1. General Provisions

This Privacy Policy on Personal Data Processing (hereinafter referred to as the “Policy”) has been developed in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and defines the procedure for processing personal data and the measures taken by LLC “Center for Economic Cooperation and Investment Development” (hereinafter referred to as the “Operator”) to ensure the security of personal data.

1.1. The Operator’s primary objective and condition for carrying out its activities is compliance with the rights and freedoms of individuals and citizens when processing their personal data, including the protection of rights to privacy, personal and family secrets.

1.2. This Policy applies to all information that the Operator may obtain about visitors to the website https://cecid.net .

2. Key Definitions Used in the Policy

2.1. Automated Processing of Personal Data – processing of personal data using computing equipment.

2.2. Blocking of Personal Data – temporary suspension of personal data processing (except where processing is necessary to clarify personal data).

2.3. Website – a set of graphic and informational materials, as well as computer programs and databases that ensure accessibility on the internet at the network address https://cecid.net .

2.4. Personal Data Information System – a combination of personal data contained in databases and the information technologies and technical means used to process them.

2.5. Anonymization of Personal Data – actions as a result of which it is impossible to identify the personal data of a specific User or other data subject without additional information.

2.6. Processing of Personal Data – any action (operation) or set of actions (operations) performed with or without automation tools involving personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.

2.7. Operator – a state body, municipal body, legal entity, or individual who independently or jointly with others organizes and/or carries out personal data processing and determines the purposes of processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.

2.8. Personal Data – any information relating directly or indirectly to a specific or identifiable User of the website https://cecid.net .

2.9. Personal Data Authorized by the Data Subject for Dissemination – personal data for which the data subject has granted consent for unrestricted access by an unlimited number of persons, in accordance with the procedure established by the Personal Data Law (hereinafter referred to as “personal data authorized for dissemination”).

2.10. User – any visitor to the website https://cecid.net .

2.11. Provision of Personal Data – actions aimed at disclosing personal data to a specific person or specific group of persons.

2.12. Dissemination of Personal Data – any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or making personal data accessible to an unlimited number of persons, including publication in mass media, posting in information and telecommunications networks, or providing access to personal data by any other means.

2.13. Cross-Border Transfer of Personal Data – transfer of personal data to the territory of a foreign state to a foreign government authority, foreign individual, or foreign legal entity.

2.14. Destruction of Personal Data – any actions resulting in the irreversible destruction of personal data, making further restoration of personal data content in the personal data information system impossible and/or destroying physical media containing personal data.

3. Operator’s Main Rights and Obligations

3.1. The Operator has the right to:

— obtain accurate information and/or documents containing personal data from the data subject;

— continue processing personal data without the data subject’s consent if the data subject withdraws consent or submits a request to cease processing, provided there are grounds specified in the Personal Data Law;

— independently determine the scope and list of measures necessary and sufficient to fulfill obligations under the Personal Data Law and related regulatory legal acts, unless otherwise provided by the Personal Data Law or other federal laws.

3.2. The Operator is obligated to:

— provide the data subject, upon request, with information regarding the processing of their personal data;

— organize personal data processing in accordance with applicable Russian legislation;

— respond to requests and inquiries from data subjects and their legal representatives in accordance with the Personal Data Law;

— provide the authorized body for the protection of data subjects’ rights with the required information within 10 days of receiving such a request;

— publish or otherwise ensure unrestricted access to this Policy;

— implement legal, organizational, and technical measures to protect personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, provision, dissemination, or other unlawful actions;

— cease the transfer (dissemination, provision, access) of personal data, stop processing, and destroy personal data in the manner and cases stipulated by the Personal Data Law;

— fulfill other obligations as required by the Personal Data Law.

4. Rights and Obligations of Personal Data Subjects

4.1. Data subjects have the right to:

— receive information regarding the processing of their personal data, except in cases provided by federal laws. Such information shall be provided by the Operator in an accessible form and shall not include personal data of other data subjects unless legally permitted;

— request the Operator to correct, block, or delete their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose, and to take lawful measures to protect their rights;

— require prior consent for the processing of personal data for marketing purposes;

— withdraw consent for personal data processing and/or submit a request to cease processing;

— appeal unlawful actions or omissions by the Operator to the authorized body for the protection of data subjects’ rights or in court;

— exercise other rights granted under Russian legislation.

4.2. Data subjects are obligated to:

— provide the Operator with accurate personal information;

— notify the Operator of any updates (corrections, changes) to their personal data.

4.3. Individuals who provide the Operator with false information about themselves or about another data subject without their consent shall be held liable under Russian law.

5. Principles of Personal Data Processing

5.1. Personal data shall be processed lawfully and fairly.

5.2. Processing shall be limited to specific, predetermined, and lawful purposes. Processing incompatible with the original collection purposes is prohibited.

5.3. Databases containing personal data processed for incompatible purposes shall not be merged.

5.4. Only personal data relevant to the processing purposes shall be processed.

5.5. The content and volume of processed personal data shall correspond to the stated purposes. Excessive data collection is prohibited.

5.6. Personal data shall be accurate, sufficient, and, where necessary, up to date in relation to the processing purposes. The Operator shall take necessary measures to delete or correct incomplete or inaccurate data.

5.7. Personal data shall be stored in a form that permits identification of the data subject only for as long as necessary to achieve the processing purposes, unless a longer retention period is required by federal law, contract, or if the data subject is a party, beneficiary, or guarantor under such contract. Upon achievement of the processing purposes or if such purposes are no longer relevant, personal data shall be destroyed or anonymized, unless otherwise required by federal law.

6. Purposes of Personal Data Processing

Purpose: To provide the User with access to services, information, and/or materials available on the website.

Legal Basis: Federal Law No. 149-FZ “On Information, Information Technologies, and Information Protection” dated July 27, 2006.

7. Conditions for Personal Data Processing

Personal data may be processed if at least one of the following conditions applies:

7.1. The data subject has given consent to the processing of their personal data.

7.2. Processing is necessary to fulfill obligations under an international treaty of the Russian Federation or a federal law, or to perform functions, powers, and duties assigned to the Operator by Russian legislation.

7.3. Processing is necessary for the administration of justice, enforcement of a court decision, or other enforceable rulings in accordance with Russian enforcement legislation.

7.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary, or guarantor, or to conclude a contract at the data subject’s initiative.

7.5. Processing is necessary to protect the legitimate interests of the Operator or third parties, or to achieve publicly significant objectives, provided that the rights and freedoms of the data subject are not violated.

7.6. The data subject has made their personal data publicly available or has requested such disclosure (“public personal data”).

7.7. Processing is required by federal law for publication or mandatory disclosure.

8. Procedure for Collection, Storage, Transfer, and Other Processing of Personal Data

The security of personal data processed by the Operator is ensured through legal, organizational, and technical measures fully compliant with current personal data protection legislation.

8.1. The Operator ensures the confidentiality and integrity of personal data and takes all possible measures to prevent unauthorized access.

8.2. The User’s personal data shall never be transferred to third parties, except where required by law or with the data subject’s explicit consent for the performance of a civil contract.

8.3. If inaccuracies are identified in personal data, the User may update them by sending a notice to the Operator’s email address info@cecid.net with the subject line “Update of Personal Data.”

8.4. The processing period lasts until the purpose of collection is achieved, unless a different term is stipulated by contract or law. The User may withdraw consent at any time by emailing info@cecid.net with the subject line “Withdrawal of Consent to Personal Data Processing.”

8.5. Information collected by third-party services (e.g., payment systems, communication platforms, or other service providers) is stored and processed by those entities in accordance with their own User Agreements and Privacy Policies. The Operator is not liable for the actions of such third parties.

8.6. Restrictions imposed by the data subject on the transfer (except access provision) or processing of publicly available personal data do not apply when processing is carried out in state, public, or other legitimate interests as defined by Russian law.

8.7. The Operator ensures the confidentiality of personal data during processing.

8.8. Personal data is stored in an identifiable form only for as long as necessary to achieve the processing purposes, unless a longer retention period is required by federal law or contract.

8.9. Processing may be terminated upon: achievement of processing purposes, expiration or withdrawal of consent, a request to cease processing, or detection of unlawful processing.

9. List of Actions Performed by the Operator with Personal Data

9.1. The Operator performs the following actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.

9.2. The Operator carries out automated processing of personal data, with or without transmission via information and telecommunications networks.

10. Cross-Border Transfer of Personal Data

10.1. Prior to initiating cross-border data transfers, the Operator must notify the authorized body for the protection of data subjects’ rights of its intention to carry out such transfers (this notification is submitted separately from the general data processing notification).

10.2. Before submitting the above notification, the Operator must obtain relevant information from the foreign government authorities, foreign individuals, or foreign legal entities to which the personal data will be transferred.

11. Confidentiality of Personal Data

The Operator and any other persons who gain access to personal data are prohibited from disclosing or disseminating such data to third parties without the data subject’s consent, unless otherwise required by federal law.

12. Final Provisions

12.1. Users may obtain clarifications on any matters concerning the processing of their personal data by contacting the Operator at info@cecid.net .

12.2. This document will reflect any amendments to the Operator’s personal data processing policy. The Policy remains in effect indefinitely until replaced by a new version.

12.3. The current version of the Policy is freely accessible online at: https://cecid.net/polytics .