” — the Russian national member society of LES International.

Contact Information

25 Bolshaya Spasskaya Street, Building 3, Moscow, 129090, Russia

Telephone:

Fax:

Email:

Address:

© Regional Public Organization “Licensing Society” (LES Russia), 2026