Personal Data Processing Policy

1. General provisions

This Personal Data Processing Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Personal Data Law”). It defines the procedure for processing personal data and the measures for ensuring personal data security taken by BiometricLabs Limited Liability Company (the “Operator”).

1.1. The Operator considers respect for the rights and freedoms of individuals when processing personal data, including the protection of privacy and personal and family secrets, an essential condition of its activities.

1.2. This Policy applies to all information the Operator may obtain about visitors to https://biometriclabs.ru.

2. Key terms

Automated processing means processing using computer equipment. Blocking means temporary suspension of processing. A website is the set of information materials, software, and databases accessible at the website address. An information system of personal data is the data contained in databases together with the technology and equipment used to process it.

Depersonalisation means actions making it impossible to identify a particular user without additional information. Processing means any operation with personal data, including collection, recording, organisation, storage, updating, retrieval, use, transfer, dissemination, provision of access, depersonalisation, blocking, deletion, or destruction.

The Operator is a public authority, legal entity, or individual that organises and/or carries out processing and determines its purposes and scope. Personal data is any information relating directly or indirectly to an identified or identifiable website user. A User is any website visitor.

Provision means disclosure to a specified person or group; dissemination means disclosure to an unlimited group, including publication in mass media or information networks. Cross-border transfer means transfer to a foreign state, authority, individual, or legal entity. Destruction means irreversible destruction of data and/or the physical media containing it.

3. Operator’s rights and obligations

The Operator may obtain accurate information and/or documents containing personal data and may continue processing without consent where grounds under the Personal Data Law exist after consent is withdrawn or a request to stop processing is received. The Operator independently determines the measures necessary and sufficient to meet its legal duties, unless otherwise required by law.

The Operator shall provide information about processing at the data subject’s request, organise processing in accordance with Russian law, respond to requests from data subjects and their representatives, provide information to the competent authority when requested, ensure unrestricted access to this Policy, protect personal data by legal, organisational, and technical measures, and stop transfer, processing, or destroy data in the cases prescribed by law.

4. Data subjects’ rights and obligations

Data subjects may obtain information about processing, request correction, blocking, or destruction of incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary data, require prior consent for direct marketing, withdraw consent, request termination of processing, and challenge unlawful acts or omissions before the competent authority or a court.

Data subjects shall provide accurate information and notify the Operator when their data is corrected, updated, or changed. Persons providing inaccurate information about themselves or another data subject without consent bear liability under Russian law.

5. Principles of processing

Processing is lawful and fair; is limited to specific, predetermined, and legitimate purposes; does not combine databases processed for incompatible purposes; covers only data relevant to those purposes; and is not excessive in scope. The Operator ensures data accuracy, sufficiency, and relevance and takes measures to correct or delete incomplete or inaccurate data.

Data is stored in a form allowing identification of the data subject no longer than required by the purposes of processing, unless a different period is prescribed by law or contract. Data is destroyed or depersonalised once the purposes are achieved or no longer necessary, unless federal law provides otherwise.

6. Purposes and scope of processing

The Operator processes data to inform users by email and to provide access to website services, information, and materials. The data may include surname, first name, patronymic, email address, telephone numbers, and company name.

The legal basis is Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and Information Protection” and other applicable legislation. Processing may include collection, recording, organisation, storage, updating, retrieval, use, transfer, depersonalisation, blocking, deletion, and destruction.

7. Legal grounds for processing

Personal data is processed with the data subject’s consent and where necessary to meet purposes set by an international treaty or law; to perform legal functions, powers, and duties; to administer justice or execute an enforceable act; to perform or enter into a contract; to protect the lawful interests of the Operator or third parties or achieve socially significant purposes without infringing rights and freedoms; or where data has been made publicly available by the subject or must be published by law.

8. Collection, storage, transfer, and other processing

The Operator ensures personal data security through legal, organisational, and technical measures required by applicable law. It preserves data and takes all reasonable measures to prevent access by unauthorised persons.

User data is not transferred to third parties except where required by law or where the data subject has consented to transfer for the performance of a civil-law contract. A user may update data or withdraw consent by emailing info@biometriclabs.ru with the subject “Personal Data Update” or “Withdrawal of Consent to Personal Data Processing”, respectively.

The processing period is determined by the purposes for which data was collected, unless a different period is required by contract or law. Information collected by third-party services is stored and processed by those providers under their own user agreements and privacy policies. The Operator is not responsible for their actions.

Restrictions set by a data subject on transfer or processing of data permitted for dissemination do not apply where processing is carried out in state, public, or other public interests defined by Russian law. The Operator maintains confidentiality and ceases processing when its purpose is achieved, consent expires or is withdrawn, a termination request is received, or unlawful processing is identified.

9. Actions performed with personal data

The Operator performs collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer, dissemination, provision of access, depersonalisation, blocking, deletion, and destruction. Automated processing may be carried out with or without receiving and/or transferring information through information and telecommunications networks.

10. Cross-border transfer

Before commencing cross-border transfer, the Operator shall notify the competent authority of its intention. Before filing that notification, the Operator shall obtain the relevant information from foreign authorities, individuals, and legal entities to whom transfer is planned.

11. Confidentiality

The Operator and other persons with access to personal data shall not disclose or disseminate it without the data subject’s consent unless federal law provides otherwise.

12. Final provisions

For questions about processing personal data, users may contact the Operator at info@biometriclabs.ru. The Operator may amend this Policy; it remains in effect until replaced by a new version. The current version is available at https://biometriclabs.ru/en/privacy/.