Personal Data Processing Policy of R7 JSC

The Personal Data Processing Policy (hereinafter the Policy) of R7 JSC (hereinafter the Company or the controller) establishes the basic principles, purposes, conditions and methods of personal data processing; the categories of data subjects and personal data processed by the Company; the Company's functions in processing personal data; the rights of data subjects; and the personal data protection requirements implemented by the Company.

This Policy applies to information that the Company may obtain about visitors to its website on the Internet information and telecommunications network with the second-level domain name r7-office.ru (hereinafter the Website), to the extent and for the purposes specified in this Policy.

The Policy has been developed taking into account the requirements of the Constitution of the Russian Federation and the laws and other regulatory legal acts of the Russian Federation concerning personal data.

The Policy is established in accordance with the following regulatory legal acts:

• the Labour Code of the Russian Federation;
• Federal Law No. 152-FZ of 27 July 2006, On Personal Data;
• Decree of the President of the Russian Federation No. 188 of 6 March 1997 (as amended on 13 July 2015), On Approval of the List of Confidential Information;
• Resolution of the Government of the Russian Federation No. 687 of 15 September 2008, On Approval of the Regulation on the Specifics of Personal Data Processing without the Use of Automated Means;
• Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012, On Approval of the Requirements for the Protection of Personal Data Processed in Personal Data Information Systems;
• Order of FSTEC of Russia No. 21 of 18 February 2013, On Approval of the Composition and Content of Organisational and Technical Measures to Ensure the Security of Personal Data Processed in Personal Data Information Systems;
• other regulatory legal acts of the Russian Federation and regulatory documents of authorised government bodies.

The legal grounds for processing personal data comprise the regulatory legal acts pursuant to and in accordance with which the Company processes personal data, including:

• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Labour Code of the Russian Federation;
• the Tax Code of the Russian Federation;
• Federal Law No. 208-FZ of 26 December 1995, On Joint-Stock Companies;
• Federal Law No. 402-FZ of 6 December 2011, On Accounting;
• Federal Law No. 167-FZ of 15 December 2001, On Mandatory Pension Insurance in the Russian Federation;
• other regulatory legal acts governing matters relating to the Company's activities;

as well as:

• the Company's Articles of Association;
• agreements entered into between the Company and data subjects;
• data subjects' consent to the processing of their personal data.

The purpose of the Policy is to ensure that collected personal data and other confidential information are appropriately protected against unauthorised access and disclosure.

To implement the provisions of the Policy, the Company develops relevant internal regulations and other documents, including:

• a regulation on the procedure for processing and ensuring the security of personal data within the Company, defining, without limitation:

a) the list of personal data processed by the Company;
b) the list of positions held by Company employees authorised to access personal data in connection with the performance of their employment duties;
c) a template for a certificate of transfer and acceptance of documents (other physical media) containing personal data;

• a procedure for internal monitoring of compliance of the Company's personal data processing with the established requirements;
• other internal regulations on personal data processing within the Company.

The pronouns 'we', 'our' and their derivatives in this Policy refer to the Company.

PLEASE READ THIS POLICY CAREFULLY BEFORE USING THE SERVICE OR WEBSITE. BY USING THE WEBSITE AND THE SERVICES AVAILABLE ON IT, YOU FULLY ACCEPT THIS POLICY AND UNDERTAKE TO COMPLY WITH IT.

If you have any questions or concerns after reading this Policy, please contact us by email at: support@r7-office.ru.

R7 Joint-Stock Company (the Company) is a legal entity incorporated under the laws of the Russian Federation (Taxpayer Identification Number (INN): 5259019343; Primary State Registration Number (OGRN): 1025202837615; registered location: Nizhny Novgorod, Russian Federation; correspondence address: Room 26, Building 22, Letter d, Larina Street, Nizhny Novgorod, 603152, Russian Federation).

• The Company is the controller of personal data processed in accordance with this Policy. As a personal data controller, the Company organises and carries out personal data processing and determines the purposes of processing, the categories of data subjects, the categories and list of personal data processed in accordance with those purposes, and the types of processing appropriate to those purposes.

The following terms and definitions are used in this Policy:

• personal data means any information relating to a directly or indirectly identified or identifiable individual (data subject);
• personal data processing means any action (operation) or set of actions (operations) performed on personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction of personal data;
• automated personal data processing means the processing of personal data using computing equipment;
• dissemination of personal data means actions aimed at disclosing personal data to an indefinite group of persons;
• provision of personal data means actions aimed at disclosing personal data to a specific person or a defined group of persons;
• blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify the personal data;
• destruction of personal data means actions that make it impossible to restore the content of personal data in a personal data information system and/or destroy the physical media containing personal data;
• anonymisation of personal data means actions that make it impossible to determine, without additional information, which specific data subject the personal data relates to;
• personal data information system (PDIS) means the combination of personal data contained in databases and the information technologies and technical means used to process it;
• cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign individual or a foreign legal entity;
• user means any individual using the Website, that is, viewing its pages or using its services and functionality, a data subject and a beneficiary under the Terms of Use;
• user data means any information processed by a user using the Website's resources;
• confidential information means any information relating to a user and/or posted by a user on the Website, including the personal data of the user and third parties, other than personal data authorised by the user for dissemination, including information on the user's activity on the Website;
• personal data authorised by the data subject for dissemination means personal data to which the data subject has granted access to an unlimited group of persons by giving separate consent to the processing of personal data authorised for dissemination, in the manner prescribed by the laws of the Russian Federation.

As a personal data controller, the Company processes on the Website the personal data of the following categories of data subjects:

Website users who are individuals applying for vacancies at the Company;
Website users who are individuals intending to enter into, or who have entered into, an agreement for the provision of the Company's goods, work, services or rights (customers);
Website users who are individuals representing legal entities intending to enter into, or which have entered into, an agreement for the provision of the Company's goods, work, services or rights (customers)


1. Data provided by users on the Website:

surname, first name, patronymic, place of employment (organisation name), position, email address and telephone number;
credentials (account name, passwords, password hints and other data used to authenticate the User's account and ensure secure use of the Websites/Service);
data that you provide at your discretion and/or with your consent when contacting support or sending messages/comments in chats, forums and on the Websites;
if you participate in surveys, the data required to take part in the survey;
publicly available information you have posted on your personal social network page (if you use one of the available social network authentication tools to sign in to your account).

2. Data we may collect automatically about users:

your device's IP address;
technical characteristics of the device used to access the Websites and Service (operating system, manufacturer, model, screen resolution and interface language);
traffic source (the source from which the Service was installed on your device) and the addresses of websites from which links to the Company's websites were followed;

browser type and version and information about the time of the Website visit;
general location data (usually at country and city level, without identifying your precise location); · records of your contacts with support and requests submitted to us under this Policy or the Terms of Use;
information about the Website pages visited and the time of the visit;
other information about user behaviour on the Website obtained using technologies such as cookies (small text files stored in the visitor's browser that retain user interface preferences), web beacons (electronic images used to count visits to a particular page), tracking pixels and Yandex.Metrica service technologies, collecting only the necessary identifying information in accordance with data protection laws.
data from payment partners for invoicing you when you make purchases, where applicable.

3. We do not collect:

payment instrument details (in particular, bank card details and similar information);
any special categories of personal data (such as health, race, religion, political opinions and similar information);
biometric personal data.

Personal data is processed for the following purposes:

• For Website users who are individuals applying for vacancies at the Company: entering into employment contracts with the Company and civil-law contracts for work or services in the Company's interests;
• For Website users who are individuals intending to enter into, or who have entered into, an agreement for the provision of the Company's goods, work, services or rights (customers): entering into, amending, performing and terminating licence agreements granting rights to software products in which the Company holds exclusive rights, including under the terms of the licence agreement published on the Website: https://r7-office.ru/license-agreement/ (individual end users);
• For Website users who are individuals representing legal entities intending to enter into, or which have entered into, an agreement for the provision of the Company's goods, work, services or rights (customers): entering into, amending, performing and terminating agreements for the distribution of the Company's goods, work, services and software products (partners and distributors), and entering into, amending, performing and terminating licence agreements granting rights to software products in which the Company holds exclusive rights, including under the terms of the licence agreement published on the Website: https://r7-office.ru/license-agreement/ (legal-entity end users);

When processing personal data, we use information collected about the user and the user's device primarily to fulfil our obligations to you as beneficiaries under the Terms of Use, namely to enable you to use the Website's functionality and services in full.

The Company processes personal data with due regard to the need to protect the rights and freedoms of its employees and other data subjects, including the right to privacy and personal and family confidentiality, based on the following principles:

• the Company processes personal data lawfully and fairly;
• personal data processing is limited to achieving specific, predetermined and lawful purposes;
• processing that is incompatible with the purposes for which personal data was collected is prohibited;
• databases containing personal data processed for mutually incompatible purposes must not be combined;
• only personal data strictly corresponding to the purposes of processing may be processed;
• the content and volume of personal data processed must correspond to the stated purposes of processing. Personal data must not be excessive in relation to those purposes;
• personal data must be accurate, sufficient and, where necessary, up to date in relation to the purposes of processing. The Company takes, or ensures that others take, the necessary measures to delete or clarify incomplete or inaccurate personal data;
• personal data is stored in a form allowing the data subject to be identified for no longer than required for the purposes of processing, unless a storage period is established by federal law or by an agreement to which the data subject is a party, beneficiary or guarantor;
• personal data being processed is destroyed or anonymised once the purposes of processing have been achieved or no longer need to be achieved, unless otherwise provided by federal law.

The Company processes personal data by collecting, recording, systematising, accumulating, storing, clarifying (updating, modifying), retrieving, using, transferring (providing, granting access to), anonymising, blocking, deleting and destroying it, with and without automated means.

To achieve the purposes of processing users' personal data, the Company performs the following actions:

1. Operating, administering and supporting the Website and all its services;

2. Receiving error reports concerning the Website and services, improving service quality, and developing, refining and improving the Website and services;

3. Enabling the user to use the functionality of the Website and services securely, including:

• registering a user account;
• authorising and identifying the user in the interface to grant access to particular Website pages and services;

4. Providing access to download from the Website and subsequently use securely the functionality of the R7-Office software range (the R7-Office Professional (Server Version) and R7-Office Professional (Desktop Version) computer programs and their additional components) produced by the Company and its partners, in performance of contracts and agreements entered into by the Company with legal entities and individuals;

5. Enabling the secure use of R7-Office client software applications for mobile platforms ('mobile applications') produced by the Company and interacting with the websites, which users can download directly to their mobile devices through the official app stores of the respective mobile platform providers, Google Play (play.google.com) and Apple iTunes AppStore (itunes.apple.com);

6. Providing the user, through the Website, with information about the Company, its products, services, promotions, competitions and other events;

7. Fulfilling obligations relating to the Company's promotions, competitions and other events in which the user participates;

8. Processing user requests, providing responses and communicating with users when they contact the Company;

9. Sending the user news, advertising and additional information about the Company, its products, promotions, competitions and other events by email, where the user has requested or consented to receiving such materials through that communication channel;

10. Fulfilling the user's orders (for example, if the user provides the Company with financial or other information relating to purchases and commercial services offered on the websites, the Company may use that information in connection with and for the purpose of fulfilling those orders, to the extent necessary for that purpose);

11. Provision by the user to third parties so that, on the Company's behalf, those third parties can provide the user with services enabling the user to operate as a user of the Websites (such functions may include, without limitation, correspondence delivery, request processing, customer service, data analysis and quality control). These third parties are independent service providers; they receive, process and store information solely for the purpose of providing the above services and acquire no right to use it for other purposes;

12. Preparing aggregate data analysis and business analytics, conducting other research and compiling reports on the Company's activities;

13. Investigating suspected fraud or other unlawful conduct, or breaches of any law, Website rules or policies, or third-party rights.
Automatically collected personal data is processed from the user's first visit to any Website page. Personal data entered by the user is processed from the time it is entered and the user consents to personal data processing on the Website.

When storing personal data, the Company uses databases located within the Russian Federation in accordance with Part 5 of Article 18 of the Federal Law On Personal Data.

Without obtaining separate consent as required by the applicable laws of the Russian Federation, the Company does not disseminate the personal data of any data subjects.

The Company does not carry out cross-border transfers of users' personal data.

For information about data retrieval, anonymisation and transfer to third parties, see the relevant section. Such personal data may be processed without automated means.

Some of your user data may be visible to others. For example, other users may see your account nickname and photograph (image), chat messages and comments on the Websites.

The Company does not itself place users' personal data in publicly available personal data sources. The Website is not a publicly available personal data source.

Cookies enable the Website and software to count visitors to a particular Website page and provide access to certain Website functions. Standard technical information collected is used solely for statistical purposes in performing agreements with the user. The Company does not use this data to personally identify users. However, when users sign in to the Website, the Company may use this information together with information obtained from data analysis tools and cookies to analyse how users use the websites and software.

By using the Website and software, the user consents to the Company downloading cookies to the user's device (creating them through the Website and software) on the terms described above.

Users can manage cookies through their browser settings. Deleting cookies removes all user preference information (in particular, browser settings for these websites), including the preference to reject cookies. Blocking cookies may affect the user interface and make some components of the Websites and software unavailable.

As a general rule, we do not disclose your user data to anyone and keep it confidential. However, in certain cases described in this Policy and directly related to the purposes of processing personal data, we may retrieve and transfer your user data to third parties. The following is an exhaustive list of such cases:

1. Government authorities. We may provide any and all user data to law enforcement agencies, other government authorities and officials in accordance with the laws of the Russian Federation.

2. Advertising partners. We may provide our advertising partners with some of your user data (including your email address) as necessary for placing and personalising (targeting) advertisements and accounting for advertising services provided.
3. Partners providing advertisement tracking services. In certain cases, we allow our partners to track impressions, installations and other performance indicators for our advertisements; for this purpose, they may process some of your user data as necessary.

4. Operational partners. We may provide any of your user data to partners providing the following services, to the extent necessary for the relevant service: (a) hosting; (b) Service support and testing; (d) statistical and marketing research and information analysis.

5. Partners providing two-factor authentication services. We may provide some of your data (such as your mobile telephone number) to partners providing two-factor authentication services.

6. Payment partners/licensees. When you make purchases, we transfer the payment ID and amount to our payment partners.

7. Rights acquirers and purchasers of the Company. If exclusive rights to the Service are assigned, operating (usage) rights are transferred to another operator, or the Company is sold or merged with another company, we may transfer your user data to the acquirer of exclusive rights to the Service, the new operator, the purchaser of the Company or the new legal entity resulting from the merger, respectively, without obtaining your additional consent.

8. Auditors. From time to time, the Company and its affiliates may engage external professional firms to conduct audits. Some of your user data (such as your ID, email address and purchases) may be transferred to those firms solely for auditing purposes.

We may enter into contracts with other partners in the future. We will make all reasonable efforts to update the list of partner types in this Policy promptly, at least once a year, or more frequently if our data processing practices change substantially.

Users are obliged to provide only accurate information. The Company does not verify the accuracy of personal information provided and, in particular, cannot assess users' legal capacity.

Users have the following rights in relation to their personal data:

1. Right of access
You may request information about the processing of your personal data at reasonable intervals. To do so, send a request to our support team at: support@r7-office.ru and follow the instructions provided, or submit the request directly through your personal account on the Website. Please note that in some cases we may request additional information necessary to identify you as a user before fulfilling your request. We undertake to fulfil your request free of charge within ten (10) business days of receiving it; in certain cases provided for by law, this period may be extended by five (5) business days. We may refuse to allow you to exercise this right in cases provided for by the laws of the Russian Federation.

2. Right to refuse to provide personal data.
However, if you refuse to provide certain personal data to the Company, you may be unable to use some Website services and functions, including registering on the Website, submitting a request or paying for products. The Company may be unable to contact you in certain ways, or you may be unable to receive certain information about the Company's products and services.

3. Right to opt out of personalised advertising and direct marketing messages.
You may change your browser settings at any time to reject analytics cookies used on your device to personalise advertising offers. You may also configure the collection of your data by our statistics and analytics Partners yourself.

We may send you targeted offers based on analysis of the user data we hold about you using specified algorithms. These offers do not significantly affect your rights or interests; they are intended to provide offers that we believe are timely and relevant to you. However, if you wish to stop receiving targeted offers from us, notify our support team at: support@r7-office.ru or opt out through your personal account, where available.

We may send direct marketing messages to your email address as described in Section 3. You may unsubscribe by following the instructions in the email received from us.

4. Right to rectification of inaccurate data.
You may request rectification of inaccurate personal data at any time. If any personal data we process about you is no longer up to date, notify us at this email address: support@r7-office.ru. Please note that in some cases we may request additional information necessary to identify you as our user before fulfilling your request. We undertake to fulfil your rectification request free of charge within seven (7) business days of receiving your request and the additional information we have requested. We may refuse to allow you to exercise this right or request a reasonable fee if your request is manifestly unfounded or if you submit such requests too frequently.

5. Right to erasure.
You may request erasure of your personal data by sending a corresponding request to this email address: support@r7-office.ru, or by submitting the relevant request through your personal account, if supported by its functionality. Please note that in some cases we may request additional information necessary to identify you as our user before fulfilling your request. We undertake to fulfil your erasure request free of charge within seven (7) business days of receiving your request and the additional information we have requested

Please note that fulfilling a request to erase your personal data will result in deletion of your account. We may continue to retain some of your user data even after fulfilling your erasure request if (1) we are required to do so to comply with applicable law, or (2) your user data has been anonymised and therefore is no longer your personal data.

We take steps to delete your personal data as necessary, but retain records required to comply with government requirements or applicable federal or local law. Where permitted by law, we may decline to process requests, including unreasonably repetitive requests.

6. Right to object.
You may object to the processing of your personal data. Notify us of your objections by email at: support@r7-office.ru.

7. Right to block processing.
When processing is blocked, we will store your personal data but will not process it further.

8. Right to review.
You have the right to review the personal data you have provided to the Company in a structured, commonly used and machine-readable format

9. Other rights.
You may have other rights under the laws of the Russian Federation. To exercise other rights, notify us by email at: support@r7-office.ru

If you believe your rights relating to the processing and use of your personal data are being infringed, notify us by email at: support@r7-office.ru. You may also complain to the supervisory authority about an infringement of your rights in connection with the processing and use of your personal data in the Russian Federation.

To exercise your rights and protect your legitimate interests, you may also request information from the Company concerning the processing and protection of personal data at the following email address: support@r7-office.ru or by writing to our registered address. The Company reviews enquiries, provides explanations and takes measures to protect personal data. In the event of claims or complaints from data subjects, the Company takes all necessary measures to remedy potential violations, identify those responsible and resolve disputes out of court.

When processing personal data, the Company takes all necessary legal, organisational and technical measures to protect it against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions involving personal data.

To ensure the security of personal data processing, we continuously develop and implement technical and organisational measures to protect your personal data against unauthorised access, disclosure, misuse, modification, loss and destruction.

The following are used to ensure data processing security:

• identification and authentication of access subjects and objects;
• dedicated access environments;
• security event logging (auditing);
• security assessments (penetration testing);
• data backups;
• granting access to systems based on User requests that have completed the approval process;

In addition, the Company's servers are hosted in a certified Tier 3 data centre. The Company has an Information Security Policy in place.

Company employees and other persons who gain access to personal data being processed must sign a confidentiality agreement and are informed of potential disciplinary, administrative, civil and criminal liability for breaching the applicable laws of the Russian Federation concerning personal data processing and protection.

The principal personal data protection measures implemented by the Company are:

• appointing a Company employee responsible for organising personal data processing;
• appointing Company employees responsible for processing personal data;
• adopting internal regulations and other documents concerning personal data processing and protection;
• conducting internal monitoring (auditing) of the compliance of personal data processing with the Federal Law On Personal Data and other regulatory legal acts governing this area;
• familiarising Company employees directly involved in personal data processing with the applicable laws of the Russian Federation concerning personal data, including processing and protection requirements, and with internal regulations, including this Policy;
• applying organisational and technical measures to secure personal data processed in personal data information systems as necessary to comply with processing and protection requirements;
• storing physical media containing personal data under conditions that ensure its preservation and prevent unauthorised access;
• separating personal data processed without automated means from other information, in particular by recording it on separate physical media or in dedicated sections;
• keeping records of physical personal data media (computers);
• ensuring separate storage of personal data and its physical media where processing serves different purposes and involves different categories of personal data;
• detecting unauthorised access to personal data and taking appropriate measures;
• restoring personal data modified or destroyed as a result of unauthorised access;
• establishing access rules for personal data processed in personal data information systems and ensuring that all actions involving personal data in those systems are logged and recorded;
• other measures provided for by the laws of the Russian Federation concerning personal data;
• monitoring the measures taken to ensure personal data security

You may update, correct and delete your personal data yourself through your personal account on the Website, or contact our support team for this purpose.

Users may submit a free-form request concerning the processing of their personal data by emailing: support@r7-office.ru. We will review the request within the time limits established by the laws of the Russian Federation.

The current version of this Policy is published online at: https://r7-office.ru/about/personal_data_processing_policy/.

We may amend this Policy at any time. Amendments take effect upon publication of the updated Policy on the Website specified above, unless another effective date is stated in the updated Policy.