Personal Data Processing Policy

1. General Provisions
1.1. This Policy on the Processing of Personal Data (hereinafter referred to as the "Policy") has been developed in compliance with the requirements of Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as the "Law") in order to ensure the protection of human and civil rights and freedoms in the processing of personal data, including the protection of the right to privacy, personal and family secrets.
1.2. The Policy applies to all personal data processed by Individual Entrepreneur Kirill Slavchovich Georgiev (Taxpayer Identification Number: 691008737401, Primary State Registration Number of Individual Entrepreneur: 320695200032579) (hereinafter referred to as the "Operator").
1.3. The Policy applies to legal relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
1.4. In compliance with the requirements of Part 2, Article 18.1 of the Law, this Policy is made publicly available by posting it on the Operator's website on the information and telecommunications network "Internet" at https://geoolegal.pro/.
1.5. The main terms used in the Policy:

• personal data – any information relating directly or indirectly to an identified or identifiable individual (personal data subject);
• operator of personal data (operator) – a state body, municipal body, legal entity or individual, independently or jointly with other persons organising and/or carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed with personal data;
• processing of personal data – any action (operation) or set of actions (operations) performed with personal data using automation means or without such means. The processing of personal data includes, inter alia:
• collection;
• recording;
• systematisation;
• accumulation;
• storage;
• updating (renewal, modification);
• retrieval;
• use;
• transfer (provision, access);
• depersonalisation (anonymisation);
• blocking;
• deletion;
• destruction.
• automated processing of personal data – processing of personal data using computer technology;
• dissemination of personal data – actions aimed at disclosing personal data to an indefinite circle of persons;
• Manager – the sole executive body of the Operator;
• provision of personal data – actions aimed at disclosing personal data to a specific person or a specific circle of persons;
• blocking of personal data – temporary suspension of the processing of personal data (except where processing is necessary for the purpose of updating personal data);
• destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the physical media containing personal data are destroyed;
• depersonalisation (anonymisation) of personal data – actions as a result of which it becomes impossible without the use of additional information to determine the ownership of personal data to a specific personal data subject;
• personal data information system – a set of personal data contained in databases and the information technologies and technical means ensuring their processing.

1.6. Basic rights and obligations of the Operator.
1.6.1. The Operator has the right:

• to independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations provided for by the Personal Data Law and the regulatory legal acts adopted in accordance therewith, unless otherwise provided by the Personal Data Law or other federal laws;
• to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with such person. The person processing personal data on behalf of the Operator shall be obliged to comply with the principles and rules of processing personal data provided for by the Personal Data Law, to maintain the confidentiality of personal data, and to take necessary measures aimed at ensuring compliance with the obligations provided for by the Personal Data Law;
• in the event of withdrawal by the personal data subject of consent to the processing of personal data, the Operator shall have the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Personal Data Law.

1.6.2. The Operator is obliged:

• to organise the processing of personal data in accordance with the requirements of the Personal Data Law;
• to respond to requests and inquiries of personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
• to provide, at the request of the authorised body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)), the necessary information within 10 working days from the date of receipt of such request. This period may be extended, but by no more than five working days. To do so, the Operator must send a reasoned notification to Roskomnadzor indicating the reasons for extending the period for providing the requested information;
• in accordance with the procedure determined by the federal executive body authorised in the field of security, to ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it of computer incidents that have resulted in unlawful transfer (provision, dissemination, access) of personal data.

1.7. Basic rights of the personal data subject. The personal data subject has the right:

• to receive information relating to the processing of his/her personal data, except in cases provided for by federal laws. The information shall be provided to the personal data subject by the Operator in an accessible form, and shall not contain personal data relating to other personal data subjects, except where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
• to require the operator to update, block or destroy his/her personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect his/her rights;
• to give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
• to appeal, to Roskomnadzor or in court, unlawful actions or omissions of the Operator in the processing of his/her personal data.

1.8. Control over the implementation of the requirements of this Policy is carried out by an authorised person responsible for organising the processing of personal data at the Operator.
1.9. Liability for violation of the requirements of the legislation of the Russian Federation and the Operator's regulations in the field of processing and protection of personal data shall be determined in accordance with the legislation of the Russian Federation.
2. Purposes of Personal Data Collection
2.1. The processing of personal data shall be limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of collecting personal data is not permitted.
2.2. Only personal data that correspond to the purposes of their processing shall be subject to processing.
2.3. The Operator processes personal data for the following purposes:

• preparation, conclusion and performance of civil law contracts;
• recruitment of personnel (candidates) for vacant positions of the operator;
• promotion of goods, works, and services on the market.

2.4. Processing of personal data may be carried out exclusively for the purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal Grounds for the Processing of Personal Data
3.1. The legal grounds for the processing of personal data are the set of regulatory legal acts in compliance with and in accordance with which the Operator processes personal data, including:

• The Constitution of the Russian Federation;
• The Civil Code of the Russian Federation;
• The Labour Code of the Russian Federation;
• The Tax Code of the Russian Federation;
• Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
• Federal Law No. 402-FZ of December 6, 2011 "On Accounting";
• Federal Law No. 167-FZ of December 15, 2001 "On Compulsory Pension Insurance in the Russian Federation";
• Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and Protection of Information";
• Government Resolution No. 719 of November 27, 2006 "On Approval of the Regulations on Military Registration";
• Government Resolution No. 687 of September 15, 2008 "On Approval of the Regulations on the Specifics of Processing Personal Data Carried Out Without the Use of Automation Means";
• other regulatory legal acts regulating relations related to the Operator's activities.

3.2. The legal grounds for the processing of personal data are also:

• the Operator's Charter;
• agreements concluded between the Operator and personal data subjects;
• consent of personal data subjects to the processing of their personal data.

4. Scope and Categories of Processed Personal Data, Categories of Personal Data Subjects
4.1. The content and scope of processed personal data shall correspond to the stated purposes of processing provided for in Section 2 of this Policy. Processed personal data shall not be excessive in relation to the stated purposes of their processing.
4.2. The Operator may process personal data of the following categories of personal data subjects:
4.2.1. Dismissed employees, employees and their relatives – for the purpose of maintaining personnel and accounting records, including the implementation of directly related legal relations, including labour, tax, pension and insurance relations:

• surname, first name, patronymic;
• year of birth;
• month of birth;
• date of birth;
• place of birth;
• income;
• gender;
• email address;
• residential address;
• registration address;
• telephone number;
• SNILS (individual personal account insurance number);
• TIN (taxpayer identification number);
• citizenship;
• identity document data;
• data contained in the birth certificate;
• bank card details;
• current account number;
• personal account number;
• profession;
• position;
• information on employment history (including length of service, current employment data indicating the name and current account of the organisation);
• military registration status, military registration information;
• educational information.

4.2.2. Beneficiaries under contracts, clients and counterparties of the Operator, including their representatives – for the purpose of carrying out statutory activities, including preparation, conclusion and performance of contracts:

• surname, first name, patronymic;
• year of birth;
• month of birth;
• date of birth;
• place of birth;
• gender;
• email address;
• residential address;
• registration address;
• telephone number;
• TIN (taxpayer identification number);
• citizenship;
• identity document data;
• driving licence data;
• data of the identity document valid outside the Russian Federation;
• bank card details;
• current account number;
• personal account number.

4.2.3. Candidates – for the purpose of recruitment of personnel (candidates) for vacant positions of the operator:

• surname, first name, patronymic;
• year of birth;
• month of birth;
• place of birth;
• gender;
• email address;
• residential address;
• registration address;
• telephone number;
• TIN (taxpayer identification number);
• citizenship;
• identity document data;
• profession;
• information on employment history (including length of service, current employment data indicating the name and current account of the organisation);
• military registration status, military registration information;
• educational information.

4.2.4. Website visitors – for the purpose of promoting goods, works, and services on the market:

• surname, first name, patronymic;
• email address;
• telephone number;
• data collected through metric programs.

4.3. The Operator processes personal data in the following ways:

• collection;
• recording;
• systematisation;
• accumulation;
• storage;
• updating (renewal, modification);
• retrieval;
• use;
• transfer (provision, access);
• blocking;
• deletion;
• destruction.

4.4. The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, or intimate life, except in cases provided for by the legislation of the Russian Federation.
5. Procedure and Conditions for the Processing of Personal Data
5.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2. The processing of personal data is carried out with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
5.3. The Operator processes personal data for each purpose of processing in the following ways:

• non-automated processing of personal data;
• automated processing of personal data with or without transmission of the obtained information via information and telecommunication networks;
• mixed processing of personal data.

5.4. Only employees of the Operator whose job responsibilities include the processing of personal data are permitted to process personal data.
5.5. The processing of personal data for each purpose of processing specified in Clause 2.3 of the Policy is carried out by:

• obtaining personal data in oral and written form directly from personal data subjects;
• entering personal data into the Operator's logs, registers and information systems;
• using other methods of processing personal data.

5.6. Disclosure to third parties and dissemination of personal data without the consent of the personal data subject is not permitted, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the personal data subject for dissemination shall be formalised separately from other consents of the personal data subject to the processing of his/her personal data.
The requirements for the content of consent to the processing of personal data permitted by the personal data subject for dissemination are approved by Order of Roskomnadzor No. 18 of February 24, 2021 "On Approval of Requirements for the Content of Consent to the Processing of Personal Data Permitted by the Personal Data Subject for Dissemination."
5.7. The transfer of personal data to bodies of inquiry and investigation, to the Federal Tax Service, the Social Fund of Russia and other authorised executive authorities and organisations shall be carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator takes necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, dissemination and other unauthorised actions, including:

• identifying threats to the security of personal data in their processing;
• adopting local regulations and other documents regulating relations in the field of processing and protection of personal data;
• appointing persons responsible for ensuring the security of personal data in the Operator's structural divisions and information systems;
• creating the necessary conditions for working with personal data;
• organising the accounting of documents containing personal data;
• organising work with information systems in which personal data are processed;
• storing personal data under conditions that ensure their safety and exclude unlawful access to them;
• organising training for the Operator's employees involved in the processing of personal data.

5.9. The Operator stores personal data in a form that allows identification of the personal data subject for no longer than required by each purpose of processing personal data, unless the storage period for personal data is established by federal law or by contract.
5.9.1. Personal data on paper media shall be stored by the Operator for the periods of document retention for which such periods are provided by the legislation on archival affairs in the Russian Federation (Federal Law No. 125-FZ of October 22, 2004 "On Archival Affairs in the Russian Federation", the List of Standard Managerial Archival Documents Generated in the Course of Activities of State Bodies, Local Self-Government Bodies and Organisations, Indicating their Retention Periods (approved by Order of Rosarkhiv No. 236 of December 20, 2019 "On Approval of the List of Standard Managerial Archival Documents Generated in the Course of Activities of State Bodies, Local Self-Government Bodies and Organisations, Indicating their Retention Periods")).
5.9.2. The storage period for personal data processed in personal data information systems shall correspond to the storage period for personal data on paper media.
5.10. The Operator terminates the processing of personal data in the following cases:

• a fact of unlawful processing is identified – within three working days from the date of identification;
• the purpose of their processing is achieved;
• the consent period expires or the consent of the personal data subject to the processing of such data is withdrawn, where under the Law the processing of such data is permitted only with consent.

5.11. Upon achievement of the purposes of processing personal data, as well as in the event of withdrawal by the personal data subject of consent to their processing, the Operator shall cease processing such data if:

• otherwise is not provided for by the contract to which the personal data subject is a party, beneficiary or guarantor;
• the Operator is not entitled to process without the consent of the personal data subject on the grounds provided for by the Law or other federal laws;
• otherwise is not provided for by another agreement between the Operator and the personal data subject.

5.12. Upon a request by the personal data subject to the Operator for termination of the processing of personal data, within a period not exceeding 10 working days from the date the Operator receives the relevant request, the processing of personal data shall be terminated, except for cases provided for by the Law. The said period may be extended, but by no more than five working days. To do so, the Operator must send a reasoned notification to the personal data subject indicating the reasons for extending the period.
5.13. When collecting personal data, including via the information and telecommunications network "Internet," the Operator ensures the recording, systematisation, accumulation, storage, updating (renewal, modification), and retrieval of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Personal Data Law.
6. Updating, Correction, Deletion, Destruction of Personal Data, Responses to Requests of Subjects for Access to Personal Data
6.1. Confirmation of the fact of processing of personal data by the Operator, the legal grounds and purposes of processing personal data, as well as other information specified in Part 7, Article 14 of the Law, shall be provided by the Operator to the personal data subject or his/her representative within 10 working days from the date of the request or receipt of the request from the personal data subject or his/her representative. This period may be extended, but by no more than five working days. To do so, the Operator must send a reasoned notification to the personal data subject indicating the reasons for extending the period for providing the requested information.
The information provided shall not include personal data relating to other personal data subjects, except where there are legal grounds for disclosing such personal data.
The request must contain:

• the number of the main identity document of the personal data subject or his/her representative, information on the date of issue of the said document and the authority that issued it;
• information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and/or other information), or information otherwise confirming the fact of processing of personal data by the Operator;
• the signature of the personal data subject or his/her representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
The Operator shall provide the information specified in Part 7, Article 14 of the Law to the personal data subject or his/her representative in the form in which the relevant request was sent, unless otherwise specified in the request.
If the request of the personal data subject does not reflect, in accordance with the requirements of the Personal Data Law, all necessary information, or the subject does not have the right of access to the requested information, a reasoned refusal shall be sent to him/her.
The right of the personal data subject to access his/her personal data may be restricted in accordance with Part 8, Article 14 of the Law, including if the personal data subject's access to his/her personal data violates the rights and legitimate interests of third parties.
6.2. In the event of detection of inaccurate personal data upon a request by the personal data subject or his/her representative, or upon their request or upon a request from Roskomnadzor, the Operator shall block the personal data relating to such personal data subject from the moment of such request or receipt of the said request for the period of verification, if blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
In the event of confirmation of the inaccuracy of personal data, the Operator, on the basis of information provided by the personal data subject or his/her representative or Roskomnadzor, or other necessary documents, shall update the personal data within seven working days from the date of provision of such information and shall unblock the personal data.
6.3. In the event of detection of unlawful processing of personal data upon a request by the personal data subject or his/her representative or Roskomnadzor, the Operator shall block the unlawfully processed personal data relating to such personal data subject from the moment of such request or receipt of the request.
6.4. Upon identification by the Operator, Roskomnadzor or other interested person of a fact of unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator shall:

• within 24 hours – notify Roskomnadzor of the incident that has occurred, the alleged causes that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, as well as provide information on the person authorised by the Operator to interact with Roskomnadzor on issues related to the incident;
• within 72 hours – notify Roskomnadzor of the results of the internal investigation of the identified incident and provide information on the persons whose actions were the cause thereof (if any).

6.5. Procedure for the destruction of personal data by the Operator.
6.5.1. Conditions and periods for the destruction of personal data by the Operator:

• achievement of the purpose of processing personal data or loss of the need to achieve this purpose – within 30 days;
• achievement of the maximum retention periods for documents containing personal data – within 30 days;
• provision by the personal data subject (his/her representative) of confirmation that the personal data were obtained unlawfully or are not necessary for the stated purpose of processing – within seven working days;
• withdrawal by the personal data subject of consent to the processing of his/her personal data, if their retention for the purpose of their processing is no longer required – within 30 days.

6.5.2. Upon achievement of the purpose of processing personal data, as well as in the event of withdrawal by the personal data subject of consent to their processing, the personal data shall be destroyed if:

• otherwise is not provided for by the contract to which the personal data subject is a party, beneficiary or guarantor;
• the Operator is not entitled to process without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
• otherwise is not provided for by another agreement between the Operator and the personal data subject.

6.5.3. The destruction of personal data shall be carried out by a commission established by order of the Operator's Manager.
6.5.4. Methods of destruction of personal data shall be established in the Operator's local regulations.
7. Final Provisions
7.1. The Policy is approved and remains in force indefinitely until a new version of the Policy takes effect.
7.2. In the event of changes to the legislation of the Russian Federation in the field of personal data protection, the Operator shall adopt a new version of the Policy in accordance with such changes. Until then, the Policy shall remain in effect to the extent that it does not contradict the applicable legislation of the Russian Federation.
7.3. For the purpose of contacting the Operator, the following contact details may be used:
Tel.: +7 (960) 717-51-77
E-mail: kir.georgiev.work@gmail.com
Postal address: 119618, Moscow, Zelyonaya Gorka Street, Building 1, Block 1.
June 1, 2026
Individual Entrepreneur K.S. Georgiev