**Personal Data Processing Policy**
**1. General Provisions**
This Personal Data Processing Policy is prepared in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and defines the procedure for processing personal data and the measures taken by TEPLOR LLC (hereinafter referred to as the “Operator”) to ensure the security of personal data.
1.1. The Operator’s primary objective and essential condition for its operations is compliance with the rights and freedoms of individuals and citizens when processing their personal data, including the protection of the right to privacy, personal and family confidentiality.
1.2. This Operator’s Policy regarding personal data processing (hereinafter referred to as the “Policy”) applies to all information that the Operator may obtain about visitors to the website https://ic-teplor.ru.
**2. Key Terms Used in the Policy**
2.1. **Automated personal data processing** – processing personal data using computer technology.
2.2. **Blocking of personal data** – temporary suspension of personal data processing (except where processing is required to clarify personal data).
2.3. **Website** – a collection of graphic and informational materials, computer programs, and databases that ensure their availability on the internet at https://ic-teplor.ru.
2.4. **Personal data information system** – a set of personal data contained in databases and the information technologies and technical means used to process them.
2.5. **Depersonalization of personal data** – actions resulting in personal data being rendered incapable of identifying a specific User or other personal data subject without the use of additional information.
2.6. **Personal data processing** – any action (operation) or set of actions (operations) performed with or without automation, including collection, recording, organization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
2.7. **Operator** – a state or municipal authority, legal entity, or individual who independently or jointly with others organizes and/or performs personal data processing and determines the purposes, scope, and actions (operations) performed with personal data.
2.8. **Personal data** – any information relating directly or indirectly to a specific or identifiable User of the website https://ic-teplor.ru.
2.9. **Personal data permitted by the data subject for dissemination** – personal data for which the data subject has granted open access to an unlimited group of persons by giving consent for processing in the manner prescribed by the Personal Data Law (hereinafter referred to as “personal data permitted for dissemination”).
2.10. **User** – any visitor to the website https://ic-teplor.ru.
2.11. **Provision of personal data** – actions aimed at disclosing personal data to a specific person or specific group of persons.
2.12. **Dissemination of personal data** – any actions aimed at disclosing personal data to an indefinite group of persons (transmission of personal data) or making personal data accessible to an unlimited group of persons, including publication in mass media, placement in information and telecommunications networks, or providing access by any other means.
2.13. **Cross-border transfer of personal data** – transfer of personal data to the territory of a foreign state to a foreign government authority, foreign individual, or foreign legal entity.
2.14. **Destruction of personal data** – any actions resulting in the irreversible destruction of personal data, making further restoration of the content impossible within the personal data information system and/or physical destruction of data carriers.
**3. Operator’s Main Rights and Obligations**
3.1. The Operator is entitled to:
– obtain accurate information and/or documents containing personal data from the data subject;
– continue processing personal data without the data subject’s consent if the data subject withdraws consent or submits a request to discontinue processing, provided that grounds specified in the Personal Data Law exist;
– independently determine the scope and list of measures necessary and sufficient to fulfill obligations under the Personal Data Law and related regulatory legal acts, unless otherwise required by the Personal Data Law or other federal laws.
3.2. The Operator is obligated to:
– provide the data subject, upon request, with information relating to the processing of their personal data;
– organize personal data processing in accordance with the current legislation of the Russian Federation;
– respond to requests and inquiries from data subjects and their legal representatives in compliance with the Personal Data Law;
– provide the authorized body for the protection of data subjects’ rights with necessary information within 10 days of receiving such a request;
– publish or otherwise ensure unrestricted access to this Policy;
– implement legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, dissemination, or other unlawful actions;
– cease transmission (dissemination, provision, access), processing, and destruction of personal data as prescribed by the Personal Data Law;
– fulfill other obligations stipulated by the Personal Data Law.
**4. Rights and Obligations of Personal Data Subjects**
4.1. Personal data subjects have the right to:
– obtain information regarding the processing of their personal data, except in cases provided by federal laws. The Operator shall provide such information in an accessible form, excluding personal data of other subjects unless legally permitted;
– request the Operator to correct, block, or delete their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose, and to take lawful measures to protect their rights;
– require prior consent for processing personal data for direct marketing purposes;
– withdraw consent for personal data processing and submit a request to discontinue processing;
– file a complaint with the authorized body for the protection of data subjects’ rights or in court against unlawful actions or omissions by the Operator;
– exercise other rights granted under the legislation of the Russian Federation.
4.2. Personal data subjects are obligated to:
– provide the Operator with accurate information about themselves;
– promptly inform the Operator of any updates (changes, corrections) to their personal data.
4.3. Individuals who provide the Operator with false information about themselves or about another data subject without the latter’s consent shall be held liable under the legislation of the Russian Federation.
**5. Principles of Personal Data Processing**
5.1. Personal data shall be processed lawfully and fairly.
5.2. Processing shall be limited to achieving specific, predefined, and lawful purposes. Processing incompatible with the purposes for which the data were collected is prohibited.
5.3. Merging databases containing personal data processed for incompatible purposes is prohibited.
5.4. Only personal data relevant to the processing purposes shall be processed.
5.5. The content and volume of processed personal data shall correspond to the stated purposes. Excessive data collection relative to the processing purposes is prohibited.
5.6. The Operator shall ensure the accuracy, sufficiency, and, where necessary, the relevance of personal data in relation to processing purposes, and shall take necessary measures to delete or correct incomplete or inaccurate data.
5.7. Personal data shall be stored in a form that permits identification of the data subject only for as long as necessary to fulfill processing purposes, unless a longer retention period is required by federal law, contract (to which the data subject is a party, beneficiary, or guarantor). Upon achievement of processing purposes or if further processing is no longer necessary, personal data shall be destroyed or depersonalized, unless otherwise provided by federal law.
**6. Purposes of Personal Data Processing**
| **Processing Purpose** | **Personal Data** | **Legal Basis** | **Types of Processing** |
|-----------------------------------------------------|------------------------------------------------------|-----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| Informing the User via email | Full name (first, middle, last)<br>Email address<br>Phone numbers | Operator’s charter (founding) documents<br>Contracts between the Operator and the data subject | Collection, recording, organization, accumulation, storage, destruction, and depersonalization of personal data<br>Sending informational emails |
**7. Conditions for Personal Data Processing**
7.1. Personal data processing is carried out with the data subject’s consent.
7.2. Processing is necessary to fulfill obligations under international treaties or federal laws, or to perform functions, powers, and duties assigned to the Operator by Russian legislation.
7.3. Processing is necessary for administering justice, enforcing court rulings or decisions of other authorities enforceable under Russian enforcement legislation.
7.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary, or guarantor, or to conclude a contract at the data subject’s initiative or where the subject will be a beneficiary or guarantor.
7.5. Processing is necessary to protect the Operator’s or third parties’ legitimate rights or to achieve publicly significant objectives, provided the data subject’s rights and freedoms are not violated.
7.6. Processing concerns personal data made publicly available by the data subject or at their request (“publicly available personal data”).
7.7. Processing concerns personal data required to be published or disclosed under federal law.
**8. Procedures for Collection, Storage, Transfer, and Other Processing of Personal Data**
The security of personal data processed by the Operator is ensured through legal, organizational, and technical measures fully compliant with current Russian personal data protection legislation.
8.1. The Operator ensures the confidentiality of personal data and takes all possible measures to prevent unauthorized access.
8.2. The User’s personal data shall never be disclosed to third parties except as required by law or with the User’s explicit consent for the performance of civil-law obligations.
8.3. If inaccuracies are detected, the User may update their data by sending a notice to the Operator’s email address gdp@teplo-resh.ru with the subject line “Personal Data Update.”
8.4. Personal data shall be processed only for as long as necessary to achieve the stated purposes, unless a different period is stipulated by contract or law. The User may withdraw consent at any time by emailing gdp@teplo-resh.ru with the subject line “Withdrawal of Consent to Personal Data Processing.”
8.5. Information collected by third-party services (e.g., payment systems, communication platforms, or other service providers) is stored and processed by those entities in accordance with their own User Agreements and Privacy Policies. The Operator is not liable for the actions of such third parties.
8.6. Restrictions imposed by the data subject on transfer (except access provision), processing, or processing conditions for publicly available personal data do not apply when processing is conducted in state, public, or other publicly recognized interests as defined by Russian law.
8.7. The Operator ensures the confidentiality of personal data during processing.
8.8. Personal data shall be retained in an identifiable form only as long as necessary for processing purposes, unless a longer retention period is required by federal law or contract (to which the data subject is a party, beneficiary, or guarantor).
8.9. Processing may be terminated upon: achievement of processing purposes; expiration or withdrawal of consent; receipt of a request to discontinue processing; or discovery of unlawful processing.
**9. List of Actions Performed by the Operator on Personal Data**
9.1. The Operator performs collection, recording, organization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
9.2. The Operator carries out automated processing of personal data, with or without the use of information and telecommunications networks.
**10. Cross-Border Transfer of Personal Data**
10.1. Prior to initiating cross-border data transfers, the Operator must notify the authorized body for the protection of data subjects’ rights of its intention to perform such transfers (submitted separately from the general data processing notification).
10.2. Before submitting the above notification, the Operator must obtain relevant assurances from the foreign state authorities, foreign individuals, or foreign legal entities receiving the data.
**11. Confidentiality of Personal Data**
The Operator and any other persons who gain access to personal data are obligated not to disclose or disseminate such data to third parties without the data subject’s consent, unless otherwise required by federal law.
**12. Final Provisions**
12.1. The User may request clarifications on any matter related to personal data processing by contacting the Operator at gdp@teplo-resh.ru.
12.2. This document will reflect any changes to the Operator’s personal data processing policy. The Policy remains in effect indefinitely until replaced by a new version.
12.3. The current version of the Policy is freely accessible online.
**1. General Provisions**
This Personal Data Processing Policy is prepared in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and defines the procedure for processing personal data and the measures taken by TEPLOR LLC (hereinafter referred to as the “Operator”) to ensure the security of personal data.
1.1. The Operator’s primary objective and essential condition for its operations is compliance with the rights and freedoms of individuals and citizens when processing their personal data, including the protection of the right to privacy, personal and family confidentiality.
1.2. This Operator’s Policy regarding personal data processing (hereinafter referred to as the “Policy”) applies to all information that the Operator may obtain about visitors to the website https://ic-teplor.ru.
**2. Key Terms Used in the Policy**
2.1. **Automated personal data processing** – processing personal data using computer technology.
2.2. **Blocking of personal data** – temporary suspension of personal data processing (except where processing is required to clarify personal data).
2.3. **Website** – a collection of graphic and informational materials, computer programs, and databases that ensure their availability on the internet at https://ic-teplor.ru.
2.4. **Personal data information system** – a set of personal data contained in databases and the information technologies and technical means used to process them.
2.5. **Depersonalization of personal data** – actions resulting in personal data being rendered incapable of identifying a specific User or other personal data subject without the use of additional information.
2.6. **Personal data processing** – any action (operation) or set of actions (operations) performed with or without automation, including collection, recording, organization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
2.7. **Operator** – a state or municipal authority, legal entity, or individual who independently or jointly with others organizes and/or performs personal data processing and determines the purposes, scope, and actions (operations) performed with personal data.
2.8. **Personal data** – any information relating directly or indirectly to a specific or identifiable User of the website https://ic-teplor.ru.
2.9. **Personal data permitted by the data subject for dissemination** – personal data for which the data subject has granted open access to an unlimited group of persons by giving consent for processing in the manner prescribed by the Personal Data Law (hereinafter referred to as “personal data permitted for dissemination”).
2.10. **User** – any visitor to the website https://ic-teplor.ru.
2.11. **Provision of personal data** – actions aimed at disclosing personal data to a specific person or specific group of persons.
2.12. **Dissemination of personal data** – any actions aimed at disclosing personal data to an indefinite group of persons (transmission of personal data) or making personal data accessible to an unlimited group of persons, including publication in mass media, placement in information and telecommunications networks, or providing access by any other means.
2.13. **Cross-border transfer of personal data** – transfer of personal data to the territory of a foreign state to a foreign government authority, foreign individual, or foreign legal entity.
2.14. **Destruction of personal data** – any actions resulting in the irreversible destruction of personal data, making further restoration of the content impossible within the personal data information system and/or physical destruction of data carriers.
**3. Operator’s Main Rights and Obligations**
3.1. The Operator is entitled to:
– obtain accurate information and/or documents containing personal data from the data subject;
– continue processing personal data without the data subject’s consent if the data subject withdraws consent or submits a request to discontinue processing, provided that grounds specified in the Personal Data Law exist;
– independently determine the scope and list of measures necessary and sufficient to fulfill obligations under the Personal Data Law and related regulatory legal acts, unless otherwise required by the Personal Data Law or other federal laws.
3.2. The Operator is obligated to:
– provide the data subject, upon request, with information relating to the processing of their personal data;
– organize personal data processing in accordance with the current legislation of the Russian Federation;
– respond to requests and inquiries from data subjects and their legal representatives in compliance with the Personal Data Law;
– provide the authorized body for the protection of data subjects’ rights with necessary information within 10 days of receiving such a request;
– publish or otherwise ensure unrestricted access to this Policy;
– implement legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, dissemination, or other unlawful actions;
– cease transmission (dissemination, provision, access), processing, and destruction of personal data as prescribed by the Personal Data Law;
– fulfill other obligations stipulated by the Personal Data Law.
**4. Rights and Obligations of Personal Data Subjects**
4.1. Personal data subjects have the right to:
– obtain information regarding the processing of their personal data, except in cases provided by federal laws. The Operator shall provide such information in an accessible form, excluding personal data of other subjects unless legally permitted;
– request the Operator to correct, block, or delete their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose, and to take lawful measures to protect their rights;
– require prior consent for processing personal data for direct marketing purposes;
– withdraw consent for personal data processing and submit a request to discontinue processing;
– file a complaint with the authorized body for the protection of data subjects’ rights or in court against unlawful actions or omissions by the Operator;
– exercise other rights granted under the legislation of the Russian Federation.
4.2. Personal data subjects are obligated to:
– provide the Operator with accurate information about themselves;
– promptly inform the Operator of any updates (changes, corrections) to their personal data.
4.3. Individuals who provide the Operator with false information about themselves or about another data subject without the latter’s consent shall be held liable under the legislation of the Russian Federation.
**5. Principles of Personal Data Processing**
5.1. Personal data shall be processed lawfully and fairly.
5.2. Processing shall be limited to achieving specific, predefined, and lawful purposes. Processing incompatible with the purposes for which the data were collected is prohibited.
5.3. Merging databases containing personal data processed for incompatible purposes is prohibited.
5.4. Only personal data relevant to the processing purposes shall be processed.
5.5. The content and volume of processed personal data shall correspond to the stated purposes. Excessive data collection relative to the processing purposes is prohibited.
5.6. The Operator shall ensure the accuracy, sufficiency, and, where necessary, the relevance of personal data in relation to processing purposes, and shall take necessary measures to delete or correct incomplete or inaccurate data.
5.7. Personal data shall be stored in a form that permits identification of the data subject only for as long as necessary to fulfill processing purposes, unless a longer retention period is required by federal law, contract (to which the data subject is a party, beneficiary, or guarantor). Upon achievement of processing purposes or if further processing is no longer necessary, personal data shall be destroyed or depersonalized, unless otherwise provided by federal law.
**6. Purposes of Personal Data Processing**
| **Processing Purpose** | **Personal Data** | **Legal Basis** | **Types of Processing** |
|-----------------------------------------------------|------------------------------------------------------|-----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| Informing the User via email | Full name (first, middle, last)<br>Email address<br>Phone numbers | Operator’s charter (founding) documents<br>Contracts between the Operator and the data subject | Collection, recording, organization, accumulation, storage, destruction, and depersonalization of personal data<br>Sending informational emails |
**7. Conditions for Personal Data Processing**
7.1. Personal data processing is carried out with the data subject’s consent.
7.2. Processing is necessary to fulfill obligations under international treaties or federal laws, or to perform functions, powers, and duties assigned to the Operator by Russian legislation.
7.3. Processing is necessary for administering justice, enforcing court rulings or decisions of other authorities enforceable under Russian enforcement legislation.
7.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary, or guarantor, or to conclude a contract at the data subject’s initiative or where the subject will be a beneficiary or guarantor.
7.5. Processing is necessary to protect the Operator’s or third parties’ legitimate rights or to achieve publicly significant objectives, provided the data subject’s rights and freedoms are not violated.
7.6. Processing concerns personal data made publicly available by the data subject or at their request (“publicly available personal data”).
7.7. Processing concerns personal data required to be published or disclosed under federal law.
**8. Procedures for Collection, Storage, Transfer, and Other Processing of Personal Data**
The security of personal data processed by the Operator is ensured through legal, organizational, and technical measures fully compliant with current Russian personal data protection legislation.
8.1. The Operator ensures the confidentiality of personal data and takes all possible measures to prevent unauthorized access.
8.2. The User’s personal data shall never be disclosed to third parties except as required by law or with the User’s explicit consent for the performance of civil-law obligations.
8.3. If inaccuracies are detected, the User may update their data by sending a notice to the Operator’s email address gdp@teplo-resh.ru with the subject line “Personal Data Update.”
8.4. Personal data shall be processed only for as long as necessary to achieve the stated purposes, unless a different period is stipulated by contract or law. The User may withdraw consent at any time by emailing gdp@teplo-resh.ru with the subject line “Withdrawal of Consent to Personal Data Processing.”
8.5. Information collected by third-party services (e.g., payment systems, communication platforms, or other service providers) is stored and processed by those entities in accordance with their own User Agreements and Privacy Policies. The Operator is not liable for the actions of such third parties.
8.6. Restrictions imposed by the data subject on transfer (except access provision), processing, or processing conditions for publicly available personal data do not apply when processing is conducted in state, public, or other publicly recognized interests as defined by Russian law.
8.7. The Operator ensures the confidentiality of personal data during processing.
8.8. Personal data shall be retained in an identifiable form only as long as necessary for processing purposes, unless a longer retention period is required by federal law or contract (to which the data subject is a party, beneficiary, or guarantor).
8.9. Processing may be terminated upon: achievement of processing purposes; expiration or withdrawal of consent; receipt of a request to discontinue processing; or discovery of unlawful processing.
**9. List of Actions Performed by the Operator on Personal Data**
9.1. The Operator performs collection, recording, organization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
9.2. The Operator carries out automated processing of personal data, with or without the use of information and telecommunications networks.
**10. Cross-Border Transfer of Personal Data**
10.1. Prior to initiating cross-border data transfers, the Operator must notify the authorized body for the protection of data subjects’ rights of its intention to perform such transfers (submitted separately from the general data processing notification).
10.2. Before submitting the above notification, the Operator must obtain relevant assurances from the foreign state authorities, foreign individuals, or foreign legal entities receiving the data.
**11. Confidentiality of Personal Data**
The Operator and any other persons who gain access to personal data are obligated not to disclose or disseminate such data to third parties without the data subject’s consent, unless otherwise required by federal law.
**12. Final Provisions**
12.1. The User may request clarifications on any matter related to personal data processing by contacting the Operator at gdp@teplo-resh.ru.
12.2. This document will reflect any changes to the Operator’s personal data processing policy. The Policy remains in effect indefinitely until replaced by a new version.
12.3. The current version of the Policy is freely accessible online.