Personal Data Processing Policy of A5000 Registration and Accreditation Systems LLC

Version dated 25 September 2026

1. General Provisions

1.1. This Personal Data Processing Policy (the “Policy”) sets out the procedures for the processing and protection of Personal Data by A5000 Registration and Accreditation Systems Limited Liability Company (the “Company” or “A5000 LLC”).
1.2. The Company Processes Personal Data in its capacity as an Operator in respect of its own processing activities and, where required by applicable laws of the Russian Federation and the relevant agreements or instructions, as a Processor acting on behalf of another Operator.
1.3. The Company's role in relation to particular Personal Data and a particular processing activity shall be determined by reference to the purposes and conditions of the relevant processing, the applicable agreement and the Operator's Instructions, as well as the actual allocation of functions among the parties involved in the processing.
1.4. This Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ dated 27 July 2006 On Personal Data, Federal Law No. 149-FZ dated 27 July 2006 On Information, Information Technologies and Information Protection, other applicable regulatory legal acts of the Russian Federation, and with due regard to the international aspects of the Company's activities in connection with the organisation of events and the provision of digital services.
1.5. This Policy applies to all information that the Company may obtain about:
1. 1.5.1. users of the Website;
2. 1.5.2. Event Participants;
3. 1.5.3. representatives of clients and counterparties;
4. 1.5.4. visitors to the Company's offices and event venues;
5. 1.5.5. subscribers to informational and marketing communications;
6. 1.5.6. other Data Subjects who interact with the Company.
1.6. The Company may process the Personal Data of Event Participants and other individuals either independently for its own purposes or on behalf of the relevant Operator.
1.7. This Policy applies to both automated and non-automated processing of Personal Data.
1.8. The Company takes the necessary measures to ensure that Personal Data remains accurate and up to date.
1.9. Access to Personal Data is granted only to authorised persons who require such access to perform their official duties or assigned functions.
1.10. The Company Processes Personal Data in accordance with the following principles:
1. 1.10.1. lawfulness and fairness;
2. 1.10.2. processing limited to specific, predetermined and lawful purposes;
3. 1.10.3. prohibition of processing incompatible with the purposes for which the Personal Data was collected;
4. 1.10.4. data minimisation;
5. 1.10.5. accuracy, adequacy and currency of Personal Data;
6. 1.10.6. retention of Personal Data no longer than necessary for the purposes of processing or as required by the laws of the Russian Federation.
1.11. By using the Website or the Company's services, or by providing Personal Data, the User acknowledges having been made aware of this Policy to the extent applicable to the relevant interaction with the Company.
1.12. Where consent of a Data Subject is required for the relevant processing activity, such consent shall be obtained in the form and manner prescribed by the laws of the Russian Federation.
1.13. The current version of this Policy is published on the Company's website at: https://www.a5000.ru/en/privacy/.

2. Terms and Definitions

Personal Data	— means any information relating directly or indirectly to an identified or identifiable individual.
Data Subject	— means an individual to whom Personal Data relates.
Processing of Personal Data	— means any operation or set of operations performed on Personal Data, including collection, recording, systematisation, accumulation, storage, updating, use, transfer, depersonalisation, blocking, deletion and destruction.
Automated Processing of Personal Data	— means the processing of Personal Data using computer technology.
Personal Data Operator or Operator	— means a state authority, municipal authority, legal entity or individual that, alone or jointly with others, organises and/or carries out the processing of Personal Data and determines the purposes of processing, the categories of Personal Data to be processed and the operations to be performed on such Personal Data.
Processor acting on behalf of the Operator or Processor	— means a person that processes Personal Data on behalf of an Operator pursuant to an agreement, another document or another basis permitted by the laws of the Russian Federation, and within the scope of the purposes, categories of Personal Data and operations determined by the Operator.
Operator's Instructions	— means documented instructions issued by an Operator for the processing of Personal Data, specifying the conditions of such processing in accordance with Federal Law No. 152-FZ dated 27 July 2006 On Personal Data.
Event Organizer	— means a legal entity, individual or individual entrepreneur that initiates and organises an Event and determines the purposes, categories of Personal Data and other material conditions for processing the Personal Data of Event Participants within its role as an Operator.
User	— means a person who uses the Website, the Company's services, registration forms or other digital resources operated by or made available through the Company.
Event Participant	— means a person registered to participate in an Event organised by an Event Organizer, including through the Company's software, technical infrastructure or services.
Cookie	— means data files automatically stored on a User's device when the User accesses the Website and processed in accordance with the Company's Cookie Policy.
Website	— means the Company's official website and any other websites, subdomains, web portals, registration platforms, personal accounts, web interfaces, digital services and other information resources owned by the Company or lawfully used by it, including resources used by the Company in providing its services.
IP Address	— means a unique network address assigned to a device or node on a computer network through which a User accesses the Website.
Confidentiality of Personal Data	— means the obligation of the Operator and any other person having access to Personal Data not to disclose such Personal Data to third parties or otherwise make it available to them without a lawful basis, unless otherwise provided by the laws of the Russian Federation.
Cross-Border Transfer of Personal Data	— means the transfer of Personal Data to the territory of a foreign state, to a foreign public authority, or to a foreign individual or legal entity.

3. Acknowledgement of the Policy

3.1. This Policy is publicly available on the Company's website and, where necessary, on other pages and information resources through which the Company collects Personal Data in its capacity as an Operator or provides information about the processing of Personal Data within its information systems and services.
3.2. A User is considered to have been made aware of this Policy when the User:
1. 3.2.1. uses the Website;
2. 3.2.2. completes registration forms and/or other forms;
3. 3.2.3. provides Personal Data to the Company;
4. 3.2.4. registers for an Event;
5. 3.2.5. interacts with the Company's services.
3.3. Acknowledgement of this Policy does not, by itself, constitute consent to the processing of Personal Data where such consent is required by the laws of the Russian Federation.
3.4. Use of the Website, registration for an Event, completion of forms, provision of Personal Data or any other interaction with the Company confirms that the Data Subject has been made aware of this Policy.
3.5. The Company Processes Personal Data relating to the categories of Data Subjects specified in this Policy within the purposes and conditions applicable to the relevant processing activities.
3.6. Where the Company Processes Personal Data on behalf of an Operator, that Operator determines the purposes and other material conditions of the processing, while the Company processes the Personal Data within the scope of the relevant agreement and the Operator's Instructions.
3.7. Where the laws of the Russian Federation require separate consent to the processing of Personal Data, the Company shall request such consent in addition to any acknowledgement of this Policy.
3.8. The User shall provide accurate Personal Data and shall not provide Personal Data relating to third parties unless there is an appropriate lawful basis for doing so.
3.9. The Company relies on the representation that any person providing the Company with Personal Data relating to third parties has all necessary lawful grounds for transferring and processing such Personal Data. At the Company's request, the person who provided such Personal Data shall provide documents, information or other evidence confirming the existence of the relevant lawful basis.

4. Categories and Purposes of Personal Data Processing

4.1. The Company Processes Personal Data for its own purposes and also processes Personal Data on behalf of other Operators.
4.2. Where the Company Processes Event Participants' Personal Data solely for registration, accreditation, organization of participation, access control, badge personalization or other activities carried out pursuant to an Event Organizer's instructions, the Company acts as a Processor on behalf of the relevant Operator, unless the applicable documents and the actual circumstances of the processing expressly provide otherwise.
4.3. The Company's own processing activities are carried out for the purposes set out below. Applicable categories of Data Subjects, categories and types of Personal Data, lawful grounds for processing, and retention periods are determined for each purpose:

Purpose of processing	Categories of Data Subjects	Categories and list of Personal Data	Legal grounds	Retention period
Establishment, administration and termination of employment relationships; performance of obligations under employment legislation; and support of the Company's workforce and business operations	Employees, former employees and candidates where relevant to the establishment of employment relationships	Surname, first name and patronymic; date and place of birth; citizenship; sex; residential and registration address; contact details; details of identity documents; education, qualifications, profession, employment history and work experience; military registration information; taxpayer identification number (INN); individual insurance account number (SNILS); salary and other payment information; bank details; information required to provide statutory guarantees and compensation; photograph; health information where and to the extent permitted by law; and other data necessary to comply with legal requirements and the employment agreement	Labour Code of the Russian Federation and other federal laws; employment agreements; the Company's internal regulations; the Company's Charter; the Data Subject's consent where required	For the duration of the employment relationship and, following its termination, for the periods prescribed by legislation governing archival, accounting, tax and other mandatory document retention
Recruitment, consideration of applications and interaction with candidates for vacant positions	Candidates for vacant positions	Surname, first name and patronymic; contact details; date of birth; citizenship; education, qualifications, profession, employment history, work experience and previous positions; information contained in CVs and accompanying materials; and other information provided by the candidate and necessary to assess the application	Laws of the Russian Federation; the Data Subject's consent where required; actions aimed at entering into an employment agreement where provided for by law	Until a decision is made regarding the candidate and thereafter for the period specified in the relevant consent or prescribed by law; where other lawful grounds apply, until those grounds cease to exist
Conclusion, performance, amendment and termination of agreements, and management of the Company's contractual, financial and other related activities	Individual entrepreneurs; natural persons acting as counterparties; representatives and employees of counterparties; client representatives; and other natural persons interacting with the Company in connection with contractual relationships	Surname, first name and patronymic; position and place of employment; contact details; identity document details where necessary; INN; bank details; information concerning authority and qualifications; information contained in agreements, applications, service acceptance certificates, invoices and other documents; information concerning interactions with the Company; and other data necessary to conclude and perform the relevant agreement	Civil legislation of the Russian Federation; other applicable legal requirements; agreements and other transactions; the Company's Charter; the Company's legitimate interests; the Data Subject's consent where required	For the term of the relevant agreements and, following their termination, for the periods prescribed by law for retaining the relevant documents, as well as for any additional period necessary to protect the Company's rights and legitimate interests
Interaction with clients, Users and other persons in connection with the provision of the Company's own services and digital services	Clients; users of the Company's digital services; and other persons using the Company's services	Surname, first name and patronymic; contact details; account details; information entered by the User during registration and use of the service; information concerning the User's actions within the service; data concerning events, meetings and other activities carried out through the service; technical data necessary for the service to function; and other data necessary to provide the relevant service	Agreements and other transactions; actions aimed at entering into an agreement; the Company's legitimate interests; the Data Subject's consent where required; and other grounds provided for by law	For the period during which the relevant service is used and the contractual relationship remains in effect; following termination, for the periods prescribed by law or necessary to protect the Company's rights and legitimate interests
Ensuring the operation of the Website, personal accounts and other digital services of the Company	Website users; visitors to the Company's digital services; and other persons interacting with the Company's digital resources	IP address; device and connection identifiers and technical information; information concerning the User's actions on the Website; Cookie Files; information concerning service settings and usage parameters; and other technical data necessary for the operation of the relevant service	Exercise of the Company's rights and legitimate interests, provided that the rights and freedoms of the Data Subject are not overridden; conclusion and performance of an agreement, where applicable; the Data Subject's consent where required	For the period necessary to achieve the relevant processing purposes, in accordance with the Cookie Processing Policy and other Company documents; thereafter, for the periods prescribed by the laws of the Russian Federation
Ensuring the operation of the EventID service, including user registration and provision of its functionality	EventID users; representatives of organisations and other persons using the service; persons whose data are provided by a User through the service's functionality, where appropriate legal grounds exist	Surname, first name and patronymic; contact details; account details; information necessary to identify the User and provide access to the service; information concerning the User's actions in EventID; information voluntarily provided by the User when using the service's functionality; technical data, including IP address and device and browser information; and other data necessary for the relevant functionality	Agreement with the User/client; actions aimed at entering into an agreement; the Company's legitimate interests; the Data Subject's consent where required; and other grounds provided for by law	For the period during which EventID is used and the relevant contractual relationships remain in effect; following cessation of use, for the period necessary to fulfil obligations, protect the Company's rights and comply with legal requirements
Ensuring the operation of meeting-scheduling services, including user registration, organisation, scheduling and support of meetings, and interaction between Users through the service	Users of meeting-scheduling services; representatives of organisations; and other persons participating in interactions through the service	Surname, first name and patronymic; contact details; account details; information concerning the organisation, position and other professional details provided by the User; information concerning scheduled and completed meetings; information concerning the User's actions within the service; technical data necessary for the service to function; and other data directly necessary for the relevant functionality	Agreements and other transactions; actions aimed at entering into an agreement; the Company's legitimate interests; the Data Subject's consent where required; and other grounds provided for by law	For the period during which the service is used and the relevant contractual relationships remain in effect; thereafter, for the periods necessary to fulfil obligations, protect the Company's rights and legitimate interests, and comply with legal requirements
Consideration of requests, enquiries, applications and claims from Data Subjects, clients, Users, counterparties and other persons	Data Subjects; clients; Users; counterparties and their representatives; and other persons submitting requests	Surname, first name and patronymic; contact details; the substance of the request; information contained in attached documents and materials; information concerning contractual and other relationships with the Company; and other data necessary to consider the request and prepare a response	Laws of the Russian Federation; agreements; the Company's legitimate interests; consent where required	For the period required to consider the request and thereafter for the period necessary to evidence the fact and outcome of its consideration, protect the Company's rights and legitimate interests, and comply with any other statutory retention periods
Sending informational, service-related and advertising communications, including by email, SMS and other means of communication	Clients; Users; counterparties and their representatives; subscribers to informational communications; and other persons who have consented to receive the relevant communications	Surname, first name and patronymic; email address; telephone number; information concerning preferences and interactions with communications; and other data necessary to send the relevant communications	Agreements and other transactions; the Company's legitimate interests in relation to informational and service-related communications where applicable; prior consent to receive advertising for advertising communications; and consent to the processing of Personal Data where required	Until the relevant purpose ceases to apply, consent is withdrawn or another lawful ground ceases to exist; in the case of advertising communications, until prior consent to receive them is withdrawn or another lawful ground ceases to exist
Maintaining accounting, tax, financial and other mandatory records and reports, and fulfilling obligations established by the laws of the Russian Federation	Employees; counterparties; representatives of counterparties; clients; and other persons whose information is necessary to fulfil the relevant obligations	Surname, first name and patronymic; INN; SNILS where required; document details; bank details; information concerning payments, settlements and obligations; and information contained in primary accounting documents, agreements and other documents subject to mandatory retention	Tax, accounting, employment and other legislation of the Russian Federation; agreements; and other grounds provided for by law	For the periods prescribed by law for retaining the relevant documents
Ensuring compliance with the laws of the Russian Federation; protecting the Company's rights and legitimate interests; preventing and detecting violations; and conducting claims and litigation	Employees; clients; counterparties and their representatives; service Users; and other persons involved in the relevant legal relationships	Data contained in agreements, documents, requests, correspondence, investigation and audit materials, claims, court documents and other case materials, as well as other data necessary to achieve the stated purpose	Laws of the Russian Federation; agreements; the Company's legitimate interests; the necessity of exercising and protecting the Company's rights	Until the relevant purpose has been achieved and thereafter for the period necessary to protect the Company's rights and legitimate interests, as well as for the statutory retention periods applicable to the relevant documents
Performance of agreements with Event Organizers concerning the provision of software and technological infrastructure for event registration and accreditation, organization of access to events, and production of badges and other identification materials	Representatives of Event Organizers and service customers; event participants; visitors; and other persons whose Personal Data are transferred to the Company in connection with the performance of an agreement and the Operator's Processing Instruction	For Event Organizer representatives: surname, first name and patronymic; position; contact details; information concerning authority; and other data necessary to perform the agreement. For event participants and visitors: data specified in the relevant Operator's Processing Instruction, including surname, first name and patronymic; contact details; identity document details; date and place of birth; citizenship; place of employment and position; photograph; registration and accreditation details; information necessary to organise access; and other Personal Data specified in the Operator's Processing Instruction and necessary to provide the relevant services	For Event Organizer representatives: the agreement and other transactions, the Company's legitimate interests, and other grounds provided for by law. For event participants and other persons whose data are transferred within the relevant project: the Operator's Processing Instruction executed in accordance with personal data legislation, together with other processing grounds determined by the Operator	For Event Organizer representatives: for the term of the agreement and thereafter for the statutory retention periods. For event participants and other persons: for the period specified in the relevant Operator's Processing Instruction and necessary to perform the agreement; following cessation of processing, in accordance with the procedures and periods specified in the instruction and prescribed by law

4.4. Processing methods may include automated, non-automated and mixed processing; processing using the Company's software and information systems, the Internet, identification and access control systems, equipment for printing and issuing badges and other identification materials, as well as processing without the use of automation tools.
4.5. The Company does not process special categories of Personal Data, except where expressly provided for by the laws of the Russian Federation or where such processing is carried out on behalf of the relevant Operator on an appropriate legal basis provided by applicable law.
4.6. Information on the specific composition of Personal Data, categories of Data Subjects, purposes, operations and retention periods applicable to Personal Data processed by the Company on behalf of another Operator shall be determined by the relevant agreement and the Operator's instructions and may be further specified in the documentation for the relevant project.
4.7. When processing Personal Data on behalf of an Operator, the Company may process other Personal Data to the extent necessary for the relevant purposes, taking into account the Operator's requirements. The Company may process the following categories of Personal Data:
- surname, first name and patronymic;
- citizenship;
- sex;
- email address;
- telephone number;
- place of birth;
- series and number of an identity document (including details of an international passport, a passport of a foreign national or other identity documents recognized under applicable law), date of issue, expiry date and issuing authority;
- photographic image of the individual;
- scanned copies of documents certifying the identity or position of an individual;
- place of employment and job title;
- Event registration details;
- information concerning interactions with the Website;
- IP Address;
- Cookies;
- other information voluntarily provided by the Data Subject.
4.8. When processing Personal Data on behalf of an Event Organizer, the Company may process photographic images of Event Participants to the extent and for the purposes specified in the relevant agreement and the Operator's Instructions, including for personalising badges and passes and providing organisational support for the Event.
4.9. The Company does not process photographic images as biometric Personal Data for the purpose of establishing the identity of a Data Subject unless such processing is provided for by the relevant process, the Operator's Instructions and the applicable laws of the Russian Federation.
4.10. Where an Event Organizer, venue owner or other third party uses photographic images of Event Participants for access control, visual identity verification or other identification processes, such processing shall be carried out by that party in accordance with its role in the relevant processing activity and the applicable laws of the Russian Federation.

5. Sources of Personal Data

5.1. Depending on the Company's role in the relevant processing activity, Personal Data may be received by the Company:
1. 5.1.1. directly from Data Subjects;
2. 5.1.2. from Event Organizers and other Operators on whose behalf the Company Processes Personal Data;
3. 5.1.3. from the legal representatives of Data Subjects;
4. 5.1.4. from counterparties, partners and other persons, where an appropriate legal basis exists;
5. 5.1.5. through registration platforms, digital services, registration forms, enquiries and other communication channels.
5.2. Where the Company receives Personal Data in the course of processing on behalf of another Operator, the fact that such data are obtained directly from the Data Subject through a registration form or another interface technically operating within the Company's information system does not change the Company's role as a Processor acting on behalf of that Operator.
5.3. The Company proceeds on the assumption that persons transferring Personal Data relating to third parties have the necessary legal grounds for such transfer.
5.4. Any person transferring Personal Data relating to third parties to the Company must have the appropriate legal grounds for such transfer. At the Company's request, that person shall provide documents or other evidence confirming the existence of the relevant legal grounds.
5.5. A Data Subject shall notify the Company of any restrictions on the processing of their Personal Data established by federal law, where such restrictions apply to that Data Subject.

6. Legal Grounds for Processing

6.1. The Company Processes Personal Data on the following legal grounds:
1. 6.1.1. the consent of the Data Subject;
2. 6.1.2. the necessity of entering into or performing a contract;
3. 6.1.3. compliance with obligations imposed by the laws of the Russian Federation;
4. 6.1.4. the exercise of the Company's rights and legitimate interests, provided that the rights and freedoms of the Data Subject are respected;
5. 6.1.5. the Operator's Instructions for the processing of Personal Data, where the Company Processes Personal Data on behalf of another Operator.
6.2. The Data Subject's consent to the Processing of Personal Data shall be given in a form and by a method appropriate to the requirements of the laws of the Russian Federation and the nature of the relevant processing:
1. 6.2.1. in writing;
2. 6.2.2. electronically;
3. 6.2.3. through the functionality of the Website;
4. 6.2.4. by selecting the relevant checkboxes in the interfaces of the Website or other information systems, where such method complies with the requirements of the laws of the Russian Federation.

7. Specific Features of Personal Data Processing in Connection with Events

7.1. In connection with Events, the Company may:
1. 7.1.1. Process Personal Data as a Processor acting on behalf of an Event Organizer or another Operator;
2. 7.1.2. provide technical infrastructure, software and registration, accreditation and access control services;
3. 7.1.3. Process Personal Data for its own purposes in relation to processing activities for which the Company independently determines the purposes and other material conditions of processing.
7.2. The Company's role in a particular processing activity shall be determined by:
1. 7.2.1. the terms of the agreement with the Event Organizer;
2. 7.2.2. the functionality of the services used;
3. 7.2.3. the actual allocation of responsibilities among the parties involved in the processing activity.
7.3. Where the Company Processes Personal Data on behalf of an Event Organizer, the Event Organizer determines the purposes of processing, categories of Data Subjects, the composition of Personal Data, legal grounds and other material conditions of processing in accordance with the laws of the Russian Federation.
7.4. The Company Processes such Personal Data solely within the scope of the relevant agreement and the Operator's Instructions.
7.5. The liability of the Company and other parties involved in processing shall be determined in accordance with Federal Law No. 152-FZ dated 27 July 2006 On Personal Data, the relevant agreement, the Operator's Instructions and the actual allocation of functions in the relevant processing activity.
7.6. When Events are held outside the Russian Federation, the Company may take into account mandatory requirements of the laws of the country in which the Event is held, to the extent applicable to the Company's activities.
7.7. When Processing Personal Data on behalf of an Operator, the Company takes into account the requirements of the laws of the Russian Federation and the terms of the relevant Operator's Instructions.

8. Processing Instructions and Transfers of Personal Data to Third Parties

8.1. The Company may engage third parties to Process Personal Data for the purpose of fulfilling its own obligations or obligations under the Operator's Instructions, where such engagement is necessary to fulfil those obligations and is permitted by the laws of the Russian Federation, the relevant agreement and the applicable Operator's Instructions.
8.2. When Processing Personal Data in its capacity as an Operator, the Company may entrust the Processing of such Personal Data to third parties within the scope of the relevant purposes and legal grounds.
8.3. When Processing Personal Data on behalf of another Operator, the engagement of third parties shall be subject to the terms of the relevant agreement and the Operator's Instructions.
8.4. Such parties may include:
1. 8.4.1. persons Processing Personal Data on behalf of the Company;
2. 8.4.2. technical contractors;
3. 8.4.3. registration and mailing service providers;
4. 8.4.4. Event venues;
5. 8.4.5. providers of information systems and infrastructure;
6. 8.4.6. other parties engaged in accordance with the relevant agreement and applicable legal grounds.
8.5. An Event Organizer or another Operator on whose behalf the Company Processes Personal Data is not a party to whom the Company entrusts the Processing of Personal Data, unless otherwise follows from the actual structure of the relevant processing activity.
8.6. The list of third parties permanently engaged by the Company in the Processing of Personal Data is set out in Appendix No. 1 to this Policy. Other parties engaged by the Company to Process Personal Data in connection with specific projects and processing activities are identified in the Registers of Other Third Parties Engaged by A5000 Registration and Accreditation Systems Limited Liability Company in the Processing of Personal Data for the Relevant Event, which form an integral part of this Policy.
8.7. The Company does not disclose or disseminate Personal Data without an appropriate legal basis. Where Personal Data are Processed on behalf of another Operator, disclosure, provision, access or other processing operations shall be carried out within the scope of the Operator's Instructions and the applicable legal basis.

9. Cross-Border Transfer of Personal Data

9.1. Taking into account the international nature of certain Events, the Company may carry out Cross-Border Transfers of Personal Data in the cases and in the manner prescribed by the laws of the Russian Federation, including transfers to:
1. 9.1.1. Event Organizers;
2. 9.1.2. foreign partners;
3. 9.1.3. Event venues;
4. 9.1.4. service contractors, where necessary to organise the Data Subject's participation in an Event or to provide the relevant services.
9.2. The Company may carry out Cross-Border Transfers of Personal Data both in connection with its own processing activities and when performing the Operator's Instructions, provided that an appropriate legal basis exists and the applicable requirements of the laws of the Russian Federation are met.
9.3. Cross-Border Transfers of Personal Data shall be carried out on lawful grounds, to the extent necessary to achieve the purposes of processing, and in compliance with the requirements of the laws of the Russian Federation.
9.4. The Company takes reasonable measures to ensure an appropriate level of protection of Personal Data when carrying out Cross-Border Transfers of Personal Data.

10. Cookies and Analytics

10.1. The Website may use Cookies and similar technologies.
10.2. Cookies are used for the following purposes:
1. 10.2.1. ensuring the proper functioning of the Website;
2. 10.2.2. saving User preferences;
3. 10.2.3. analytics;
4. 10.2.4. improving the usability of the Website.
10.3. The Company may use technical Cookies, analytical Cookies and functional Cookies.
10.4. A User may restrict or disable the use of Cookies through their browser settings.
10.5. Additional information about Cookies is provided in a separate Cookie Processing Policy.

11. Personal Data Protection Measures and Destruction

11.1. The Company takes the necessary legal, organizational and technical measures to protect Personal Data against unauthorized access, destruction, alteration, blocking, copying, dissemination and other unlawful actions. Such measures include:
1. 11.1.1. access rights management;
2. 11.1.2. the use of antivirus protection tools;
3. 11.1.3. the use of passwords and authentication tools;
4. 11.1.4. backup copying;
5. 11.1.5. the establishment of internal rules and procedures;
6. 11.1.6. access control for information systems.
11.2. Personal Data shall be destroyed or depersonalized:
1. 11.2.1. when the purposes of processing have been achieved;
2. 11.2.2. when the need to achieve the purposes of processing ceases to exist;
3. 11.2.3. when the Data Subject withdraws their consent, provided that no other legal grounds for processing exist;
4. 11.2.4. where unlawful processing is identified;
5. 11.2.5. in other cases provided for by the laws of the Russian Federation.
11.3. Personal Data shall be destroyed using methods that prevent the restoration of such data.

12. Rights of Data Subjects

12.1. A Data Subject has the right to:
1. 12.1.1. obtain information concerning the Processing of their Personal Data;
2. 12.1.2. request the rectification, blocking or destruction of their Personal Data;
3. 12.1.3. withdraw their consent to the Processing of Personal Data;
4. 12.1.4. challenge the Company's actions before the competent authority or in court;
5. 12.1.5. submit requests and complaints concerning the Processing of Personal Data in accordance with the laws of the Russian Federation.

12.2. To exercise their rights, a Data Subject may submit a request to:

Email:	dataprotection@a5000.ru
Address:	Floor 1, Premises I, Rooms 1 (part) and 2, 7, Building 2, Kolskaya Street, Moscow, 129329, Russian Federation

12.3. The Company shall consider requests from Data Subjects within the time limits prescribed by the laws of the Russian Federation.
12.4. Where a Data Subject's request concerns Personal Data Processed by the Company on behalf of another Operator, the Company shall receive and handle such request in accordance with the procedure established by the relevant agreement and the Operator's Instructions and, where necessary, forward it to the Operator for a decision.

13. Marketing and Informational Communications

13.1. Advertising messages sent by means of communication shall be sent subject to the Data Subject's prior consent, unless otherwise provided for by the laws of the Russian Federation.
13.2. The Company may send Users service-related and organizational notifications concerning the use of the Website, registration for Events, performance of contractual obligations and the operation of services. Such notifications do not constitute advertising messages.
13.3. Users may opt out of advertising messages in accordance with the procedure prescribed by the laws of the Russian Federation and the relevant message, including through an unsubscribe function where one is provided.
13.4. It may not be possible to stop receiving service-related and organizational notifications where such notifications are necessary for the performance of a contract, registration for an Event, access arrangements or another purpose for which they are sent.

14. Specific Features of Processing Personal Data of Minors

14.1. The Company pays particular attention to protecting the Personal Data of minors.
14.2. Personal Data of minors shall be Processed in accordance with the requirements of the laws of the Russian Federation, taking into account the nature of the relevant service, Event or legal relationship.
14.3. In cases provided for by the laws of the Russian Federation, or where there are heightened risks to the rights and freedoms of a minor, the Company may request the consent of the minor's legal representative to the Processing of Personal Data.
14.4. The Company may restrict minors' use of certain services, functions or participation forms where necessary to comply with legal requirements or protect the rights of Data Subjects.

15. Third-Party Resources

15.1. The Website may contain links to third-party websites, services and resources.
15.2. The Company shall not be liable for the Processing of Personal Data carried out by such third parties, unless otherwise provided for by the laws of the Russian Federation.
15.3. Data Subjects are advised to review the personal data processing policies of the relevant resources themselves.

16. Final Provisions

16.1. The Company may amend this Policy. This Policy shall remain in effect until a new version of the Policy is published on the Website.
16.2. A new version of the Policy shall enter into force upon publication on the Website, unless otherwise provided in that new version.
16.3. Matters not governed by this Policy shall be governed by the laws of the Russian Federation.
16.4. Relations involving the Processing of Personal Data shall be governed by the laws of the Russian Federation, unless otherwise provided for by applicable law.
16.5. This Policy shall be applied together with Appendix No. 1, “List of Permanent Third Parties Involved in the Processing of Personal Data”, and the relevant Registers of Other Third Parties Engaged by A5000 Registration and Accreditation Systems Limited Liability Company in the Processing of Personal Data.
16.6. Information about parties engaged exclusively for the organization and conduct of individual Events (including organizers, co-organizers, customers, venue owners, Event contractors, government authorities and other parties involved in processing) shall be included in the Register of Personal Data Recipients for the relevant project, published on the information resource of the relevant Event.
16.7. This Policy may be published in Russian and English. In the event of any discrepancy, inconsistency or ambiguity between the Russian-language and English-language versions of this Policy, the Russian-language version shall prevail.

Appendices: Appendix No. 1 — List of Permanent Third Parties Involved in the Processing of Personal Data.

Appendix No. 1

to the Personal Data Processing Policy of A5000 Registration and Accreditation Systems Limited Liability Company

List of Permanent Parties Involved in the Processing of Personal Data

General Provisions

This Appendix sets out the list of parties that A5000 Registration and Accreditation Systems Limited Liability Company (hereinafter referred to as the “Company”) engages on a permanent basis to ensure the functioning of information systems, services and business processes related to the Processing of Personal Data.
The parties specified in this Appendix are engaged by the Company in the Processing of Personal Data within the scope of their respective functions. Where such a party Processes Personal Data on behalf of the Company or on behalf of another Operator, its status shall be determined by the relevant agreement, the Operator's Instructions and the legislation of the Russian Federation.
The inclusion of a party in this Appendix does not mean that such party is an Operator of Personal Data in respect of all Personal Data transferred to it.
This Appendix contains information exclusively about parties engaged by the Company on a permanent basis.
Information about parties engaged exclusively for the organization and conduct of individual Events (Event Organizers, co-organizers, service customers, venue owners, Event contractors, government authorities and other parties involved in Processing) is published in the Register of Personal Data Recipients for the relevant project, available on the information resource of the respective Event.
This Appendix forms an integral part of the Personal Data Processing Policy of A5000 LLC and shall be applied together with other documents governing the Processing of Personal Data.

Permanent Parties Involved in the Processing of Personal Data:

Category of person	Organisation name	Role in processing	Purpose of involvement	Categories of Personal Data	Legal basis for processing
Hosting/data centre provider	JSC Selectel, INN 7810962785, Russian Federation, 197110, St Petersburg, Tsvetochnaya Street, Building 21, Letter A	Processing on behalf of an Operator	Hosting server infrastructure and ensuring the storage and availability of information systems to support the Company's operations	Citizenship; surname and first name in Russian and English; patronymic, if any; sex; date of birth; place of birth; identity document number; country, region and city of residence; place of employment; position; contact telephone number; email address; photographic image of the face; scanned copy of an identity document and information contained in electronic images (scanned copies) of identity documents; scanned copies of press credentials and information contained in electronic images (scanned copies) of such credentials, where the registration form includes this field.	Personal Data Processing Instruction / service agreement
Cloud infrastructure provider	LLC Yandex Cloud, INN 7704458262, Russian Federation, 119021, Moscow, Lev Tolstoy Street, Building 16, Premises 528	Processing on behalf of an Operator	Hosting and operating information systems; storing Personal Data on server infrastructure to support the Company's operations; and providing cloud infrastructure, computing capacity and data-processing services used by the Company.	Citizenship; surname and first name in Russian and English; patronymic, if any; sex; date of birth; place of birth; identity document number; country, region and city of residence; place of employment; position; contact telephone number; email address; photographic image of the face; scanned copy of an identity document and information contained in electronic images (scanned copies) of identity documents; scanned copies of press credentials and information contained in electronic images (scanned copies) of such credentials, where the registration form includes this field	Agreement
SMS provider	LLC Aviator, INN 7805590323, Russian Federation, 197183, St Petersburg, Lipovaya Alleya, 9, Letter A, Premises 12N	Processing on behalf of an Operator	Sending SMS notifications	Contact telephone number	Agreement
Provider of a service for recognising information contained in electronic images of documents	LLC BIORG, INN 7724396261, Russian Federation, 121205, Moscow, Bolshoy Boulevard (Skolkovo Innovation Center Territory), Building 42, Structure 1, Floor 0, Premises 137, Workplace 26	Processing on behalf of an Operator	Processing photographic images; recognising images; extracting information from identity documents and verifying the accuracy of extracted information when the relevant functionality is used; supporting participant identification; integrating image-recognition services where the relevant functionality is used; and recognising and extracting information from scanned copies of identity documents and checking their validity and accuracy	Electronic images (scanned copies) of identity documents, including passports of citizens of the Russian Federation, passports of foreign citizens, international passports and other identity documents recognised under applicable law, provided by the Data Subject	Agreement
Email distribution service	JSC Internet Projects (Sendsay), INN 7811090248, Russian Federation, 197110, St Petersburg, intra-city municipal district of Chkalovskoye, Levashovsky Prospekt, Building 11/7, Structure 4, Non-Residential Premises 1-N, Premises 157	Processing on behalf of an Operator	Sending service notifications and informational communications, as well as distribution messages where the relevant consent of the Data Subject has been obtained	Surname, first name, email address, contact telephone number where necessary, and information required to prepare and send communications	Agreement

The specific list of parties actually involved in the Processing of Personal Data in connection with an individual Event shall be determined by the specifics of the relevant project. The fact that certain services or contractors are not used in connection with a particular Event does not mean that they cease to be parties permanently engaged by the Company.

Principles Governing the Engagement of Parties in the Processing of Personal Data

The Company engages third parties only where their involvement is necessary to ensure the functioning of information systems, perform contractual obligations or comply with the requirements of the legislation of the Russian Federation.
Parties that Process Personal Data on behalf of the Company shall have access only to the Personal Data necessary for the performance of their assigned functions.
Before the Processing of Personal Data begins, an agreement shall be entered into with such parties, or the relevant provisions shall be included in the principal agreement, providing for obligations to maintain confidentiality, ensure the security of Personal Data, and comply with the requirements of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other regulatory legal acts of the Russian Federation.
The engagement of third parties does not release the Company from its obligations as an Operator of Personal Data where such obligations are imposed by the legislation of the Russian Federation.
Where the Company Processes Personal Data on behalf of another Operator, the engagement of other parties by the Company to perform individual operations involving Personal Data shall be carried out within the scope of the agreement and the relevant Operator's Instructions and subject to the existence of a legal basis required by applicable law.

Updating this Appendix

This Appendix shall be updated as the list of parties engaged by the Company on a permanent basis changes.
The current version of this Appendix shall be published on the Company's official Website together with the current version of this Personal Data Processing Policy.
Changes to the list of parties involved exclusively in the Processing of Personal Data in connection with individual Events do not require amendments to this Appendix and shall instead be reflected in the Registers of Other Third Parties Engaged by A5000 Registration and Accreditation Systems Limited Liability Company in the Processing of Personal Data in connection with the relevant Event.