PRIVACY AND PERSONAL DATA PROCESSING POLICY

This Privacy and Personal Data Processing Policy (hereinafter referred to as the “Policy”) governs the relationship between Alfa Cargo Airlines Limited Liability Company, Primary State Registration Number (OGRN) 1195081052572, Taxpayer Identification Number (INN) 5047228708 (hereinafter referred to as the “Operator” or the “Company”), and you (hereinafter also referred to as the “User”), as a visitor to the website available on the Internet at https://alfa-aviation.ru/(hereinafter referred to as the “Website”).

This Policy applies to any data that the Operator may receive from the User or about the User in connection with the use of the Website, including personal data and other information that the User provides to the Operator by completing feedback forms on the Website, as well as data automatically collected by the Operator when the User uses the Website (hereinafter collectively referred to as the “Data”).

When processing User Data in connection with the use of the Website, the Company acts as a personal data operator and is guided by the laws and other regulatory legal acts of the Russian Federation concerning information security and personal data protection, including, in particular, Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”, Resolution of the Government of the Russian Federation No. 1119 dated November 1, 2012 “On Approval of Requirements for the Protection of Personal Data When Processed in Personal Data Information Systems”, and other applicable regulations.

The terms used in this Policy shall be interpreted in accordance with the above-mentioned regulations and other applicable laws of the Russian Federation, unless otherwise expressly follows from the context.

Before using the Website, the User must read the terms of this Policy. Each time the User accesses the Website or any of its pages and actually uses the Website, the User agrees to the terms of this Policy in the version effective at the time of access.

By continuing to use the Website and browse its pages, the User accepts the terms of this Policy and agrees to the processing of the Data.

If the User does not agree with any of the terms set out in this Policy, we ask the User to leave the Website and refrain from visiting or using it in the future.

Please note that the Website may contain links to third-party content. If the User follows such links, we are not responsible for their content, the level of data protection provided by such third parties, or the actions of such third parties.

WHAT DATA WE COLLECT AND PROCESS AND FOR WHAT PURPOSES

The User may use the Website to review information about the Company, its areas of activity, services, and other information available on the Website without providing the Operator with personal data, except for information collected automatically as described below.

At the same time, the User may use the Website functionality, including feedback forms, where available and operational, and provide personal data to the Operator for the purposes described below.

A. Information collected through feedback forms

If a Website User wishes to receive a callback from Company employees, obtain advice regarding the Company’s services, receive a cost estimate, or obtain other information, the User may submit Data through a feedback form on the Website and provide consent to the Company for its processing.

Such Data may include:

• surname;
• first name;
• patronymic;
• telephone number;
• email address.

The Company processes such Data for the following purposes:

• reviewing User requests regarding the provision of Company services;
• responding to such requests;
• preparing and entering into civil-law agreements concerning services provided by the Company;
• informing Website Users about new products of the Operator, special offers, and updates concerning the Company’s services, to the extent permitted by applicable law or on the basis of the User’s separate consent.

If the Website User provides personal data of a third party through a form, the User must ensure that written consent has been obtained from that third party for the transfer of such Data to the Operator.

The Website User must provide such consent to the Operator within 3 (three) days from the date of receipt of the relevant request from the Operator.

In such cases, subject to the consent of the third party, the Operator may additionally process the following Data relating to that person:

• surname;
• first name;
• patronymic;
• telephone number;
• email address.

B. Data collected automatically through cookies and web beacons

Such data is not personalized and is of a general or statistical nature.

This data may include, among other things:

• technical information about User devices;
• IP addresses;
• device screen resolution;
• browser identifier data;
• hardware and software information;
• Wi-Fi network data;
• geolocation data;
• date and time of access to the Website and its pages;
• information about the User’s activity while using the Website and its pages;
• search history;
• User preferences;
• frequency of Website visits;
• other similar information.

This data is used exclusively for:

• system administration;
• analysis and conversion optimization;
• ensuring Website security;
• ensuring proper operation of the Website;
• improving User experience;
• providing Users with the most relevant content;
• ensuring correct display of Website pages on User devices.

PERSONAL DATA PROCESSING

The Operator recognizes the importance of User Data and therefore processes and protects such Data in strict compliance with applicable law and where there are lawful grounds for such processing.

We may perform the following actions with your personal data:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification, including updating and modification;
• retrieval;
• use;
• transfer, including provision and access;
• anonymization;
• blocking;
• deletion;
• destruction of personal data,

in accordance with the Federal Law “On Personal Data”.

The general method of personal data processing is mixed processing.

Personal data may be processed both with direct human involvement and using automated means, with transmission through the Operator’s internal network and via the Internet.

When processing Data, the Operator complies with the database localization requirement. All Data processing operations are therefore performed using databases located within the territory of the Russian Federation.

TRANSFER OR DISCLOSURE OF PERSONAL DATA

The Operator transfers Data only where the User has provided consent.

Without such consent, we may disclose User Data only where necessary to comply with applicable laws of the Russian Federation or at the request of authorized officials of state authorities or local self-government bodies.

We may transfer User Data to external organizations that provide services to the Operator or to which the Operator provides services, including:

• persons involved in providing services related to the placement and display of information on the Website;
• owners of websites and applications;
• third parties to whom rights or obligations under the relevant agreement have been assigned;
• third parties involved in a novation under the relevant agreement.

As of the date of approval of this Policy, we do not perform cross-border transfers of Data.

If cross-border transfer of Data becomes necessary in order to achieve the Operator’s purposes, we will update this Policy and notify Website Users of the need to provide additional consent, specifying the countries to which the cross-border transfer will be made.

We will also make every reasonable effort to ensure that the countries to which Data may be transferred provide an adequate level of personal data protection in accordance with the Convention of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data.

Where Data is transferred to countries whose data protection legislation does not provide an adequate level of protection, the Operator will ensure that the receiving party provides appropriate safeguards for the protection of the Data in accordance with the list approved by the Federal Service for Supervision of Communications, Information Technology and Mass Media.

HOW WE ENSURE THE SECURITY OF PERSONAL DATA

We have implemented appropriate legal, technical, and organizational measures to protect Data against:

• loss;
• misuse;
• unauthorized access;
• unauthorized disclosure;
• alteration;
• destruction.

The Company processes Data in accordance with the following principles:

• lawfulness of the purposes and methods of Data processing;
• good faith on the part of the Operator;
• consistency of the purposes of Data processing with the purposes determined and declared in advance at the time of collection, as well as with the authority of the Operator;
• consistency of the scope and nature of the Data being processed and the methods of processing with the purposes of processing;
• ensuring the accuracy, sufficiency, and relevance of the Data in relation to the purposes of processing;
• prohibition against combining databases containing Data that were created for purposes incompatible with one another;
• ensuring that Data retention periods strictly correspond to the purposes for which the Data is processed.

The Operator implements technical security measures taking into account:

• the requirements of applicable law;
• the current state of technology;
• the nature of the information being processed;
• the risks associated with such processing.

Data is processed predominantly by automated means without access by the Operator’s employees and/or contractors.

Where access is granted to employees or contractors of the Operator, such access is limited to the extent necessary for them to perform their official duties or contractual obligations.

Such persons are required to comply with all applicable security requirements when accessing Data.

In order to protect Data and ensure its confidentiality, all employees and contractors comply with internal rules and procedures concerning information processing.

Such persons also comply with all technical and organizational security measures required by applicable Russian legislation and necessary to protect the Data.

Employees of the Operator involved in receiving, processing, and protecting Data are required not to disclose personal data and provide a written undertaking to that effect.

To protect Data and other confidential information, the Operator creates targeted safeguards and barriers designed to prevent unauthorized access and acquisition of information.

HOW LONG WE RETAIN YOUR PERSONAL DATA

Data retention periods are governed by the laws of the Russian Federation and by the purposes for which the Data was collected.

We retain Data for as long as it is necessary to achieve the purposes of processing specified in this Policy.

Once the Operator has achieved the purposes of Data processing, the processing of such Data will be terminated and the Data will subsequently be destroyed.

The retention period for personalized Data provided through Website feedback forms may not exceed the period specified in the consent to personal data processing provided by the User or third party.

The User may withdraw consent to the processing of Data at any time by submitting a corresponding request using the Operator’s contact details specified in this Policy.

Please note that in certain cases the Operator may continue processing Data after the User has withdrawn consent where:

• such processing is necessary for the Operator to comply with obligations imposed by applicable law; or
• such processing is necessary to exercise the rights and legitimate interests of the Company and/or third parties.

YOUR RIGHTS REGARDING PERSONAL DATA

Personal data subjects have the right to access Data processed by the Operator and the right to request clarification, blocking, and destruction of personal data.

If a User or a third party whose Data has been transferred to the Operator through the Website wishes to exercise these rights, that person must submit a request to the Operator using the contact details specified in this Policy.

The person may request the following information:

a) confirmation that the Operator is processing the Data;

b) the legal grounds and purposes of Data processing;

c) the purposes and methods of personal data processing used by the Operator;

d) the name and location of the Operator and information about persons, excluding the Operator’s employees, who have access to the Data or to whom the Data may be disclosed under an agreement with the Operator or under federal law;

e) the Data being processed that relates to the relevant personal data subject and the source from which it was obtained;

f) the periods of Data processing, including retention periods;

g) the procedure for exercising the rights of the personal data subject provided for by the Federal Law “On Personal Data”;

h) information regarding completed or proposed cross-border transfers of Data;

i) the name or surname, first name, patronymic, and address of the person processing personal data on behalf of the Operator where such processing has been or will be entrusted to that person;

j) information on how the Operator fulfills the obligations established by Article 18.1 of the Federal Law “On Personal Data”.

Upon request, the Operator will provide, within 10 days, all Data in its possession relating to the relevant personal data subject.

If the personal data subject determines that their Data is inaccurate, or if the Operator discovers such inaccuracies, the Operator will block the relevant Data and subsequently correct it.

The request must contain sufficient basic information to locate and identify the requested Data.

After receiving and processing the request, we will provide a copy of the Data either:

• in hard copy by post; or
• electronically.

The personal data subject also has the right at any time to:

• change, update, or supplement their Data;
• withdraw previously provided consent to Data processing;
• request that the Operator cease processing the Data;
• request destruction of the Data collected,

except where this is expressly prohibited by applicable legislation of the Russian Federation.

These rights may be exercised by submitting a request to the Operator in accordance with the procedure described in this section of the Policy.

Until the Operator receives such a request, the Operator assumes that all Data is accurate, current, complete, eligible for processing, and does not relate to third parties.

LIABILITY OF THE PERSONAL DATA OPERATOR

The Operator is not responsible for disclosure or distribution of User Data by other Website Users or other Internet users where such persons obtained access to the Data as a result of the User’s own actions or omissions.

If a personal data subject believes that the Operator processes personal data in violation of applicable law or otherwise infringes their rights and freedoms, the personal data subject has the right to appeal the Operator’s actions or omissions to the authorized body responsible for protecting the rights of personal data subjects.

A personal data subject has the right to protect their rights and legitimate interests, including the right to claim damages and compensation for moral harm through court proceedings.

Persons responsible for violating this Policy or the Federal Law “On Personal Data” may be subject to disciplinary, administrative, civil, or criminal liability in accordance with federal laws, internal regulations, and confidentiality agreements entered into by the Operator.

FINAL PROVISIONS

The Operator reserves the right to amend the terms of this Policy at any time at its sole discretion. We recommend checking the Website periodically for updates to the Policy.

If, for any reason, the User believes that the Operator is not complying with this Policy, we ask the User to contact us by email at:

sales@alfa-aviation.ru

We will make every reasonable effort to promptly identify and correct any problems or violations.

Any disputes arising from the Operator’s activities related to personal data processing shall be resolved in accordance with the applicable laws of the Russian Federation at the place of registration of the Operator.

Before filing a claim with a court, the claimant must comply with the mandatory pre-trial dispute resolution procedure and submit a written claim.

The period for responding to such claim is 10 (ten) days from the date of receipt.

CONSENT TO PERSONAL DATA PROCESSING

This consent applies where feedback forms are available on the Website and are completed by a Website User.

By completing a feedback form on the website alfa-aviation.ru/ (hereinafter referred to as the “Form”), I hereby give my consent to Alfa Cargo Airlines Limited Liability Company, Primary State Registration Number (OGRN) 1195081052572, Taxpayer Identification Number (INN) 5047228708 (hereinafter referred to as the “Operator”), to process my personal data provided by me through the Form while using alfa-aviation.ru/ (hereinafter referred to as the “Website”).

This consent is provided in accordance with Article 9 of the Federal Law “On Personal Data” and is voluntary, given in my own interest, specific, informed, conscious, and unambiguous.

I confirm that I have read and understood the Operator’s Privacy and Personal Data Processing Policy concerning personal data protection.

This consent to the processing of my personal data is granted to the Operator and persons authorized by the Operator acting pursuant to confidentiality and non-disclosure agreements in relation to the following actions:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification, including updating and modification;
• retrieval;
• use;
• transfer, including distribution, provision, and access;
• anonymization;
• blocking;
• deletion;
• destruction of personal data;
• cross-border transfer to the territories of foreign states that are parties to the Convention of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data;
• other actions permitted under the Federal Law “On Personal Data”.

Such processing may be carried out for the following purposes:

• fulfillment by the Operator of its obligations to personal data subjects;
• provision of goods, services, and works;
• provision of reference and informational materials, including through mailings;
• promotion of goods, works, and services;
• attracting an unlimited number of persons to market research conducted by the Operator, including research involving third parties acting on behalf of the Operator pursuant to agreements entered into with the Operator.

Personal data is processed in accordance with the Operator’s Privacy and Personal Data Processing Policy.

The Operator may entrust personal data processing to third parties and/or transfer personal data to third parties acting pursuant to agreements entered into with the Operator, as well as to third parties to whom rights or obligations under the relevant agreement have been assigned or transferred by novation.

The general method of personal data processing is mixed processing, meaning that personal data may be processed both using automated means and with direct human involvement.

Consent validity period: from the date the personal data subject provides their personal data to the Operator until the need for personal data processing ceases or until the personal data subject withdraws this consent, whichever occurs first.

This consent applies to the following categories of personal data:

• surname, first name, patronymic;
• contact telephone number;
• email address.

Procedure for withdrawing consent to personal data processing

To withdraw consent to the processing of personal data, the personal data subject must submit a corresponding written request:

to the registered address of Alfa Cargo Airlines LLC:

141402, Moscow Region, Khimki Urban District, Khimki, 39 Leningradskaya Street, Building 6, Floor 11, Premises No. OV0211_06

or by email to:

sales@alfa-aviation.ru

After this consent expires, personal data may be used only for purposes permitted by applicable law.

I confirm that:

• all information provided by me in the Form belongs personally to me;
• such information is accurate;
• I am at least 18 years old;
• the telephone number specified in the Form is my own telephone number provided to me by a mobile network operator.

I confirm that this consent is provided voluntarily and in my own interest.

I knowingly grant the Operator access to the personal data specified above, which is expressed by checking the relevant checkbox on the Website in the Internet information and telecommunications network.