Personal Data Processing Policy

This Policy of Акционерное общество «Корпорация развития Кабардино-Балкарской Республики» (hereinafter — the "Operator", "АО «Корпорация развития КБР»", the "Corporation") establishes the procedure for processing personal data and the measures for ensuring the security of personal data taken by the Operator when processing personal data of users of the website https://invest-kbr.ru/ (hereinafter — the "Website") and other persons who have provided their personal data.

The Policy has been developed in accordance with:

• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Labor Code of the Russian Federation;
• Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
• Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technology and Information Protection";
• Federal Law No. 273-FZ of December 25, 2008 "On Combating Corruption";
• Decree of the Government of the Russian Federation No. 1119 of November 1, 2012 "On the Approval of the Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems";
• Decree of the Government of the Russian Federation No. 687 of September 15, 2008 "On the Approval of the Regulation on Specifics of Personal Data Processing Carried Out without the Use of Automation Tools";
• Order of the FSTEC of Russia No. 21 of February 18, 2013;
• other regulatory legal acts of the Russian Federation in the field of personal data protection.

1. General provisions and definitions

1.1. Definitions

For the purposes of this Policy, the following terms and definitions shall apply:

Operator of personal data (hereinafter — the Operator) — a state authority, municipal authority, legal entity or individual that, independently or jointly with other persons, organizes and (or) carries out the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data subject to processing, and the actions (operations) performed with personal data.

Subject of personal data — a natural person to whom personal data relates.

Employee of the Operator — a natural person in labor or other civil-law relations with the Operator.

Personal data — any information relating to a directly or indirectly determined or determinable natural person (the subject of personal data).

Biometric personal data — information that characterizes the physiological and biological features of a person, on the basis of which his or her identity can be established.

Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including the collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

Dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons.

Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons.

Depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the belonging of personal data to a specific subject of personal data.

Blocking of personal data — temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify personal data).

Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.

Automated processing of personal data — processing of personal data using computing equipment.

Personal data information system — a set of personal data contained in databases together with the information technologies and technical means that ensure their processing.

Confidentiality of personal data — operators and other persons who have gained access to personal data are obliged not to disclose to third parties and not to disseminate personal data without the consent of the personal data subject, unless otherwise provided by federal law.

Authorized access to information — access to information that does not violate access control rules.

Unauthorized access (UA) — access to information that violates access control rules using standard means provided by computing equipment or automated systems.

Threats to personal data security — a set of conditions and factors that create the risk of unauthorized, including accidental, access to personal data, which may result in the destruction, modification, blocking, copying, provision, dissemination of personal data, as well as other illegal actions during their processing in a personal data information system.

Personal data protection level — a comprehensive indicator characterizing the requirements, the fulfillment of which ensures the neutralization of certain threats to personal data security during their processing in personal data information systems.

Publicly available personal data — personal data to which access by an unlimited circle of persons is provided with the consent of the personal data subject.

2. Information about the Operator

• Full name: Акционерное общество «Корпорация развития Кабардино-Балкарской Республики»
• Short name: АО «Корпорация развития КБР»
• TIN (INN): 0721019946
• Primary State Registration Number (OGRN): 1070721000250
• Tax Registration Reason Code (KPP): 072501001
• Registered address: 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57
• Postal address for correspondence: 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57
• Email for inquiries regarding personal data processing: consult@air-kbr.ru
• Phone: +7 (8662) 77-01-91
• Registration number in the Roskomnadzor register of operators: the notification of personal data processing is filed pursuant to Article 22 of Federal Law No. 152-FZ; the registry number will be published in the next revision of this Policy

Person responsible for organizing the processing of personal data (Article 22.1 of Federal Law No. 152-FZ): A duly authorised person is being appointed; the details will be published in the next revision of this Policy (version 1.1).

3. Categories of personal data subjects

The Operator processes personal data of the following categories of subjects:

1. Users of the Website https://invest-kbr.ru/ (hereinafter — "Website Users"):
   • applicants (individuals) sending inquiries via feedback forms;
   • recipients of informational newsletters;
   • investors and representatives of investors using the services of the Website;
   • visitors of the Website (for web analytics purposes).
2. Representatives of the Operator's counterparties (legal entities and individual entrepreneurs) interacting with АО «Корпорация развития КБР» on matters of investment activity.
3. Employees of АО «Корпорация развития КБР» and applicants for vacant positions (such processing is governed by the internal «Regulation on the Personal Data Security Policy» approved by the Operator).

4. Categories of personal data being processed

In respect of Website Users, the Operator processes the following personal data.

(a) Data voluntarily provided by the User through the Website forms:

• last name, first name, patronymic;
• email address;
• phone number;
• postal address (where applicable);
• organization and position (where the inquiry is made on behalf of a legal entity);
• subject and content of the inquiry;
• attached files.

(b) Data collected automatically:

• IP address and other network identifiers;
• browser information (User-Agent);
• operating system and device information;
• referral source (HTTP Referer);
• Website navigation history;
• information about actions on the Website obtained through cookies and similar technologies (see § 15 «Use of cookies and web analytics»).

The Operator does not process special categories of personal data (Article 10 of Federal Law No. 152-FZ: racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life) — except as expressly provided by the legislation of the Russian Federation.

The Operator does not process biometric personal data (Article 11 of Federal Law No. 152-FZ).

5. Purposes of personal data processing

The Operator processes personal data for the following specific, pre-defined and lawful purposes:

1. Consideration of User inquiries submitted via Website forms.
2. Informing Users about the Operator's activities (news, events, conferences).
3. Support of investment projects in accordance with the Operator's statutory tasks.
4. User identification within the provided services.
5. Distribution of informational materials (subject to the User's consent).
6. Improvement of the quality of the Website and the services provided (statistics, analytics).
7. Registration for events organized by the Operator.
8. Compliance with the requirements of the legislation of the Russian Federation.

Processing of personal data incompatible with the stated purposes is not permitted.

6. Legal grounds for the processing of personal data

The legal grounds for processing personal data are:

1. Consent of the personal data subject to the processing of his or her personal data (Article 6, Part 1, Clause 1 of Federal Law No. 152-FZ) — for all cases of collection through the Website forms; consent is expressed by selecting the checkbox in the form and clicking the submit button.
2. Performance of the powers vested in the Operator by law as a joint-stock company with the participation of the Kabardino-Balkar Republic, performing functions to develop investment activities on the territory of the Republic (Article 6, Part 1, Clause 4 of Federal Law No. 152-FZ).
3. Conclusion and performance of contracts to which the personal data subject is a party (Article 6, Part 1, Clause 5 of Federal Law No. 152-FZ).
4. Exercise of the rights and legitimate interests of the Operator, provided that the rights and freedoms of the personal data subject are not violated (Article 6, Part 1, Clause 7 of Federal Law No. 152-FZ).
5. Other grounds provided for by federal legislation.

7. Principles and conditions for processing personal data

Processing of personal data by the Operator is based on the following principles:

1. The processing of personal data must be carried out on a lawful and fair basis.
2. The processing of personal data must be limited to achieving specific, pre-defined and lawful purposes. Processing of personal data incompatible with the purposes of collecting personal data is not permitted.
3. It is not permitted to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other.
4. Only personal data that corresponds to the purposes of their processing is subject to processing.
5. The content and volume of personal data processed must correspond to the stated purposes of processing. The personal data processed must not be excessive in relation to the stated purposes of their processing.
6. When processing personal data, the accuracy of personal data, their sufficiency, and, where necessary, relevance in relation to the purposes of processing must be ensured. The Operator must take the necessary measures or ensure that they are taken to remove or clarify incomplete or inaccurate data.
7. Storage of personal data must be carried out in a form that allows the personal data subject to be identified, no longer than is required for the purposes of their processing, unless the period of storage of personal data is established by federal law or by a contract to which the personal data subject is a party, beneficiary or guarantor. Processed personal data are subject to destruction or depersonalization upon achievement of the purposes of processing, as well as in the event of loss of the need to achieve them, unless otherwise provided by federal legislation.

8. List of actions with personal data and methods of processing

The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access — in cases provided for by law), blocking, deletion, destruction.

Methods of processing: mixed — automated processing using computing equipment and non-automated processing (on paper carriers) in cases where this is necessary in connection with the fulfillment of the requirements of the legislation.

Decisions giving rise to legal consequences in respect of the personal data subject or otherwise affecting his or her rights and legitimate interests are not made by the Operator solely on the basis of automated processing of personal data (except as expressly provided for by law).

9. Transfer of personal data to third parties

The transfer of personal data to third parties is carried out only in the following cases:

1. Upon requests of authorized state authorities of the Russian Federation and the Kabardino-Balkar Republic — on the grounds and in the manner established by law.
2. To persons performing certain actions on behalf of the Operator to process personal data (the instruction is executed in the form of an agreement pursuant to Article 6, Part 3 of Federal Law No. 152-FZ), namely:
   • Website hosting provider: LLC "REG.RU Domain Name Registrar" (territory of the Russian Federation, Moscow) — provides hosting and technical operation of the website and database.
   • Web analytics service: LLC "YANDEX" (JSC "YANDEX.Metrika", territory of the Russian Federation) — processing of anonymized statistics of Website visits through counter ID 87109424 without the session recording (webvisor) mode enabled.
3. With the consent of the personal data subject — to other persons specified in the consent.
4. In other cases expressly provided for by federal law.

There are no other categories of recipients of personal data of Website users. Internal forwarding of email notifications to the Operator's staff upon receipt of an inquiry through a Website form does not constitute a transfer to third parties within the meaning of Federal Law No. 152-FZ.

No cross-border transfer of personal data is carried out by the Operator.

10. Periods of processing and storage of personal data

Personal data is processed and stored during the period necessary to achieve the purposes of processing, but no longer than:

• for inquiries via the Website forms — 3 years from the date of the last inquiry;
• for newsletter subscriptions — until consent is withdrawn;
• for records in the consent log for the processing of personal data — 3 years from the moment consent is provided (by analogy with the general limitation period under civil law claims, Article 196 of the Civil Code of the Russian Federation);
• for data collected through cookies and web analytics — in accordance with the periods set by technological constraints (see § 15);
• for other purposes — within the storage periods of the relevant documents established by regulatory acts.

Upon the achievement of the purposes of processing or upon the loss of the need to achieve them, personal data is subject to destruction or depersonalization.

11. Measures to ensure the security of personal data

The Operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions (Article 19 of Federal Law No. 152-FZ; Decree of the Government of the Russian Federation No. 1119 of November 1, 2012; Order of the FSTEC of Russia No. 21 of February 18, 2013).

In particular:

• threats to the security of personal data during their processing in personal data information systems have been identified;
• organizational and technical measures to ensure security are applied;
• the effectiveness of the measures taken is evaluated;
• machine carriers of personal data are accounted for;
• rules for access to personal data are established;
• a record of actions performed with personal data is maintained;
• monitoring of the measures taken is carried out;
• personal data is transmitted over secure communication channels (HTTPS, TLS 1.2 or higher);
• the IP address and User-Agent in the consent log are stored in the form of a cryptographic hash (HMAC-SHA256) rather than in plain text.

Detailed information about organizational and technical measures constitutes confidential information and is not published in full to avoid lowering the level of protection.

12. Localization of personal data on the territory of the Russian Federation

In accordance with Part 5 of Article 18 of Federal Law No. 152-FZ, the recording, systematization, accumulation, storage, clarification (update, change), and extraction of personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation.

The Website database is located on the servers of the hosting provider in the Russian Federation (Moscow).

13. Rights of personal data subjects

The personal data subject has the following rights (Articles 14 and 21 of Federal Law No. 152-FZ):

1. To receive information regarding the processing of his or her personal data, including:
   • confirmation of the fact of processing of personal data by the Operator;
   • legal grounds and purposes of processing;
   • the processing methods used by the Operator;
   • the name and location of the Operator;
   • information about the persons (with the exception of the Operator's employees) who have access to personal data;
   • the personal data being processed that relate to the subject and the source of their receipt;
   • the periods of processing of personal data, including the periods of their storage;
   • the procedure for the exercise by the subject of the rights provided for by law.
2. To require the clarification of his or her personal data, their blocking or destruction in the event that they are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing.
3. To withdraw his or her consent to the processing of personal data (the withdrawal procedure is described in § 14 below).
4. To appeal against the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.
5. To the protection of his or her rights and legitimate interests, including compensation for damages and (or) compensation for moral harm in court.

To exercise the above rights, the subject may send a written request to the postal address 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57 or an electronic request to the email address consult@air-kbr.ru.

The deadline for considering a request is no more than 30 days from the moment of its receipt (in individual cases provided for by Article 14 of Federal Law No. 152-FZ — 10 business days).

14. Procedure for withdrawing consent to the processing of personal data

Consent to the processing of personal data may be withdrawn by the personal data subject at any time by sending:

• a written application to the postal address 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57;
• an electronic message from a confirmed sender address to consult@air-kbr.ru.

The application for withdrawal of consent must contain information that reliably identifies the applicant:

• the subject's last name, first name, patronymic;
• information confirming participation in relations with the Operator (for example, the date of the inquiry, the email address used when submitting an inquiry through the Website form, and other information at the discretion of the applicant);
• where necessary — information identifying the subject, in a volume reasonably sufficient for identification.

Upon receipt of the withdrawal of consent, the Operator shall stop processing personal data within 30 days from the date of receipt of the application (unless otherwise provided for by law).

Management of consent to the use of cookies is carried out through the permanent «Cookie settings» trigger at the bottom of the Website (see § 15).

15. Use of cookies and web analytics

The Website uses cookies — small text files saved on the User's device when visiting the Website.

Categories of cookies used on the Website.

1. NECESSARY — without them the Website cannot function:
   • session authorization cookies (BITRIX_SM_*, PHPSESSID);
   • CSRF security tokens.
   These cookies are set in all cases and do not require separate consent (based on Article 6, Part 1, Clause 5 of Federal Law No. 152-FZ — necessity for the performance of obligations to the User).
2. ANALYTICS — help improve the Website:
   • Yandex.Metrika (mc.yandex.ru) — web analytics service of LLC "YANDEX", counter ID 87109424. Without the webvisor mode (session video recording is not performed).
3. MARKETING — for advertising personalization:
   • At the time of publication of this version of the Policy, marketing cookies are not used on the Website.
4. FUNCTIONAL — remember the User's preferences and provide extended functionality:
   • kbr-widget ("Investor Assistant") — a built-in AI assistant that processes text questions from Users in an online consultation mode as part of the Operator's activities to support investment projects. The content of the dialog is processed for the purposes of providing responses and improving the quality of consultations.

Consent management. The User may at any time:

• open «Cookie settings» via the permanent link at the bottom of the Website and change the categories to which he or she gives or withdraws consent;
• configure cookie parameters in the browser (disabling cookies may limit the functionality of the Website).

Cookie retention periods. Cookies are stored on the User's device for the period set for each file (from session to 6 months).

16. Changes to this Policy

The Operator reserves the right to make changes to this Policy. When making significant changes, the Operator updates the Policy on the Website and indicates the date of the last update at the beginning of the document.

• Document version: 1.0
• Effective date: 05/21/2026

The full change history is available in the collapsible block at the bottom of this page.

17. Contact information and the procedure for handling inquiries

For all questions related to the processing of personal data, the User may contact the Operator at:

• Postal address: 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57
• Email: consult@air-kbr.ru
• Phone: +7 (8662) 77-01-91

Person responsible for organizing the processing of personal data: A duly authorised person is being appointed; the details will be published in the next revision of this Policy (version 1.1).

Complaints against the actions of the Operator may be sent:

• to Roskomnadzor: https://rkn.gov.ru/ (central office) or to the relevant Federal District Department of Roskomnadzor;
• to the prosecuting authorities of the Russian Federation;
• in court.

In the event of an incident related to a breach of the security of personal data, the Operator notifies Roskomnadzor within 24 hours of the moment of detection (Article 21, Part 3.1 of Federal Law No. 152-FZ).