Personal data processing policy

Website address: https://algimed-techno.com.

---

1. General Provisions and Scope

1. 1.1. This Personal Data Processing Policy (hereinafter — the "Policy") is an internal document of the Operator - Algimed Techno LLC (hereinafter — the "Operator", "Company", "We") and defines the basic principles, purposes, procedure and conditions for the processing of personal data, as well as requirements for the personal data protection system.
2. 1.2. The Policy is developed in accordance with:
   • - Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (RF);
   • - Law of the Republic of Belarus No. 99-Z of May 7, 2021 "On Personal Data Protection";
   • - other regulatory legal acts of the RF and RB in the field of personal data processing and protection.
3. 1.3. The Policy is binding on all employees and other persons involved in the processing of personal data within the Operator's activities. The public version of the Policy is posted on the Website for review by an unlimited number of persons.
4. 1.4. The Operators are:
   • - For citizens of the Russian Federation: Algimed Techno LLC (INN 9731082051);
   • - For citizens of the Republic of Belarus: Algimed Techno LLC (UNP 193208315).

---

2. Categories of Subjects and Composition of Processed Data

1. 2.1. Within the framework of this Policy, the Operator may process personal data of the following categories of subjects:
   • - Users of the Website https://algimed-techno.com (including potential and existing clients, counterparties and visitors);
   • - Clients and counterparties (representatives of legal entities and individuals with whom the Operator has concluded contracts or is conducting negotiations);
   • - Candidates for vacant positions (during the selection process and registration of employment relations).
2. 2.2. The list of processed personal data is determined by the purposes specified in Section 3, and may include:
   • - Last name, First name;
   • - Contact phone numbers;
   • - Email addresses;
   • - Company names and positions held;
   • - Gender;
   • - Country, city;
   • - Postal address;
   • - Data provided in the Candidate's application form (education, work experience, professional skills, references, and other information necessary for reviewing the candidacy);
   • - Other data communicated by the personal data subject to the Operator.
3. 2.3. Data collected automatically when visiting the Website:
   • - IP address;
   • - browser type and version;
   • - cookie data;
   • - information about devices and user actions collected using statistics services (Yandex.Metrica, Google Analytics).

   This information is processed on the basis of consent, which the user gives through a pop-up window upon the first visit to the Website, with the possibility of refusal at any time.

---

3. Purposes of Personal Data Processing

The processing of personal data is limited to the achievement of the following specific, predetermined and legitimate purposes:

1. 3.1. Commercial activities: conclusion and execution of contracts, invoicing, shipment of goods and provision of services.
2. 3.2. Marketing and communication: informing about products, services, promotions and special offers, conducting surveys and research. The User may always refuse to receive informational messages by sending a letter to the Operator at techno@algimed.com with the subject "Unsubscribe from notifications".
3. 3.3. Customer support: processing requests received by email, phone or through feedback forms on the Website.
4. 3.4. Internal business processes: maintaining accounting and tax records, document flow.
5. 3.5. Security: preventing fraud, protecting the Website and information systems from attacks and violations.

---

4. Legal Grounds for Processing

1. 4.1. Consent of the subject to the processing of personal data, obtained by accepting a public offer, filling out a form on the Website or in another written/electronic form.
2. 4.2. Necessity for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor.
3. 4.3. Necessity for the performance of duties imposed by law (including in the field of accounting, tax and labor records).
4. 4.4. Processing of data authorized by the subject for distribution in accordance with the legislation.

---

5. Principles and Conditions of Processing

The processing of personal data is based on the following principles:

1. 5.1. Legality and fairness — processing is carried out on a legal basis and with respect for the rights of subjects.
2. 5.2. Proportionality and accuracy — only data necessary for the stated purposes are processed, and measures are taken to update them.
3. 5.3. Transparency — the subject is informed about the processing of his/her data.
4. 5.4. Confidentiality — ensuring non-disclosure of data without the consent of the subject or other legal grounds.

Processing conditions:

1. 5.5. The Operator does not disclose or transfer personal data to third parties without the consent of the subject, except in cases established by the legislation of the RF and RB.
2. 5.6. Transfer of data to third parties (outsourcers) is carried out only on the basis of an agreement that includes obligations to ensure confidentiality.

---

6. Measures to Ensure Personal Data Security

To protect personal data from accidental or unauthorized access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions, the Operator takes the following measures:

1. 6.1. Organizational measures:
   • - appointment of a person (employee) responsible for organizing the processing and protection of personal data;
   • - approval of the list of persons with access to personal data;
   • - conducting internal control and audit of compliance of personal data processing with legal requirements;
   • - training and instruction of employees directly involved in data processing.
2. 6.2. Technical measures:
   • - use of encryption tools (SSL/TLS) when transferring data;
   • - differentiation of access rights to information systems and databases;
   • - use of antivirus and firewalls;
   • - regular software updates and vulnerability monitoring.
3. 6.3. Data localization:
   • - collection, systematization, accumulation and storage of personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation, in accordance with Part 5 of Art. 18 of Federal Law No. 152-FZ.

---

7. Procedure and Terms of Storage

1. 7.1. The processing of personal data is terminated upon achievement of the processing purposes, expiration of the consent period, withdrawal of consent or detection of unlawful processing.
2. 7.2. Personal data shall be destroyed or depersonalized upon achievement of the processing purposes or in other cases established by law, unless otherwise provided by federal laws or contracts.
3. 7.3. The terms of storage of personal data are determined by:
   • - the statute of limitations and archival storage periods established by law (for example, for accounting documents);
   • - the terms of contracts with counterparties;
   • - the period of validity of the subject's consent, unless otherwise established by law.

---

8. Rights and Obligations of Personal Data Subjects

The personal data subject has the right:

1. 8.1. To receive information relating to the processing of his/her personal data.
2. 8.2. To clarify, block or destroy his/her personal data if they are incomplete, outdated, inaccurate or obtained illegally.
3. 8.3. To withdraw his/her consent to the processing of personal data by sending a notice to techno@algimed.com with the subject "Withdrawal of consent to personal data processing".
4. 8.4. To appeal the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects or in court.

The subject is obliged:

1. 8.5. To provide accurate and up-to-date personal data.
2. 8.6. To promptly notify the Operator of changes in his/her personal data by sending a notice to techno@algimed.com with the subject "Updating personal data".

---

9. Cross-border transfer of personal data

1. 9.1. The Operator understands cross-border transfer of personal data as the transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign natural person, or a foreign legal entity.
2. 9.2. Before commencing cross-border transfer of personal data, the Operator is obliged to ensure that the foreign state to which the personal data is intended to be transferred provides reliable protection of personal data subjects' rights. All foreign states in accordance with the Federal Law "On Personal Data" dated 27.07.2006 No. 152-FZ are divided into two categories:
   • Countries ensuring adequate protection of personal data subjects' rights. These include parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as countries that have not signed this convention but comply with its requirements.
   • Countries not ensuring adequate protection of personal data subjects' rights.
3. 9.3. Cross-border transfer of personal data to the territories of foreign states not ensuring adequate protection of personal data subjects' rights may be carried out in the following cases:
   • availability of written consent from the personal data subject for cross-border transfer of their personal data;
   • performance of a contract to which the personal data subject is a party;
   • protection of life, health, other vital interests of the personal data subject or other persons when it is impossible to obtain written consent.
4. 9.4. Before commencing cross-border transfer of personal data, the Operator sends a notification of intent to carry out cross-border transfer to the authorized body for the protection of personal data subjects' rights (Roskomnadzor).
5. 9.5. Information on the location of databases and hosting providers:

1. 9.6. All processing of personal data, including collection, systematization, accumulation, storage, and clarification, is carried out using databases located in the territory of the Republic of Belarus (for data of Belarusian citizens) and in the territory of the Russian Federation (for data of Russian citizens).
2. 9.7. The Operator guarantees that access to personal data on the backup hosting is available only to authorized employees of the Operator.

---

10. Operator Contacts

For all questions related to the processing of personal data, you can contact us:

---

11. Final Provisions

1. 11.1. This Policy comes into force from the moment of its approval and is valid until a new version is adopted.
2. 11.2. All changes and additions to the Policy are approved by the head of the Operator and put into effect by order.
3. 11.3. The current version of the Policy is freely available on the Internet at: https://algimed-techno.com/en/data-processing-policy/.
4. 11.3. The current version of this Policy is freely available on the Internet at: https://algimed-techno.com/en/cookies-en/.