Personal Data Processing Policy

1.1. Operator

The Crystal Fund JSC, TIN 5032371938, OGRN 1235000154399, address: office 02-20/4B, 14 Chikina St., Odintsovo, Odintsovsky urban district, Moscow Region, 143005 (the “Operator”).

1.2. The Policy applies to all personal data that the Operator receives from Website visitors and by other lawful means in the course of its activities.

1.3. The Operator does not control and is not responsible for third-party websites that the User may visit via links available on the Website.

1.4. Key terms

Key terms are used in the meanings defined by article 3 of Federal Law No. 152-FZ:

• personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
• processing of personal data — any action or set of actions performed on personal data, with or without automation;
• operator — a person who organises and/or carries out the processing of personal data and determines the purposes and scope of the data processed;
• personal data subject — the individual to whom the relevant data relates;
• user — any person visiting the Website and using its information, materials and services. A Website user is a personal data subject within the meaning of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”;
• Website services — interactive (dialogue) software components on the Website's pages used for integration with information systems and giving Website users certain ways to access information on the Website.

1.5. Rights and obligations of the Operator

1.5.1. The Operator shall:

• process personal data solely for the purposes set out in the Policy, in the manner established by the current legislation of the Russian Federation;
• not disclose personal data without the User's consent, unless otherwise provided by law;
• process personal data in compliance with the principles and rules set by Federal Law No. 152-FZ;
• organise the protection of personal data;
• consider the User's requests on personal data processing and give reasoned responses;
• provide the User with free access to their personal data;
• take measures to clarify, block and destroy personal data in cases established by law.

1.5.2. The Operator has the right to:

• independently determine the composition and list of measures necessary and sufficient to fulfil the obligations under personal data legislation;
• entrust the processing of personal data to another person with the User's consent, unless otherwise provided by federal law, on the basis of a contract concluded with that person;
• if the User withdraws consent, continue processing personal data without the User's consent where there are grounds provided by law;
• obtain from the User accurate information and/or documents containing their personal data for the processing purposes set out in clause 2.2 of the Policy;
• require the User to promptly update the personal data provided.

1.6. Rights and obligations of the User

1.6.1. The User shall:

• ensure the accuracy of the personal data provided to the Operator;
• provide the Operator, if necessary, with information to update the personal data provided.

1.6.2. The User has the right to:

• receive information concerning the processing of their personal data by the Operator;
• give prior consent to the processing of personal data for receiving advertising;
• take measures provided by law to protect their rights;
• appeal against unlawful actions or omissions of the Operator;
• require the clarification, blocking or destruction of their personal data in cases provided by law;
• withdraw consent to the processing of personal data.

1.6.3. Requests should be sent to info@crystalfund.ru or by post to: office 02-20/4B, 14 Chikina St., Odintsovo, Moscow Region, 143005.

1.6.4. The Operator considers the request and gives a reasoned response within 10 working days of receipt. This period may be extended by no more than 5 working days with notice to the subject stating the reasons for the extension.

1.6.5. Withdrawal of consent may be sent in free form to the same address. From the moment the withdrawal is received, the Operator stops processing, except where the law permits processing without the subject's consent.

1.7. The Operator and Users also have other rights and obligations provided by the legislation of the Russian Federation.

2.1. Personal data processing is limited to achieving specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of their collection is not permitted.

2.2. The Operator processes personal data solely for the following purposes:

• establishing feedback with the User, including processing enquiries and requests;
• organising interaction with representatives of Russian and foreign companies interested in locating production and obtaining resident status in the Russian Industrial Zone in Egypt;
• assessing the feasibility and parameters of locating production projects in the Russian Industrial Zone in Egypt;
• informing about the project's development, sending materials and invitations — subject to the subject's separate consent;
• fulfilling obligations imposed on the Operator by the legislation of the Russian Federation;
• ensuring the Website's operation and collecting anonymised visitor statistics;
• providing the User with customer and technical support;
• sending advertising to the User — only with their separate prior consent.

2.3. Personal data is not processed for any other purposes.

3.1. The legal grounds for processing personal data are:

• Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and related regulatory legal acts;
• the personal data subject's consent to the processing of their personal data.

Consent to the processing of personal data is given by the User separately from other confirmations and documents after reading this Policy and the text of the Consent to the processing of personal data.

Consent is given by the User ticking a separate checkbox that is not pre-selected:

“I give my Consent to the processing of personal data and confirm that I have read the Personal Data Processing Policy.”

Before ticking the box, the User has access to the full text of the Consent to the processing of personal data and this Personal Data Processing Policy via the corresponding links in the form.

The form cannot be submitted without ticking this box.

Consent to receive advertising and information materials, if offered on the Website, is given separately and is not included in the consent to the processing of personal data required to submit the form.

4.1.1. Website visitors who submit an enquiry

We process the data the subject provides when filling in the form:

• surname, first name;
• name of organisation;
• country;
• e-mail address;
• telephone number;
• information about the project, area of interest and other information voluntarily provided by the User in the enquiry.

4.1.2. Website visitors

We process technical data transmitted automatically when using the Website: IP address, information about the User's browser and device, technical characteristics of hardware and software, date and time of access, addresses of requested pages, referral source, history of requests and views.

This data is used to ensure the Website's operation and to compile statistics.

4.2. The Operator does not process special categories of personal data or biometric personal data.

4.3. The Operator does not process the personal data of minors. The Website's forms are not intended for persons under 18.

4.4. The Operator does not make decisions producing legal consequences for the subject solely on the basis of automated processing.

4.5. The Operator ensures that the content and scope of the personal data processed correspond to the stated purposes of processing.

5.1. The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

5.2. Personal data is processed in a mixed manner — with and without automation.

5.3. Personal data is processed subject to the User's consent, except in cases established by law where processing may be carried out without such consent.

The Operator records the fact of consent in a way that makes it possible to confirm consent by a specific User and the version of the Consent in force at the time it was given.

5.4. The User decides to provide their personal data and gives Consent freely, of their own will and in their own interest.

5.5. Processing periods

Personal data is processed until the processing purposes are achieved or the need to achieve them ceases, but no longer than 3 (three) years from the date of the last interaction with the subject, or until consent is withdrawn — whichever occurs first.

Once the purposes are achieved or consent is withdrawn, the data is destroyed or anonymised within no more than 30 days, unless a different period is established by law.

5.6. The Operator stores information confirming that the User has given consent to the processing of personal data for the duration of processing and in other cases and periods provided by the legislation of the Russian Federation.

5.7. The Operator takes the necessary legal, organisational and technical measures to protect personal data.

5.8. Storage and localisation

Recording, systematisation, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation.

5.9. Storage and transfer of personal data

Personal data provided by the User through the form on the Website is sent to the Operator's corporate e-mail and stored on the Operator's server.

The Operator does not disclose or transfer personal data to third parties without the subject's consent, except in cases expressly provided by the legislation of the Russian Federation.

5.10. Cross-border transfer

The Operator does not carry out cross-border transfer of personal data.

5.11. Confidentiality

Operator employees who have access to personal data must not disclose it to third parties or disseminate it without the subject's consent, unless otherwise provided by law.

5.12. If an unlawful or accidental transfer (provision, dissemination, access) of personal data is established that has resulted in a violation of personal data subjects' rights, the Operator notifies the authorised body for the protection of personal data subjects' rights:

• within 24 hours of identifying the incident — about the incident, its presumed causes and the harm caused to the rights of personal data subjects, as well as the measures taken to eliminate its consequences;
• within 72 hours of identifying the incident — about the results of the internal investigation of the incident, and provides information about the persons whose actions caused the incident, if available.

5.13. The Operator takes the necessary measures to prevent losses and other negative consequences caused by unlawful or accidental transfer of personal data.

6.1. The Operator takes the legal, organisational and technical measures provided by law, including:

• appointing a person responsible for organising personal data processing;
• issuing local acts on personal data processing and protection;
• identifying security threats and applying the necessary protective measures;
• restricting and differentiating access to personal data;
• keeping records of machine media and detecting unauthorised access;
• using a secure connection (HTTPS) when transmitting data from the Website;
• internal control over compliance of processing with legal requirements.

7.1. The Website uses cookies — small text files stored by the browser — to ensure the correct operation of the interface and to collect statistics.

7.2. Cookies can be disabled in your browser settings. Disabling cookies may affect how certain elements of the Website work.

8.1. When the processing purpose is achieved, the Operator stops processing and destroys the data within no more than 30 days, unless otherwise provided by contract or law.

8.2. If unlawful processing is identified, the Operator stops it within the time limits and in the manner provided by the legislation of the Russian Federation.

9.1. The Operator is liable for violating the requirements of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” in accordance with the legislation of the Russian Federation.

9.2. Disputes and disagreements arising from relations between the User and the Operator are resolved in accordance with the current legislation of the Russian Federation.

10.1. The current version of the Policy is publicly available at:

https://russianindustrialzone.ru/privacy.html

10.2. The Operator may amend the Policy without the User's consent. The new version comes into force when published on the Website, unless otherwise provided by the new version.

10.3. All suggestions or questions regarding the Policy and personal data processing should be sent to:

info@crystalfund.ru

+7 (495) 129-04-44