POLICY FOR PERSONAL DATA PROCESSING IN VERTEST LLC

1. General Provisions

1.1. This Policy defines the procedure for processing personal data and measures to ensure the security of personal data at VERTEST LLC (hereinafter referred to as the Operator) in order to protect human and civil rights and freedoms when processing their personal data.

1.2. The Policy has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as 152-FZ).

1.3. The Policy applies to all personal data subjects whose data is processed by the Operator, including:

visitors to the Operator's website on the Internet;
clients and counterparties of the Operator (individuals);
employees and job applicants of the Operator.

2. Information about the Operator

2.1. Full name: VERTEST Limited Liability Company.

2.2. Legal and actual address: 125476, Russia, Moscow, Vasiliya Petushkova St., 8, floor 3, room 352.

2.3. General Director: Roman Valeryevich Suprun.

2.4. Contact phone number: +7 (495) 740-0655.

2.5. Person responsible for organizing personal data processing: General Director Roman Valeryevich Suprun.

3. What personal data we collect and why

3.1. Website visitors

When filling out a feedback form, an application on the website, or sending a message by email, the Operator may process:

last name, first name, patronymic (if any);
contact phone number;
email address;
message or application text.

Purposes of processing:

responding to the user's request;
providing requested information about the Operator's services;
concluding and executing contracts (if the user expresses their will).

3.2. Clients and counterparties (individuals)

The Operator processes personal data of clients and counterparties in the context of concluding and executing contracts, as well as to comply with tax and accounting legislation requirements.

The list of data may include:

last name, first name, patronymic;
passport data (when concluding a contract);
registration and actual residence address;
contact phone number;
email address;
Taxpayer Identification Number (INN), Individual Personal Account Insurance Number (SNILS) (Article 85 of the Tax Code of the Russian Federation);
bank details (for transferring funds).

Purposes of processing:

concluding and executing contracts;
issuing invoices, accepting payments, refunding funds;
complying with tax and accounting legislation requirements;
informing about changes to contract terms, promotions, and offers (with the client's consent).

3.3. Employees and job applicants

Processing of employee personal data is carried out in accordance with the labor legislation of the Russian Federation and the Operator's local regulations.

Purposes of processing:

maintaining personnel and accounting records;
complying with tax and pension legislation requirements;
ensuring access control;
organizing business trips and training.

The procedure for processing employee personal data can be found in the Operator's internal document — "Regulations on Personal Data Processing".

4. Legal grounds for processing personal data

The Operator processes personal data only if one of the following grounds exists:

consent of the personal data subject to the processing of their personal data;
conclusion and execution of a contract to which the personal data subject is a party;
requirement of federal law (e.g., tax, labor, accounting legislation).

5. Conditions for processing and transferring personal data to third parties

5.1. The Operator does not disclose personal data to third parties without the subject's consent, except in cases expressly provided for by federal law (e.g., at the request of a court, prosecutor's office, or investigative authorities).

5.2. The Operator has the right to transfer personal data to third parties in the following cases:

the subject has explicitly expressed their consent to such transfer;
the transfer is necessary to execute a contract (e.g., to a transport company for goods delivery, to a bank for fund transfers);
the transfer is required to comply with tax, pension, or accounting legislation (e.g., to the Federal Tax Service, Pension Fund, Social Insurance Fund).

5.3. When transferring personal data, the Operator enters into a processing agreement with the third party (if required by law) and requires confidentiality.

6. Periods for processing and storing personal data

6.1. Personal data is processed no longer than required by the purposes of its processing, unless a different period is established by federal law or contract.

6.2. Specific storage periods:

website visitor data (feedback forms) — until the purpose of the response is achieved, but no more than 1 year from the date of the last contact, unless otherwise provided by contract;
client and counterparty data — for the duration of the contract and for 5 years after its expiration (to comply with tax and accounting legislation requirements);
employee data — in accordance with the records retention schedule and archival document storage periods (50 years for personal files, pay slips, and hiring/firing orders).

6.3. Upon expiration of the storage period, personal data is destroyed or anonymized, unless otherwise provided by law.

7. Rights of personal data subjects

As a personal data subject, you have the right to:

7.1. Obtain information about the processing of your personal data (including confirmation of processing, list of data being processed, processing periods, etc.).

7.2. Request clarification (correction) of your personal data if it is incomplete, outdated, or inaccurate.

7.3. Withdraw consent to the processing of personal data (if processing is based solely on consent).

Withdrawal of consent is carried out by sending a written notice to the Operator's address or email specified in Section 8. Withdrawal of consent does not have retroactive effect regarding processing already performed.

7.4. Request termination of processing and destruction of personal data if it is no longer required for the stated purpose of processing or if processing is carried out unlawfully.

7.5. Appeal the Operator's actions or inactions to the authorized body for the protection of personal data subjects' rights (Roskomnadzor) or to court.

8. How to exercise your rights

To exercise your rights, you can send a request to the Operator in one of the following ways:

By Russian Post: 125476, Russia, Moscow, Vasiliya Petushkova St., 8, floor 3, room 352 (marked "For the person responsible for personal data processing").
By email: info@vertest.ru
In person at: Moscow, Vasiliya Petushkova St., 8, floor 3, room 352 (by prior appointment).

A written request must contain:

last name, first name, patronymic of the subject;
number of the primary identification document;
information confirming your relationship with the Operator (e.g., contract number, date and time the form was submitted on the website);
essence of the request (what exactly you want: correct, delete, obtain information);
your signature (for a written request).

The Operator is obliged to respond to the request within 10 business days (unless a different period is established by 152-FZ).

9. Measures to ensure the security of personal data

The Operator takes the following measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, and distribution:

appointing a person responsible for personal data processing;
approving local regulations on personal data processing and protection;
familiarizing employees directly involved in personal data processing with the provisions of 152-FZ and this Policy;
organizing access control to the Operator's premises;
using antivirus and firewall software;
backing up databases;
differentiating access rights to information systems;
regular internal monitoring of compliance with personal data protection requirements.

10. Processing of cookies and other technologies

The Operator's website may use cookies and similar technologies to ensure the website's functionality, collect visit statistics, and improve website performance.

The user can disable cookies in their browser settings at any time, but this may affect the correct functioning of some website features.

Processing of data obtained through cookies is carried out under the terms of this Policy.

11. Final provisions

11.1. This Policy is a publicly available document. The current version of the Policy is posted on the Operator's website at: https://vertest.ru/policy/

11.2. The Operator has the right to make changes to this Policy. The new version of the Policy comes into force from the moment it is posted on the website, unless otherwise provided by the new version.

11.3. Control over compliance with the requirements of this Policy is carried out by the person responsible for personal data processing.