Website users’ personal data privacy policy

1. General provisions

1.1. This Website Users’ Personal Data Privacy Policy (hereinafter referred to as the “Policy”) has been developed in pursuance of the requirements of art. 18.1 of Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data”, as well as other regulatory legal acts of the Russian Federation in the field of protection and processing of personal data.

1.2. A.MILLER JSC (hereinafter referred to as the “Operator”) ensures the protection of processed personal data from unauthorized access and disclosure, unlawful use or loss in accordance with the requirements of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.

1.3. The Policy is a publicly available document that applies only to the website located on the Internet information and communication network at the address: a-miller.com (hereinafter referred to as the “Website”).

1.4. The Policy does not apply to third-party websites that the personal data subject may access through the Website.

1.5. The Policy establishes general requirements and rules mandatory for the Operator’s employees involved in the processing of personal data, regarding work with all types of information carriers containing personal data of personal data subjects using the Website.

1.6. The Policy does not apply to issues of ensuring the security of personal data classified as information constituting a state secret of the Russian Federation.

1.7. The main objectives of the Policy are:

• ensuring the protection of the rights and freedoms of individuals and citizens in the processing of personal data, including the protection of the rights to privacy, personal and family secrets;

• exclusion of unauthorized actions of the Operator’s employees and third parties in the collection, systematization, accumulation, storage, clarification (updating, modification) of personal data, and other forms of unlawful interference in the information resources and local computer network of the Operator;

• ensuring the legal and regulatory regime of confidentiality of undocumented information of Website Users;

• protection of the constitutional rights of citizens to personal privacy, confidentiality of information constituting personal data, and prevention of the occurrence of a possible security threat to Website Users.

1.8. Basic concepts used in the Policy:

website — a set of software and hardware for computers that ensure the publication for public viewing of information and data united by a common purpose, by means of technical means used for communication between computers on the Internet;

User — a personal data subject who has access to the Internet and uses the capabilities of the website;

personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject);

Head — the sole executive body of the Operator;

personal data processing — any action (operation) or set of actions (operations) with personal data performed using automation tools or without their use. Personal data processing includes, among other things:

• collection;

• recording;

• systematization;

• accumulation;

• storage;

• clarification (updating, modification);

• extraction;

• use;

• transfer (provision, access);

• depersonalization;

• blocking;

• deletion;

• destruction.

automated personal data processing — processing of personal data using computer technology.

dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons;

provision of personal data — actions aimed at disclosing personal data to a certain person or a certain circle of persons;

blocking of personal data — temporary suspension of personal data processing (except in cases where processing is necessary to clarify personal data);

destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed;

depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the belonging of personal data to a specific personal data subject;

personal data information system (hereinafter referred to as PDIS) — a set of personal data contained in databases and information technologies and technical means ensuring their processing.

2. Processing principles

2.1. Processing principles. The Operator’s employees are guided by the following:

• personal data processing is carried out on a lawful and fair basis;

• personal data processing must be limited to achieving specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of personal data collection is not allowed;

• it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes incompatible with each other;

• the content and scope of processed personal data must correspond to the stated purposes of processing. Processed personal data must not be excessive in relation to the purposes of their processing;

• when processing personal data, the accuracy and sufficiency of personal data must be ensured;

• personal data storage must be carried out no longer than required by the purposes of personal data processing, unless the storage period of personal data is established by Federal Law or an agreement with the User;

• processed personal data is subject to destruction or depersonalization upon achieving the purposes of processing or in the event of loss of the need to achieve these purposes, unless otherwise provided by the requirements of legislation.

2.2. Conditions for personal data processing:

• processing of personal data of Website Users is carried out in accordance with the requirements of the current legislation in the field of personal data protection;

• processing of personal data on the Website is carried out in compliance with the principles and rules provided for by the Policy and the legislation of the Russian Federation.

2.3. Processing of personal data of Website Users is carried out exclusively for the purposes of:

• promotion of goods, works, services on the market.

2.5. Personal data used on the Website is provided by the User independently by entering it into the appropriate form during account registration, relates to confidential information and is processed exclusively using automation tools.

3. User’s rights

3.1. The User has the right to:

• receive information about the Operator, its location, the presence of personal data relating to the User at the Operator, as well as to familiarize themselves with such personal data, except in cases expressly provided for by law;

• receive from the Operator the following information concerning the processing of their personal data:

  • confirmation of the fact of personal data processing by the Operator, as well as the purpose of such processing;

  • legal grounds and purposes of personal data processing;

  • purposes and methods of personal data processing applied by the Operator;

  • name and location of the Operator, information about persons who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Operator or on the basis of current legislation;

  • processed personal data relating to the relevant User, the source of their receipt;

  • terms of personal data processing, including terms of their storage;

  • procedure for the exercise by the personal data subject of the rights provided for by Federal Law;

  • information about the carried out or proposed cross-border transfer of data;

  • name or surname, name, patronymic and address of the person processing personal data on behalf of the Operator, if processing is or will be entrusted to such a person;

  • other information provided for by the current legislation of the Russian Federation;

• require changes, clarification, destruction of information about themselves;

• appeal against unlawful actions or inaction in the processing of personal data and demand appropriate compensation in court;

• determine representatives to protect their personal data;

• require the Operator to notify about all changes made to them or exclusions from them;

• appeal to the authorized body for the protection of the rights of personal data subjects or in court against the actions or inaction of the Operator if they believe that the latter is processing their personal data in violation of the requirements of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” or otherwise violates their rights and freedoms;

• protect their rights and legitimate interests, including compensation for losses or compensation for moral harm in court.

4. Operator’s obligations

4.1. In the event of receiving a written request from the User, the Operator is obliged to process it and provide a response to it in the manner provided for by the Rules for Consideration of Appeals of Personal Data Subjects and the current legislation of the Russian Federation.

4.2. In the event of receiving a request from the authorized body for the protection of the rights of personal data subjects for the provision of information necessary for the implementation of the activities of the specified body, the Operator is obliged to provide such information within the time limits established by law.

4.3. In the event of detection of unlawful processing of personal data, the Operator is obliged to block the unlawfully processed personal data relating to the User from the moment such a fact is established.

4.4. In the event of achieving the purpose of personal data processing, the Operator is obliged to stop processing personal data and destroy personal data in the manner provided for by the Regulation on the Procedure for the Destruction of Personal Data and the current legislation of the Russian Federation.

4.5. The Operator is prohibited from making decisions based solely on automated processing of personal data that generate legal consequences in relation to the personal data subject or otherwise affect their rights and legitimate interests.

5. Confidentiality of personal data

5.1. The Operator ensures the confidentiality and security of personal data during their processing in accordance with the requirements of the Operator’s local regulatory acts and the requirements of current legislation.

5.2. The Operator does not disclose to third parties or disseminate personal data without the User’s consent, unless otherwise provided by the requirements of the current legislation of the Russian Federation.

6. Personal data processing

6.1. All personal data must be obtained from the User themselves. In the event of obtaining consent to personal data processing from the User’s representative, their powers must be confirmed in the manner established by law.

6.2. The list of persons entitled to access personal data is determined in accordance with the Operator’s local regulatory acts and approved by order of the Head of the Operator.

6.2. The Operator stores the personal data of Users from the moment of their provision until the moment of withdrawal of consent to personal data processing, achievement of processing purposes, or expiration of the period for which consent was given, as well as in other cases expressly provided for by the current legislation of the Russian Federation.

6.3. The Operator does not process the personal data of Users on paper media.

6.4. The Operator does not transfer personal data to third parties, including for processing purposes. The personal data of Users is processed exclusively by the Operator’s employees.

6.5. Blocking and deletion of personal data on the Website is carried out on the basis of a written application from the User or an authorized body.

6.6. Destruction of personal data is carried out by erasing information using certified software.

7. Personal data protection

7.1. When processing personal data, the Operator takes the necessary legal, organizational and technical measures or ensures their adoption to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions in relation to personal data.

7.2. Personal data security is achieved by the following methods:

• determining threats to the security of personal data during their processing in personal data information systems;

• applying organizational and technical measures to ensure the security of personal data during their processing in personal data information systems, necessary to meet the requirements for personal data protection;

• accounting for machine carriers of personal data;

• detecting facts of unauthorized access to personal data and taking measures;

• restoring personal data modified or destroyed as a result of unauthorized access to them;

• establishing rules for access to personal data processed in the personal data information system, as well as ensuring the registration and accounting of all actions performed with personal data in the personal data information system;

• control over the measures taken to ensure the security of personal data and the level of security of personal data information systems;

• appointing a person responsible for personal data processing;

• establishing individual access passwords for employees to the information system in accordance with their job responsibilities;

• using certified antivirus software;

• training the Operator’s employees directly involved in personal data processing in the provisions of the legislation of the Russian Federation on personal data, including the requirements for personal data protection.

7.3. The protected information about the User on the Website includes data that allows identifying the User or obtaining additional information about them provided for by legislation and the Policy.

7.4. The protected personal data objects include:

• informatization objects and technical means of automated processing of information containing personal data;

• information resources containing information about information and telecommunications systems in which personal data is used, about events that have occurred with managed objects, about plans for ensuring uninterrupted operation and procedures for switching to control in emergency modes;

• communication channels that are used to transmit personal data in the form of informative electrical signals and physical fields;

• alienable machine information carriers on magnetic, magneto-optical and other bases used for processing personal data.

7.5. Technological information about information systems and elements of the personal data protection system subject to protection includes:

• information about the access control system to informatization objects on which personal data processing is carried out;

• control information;

• technological information of means of access to control systems;

• characteristics of communication channels that are used to transmit personal data in the form of informative electrical signals and physical fields;

• information about personal data protection means, their composition and structure, principles and technical solutions of protection;

• service data appearing during the operation of software, messages and protocols of internetwork interaction, as a result of personal data processing.

7.6. The personal data protection system complies with the requirements of Decree of the Government of the Russian Federation No. 1119 dated 1 November 2012 “On Approval of Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems” and ensures:

• timely detection and prevention of unauthorized access to personal data or its transfer to persons who do not have the right to access such information;

• prevention of impact on technical means of automated personal data processing, as a result of which their functioning may be disrupted;

• the possibility of immediate restoration of personal data modified or destroyed as a result of unauthorized access to them;

• constant control over ensuring the level of security of personal data.

8. Responsibility

8.1. All employees of the Operator involved in personal data processing are obliged to keep the secret of information containing personal data.

8.2. Persons guilty of violating the requirements for personal data processing bear responsibility in accordance with the current legislation of the Russian Federation.

8.3. Responsibility for compliance with the personal data regime in relation to personal data located in the Website’s databases is borne by the Operator’s employees responsible for personal data processing.

9. Final provisions

9.1. The Policy was approved by order of the Head of the Operator No. 1-PDn dated 30.07.2025, and is valid indefinitely until the new version of the Policy comes into force.

9.2. In the event of changes in the legislation of the Russian Federation in the field of personal data protection, the Operator adopts a new version of the Policy, taking into account the changes. Until then, the Policy is valid to the extent that does not contradict the current legislation of the Russian Federation.

9.3. For the purpose of communication with the Operator, the following contact details may be used:

tel.: 8(495) 775 73 76;

e-mail: office@a-miller.com;

postal address: 123557, Moscow, Novopresnensky Lane, building 3, room 10, floor 1.

30.07.2025

General Director

A.MILLER JSC _____________/ V.I. Gavricheva