Personal Data Processing Policy

This English version is a translation provided for convenience. The Russian text is legally binding and prevails in case of any discrepancy: https://invest-kbr.ru/agreement/

1. General provisions

1. This Policy of Joint-Stock Company “Development Corporation of the Kabardino-Balkarian Republic” (the "Operator") sets out the purposes, legal grounds, conditions and methods of personal data processing and the measures to ensure its security in connection with the website https://invest-kbr.ru (the "Website"), including its English version https://invest-kbr.ru/en/.
2. The Policy has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Personal Data Law"), including Part 2 of Article 18.1, and is published on all Website pages used to collect personal data.
3. The consent to personal data processing given on the Website is set out as a separate document, "Consent to Personal Data Processing When Submitting Enquiries and Registering on the invest-kbr.ru Website" — https://invest-kbr.ru/en/consent/.
4. Processing of personal data of the Operator's employees, job applicants and representatives of counterparties outside the Website is governed by the Operator's internal regulations and is not described in this Policy.

1.1. Definitions

For the purposes of this Policy, the following terms and definitions shall apply:

Operator of personal data (hereinafter — the Operator) — a state authority, municipal authority, legal entity or individual that, independently or jointly with other persons, organizes and (or) carries out the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data subject to processing, and the actions (operations) performed with personal data.

Subject of personal data — a natural person to whom personal data relates.

Employee of the Operator — a natural person in labor or other civil-law relations with the Operator.

Personal data — any information relating to a directly or indirectly determined or determinable natural person (the subject of personal data).

Biometric personal data — information that characterizes the physiological and biological features of a person, on the basis of which his or her identity can be established.

Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including the collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

Dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons.

Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons.

Depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the belonging of personal data to a specific subject of personal data.

Blocking of personal data — temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify personal data).

Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.

Automated processing of personal data — processing of personal data using computing equipment.

Personal data information system — a set of personal data contained in databases together with the information technologies and technical means that ensure their processing.

Confidentiality of personal data — operators and other persons who have gained access to personal data are obliged not to disclose to third parties and not to disseminate personal data without the consent of the personal data subject, unless otherwise provided by federal law.

Authorized access to information — access to information that does not violate access control rules.

Unauthorized access (UA) — access to information that violates access control rules using standard means provided by computing equipment or automated systems.

Threats to personal data security — a set of conditions and factors that create the risk of unauthorized, including accidental, access to personal data, which may result in the destruction, modification, blocking, copying, provision, dissemination of personal data, as well as other illegal actions during their processing in a personal data information system.

Personal data protection level — a comprehensive indicator characterizing the requirements, the fulfillment of which ensures the neutralization of certain threats to personal data security during their processing in personal data information systems.

Publicly available personal data — personal data to which access by an unlimited circle of persons is provided with the consent of the personal data subject.

---

2. Information about the Operator

• Full name: Joint-Stock Company “Development Corporation of the Kabardino-Balkarian Republic” (in Russian: Акционерное общество «Корпорация развития Кабардино-Балкарской Республики»)
• Short name: “KBR Development Corporation” JSC (in Russian: АО «Корпорация развития КБР»)
• INN (taxpayer ID): 0721019946
• OGRN (state registration number): 1070721000250
• KPP: 072501001
• Legal address: 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57
• Postal address for enquiries: 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57
• E-mail for enquiries on personal data processing: consult@air-kbr.ru
• Telephone: +7 (8662) 77-20-17
• Registration number in the register of personal data operators: 7-17-000506

Person responsible for organising personal data processing (Article 22.1 of the Personal Data Law): Full name: Alim Ibragimovich Kaziev. Position: Head of the Marketing and Information and Analytical Work Department. Contacts: tel. +7 (8662) 77-20-17, consult@air-kbr.ru.

---

3. Categories of personal data subjects

The Operator processes personal data of the following persons interacting with the Website:

1. Applicants — individuals, including representatives of organisations and individual entrepreneurs, who send enquiries via the feedback and "Direct line" forms.
2. Registered users — persons who have created an account on the Website and use the personal account.
3. Website visitors — in respect of information automatically recorded to ensure the security of the Website (section 5).

---

4. Special and biometric personal data

The Operator does not process special categories of personal data (Article 10 of the Personal Data Law) or biometric personal data (Article 11 of the Personal Data Law) on the Website. Users should not include such information in their enquiries.

---

5. Purposes, legal grounds, scope and periods of processing

For each purpose of processing, the categories of subjects, the list of personal data, the legal ground under Part 1 of Article 6 of the Personal Data Law, the actions and methods of processing, the periods of processing and storage, and the procedure for destruction are established.

Purpose	Subjects	Legal ground (Part 1 of Article 6 of the Personal Data Law)	Storage period
5.1. Considering enquiries sent via Website forms	Applicants	Clause 1 — consent; for investment project support also Clause 2	3 years from the last enquiry or until consent is withdrawn
5.2. Registration and personal account	Registered users	Clause 1 — consent; for investment project support also Clause 2	Until the account is deleted, no longer than 3 years from the last login
5.3. Confirming that consents were obtained	Applicants, registered users	Clause 2 (Part 3 of Article 9)	3 years after the consent ceases to be valid
5.4. Website security	Visitors	Clause 2 (Article 19 of the Personal Data Law, Article 16 of Federal Law No. 149-FZ)	90 days

Detailed conditions for each purpose are set out in subsections 5.1–5.4.

Metric programs (including Yandex Metrica) and other web analytics services are not used on the Website.

5.1. Considering enquiries sent via Website forms

• Forms: "New enquiry" (/contact-new/, /contacts/), "Direct line" (/hotline/), English versions (/en/contacts/, /en/contact-new/, /en/hotline/).
• Subjects: applicants.
• Personal data: surname, first name, patronymic; postal address with postcode; e-mail address; telephone number (if provided); subject and text of the enquiry; information in attached files; date and time of the enquiry.
• Legal ground: consent of the personal data subject (Clause 1 of Part 1 of Article 6 of the Personal Data Law) set out as a separate document (https://invest-kbr.ru/en/consent/, section 1). If the enquiry concerns support of an investment project, the data are also processed to perform the functions assigned to the Operator as the authorised organisation of the Kabardino-Balkarian Republic for supporting investment projects on a "one-stop shop" basis (Clause 2 of Part 1 of Article 6 of the Personal Data Law; Article 46-2 of the Law of the Kabardino-Balkarian Republic No. 23-RZ of 16.04.2001 "On Investment Activity in the Kabardino-Balkarian Republic"; Clause 2-1 of Resolution of the Government of the Kabardino-Balkarian Republic No. 130-PP of 29.04.2013).
• Actions: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access) to the executive authorities of the Kabardino-Balkarian Republic within their competence where necessary to consider the enquiry, blocking, deletion, destruction.
• Method: mixed — automated with transfer over the Internet, and without the use of automation tools.
• Period of processing and storage: 3 years from the date of the last enquiry, or until the consent is withdrawn, if earlier, unless a longer storage period is established by law or by the Operator's records schedule.
• Destruction: deletion from the Website database and from the mailbox to which the enquiry notification was sent, recorded in a destruction certificate (section 10).

5.2. Registration on the Website and the personal account

• Forms: registration (/auth/registration.php), requests from the personal account.
• Subjects: registered users.
• Personal data: login; name; e-mail address; password (stored only as a hash value); INN of the organisation or individual entrepreneur (if provided in the profile); surname, first name, patronymic, telephone number, subject and text of requests from the personal account; date of registration and of the last login.
• Legal ground: consent of the personal data subject (Clause 1 of Part 1 of Article 6 of the Personal Data Law; https://invest-kbr.ru/en/consent/, section 2). For requests concerning support of an investment project — also Clause 2 of Part 1 of Article 6 (as in subsection 5.1).
• Actions: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access) to the executive authorities of the Kabardino-Balkarian Republic within their competence, blocking, deletion, destruction.
• Method: mixed, with transfer over the Internet.
• Period of processing and storage: until the account is deleted, but no longer than 3 years from the date of the last login, or until the consent is withdrawn, if earlier.
• Destruction: deletion of the account and related requests from the Website database, recorded in a destruction certificate (section 10).

5.3. Confirming that consents were obtained

• Subjects: applicants and registered users.
• Personal data: date and time of the consent; the form in which the consent was given; version and language of the consent text; technical identifier of the record; hash values (HMAC-SHA256) of the IP address, User-Agent string and page address. Plain IP addresses, names, telephone numbers and e-mail addresses are not stored in the consent logs.
• Legal ground: performance of the Operator's obligation to prove that consent was obtained (Part 3 of Article 9 of the Personal Data Law; Clause 2 of Part 1 of Article 6 of the Personal Data Law).
• Actions: collection, recording, storage, use, deletion, destruction. Method: automated processing.
• Storage period: 3 years after the consent ceases to be valid.

5.4. Website security

• Subjects: Website visitors.
• Personal data: IP address, User-Agent string, address of the requested page, date and time of the request — in the event logs of the Website management system and the server.
• Legal ground: performance of the Operator's obligation to take measures to ensure the security of personal data and to protect information (Clause 2 of Part 1 of Article 6 and Article 19 of the Personal Data Law; Article 16 of Federal Law No. 149-FZ of 27 July 2006 "On Information, Information Technologies and Protection of Information").
• Actions: collection, recording, storage, use, deletion. Method: automated processing.
• Storage period: 90 days.

---

6. Principles of personal data processing

Processing of personal data by the Operator is based on the following principles:

1. The processing of personal data must be carried out on a lawful and fair basis.
2. The processing of personal data must be limited to achieving specific, pre-defined and lawful purposes. Processing of personal data incompatible with the purposes of collecting personal data is not permitted.
3. It is not permitted to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other.
4. Only personal data that corresponds to the purposes of their processing is subject to processing.
5. The content and volume of personal data processed must correspond to the stated purposes of processing. The personal data processed must not be excessive in relation to the stated purposes of their processing.
6. When processing personal data, the accuracy of personal data, their sufficiency, and, where necessary, relevance in relation to the purposes of processing must be ensured. The Operator must take the necessary measures or ensure that they are taken to remove or clarify incomplete or inaccurate data.
7. Storage of personal data must be carried out in a form that allows the personal data subject to be identified, no longer than is required for the purposes of their processing, unless the period of storage of personal data is established by federal law or by a contract to which the personal data subject is a party, beneficiary or guarantor. Processed personal data are subject to destruction or depersonalization upon achievement of the purposes of processing, as well as in the event of loss of the need to achieve them, unless otherwise provided by federal legislation.

Processing of personal data incompatible with the purposes set out in section 5 is not permitted. The Operator does not take decisions that produce legal effects for the subject solely on the basis of automated processing of his or her personal data.

---

7. Persons processing data on behalf of the Operator and other recipients

1. Persons processing personal data on behalf of the Operator (Part 3 of Article 6 of the Personal Data Law):
   • REG.RU LLC (INN 7733568767, OGRN 1067746613494; 12 Berezovoy Roshchi Pr., floor 2, room 4, Moscow, 125252) — hosting of the Website and database, mail of the invest-kbr.ru domain; purposes 5.1–5.4.
2. Recipients within their competence: executive authorities of the Kabardino-Balkarian Republic — where necessary to consider an enquiry or request (purposes 5.1, 5.2).
3. Authorised state bodies — on request and in cases provided for by the legislation of the Russian Federation.

Personal data of Website users are not transferred to other persons. Sending notifications about received enquiries to the Operator's employees is not a transfer of personal data to third parties.

Third-party services on Website pages. Some Website pages contain materials of third-party organisations: the feedback platform widget of the Gosuslugi portal (pos.gosuslugi.ru), videos of the VK Video service (vk.com) and the map of the Investment Map of the Russian Federation (invest.gov.ru). When they load, the visitor's browser contacts the servers of these organisations, which process information about the visit as independent operators under their own rules. The Operator does not transfer personal data collected on the Website to them.

---

8. Cross-border transfer and data localisation

1. The Operator does not carry out cross-border transfer of personal data.
2. Recording, systematisation, accumulation, storage, clarification (updating, modification) and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation (Part 5 of Article 18 of the Personal Data Law). The Website database is hosted on REG.RU LLC servers in the Russian Federation (Moscow).
3. The Operator does not use forms of third-party services that store data outside the Russian Federation to collect personal data.

---

9. Cookies and similar technologies

1. Only necessary cookies, without which the Website does not work, are used on the Website: the session identifier (PHPSESSID) and service cookies of the Website management system (BITRIX_SM_*), protection of forms against request forgery, and remembering that the visitor has read the cookie notice (cookie investkbr_cc_v1 and the investkbr_cookie_consent entry in browser storage, 12 months). They are not used for analytics or advertising.
2. Analytics cookies (including Yandex Metrica), marketing and advertising cookies are not used on the Website.
3. The visitor may delete cookies or block them in the browser settings; if necessary cookies are blocked, some Website functions (submitting forms, logging in to the personal account) may not work properly.

---

10. Periods of processing and destruction of personal data

1. The periods of processing and storage are set for each purpose in section 5. Copies of notifications about received enquiries in the Website mail queue are kept for no longer than 30 days.
2. Personal data are destroyed when the purposes of processing are achieved, when the need to achieve them is lost, when the storage period expires, when consent is withdrawn (unless there is another ground for processing) and when unlawful processing is detected — within the periods established by Article 21 of the Personal Data Law.
3. Destruction is confirmed by a personal data destruction certificate and an extract from the event log of the information system in accordance with the Requirements approved by Roskomnadzor Order No. 179 of 28.10.2022. Certificates are kept for 3 years.

---

11. Measures to ensure the security of personal data

The Operator takes the legal, organizational and technical measures provided for by Articles 18.1 and 19 of the Personal Data Law to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions. The requirements for the protection of personal data processed in the Website information system are determined in accordance with Decree of the Government of the Russian Federation No. 1119 of 1 November 2012.

In particular:

• a person responsible for organising personal data processing has been appointed; this Policy, the consent form, storage periods and the procedure for destruction of personal data have been approved;
• only the Operator's employees and contractors who need access to perform their duties have access to personal data in the administrative part of the Website; access is password-protected and restricted by rights;
• personal data is transmitted over secure communication channels (HTTPS, TLS 1.2 or higher);
• the IP address, User-Agent string and page address in the consent logs are stored only as cryptographic hashes (HMAC-SHA256);
• actions in the administrative part of the Website and requests to the Website are recorded in event logs;
• backup copies of the Website database are kept outside the public part of the Website with restricted access;
• automated form submissions are checked by built-in tools on the Website server, without transferring visitor data to third-party services.

Detailed information about organizational and technical measures is confidential and is not published in full to avoid lowering the level of protection.

---

12. Internal regulations

The Operator appoints a person responsible for organising personal data processing, approves this Policy, the consent forms and the procedure for destruction of personal data, and familiarises employees who process personal data with the legislation and internal regulations (Articles 18.1 and 22.1 of the Personal Data Law).

---

13. Rights of personal data subjects

The personal data subject has the following rights (Articles 14 and 21 of the Personal Data Law):

1. To receive information regarding the processing of his or her personal data, including:
   • confirmation of the fact of processing of personal data by the Operator;
   • legal grounds and purposes of processing;
   • the processing methods used by the Operator;
   • the name and location of the Operator;
   • information about the persons (with the exception of the Operator's employees) who have access to personal data;
   • the personal data being processed that relate to the subject and the source of their receipt;
   • the periods of processing of personal data, including the periods of their storage;
   • the procedure for the exercise by the subject of the rights provided for by law.
2. To require the clarification of his or her personal data, their blocking or destruction in the event that they are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing.
3. To withdraw his or her consent to the processing of personal data (the withdrawal procedure is described in section 14).
4. To appeal against the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.
5. To the protection of his or her rights and legitimate interests, including compensation for damages and (or) compensation for moral harm in court.

To exercise the above rights, the subject may send a written request to the postal address 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57 or an electronic request to the email address consult@air-kbr.ru.

A request is considered within 10 business days from the date of receipt; this period may be extended by no more than 5 business days (Articles 14 and 20 of the Personal Data Law).

---

14. Withdrawal of consent and requests from subjects

1. Consent to processing of data from forms and on registration is withdrawn by e-mail to consult@air-kbr.ru or by post to 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57. The request should contain information allowing the applicant to be identified (surname, first name, patronymic; the e-mail address given in the form or account; the date of the enquiry, if available). The user account may be deleted on request sent to the same addresses.
2. On receipt of a withdrawal, the Operator stops processing and destroys the personal data within 30 days (Part 5 of Article 21 of the Personal Data Law), unless there is another ground for processing.
3. Requests from subjects for information about the processing of their personal data are considered within 10 business days from the date of receipt; the period may be extended by no more than 5 business days with a reasoned notice (Articles 14 and 20 of the Personal Data Law).

---

15. Incidents

If an unlawful or accidental transfer (provision, dissemination, access) of personal data is established, the Operator notifies Roskomnadzor of the incident within 24 hours and of the results of the internal investigation within 72 hours (Part 3.1 of Article 21 of the Personal Data Law).

---

16. Contacts and appeals

Questions about personal data processing may be sent to the Operator: postal address — 360001, Кабардино-Балкарская Республика, г. Нальчик, пр-кт Ленина, д. 57; e-mail — consult@air-kbr.ru; telephone — +7 (8662) 77-20-17.

Actions or inaction of the Operator may be appealed to Roskomnadzor (https://rkn.gov.ru/) or in court.

---

17. Changes to the Policy

1. The Operator may amend the Policy. A new revision takes effect on the date of its publication on the Website unless otherwise stated in it. The current revision is always available at https://invest-kbr.ru/agreement/; the English version (translation) — at https://invest-kbr.ru/en/agreement/. In case of any discrepancy, the Russian text prevails.
2. Changes in version 1.2 compared with version 1.1:
   • the Website does not use Yandex Metrica or other metric programs: the "Web analytics" purpose, the category of visitors who consented to web analytics and Yandex LLC as a person processing data on behalf of the Operator are removed (sections 1, 3, 5, 7, 8); consent to web analytics is no longer requested (section 14);
   • section 9 — necessary cookies only;
   • section 11 — the list of measures actually applied;
   • the telephone number for enquiries and the information about the person responsible for organising personal data processing are updated (section 2).
3. Changes in version 1.1 compared with version 1.0:
   • purposes of processing are described separately, each with the subjects, list of data, legal ground under Part 1 of Article 6 of the Personal Data Law, actions, periods and destruction procedure (section 5);
   • instead of Clause 4 of Part 1 of Article 6 (not applicable to the Operator), Clause 2 of Part 1 of Article 6 with reference to acts of the Kabardino-Balkarian Republic is given for investment project support;
   • consents are set out as separate documents (Part 1 of Article 9 of the Personal Data Law);
   • Yandex Metrica runs only after consent; the list of data and the role of Yandex LLC as a person acting on behalf of the Operator are specified (subsection 5.3, section 9);
   • persons processing data on behalf of the Operator and third-party services on Website pages are listed (section 7);
   • information about services no longer used on the Website (AI assistant, marketing and functional cookies) is removed;
   • storage periods of service logs and the procedure for confirming destruction are added (sections 5 and 10);
   • the registration number in the register of operators and information about the person responsible for organising personal data processing are given (section 2).