Personal data processing policy

1. ARKHYZ-1650 LLC (OGRN: 1110912000099, INN: 0912003087) respects privacy and cares about the protection of personal information that you provide to us. We would like to familiarize you with the following principles on which our policy regarding your personal data is based. 2. In the course of doing business, ARKHYZ-1650 LLC processes personal data of individuals - subjects of personal data. In order to maintain a business reputation and ensure compliance with federal legislation in full, ARKHYZ-1650 LLC (hereinafter referred to as the Operator) considers it most important to ensure the legality and fairness of personal data processing, compliance with their confidentiality and the security of their processing processes. 3. The policy of ARKHYZ-1650 LLC regarding the processing of personal data (hereinafter referred to as the Policy) has been developed to determine the main goals, procedure and conditions for processing personal data by the Operator, as well as measures to ensure the security of personal data.
2. This Policy has been developed in accordance with the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data", the Federal Law "On Amendments to the Federal Law "On Personal Data" No. 519-FZ dated December 25, 2020.
3. ARKHYZ-1650 LLC carries out activities in the field of processing personal data on the basis of and in accordance with the requirements of the current legislation of the Russian Federation, specified in Appendix No. 2 to this document.
4. This Policy applies to all information containing personal data of personal data subjects that ARKHYZ-1650 LLC and related legal entities may receive about the personal data subject in the course of ARKHYZ-1650 LLC’s activities.
5. The Policy applies to all operations performed in ARKHYZ-1650 LLC with personal data using automation tools and without them.
6. All employees of the Operator are guided by the provisions of this Policy.
7. The provisions of this Policy serve as the basis for the development of internal administrative documents by ARKHYZ-1650 LLC detailing the processing and protection of personal data.
8. The Policy is publicly available and is subject to publication on the official website of ARKHYZ-1650 LLC or otherwise providing unrestricted access to this document.
9. The policy is approved by order of the General Director of ARKHYZ-1650 LLC and is subject to revision when changes are made to the current legislation in the field of processing and protection of personal data.

When processing personal data, ARKHYZ-1650 LLC follows the principle of sufficiency and expediency of personal data processing.

ARKHYZ-1650 LLC processes personal data for the following purposes:

• provision of services to the Subject of personal data, provision of services by the Subject of personal data on the basis of the concluded agreement and fulfillment of obligations thereunder;
• conducting surveys and informing;
• conducting personnel work;
• implementation of labor and other relations directly related to them;
• implementation of the activities of ARKHYZ-1650 LLC;
• to achieve the goals provided for by law, to implement and fulfill the functions, powers and duties imposed on ARKHYZ-1650 LLC by the legislation of the Russian Federation.

Personal data includes any information directly or indirectly related to a specific or identifiable individual (Personal Data Subject), processed by ARKHYZ-1650 LLC to achieve predetermined goals:

• subjects whose personal data processing is related to the fulfillment of the terms of concluded agreements and accepted and established obligations;
• employees and their close relatives;
• job candidates;

3.1. ARKHYZ-1650 LLC processes personal data of the following categories of Personal Data Subjects:

• subjects whose personal data processing is related to the fulfillment of the terms of concluded agreements and accepted and established obligations;
• employees and their close relatives;
• job candidates;
• employees of counterparties;
• clients of ARKHYZ-1650 LLC, their representatives and beneficiaries;
• users of ARKHYZ-1650 LLC websites;
• individuals staying at the facilities of ARKHYZ-1650 LLC;

3.2. ARKHYZ-1650 LLC processes the following categories of personal data of personal data subjects:

• publicly available personal data;
• biometric personal data;
• other personal data, including: gender, age, passport details, TIN, insurance number of the state pension insurance certificate (SNILS), address information and contact details, citizenship, payment details, work permits and residence rights in other countries, military registration information, information on criminal prosecution, information on family composition, information on education and profession, information on advanced training and additional education, information on the presence of an academic degree, information on achievements, information automatically received when accessing the websites of ARKHYZ-1650 LLC using cookies, which are fragments of text that are automatically saved in the memory of your Internet browser using the websites of ARKHYZ-1650 LLC; information received as a result of the actions of subjects on the websites of ARKHYZ-1650 LLC, including: on sending comments, requests, reviews and questions, etc.

As part of its activities, ARKHYZ-1650 LLC collects, records, systematizes, accumulates, stores, clarifies (updates, changes), extracts, uses, transfers (distributes, provides, accesses), depersonalizes, blocks, deletes and destroys personal data.

ARKHYZ-1650 LLC processes personal data, including storing it, using servers located on the territory of the Russian Federation.

ARKHYZ-1650 LLC does not carry out cross-border transfer of personal data.

ARKHYZ-1650 LLC processes personal data based on the consent of the personal data subject to the processing of his personal data in accordance with the stated purposes of processing.

When processing personal data, ARKHYZ-1650 LLC takes the necessary and sufficient legal, organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data, including:

• appointment of a person responsible for organizing the processing of personal data;
• adoption of internal regulations and other documents in the field of processing and protection of personal data;
• limitation and control of the composition of employees who have access to personal data;
• familiarization of ARKHYZ-1650 LLC employees directly involved in the processing of personal data with the provisions of the legislation of the Russian Federation on personal data and internal administrative documents on the processing of personal data;
• obtaining consent from personal data subjects for the processing of their personal data, except for cases stipulated by the legislation of the Russian Federation;
• organization of accounting of documents containing personal data;
• identification of threats to the security of personal data when processing them in personal data information systems;
• application of organizational and technical measures to ensure the security of personal data when processing them in personal data information systems;
• implementation of internal control over the measures taken to ensure the security of personal data;
• organization of work with information systems in which personal data are processed;
• other measures stipulated by the legislation of the Russian Federation in the field of personal data.

In the event of detection of the fact of inaccuracy of personal data, ARKHYZ-1650 LLC takes the following measures:

Blocks personal data;

• clarifies or ensures clarification of personal data within 7 (seven) days from the date of provision of such information, updates personal data and removes the block in personal data information systems;
• in case of confirmation of the fact of illegality of processing of personal data - processing is terminated within a period not exceeding 3 (three) business days from the date of such detection;
• if it is impossible to ensure the legality of personal data processing, ARKHYZ-1650 LLC, within a period not exceeding 10 (ten) business days from the date of detection of illegal processing of personal data, destroys such personal data or ensures their destruction.

In accordance with the legislation, ARKHYZ-1650 LLC stops processing personal data in the following cases:

Achievement of the goals of personal data processing;

• revocation of the consent of the personal data subject to the processing of his personal data; termination of the activities of ARKHYZ-1650 LLC (liquidation or reorganization).
• The storage periods of personal data are limited by the purposes of personal data processing, revocation of consent to the processing of personal data, the provisions of the Order of Rosarchive dated 20.12.2019 No. 236 "On approval of the List of standard management archival documents generated in the course of activities of state bodies, local governments and organizations, indicating the periods of their storage."

The personal data subject has the right to:

• receive information about the processing of his personal data;
• receive information concerning the processing of his personal data in the manner, form and terms established by law, except for cases stipulated by the Federal Law "On Personal Data". Information is provided to the personal data subject in an accessible form, and it must not contain personal data related to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data;
• clarify his personal data;
• revoke consent to the processing of personal data;
• appeal to the authorized body for the protection of the rights of personal data subjects or in court against illegal actions or inactions in the processing and protection of his personal data;
• to protect his rights and legitimate interests, including compensation for damages and (or) compensation for moral damage in court;
• to exercise other rights stipulated by the legislation of the Russian Federation.

The right of a personal data subject to access his/her personal data may be limited in accordance with federal laws, including if:

• the processing of personal data, including personal data obtained as a result of operational-search, counterintelligence and intelligence activities, is carried out for the purposes of national defense, state security and law enforcement;
• the processing of personal data is carried out by the bodies that detained the personal data subject on suspicion of committing a crime, or brought charges against the personal data subject in a criminal case, or applied a preventive measure to the personal data subject before charges are brought, with the exception of cases provided for by the criminal procedure legislation of the Russian Federation, if the suspect or accused is allowed to familiarize themselves with such personal data;
• the processing of personal data is carried out in accordance with the legislation on combating the legalization (laundering) of proceeds from crime and the financing of terrorism;
• the personal data subject's access to his/her personal data violates the rights and legitimate interests of third parties;
• the processing of personal data is carried out in cases stipulated by the legislation of the Russian Federation on transport security, in order to ensure the stable and safe functioning of the transport complex, to protect the interests of the individual, society and the state in the sphere of the transport complex from acts of illegal interference.

6.1. ARKHYZ-1650 LLC has the right to:

• process the personal data of the Personal Data Subject in accordance with the stated purpose;
• require the Personal Data Subject to provide reliable personal data necessary for the execution of the agreement, provision of the service, identification of the Personal Data Subject, as well as in other cases stipulated by the Personal Data Legislation;
• process publicly available personal data of individuals;
• process personal data subject to publication or mandatory disclosure in accordance with the legislation of the Russian Federation;
• with the consent of the Personal Data Subject, entrust the processing of his personal data to another person, unless otherwise provided by federal law, on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Fund is obliged to comply with the principles and rules for processing personal data stipulated by the Federal Law "On Personal Data"
• provide personal data of subjects to third parties if this is stipulated by the current legislation of the Russian Federation (transfer personal data to inquiry, investigation bodies, other authorized bodies on the grounds stipulated by the current legislation of the Russian Federation);
• use personal data of the subject without his consent, in cases stipulated by the legislation of the Russian Federation;
• refuse to provide personal data in cases stipulated by the legislation of the Russian Federation.
• defend their interests in judicial bodies;

6.2. ARKHYZ-1650 LLC is obliged to:

• organize the processing of personal data in accordance with the requirements of the Federal Law "On Personal Data";
• inform the personal data subject or his/her representative about the availability of personal data related to the relevant personal data subject, as well as provide an opportunity to become familiar with this personal data upon request of the personal data subject or his/her representative or within 30 days from the date of receipt of the request of the personal data subject or his/her representative;
• if the provision of personal data is mandatory in accordance with federal law, the operator is obliged to explain to the personal data subject the legal consequences of refusing to provide his/her personal data;
• take measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Federal Law "On Personal Data" and regulatory legal acts adopted in accordance with it.

• Information concerning the processing of personal data is provided to the personal data subject or his/her legal representative on the basis of a request or appeal to ARKHYZ-1650 LLC.
• The request can be sent electronically to the ARKHYZ-1650 LLC mailbox for requests info@romantikarkhyz.ru and signed with an electronic signature in accordance with the legislation of the Russian Federation.
• The request is registered within three business days from the date of its receipt.
• Information on the request or refusal to provide information is sent to the personal data subject or his/her representative within a period not exceeding thirty calendar days from the date of receipt of the request.

ARKHYZ-1650 LLC provides information on the availability of personal data and its processing to the subject in an accessible form. This information does not contain information related to other personal data subjects.

List of terms and definitions and their use.

1. Personal data – any information related to a directly or indirectly defined or determinable individual (subject of personal data): your first and last name, postal address or passport number, telephone number, profession or personal interests.

2. In this Policy, unless the context otherwise requires, the following capitalized terms have the following meanings:

2.1 Personal data operator (operator) – ARKHYZ-1650 LLC 369152, Karachay-Cherkess Republic, Zelenchuksky district, Arkhyz village, Gornaya street, 4, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data.

2.2 Website - manteratravel.ru, as well as a mobile application (regardless of the platform). 3. Processing of personal data - any action (operation) or set of actions (operations) with personal data, performed using automation tools or without their use. Processing of personal data includes, among other things: collection; recording; systematization; accumulation; storage; clarification (updating, modification); retrieval; use; transfer (distribution, provision, access); depersonalization; blocking; deletion; destruction. 4. Automated processing of personal data - processing of personal data using computer technology. 5. Distribution of personal data - actions aimed at disclosing personal data to an indefinite number of persons. 6. Provision of personal data - actions aimed at disclosing personal data to a specific person or a specific group of persons. 7. Blocking of personal data - temporary cessation of processing of personal data (except in cases where processing is necessary to clarify personal data). 8. Destruction of personal data – actions that make it impossible to restore the contents of personal data in the personal data information system and/or that result in the destruction of tangible personal data carriers. 9. Depersonalization of personal data – actions that make it impossible to determine the ownership of personal data by a specific personal data subject without the use of additional information. 10. Personal data information system – a set of personal data contained in databases and the information technologies and technical means that ensure their processing. 11. Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign government agency, a foreign individual or a foreign legal entity. 12. Cookies are a small piece of data that is received and processed by the device you use to access the Sites. Cookies store and send back to the Sites information that helps you work with the Sites and allows us to remember your preferences over time, such as browser settings or to recognize your account. For more information about cookies, their description, the purposes of their use and possible ways to manage them, please follow our Cookie Policy. The following types of cookies are used on the Sites:

• strictly necessary cookies/technical cookies: these cookies are essential for the operation of the Sites and the provision of the Services to you; among other things, they allow you to identify your hardware and software, including your browser type;
• statistical/analytical cookies: these cookies allow us to recognise users, count their number and collect information, such as your transactions on the Sites and Services, including information about the web pages you visit and the content you access;
• performance cookies: these cookies collect information about how users interact with the Sites and/or Services, which allows us to identify errors and test new features to improve the performance of the Sites and Services;
• functional cookies: these cookies allow us to provide certain features to make your use of the Sites easier, for example, by storing your preferences (such as language and location);
• (third party) tracking/advertising cookies: these cookies collect information about users, traffic sources, pages visited and advertisements displayed to you, as well as the one that brought you to the advertised page. They allow you to see advertisements that may be of interest to you based on the analysis of Personal Information collected about you. They are also used for statistical and research purposes.

The information contained in the cookies is used only for the purposes specified in this Policy, after which the collected data will be stored on your device for a period that may depend on the relevant type of cookie, but not exceeding the period necessary to achieve their purpose, after which they will be automatically deleted from your system.

Personal information collected through cookies placed on your device may be transferred to and accessed by third parties specified in this Policy. Your consent to the use of cookies may be requested upon your first visit to the Sites. If, after you have accepted the use of cookies, you wish to change your mind, you can do so by deleting the cookies stored in your browser (usually in your browser settings – please refer to your browser manual or the website of its developer). The pop-up window asking for your consent may then be displayed again and you will be able to make a different choice. If you refuse the use of cookies, this may result in some features of the Sites not being available to you and will affect your ability to use the Sites. You can also change your browser settings to accept or reject all cookies or cookies from certain sites by default.

Legal grounds for processing personal data.

1. The Labor Code of the Russian Federation of 30.12.2001 No. 197-FZ, as amended and supplemented;
2. The Civil Code of the Russian Federation of 30.11.1994 No. 51-FZ, as amended and supplemented;
3. Federal Law of the Russian Federation of 08.02.1998 N 14-FZ (as amended on 31.07.2020, as amended on 24.02.2021) "On Limited Liability Companies" and other current legislative acts of the Russian Federation for entrepreneurial activities aimed at making a profit.

Rules for Information Mailing

The Administration of the Websites and Services of ARKHYZ-1650 LLC (OGRN: 1110912000099, INN: 0912003087) (hereinafter referred to as the "Contractor") provides the opportunity to use the Contractor's information mailings in accordance with the terms of these Rules for Information Mailings.

The Administration of the Websites and Services of ARKHYZ-1650 LLC (OGRN: 1110912000099, INN: 0912003087) notifies you as a user of the Contractor's websites - manteratravel.ru and mobile application. That by registering for the loyalty program on the Contractor's websites and leaving your contact information, you give your express consent to the Contractor to send you information, as well as to advertise its own activities within the framework of the relevant newsletters by making direct contacts using all means of communication, including, but not limited to: mailing list, SMS mailing list, voice mailing list, email mailing list, sending messages via social networks, any types of messengers.

If you have subscribed to the mailing list in the relevant section of the Contractor's website by indicating your contact information (for example, e-mail), you have the right to unsubscribe from such mailing list at any time by sending a notice to the Contractor.

If you do not wish to receive the Contractor's mailing list, you can independently unsubscribe from such mailing lists by sending a letter to the following e-mail address: info@romantikarkhyz.ru.

This consent is given for the purpose of receiving the Contractor's news, as well as corporate newsletters of an informational and advertising nature.

By giving such consent, you confirm that you are acting of your own free will and in your interest, and undertake to provide reliable data when registering or subscribing through the appropriate forms on the Contractor's website. You are also informed that if you have any questions regarding refusal, you can seek help by sending a letter to the following e-mail address: info@romantikarkhyz.ru.

By using the Contractor's Websites and Services and/or entering your personal and contact information, you confirm that you have read the Personal Data Protection and Processing Policy of the Contractor.

The term of this consent is unlimited.