Privacy policy on the processing of personal data of website visitors NovaMedica LLC

Reg. No. 16/10А-1/5

dated February 06, 2024

Moscow 2024

1. GENERAL PROVISIONS

This document defines the policy of NovaMedica Limited Liability Company (hereinafter, the “Company”, “Operator”), address: 125124, 18, 3rd Yamskogo Polya street, Moscow, on the processing of personal data of visitors to the Company’s website https://novamedica.com.

The Company processes personal data, ensures protection of the rights and freedoms of subjects when processing their personal data and takes measures to ensure fulfillment of the responsibilities stipulated by Federal Law No. 152-ФЗ dated July 27, 2006 on Personal Data (hereinafter, “Law No. 152-ФЗ”) and regulations adopted on the basis thereof.

This Policy shall be published on the Company’s website https://novamedica.com, on all pages of the Company’s Website where personal data of subjects is collected, including under the “Write a message” form.

Website of the Company https://novamedica.com may contain links to resources of other service providers, which the Company does not control and which are not covered by this Policy.

Website of the Company https://novamedica.com is not intended for processing personal data of underage persons. If you have reason to believe that an underage person has provided us with his or her personal data through the Website, please inform the Company by sending a message to privacy@novamedica.com.

Contacts of the person responsible for the organization of personal data processing (contact for sending messages): e-mail: privacy@novamedica.com, phone number: +7 (495) 230-02-90 ext. 2114, postal address: 125124, 18, 3rd Yamskogo Polya street, Moscow.

2. KEY TERMS USED IN THE POLICY

The following terms are used in this document:

The subject of personal data or personal data subject means an individual who is directly or indirectly identified or identifiable by personal data. In this Policy, subject is understood to mean an individual who is a visitor to the website https://novamedica.com.

Operator means a public authority, local authority, an individual or a legal entity who, alone or jointly with other persons, organizes and (or) carries out personal data processing and defines the purposes of personal data processing, the composition of personal data to be processed and the actions (operations) performed with personal data. In this Policy, the operator means the Company.

Automated processing of personal data means processing of personal data using computer hardware.

Blocking of personal data means temporary suspension of personal data processing (except in cases where processing is necessary to correct personal data).

Personal data information system means the entirety of personal data contained in databases, and information technologies and technical tools used for their processing.

Depersonalization of personal data means actions, as a result of which it becomes impossible to attribute personal data to a specific personal data subject without additional information.

Processing of personal data means any action (operation) or a set of actions (operations), which is performed with personal data, whether or not by automated means. Processing of personal data includes, among other things, collection, recording, systematization, accumulation, storage, correction (update, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

Personal data means any information relating directly or indirectly to an identified or identifiable individual (the subject of personal data).

Personal data allowed by the subject of personal data for distribution mean the personal data, access of the general public to which has been provided by the subject of those personal data by giving consent to the processing of the personal data allowed by the subject of personal data for distribution as prescribed by Law No. 152-ФЗ.

Provision of personal data means actions aimed at disclosing personal data to a certain person or a certain group of persons.

Distribution of personal data means actions aimed at disclosing personal data to the general public.

Cross-border transfer of personal data means transfer of personal data to the territory of a foreign state, to an authority of a foreign state, or to a foreign individual or legal entity.

Destruction of personal data means actions, as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which physical carriers of personal data are destroyed.

3. PRINCIPLES OF PERSONAL DATA PROCESSING

The Company processes personal data based on the following principles:

1. Processing of personal data is performed on a lawful and fair basis.
2. Processing of personal data is limited to the achievement of specific and lawful goals defined in advance. The purposes of personal data processing are listed in the section Purposes of Personal Data Processing of the Policy.
3. It is not allowed to combine databases containing personal data which are processed for purposes that are incompatible with each other.
4. Only those personal data that correspond to the purposes of their processing are subject to processing.
5. The content and volume of the processed personal data correspond to the stated purposes of processing. The personal data being processed are not excessive in relation to the stated purposes of processing.
6. During processing of personal data, the accuracy of personal data, their sufficiency, and, if necessary, their relevance in relation to the stated purposes of their processing, are ensured.
7. Personal data are stored in a form that allows determining the subject of personal data for no longer than the purposes of personal data processing require, unless the period of personal data storage is established by a Federal Law or an agreement to which the subject of personal data is a party, beneficiary or guarantor. The processed personal data are subject to destruction upon achievement of the purpose of processing or in case that purpose has lost relevance, unless otherwise provided for by the legislation of the Russian Federation.

4. PURPOSES OF PERSONAL DATA PROCESSING. TERMS AND CONDITIONS OF PERSONAL DATA PROCESSING

4.1. The Company’s website https://novamedica.com processes the personal data of individuals who visit or have visited the official website of NovaMedica LLC www.novamedica.com (hereinafter, the “Website Visitors”).

The Company receives personal data in electronic form directly from the subjects of personal data – Website Visitors.

When collecting personal data on the Website pages, the Company offers to the Website Visitor to read this Policy and consent to the processing of his or her personal data of his or her own free will and volition and in his or her own interest. Consent of the subject of personal data to the processing of his/her personal data is provided in Appendix 1 to this Policy.

4.1.1. Personal data entry form: “Write a message” https://novamedica.com/ru/contacts

Purpose of personal data processing:

• sending a response to the Website Visitor’s message;

Which personal data is processed:

• full name (last name, first name, patronymic);
• email address;
• phone number;
• text of the message.

Actions performed with personal data:

• collection, recording, systematization, accumulation, storage, correction (update, modification), extraction, use, transfer (provision, access), blocking, deletion, destruction

Legal basis for personal data processing:

• Consent to the processing of personal data

Methods of personal data processing:

• automation tools.

Processing time:

• until the end of the conversation as part of responding to the incoming message.

4.1.2. Personal data entry form: “Employment” https://novamedica.com/ru/12630

Purpose of personal data processing:

• consideration of a suitable candidate for employment.

Which personal data is processed:

• full name (last name, first name, patronymic);
• email address;
• phone number;
• vacancy of interest;
• text of the message;
• text of the CV.

Actions performed with personal data:

• collection, recording, systematization, accumulation, storage, correction (update, modification), extraction, use, transfer (provision, access), blocking, deletion, destruction

Legal basis for personal data processing:

• Consent to the processing of personal data

Methods of personal data processing:

• automation tools.

Processing time:

• until the end of the conversation as part of responding to the incoming message.

4.1.3. Cookie files. The purposes of personal data processing, as well as the information on which personal data is processed, are described in Section 5 of the Policy.

4.2. Deletion and destruction of personal data are carried out upon achievement of the purposes of processing or at the request of the personal data subject.

4.4. Conditions for transfer of personal data to third parties

Provision of personal data to public authorities and local government bodies (including by entering information into state and municipal information systems), as well as to other authorized bodies, is allowed in cases and on the grounds provided for by the legislation of the Russian Federation.

Transfer of personal data between the Company’s divisions is carried out only between employees who have access to the personal data of subjects.

5. COOKIES AND AUTOMATIC LOGGING

The Company’s website https://novamedica.com collects information during a User’s visit to the Website in order to accumulate use statistics and analyze effectiveness, to personalize and adjust interaction, as well as to improve the products and services. Information is collected using various technologies, including cookie files.

A cookie is a piece of data sent by a website to the User’s browser, which can then be stored on the computer as a tag identifying the computer. Cookies are often used only to analyze the use of a website (in particular, to determine the number of Users and the duration of the visit) and its effectiveness (in particular, to identify the topics that the User is most interested in), as well as to simplify website navigation and use, and in this context are not associated with personal data.

The table below shows the cookies collected on the Company’s Website https://novamedica.com

Cookie key	Domain	Storage time	Description
Strictly necessary cookies
_ym_uid	.novamedica.com	1 year	Used to identify the User on the website.
_ym_d			Used to save the first visit to the website.
Performance cookie files
yandexuid	.yandex.com	1 year	Registers data about the behavior of website visitors. This is used for internal analysis and website optimization.
yandexuid	.yandex.ru	1 year 1 month	Registers data about the behavior of website visitors. This is used for internal analysis and website optimization.
_ym_isad	novamedica.com	20 hours	This cookie file determines whether the User has ad blockers.
Target cookie files
yuidss	.yandex.com	1 year	Collects information about the behavior of visitors on several websites. The information is necessary to optimize the relevance of advertising.
Sid	novamedica.com	Session	Used to manage the session state.
Functional cookie files
yabs-sid	mc.yandex.com	Session	Used to identify the User on the website.
Unclassified cookie files
sync_cookie_csrf	.mc.yandex.ru	10 minutes	–
sync_cookie_ok	.mc.yandex.com	1 day	–
_ym_visorc	.novamedica.com	30 minutes	–
i	.yandex.ru	1 year 1 month	–
sync_cookie_csrf	.mc.yandex.com	10 minutes	–
yp	.yandex.com	1 year 1 month	–
bh	.yandex.com	1 year	–
site_lang	.novamedica.com	1 year	–
i	.yandex.com	1 year 1 month	–

When visiting the Company’s Website https://novamedica.com the User can select options for the use of cookies and other similar technologies via the settings and tools provided in the browser. The User can delete existing cookie files through the browser settings.

The User can specify the preferred options for most of the cookie files and similar technologies through the browser. Information about cookie files control can be found in the Settings (or similar) section of the browser. The User can completely disable cookie files in the browser. If the User blocks, disables or otherwise prohibits the use of cookie files, the Website may not display correctly.

6. RIGHTS OF THE SUBJECT OF PERSONAL DATA

In accordance with Law No. 152-ФЗ, the subject of personal data has:

• the right to access personal data;
• the right to correct personal data;
• the right to withdraw consent;
• the right to appeal against our actions or our inaction;
• the right to appeal against decisions made solely on the basis of automated processing of personal data.

6.1. The right to access personal data.

The subject of personal data has the right to receive reliable information from the Operator about the processing of his or her personal data, and, if possible, access to his or her personal data and to the following information:

• confirmation that his or her personal data is being processed by the Company;
• legal grounds for and purposes of personal data processing;
• purposes and methods of personal data processing used by the Company;
• name and location of the Company, information about the persons (except for employees of the Company) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Company or on the basis of the legislation of the Russian Federation;
• processed personal data related to the relevant personal data subject and their source, unless another procedure for submitting such data is provided for by a Federal Law;
• period of processing of personal data, including period of their storage;
• procedure for the exercise by the subject of personal data of the rights provided for by Law No. 152-ФЗ;
• information on whether there is any cross-border data transfer;
• name or full name (last name, first name, patronymic) and address of the person processing personal data on behalf of the Company, if processing is delegated or will be delegated to such a person;
• information on the ways in which the Operator fulfills the obligations established by Article 18.1 of Law No. 152-ФЗ;

other information provided for by the legislation of the Russian Federation.

6.2. The right to revoke consent to the processing of personal data.

If personal data is processed on the basis of consent, the subject has the right to revoke it.

6.3. The right to request that the Operator corrects the subject’s personal data, blocks or destroys them.

If the subject’s personal data are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, the subject has the right to request that the Operator corrects the data concerning the subject without undue delay. After correcting the personal data, the Operator shall notify the subject.

6.4. The right to revoke consent to the processing of personal data.

If the subject’s personal data are processed on the basis of consent, the subject has the right to revoke it.

6.5. The subject of personal data can exercise the rights listed in clauses 6.1-6.4. of the Policy in several ways:

• by sending a written request to the Operator at: 125124, 18, 3rd Yamskogo Polya street, Moscow;
• by sending a written request to the Operator by e-mail at privacy@novamedica.com. Such request may be sent to the Operator’s e-mail in the form of an electronic document signed in accordance with the legislation of the Russian Federation on electronic signature.

A request must contain: information about your identification document or the identification document of your representative (type of document, series and number, issuing authority and the date of issue), your full name or the full name of your representative, and information about the relationship with you, which will confirm that your personal data is being processed by us, your signature or the signature of your representative.

6.6. The right to appeal against the actions or inaction of the Company to the authorized body for the protection of the rights of personal data subjects (Federal Service for Supervision of Communications, Information Technologies and Mass Media – Roskomnadzor) of the subject’s region or in court.

6.7. The right to defend his or her rights and lawful interests, including the right to compensation for damages and (or) moral injury in court.

7. RESPONSIBILITIES OF THE COMPANY IN RELATION TO THE PROCESSING OF PERSONAL DATA

When processing personal data, the Company fulfills the following requirements:

1. Publishes or otherwise provides unrestricted access to the document defining the Company’s policy on the processing of personal data and to the information on the observed requirements to protection of personal data, and ensures that it is possible to access the above document via the appropriate information and telecommunication network.
2. When collecting personal data, provides the subject of personal data, at his or her request, with information related to the processing of his or her personal data.
3. Clarifies to the personal data subject the legal consequences of refusing to provide personal data and (or) consent to the processing of personal data, if provision of personal data and (or) obtaining consent to the processing of personal data is mandatory in accordance with the legislation of the Russian Federation.
4. Ensures the recording, systematization, accumulation, storage, correction (update, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases specified in Law No. 152-ФЗ.
5. Does not disclose or distribute personal data without consent of the personal data subject, unless otherwise provided for by the legislation of the Russian Federation.
6. Allows the personal data subject or his or her representative free of charge to see the personal data related to that personal data subject in the form in which the relevant message or request was sent, unless otherwise specified in that message or request.
7. Makes necessary changes to personal data if there is information confirming that the personal data is incomplete, inaccurate or outdated.
8. Immediately, at the request of the personal data subject, stops the processing of his or her personal data for the purpose of promoting goods, works or services on the market by making direct contacts using communication tools.
9. Destroys personal data if there is information confirming that those personal data have been illegally obtained or are not necessary for the stated purpose of processing.
10. If the personal data subject withdraws consent to the processing of his or her personal data, the Company stops processing them and destroys them, except in cases provided for by the legislation on personal data.
11. At the request of the personal data subject, stops processing and destroys his or her personal data, except in cases provided for by the legislation on personal data.
12. Takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, or distribution, as well as from other illegal actions in relation to personal data.
13. Notifies the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) in case of establishing the fact of unlawful or accidental transfer (provision, distribution, access) of personal data, which resulted in violation of the rights of personal data subjects, in accordance with the procedure and timeline established by the legislation on personal data.
14. Provides necessary information to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) at its request.

8. CONFIDENTIALITY OF PERSONAL DATA

Access to personal data is restricted in accordance with the legislation of the Russian Federation.

Access to the processed personal data is provided only to those employees of the Company who need it to perform their official duties.

Employees of the Company who have received access to personal data undertake to ensure confidentiality and security of the processed personal data.

The Company does not disclose personal data to third parties or distribute them without consent of the personal data subject, unless otherwise provided for by the legislation of the Russian Federation.

9. REQUIREMENTS TO PROTECTION OF PERSONAL DATA OBSERVED BY THE COMPANY

Security of personal data during their processing by the Company is ensured in accordance with the legislation of the Russian Federation and the requirements of the authorized body for the protection of the rights of personal data subjects (Roskomnadzor), the federal executive body authorized in the field of security (Federal Security Service of Russia), and the federal executive body authorized in the field of technical protection of information (Federal Service for Technology and Export Control of Russia).

The Company takes the necessary organizational and technical measures to protect personal data from accidental or unauthorized access, destruction, modification, blocking of access or other unauthorized actions.

10. PROHIBITIONS AND RESTRICTIONS ON THE PROCESSING OF PERSONAL DATA AUTHORIZED BY THE SUBJECT OF PERSONAL DATA FOR DISTRIBUTION

Website visitors (the general public) and any third-party operators may not perform any actions in relation to the personal data of employees distributed via the Company’s Website https://novamedica.com, except for reading that personal data.

11. FINAL PROVISIONS

This Policy is subject to review and improvement on a regular basis, as well as in case of changes in the legislation of the Russian Federation.

Control of compliance with the requirements of this Policy is carried out by the persons responsible for organizing the processing and ensuring security of personal data in the Company.

In case of violation of the requirements of the legislation of the Russian Federation or internal regulations of the Company on the processing and protection of personal data, the Company bears liability in accordance with the legislation of the Russian Federation.

Appendix 1

CONSENT
of the subject of personal data to the processing of his/her personal data

I, the subject of personal data (a visitor to the official website of NovaMedica LLC on the Internet information and telecommunication network https://novamedica.com/ru), in reliance on Article 9 of Federal Law No. 152-ФЗ dated July 27, 2006 on Personal Data, acting of my own free will and in my own interest, hereby voluntarily provide my personal data and give my consent to NovaMedica Limited Liability Company (Taxpayer’s Individual Number 7718886050), registered in accordance with the legislation of the Russian Federation at: 125124, 18, 3rd Yamskogo Polya street, Moscow, (hereinafter, the “Organization”), to the processing of my personal data upon the following conditions:

1. This Consent is given to the processing of my personal data using automation tools. This Consent is given to the processing of my following personal data: full name (last name, first name, patronymic); phone number; email address; CV; cookie files (user data (location, OS type and version, browser type and version, device type and screen resolution; source from where the user came to the website (website or advertisement); OS and browser language ; pages that the user opens and buttons that the user clicks; IP address); information about me that will become known during performance of contracts (if a contract will be executed between me and the Organization), as well as other publicly available information about me.

2. Purposes of personal data processing: sending a response to a website visitor’s message (processing incoming messages from individuals with the purpose of providing consultations on various issues related to the Organization’s field of activity); considering a suitable candidate for employment; analyzing the actions of an individual on the website and the functioning of the website.

3. The basis for the processing of personal data is Article 24 of the Constitution of the Russian Federation; Article 6 of Federal Law No. 152-ФЗ on Personal Data; this Consent of the website visitor to the processing of personal data.

4. During the processing of personal data, the Organization has the right to perform any of the following actions (operations) or a set of the following actions (operations) with personal data: collection, recording, systematization, accumulation, storage, correction (update, modification), extraction, use, transfer (provision, access), blocking, deletion, destruction of personal data.

5. I am hereby notified by the Organization that the intended users of personal data are employees of the Organization, as well as persons engaged by the Organization under civil law contracts.

6. I am aware, that:

6.1. This Consent to the processing of my personal data is valid for 13 months (1 year 1 month) and can be revoked by me sending a notification to the Organization’s email: privacy@novamedica.com.

6.2. I have the right to access my personal data, to request correction (update, modification) of my personal data, as well as deletion and destruction of my personal data in case their processing by the Organization violates my lawful rights and interests or the legislation of the Russian Federation.

6.3. In case of withdrawal of this Consent to the processing of personal data, the Organization has the right to continue processing personal data without consent of the personal data subject in cases provided for by the legislation of the Russian Federation.

7. By giving this Consent, I confirm that I am the subject of the personal data provided, and also confirm the accuracy of the data provided.

8. This Consent is valid until termination of the processing of my personal data in accordance with clause 6.1 of this Consent.