Policy

1.1. The most important condition for achieving the goals of the activities of AQUA ALLIANCE LLC, OGRN 7716806370 (hereinafter referred to as AQUA ALLIANCE LLC or the Operator) is to ensure the necessary and sufficient level of information security of information, which includes personal data.

1.2. The policy regarding the processing of personal data in AQUA ALLIANCE (hereinafter referred to as the Regulation) determines the procedure for collecting, storing, transferring and other types of processing of personal data in AQUA ALLIANCE LLC (hereinafter referred to as AQUA ALLIANCE or the Operator), as well as information on the implemented requirements for the protection of personal data.

1.3. The policy has been developed in accordance with the current legislation of the Russian Federation.

2.1. Information constituting personal data is any information related to a directly or indirectly defined or determinable individual (subject of personal data). A detailed list of personal data is recorded in the local regulatory documentation of "AQUA ALLIANCE".

2.2. All personal data processed by "AQUA ALLIANCE" are confidential, strictly protected information in accordance with the law.

3.1. Personal data are processed by AQUA ALLIANCE for the purposes of formalizing labor and other contractual relations, personnel, accounting, tax records, on the grounds provided for in Article 22 of the Federal Law of 27.06.2006 No. 152-FZ, 85-90 of the Labor Code of the Russian Federation, as well as for the purposes of organizing and conducting by AQUA ALLIANCE (including with the involvement of third parties) loyalty programs, marketing and/or advertising campaigns, research, surveys and other events; fulfillment by AQUA ALLIANCE of obligations under retail sale and purchase agreements/supply agreements/agreements for the performance of work (provision of services) concluded by AQUA ALLIANCE, including through the website - https://www.aqua-visor.ru; provision of other services to personal data subjects; promotion of services and/or goods of "AQUA ALLIANCE" and/or partners of "AQUA ALLIANCE" on the market by establishing direct contacts with clients of "AQUA ALLIANCE" using various means of communication, including, but not limited to, by telephone, e-mail, mailing list, on the Internet, etc.; for other purposes, if the actions of "AQUA ALLIANCE" do not contradict the current legislation.

When registering on the Site, the User provides the following information: Last name and/or First name and/or Patronymic (if any), contact phone number and/or e-mail address.

When using the Site, the User provides information about his/her behavior, place of work and position held; user data (location information; OS type and version; Browser type and version; device type and its screen resolution; source from which the user came to the site; from which site or via which advertisement; OS and Browser language; which pages the user opens and which buttons the user clicks; IP address.

By providing their personal data to the Operator, the Site Visitor/User/Buyer agrees to their processing by the Operator, including for the purpose of fulfilling the Operator's obligations to the Site Visitor/User/Buyer within the framework of concluded/executed agreements, promoting goods and services by the Operator, conducting electronic and SMS surveys, monitoring the results of marketing campaigns, customer support, organizing the delivery of goods to Buyers, holding prize draws among Site Visitors/Users/Buyers, monitoring the satisfaction of the Site Visitor/User/Buyer, as well as the quality of services provided by the Operator, as well as for the purpose of processing incoming requests from individuals and/or legal entities for the purpose of providing consulting; analytics of an individual's actions on the website and the functioning of the website;

By checking the appropriate box and clicking on the “Submit Order” button on the website, the User/Buyer, acting freely, of his own free will and in his own interests, and also confirming his legal capacity, gives informed consent to the Operator to process his personal data, in accordance with (the specified personal data, in the specified ways, and within the specified period, etc., etc.) with the terms of this Policy on the processing of personal data in "AQUA ALLIANCE".

Employees give informed consent to the Operator to process their personal data, in accordance with this Policy on the processing of personal data in "AQUA ALLIANCE", by signing an employment contract and familiarizing themselves with this policy.

3.2. "AQUA ALLIANCE", in order to properly fulfill its duties as an Operator, processes the following personal data necessary for proper fulfillment of contractual obligations:

• personal data of the Operator's employees who are in employment relations with the Operator;

• personal data of other individuals (including employees of the control agents of the Operator), including, but not limited to, those in contractual, civil-law relations with the Operator, including, but not limited to, customers, candidates for vacant positions, etc.

4.1. The processing of personal data carried out without the use of automation tools is carried out in such a way that for each category of personal data it is possible to determine the storage locations of personal data (tangible media). The Operator has established a list of persons who process personal data or have access to them. Separate storage of personal data (tangible media) is ensured, the processing of which is carried out for different purposes. The Operator ensures the safety of personal data and takes measures to prevent unauthorized access to personal data.

4.2. The processing of personal data carried out using automation tools is carried out subject to the following actions: The Operator carries out technical measures aimed at preventing unauthorized access to personal data and (or) transferring them to persons who do not have the right to access such information; protective tools are configured to promptly detect facts of unauthorized access to personal data; technical means of automated processing of personal data are isolated in order to prevent impact on them, as a result of which their functioning may be disrupted; The Operator makes backup copies of data in order to be able to immediately restore personal data modified or destroyed due to unauthorized access to them; exercises constant control over ensuring the level of security of personal data.

4.3. Processing of personal data means any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (including transfer to third parties, not excluding cross-border transfer, if the need for it arose in the course of fulfilling obligations), depersonalization, blocking, deletion, destruction of personal data.

4.4. The Operator has the right to send informational, including advertising messages, to the User/Buyer's e-mail and mobile phone with his/her consent, expressed by performing actions that uniquely identify this User/Buyer and allow to reliably establish his/her will to receive the message. The will to receive messages is considered given after the User/Buyer performs actions to register on the website and enters the relevant information in the appropriate fields of the registration form. The User/Buyer has the right to refuse to receive advertising and other information without explaining the reasons for the refusal by informing the Operator by sending a corresponding statement to the Seller's email address: a.savolokin@sma-russia.ru

Service messages informing the User/Buyer about the order and the stages of its processing can be sent automatically and cannot be rejected by the User/Buyer.

4.5. The Operator has the right to use the "cookies" technology. "Cookies" do not contain confidential information. The Visitor / User / Buyer hereby consents to the collection, analysis and use of cookies, including by third parties for the purpose of generating statistics and optimizing advertising messages.

4.6. The Operator can receive information about the IP address of the Site visitor. This information is not used to identify the visitor.

4.7. The Operator has the right to record telephone conversations with the User/Buyer. In this case, the Operator undertakes to: prevent attempts at unauthorized access to information obtained during telephone conversations and/or its transfer to third parties not directly related to the execution of Orders, in accordance with paragraph 4 of Article 16 of the Federal Law "On Information, Information Technologies and Information Protection".

5.1. The Operator carries out the following activities: identifies threats to the security of personal data during their processing, forms threat models based on them; develops a personal data protection system based on the threat model that ensures the neutralization of potential threats using the methods and means of protecting personal data provided for the relevant class of information systems; forms plan for conducting checks of the readiness of new information security tools for use with the preparation of conclusions on the possibility of their operation; installs and puts into operation information security tools in accordance with the operational and technical documentation; trains persons using information security tools applied in information systems in the rules for working with them; keeps records of the applied information security tools, operational and technical documentation for them, personal data carriers; keeps records of persons authorized to work with personal data in the information system; monitors compliance with the terms of use of information security tools stipulated by the operational and technical documentation; has the right to initiate an investigation and preparation of conclusions on the facts of non-compliance with the conditions for storing personal data carriers, the use of information security tools that may lead to a breach of the confidentiality of personal data or other violations leading to a decrease in the level of protection of personal data, the development and adoption of measures to prevent possible dangerous consequences of such violations; has descriptions of the personal data protection system.

5.2. Persons whose access to personal data processed in the information system is necessary for the performance of official (labor) duties are allowed to access the relevant personal data on the basis of the list approved by the Operator. Requests from users of the information system to obtain personal data, as well as the facts of providing personal data in response to these requests, are registered by automated means of the information system in the electronic request log. The contents of the electronic request log are periodically checked by the relevant officials (employees) of the Operator or an authorized person. If violations of the procedure for providing personal data are detected, the Operator or an authorized person immediately suspend the provision of personal data to users of the information system until the causes of the violations are identified and eliminated.

6.1."AQUA ALLIANCE" as a personal data Operator has the right to:

• defend its interests in court;

• provide personal data of subjects to third parties, if required by applicable law (tax, law enforcement agencies, etc.);

• refuse to provide personal data in cases provided for by law;

• use personal data of the subject without his consent, in cases provided for by law.

7.1. The subject of personal data has the right:

• to demand clarification of his personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as to take measures provided by law to protect his rights;

• demand a list of his personal data processed by the Operator and the source of their receipt;

• receive information about the processing periods of their personal data, including the storage periods;

• demand that all persons who were previously provided with incorrect or incomplete personal data be notified of all exclusions, corrections or additions made to them;

• appeal to the authorized body for the protection of the rights of personal data subjects or in court against illegal actions or inactions during the processing of their personal data;

• to protect their rights and legitimate interests, including compensation for damages and (or) compensation for moral damage in court.

8.1. This Policy is subject to change, supplementation in the event of the emergence of new legislative acts and special regulatory documents on the processing and protection of personal data.

8.2. This Policy is an internal document of "AQUA ALLIANCE" and is subject to posting on the official website of "AQUA ALLIANCE".

8.3. Compliance with the requirements of this Policy is monitored by the person responsible for ensuring the security of personal data of "AQUA ALLIANCE".

8.4. Personal data are processed until the liquidation of the organization. Also, the processing of personal data may be terminated at the request of the subject of personal data. Storage of personal data recorded on paper media is carried out in accordance with Federal Law No. 125-FZ "On Archival Affairs in the Russian Federation" and other regulatory legal acts in the field of archival affairs and archival storage.