1. GENERAL PROVISIONS.

In order to ensure the protection of human and civil rights and freedoms when processing his personal data, including the protection of the rights to privacy, personal and family secrets, in pursuance of the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data” ( hereinafter referred to a sthe “Personal Data Law”), guided by the “Recommendations for drafting a document defining the operator’spolicy regarding the processing of personal data, in the manner established by Federal Law No. 152-FZ of July 27, 2006 “On Personal Data”, developed by the Federal Service for Supervision of Communications, Information Technology and Mass Media ( ROSKOMNADZOR), the owners (hereinafter referred to as the “Site Administration”) of the Internet site (labmgmu.ru) (hereinafter referred to a sthe “Site”) have developed this Operator Policy regarding the processing of personal data (hereinafter referred to as the “Policy”), and implemented their work in relation to the data of Internet users – subjects of personal data ( hereinafter referred to as the “User”, ” Subject of personal data”) collected using the Site, are based on the principles and rules set out below.

1.1. Concepts used in the Policy:

• Site Administration – Limited Liability Company “LABMGMU” (hereinafter referred to as LLC “LABMGMU”), INN 7733856211, OGRN 1137746887190, registration address: 119435, Moscow, Malaya Pirogovskaya Street, Building 13, Building 1, which owns the Site;
• personal data – any information relating to a directly or indirectly identified or identifiable individual (Subject of personal data);
• personal data permitted by the subject of personal data for distribution, – personal data, access to which by a nunlimited number of persons is provided by the subject of personal data by giving consent to the processing of personal data, permitted by the subject of personal data for distribution in the manner prescribed by this Federal Law by law;
• subject of personal data – an individual who can bedirectly or indirectly identified or identifiable using personal data. Within the framework of this Policy, the Subject of personal data isthe User of the Site ( hereinafter referred to a sthe User);
• anonymized data – data by which itis impossible to determine ( identify) an individual;
• Operator – a legal entity ( Limited Liability Company “LABMGMU” ( hereinafter referred to as LLC “LABMGMU”), INN 7733856211, OGRN 1137746887190, registration address: 119435, Moscow, Malaya Pirogovskaya Street, Building 13), independently or jointly with other persons organizing and ( or) carrying out the processing of personal data, as well as determining the goals processing of personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
• processing of personal data – any action (operation) or set of actions (operations) with data performed using automation tools or without their use, including collection, recording, systematization, accumulation, storage, clarification ( updating, modification), extraction, use, transfer ( distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;
• automated processing of personal data – processing of personal data using computer technology;
• dissemination of personal data – actions aimed at disclosure personal data to an indefinite number of persons;
• provision of personal data – actions aimed at disclosure personal data to a specific person or a specific group of persons;
• blocking of personal data – temporary cessation of processing of personal data (except in cases where processing is necessary for clarification of personal data);
• destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and ( or) as a result of which the material carriers of personal data are destroyed;
• depersonalization of personal data – actions as a result of which it becomes impossible to determine the ownership of personal data to a specific subject of personal data without the use of additional information data;
• cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a government body of a foreign state, a foreign individual or a foreign legal entity.

1.2. Operator’sPolicy on the Processing ofPersonal Data applies to all information that the Operator may receive about the User.

1.3. The Policy applies toall personal data processed by the Operator.

1.4. The policy applies to relations in the field of personal data processing. data that arose with the Operator both before and after the approval of this Policy.

1.5. I ncompliance with the requirements of paragraph 2 of Article 18.1 of the Law on Personal Data, this Policy is published in the public domain on the Operator’s Website on the Internet.

1.6. Compliance with the requirements of this Policy shall be monitored by an authorized person responsible for organizing the processing of personal data by the Operator.

1.7. Liability for violation of the requirements of the legislation of the Russian Federation and the regulations ofLABMGMU LLC in the field of processing and protection of personal data is determined ina cc or dance with the legislation of the Russian Federation.

1.8. Basic rights and obligations of the Operator.

1.8.1. The operator has the right:

1.8.1.1. Receive reliable information from the personal data subject and (or) documents containing personal data;

1.8.1.2. Independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations stipulated by the Law on personal data and regulatory legal acts a dopted in accordance with it, unless otherwise provided by the Law onPersonal Data or other federal laws;

1.8.1.3. Entrust the processing of personal data to another person with the consent of the Personal Data Subject, unless otherwise provided by federal law, on the basis ofan agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data stipulated by the Law onPersonal Data, maintain the confidentiality of personal data, and take the necessary measures aimed at ensuring the fulfillment of obligations stipulated by the Law on personal data;

1.8.1.4. In the event that the Subject of personal data revokes consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the Subject of personal data if there are grounds specified in the Law on Personal Data.

1.8.2. The operator is obliged to:

1.8.2.1. Organize the processing of personal data in accordance with requirements of the Law on Personal Data.

1.8.2.2. The operator and other persons who have gained access to personal data are obliged not to disclose to third parties or distribute personal data without the consent of the personal data subject, unless otherwise provided by federal law.

1.8.2.3. Provide the Personal Data Subject, at his request, with information, concerning the processing of his personal data.

1.8.2.4. Publish or otherwise provide unrestricted access to this Policy regarding the processing of personal data.

1.8.2.5. Respond to requests and inquiries from personal data subjects and their legal representatives ina cc or dance with the requirements of the Law onPersonal Data;

1.8.2.6. Provide the authorized body for the protection of personal data subjects’ rights (the Federal Service for Supervision of Communications, Information Technology, and Mass Media ( Roskomnadzor)) with the necessary information upon request of this body within 10 (ten) business days from the date of receipt of such request. This period may beextended, but by nomore than 5 ( five) business days. To do so, the Operator must send Roskomnadzor a reasoned notice stating the reasons for the extension of the deadline for providing the requested information.

1.8.2.7. In the manner determined by the federal executive body authorized in the area of security, ensure interaction with the state system for the detection, prevention, and elimination of the consequences of computer attacks on the information resources of the Russian Federation, including informing it of computer incidents that have resulted in the unauthorized transfer (provision, distribution, access) of personal data.

1.8.2.8. Stop the transfer ( distribution, provision, access) of personal data, stop processing and destroy personal data in the manner and cases stipulated by the Law on Personal Data.

1.8.2.9. Perform other duties stipulated by the Law on Personal data.

1.9. Basic rights and obligations of the User.

1.9.1. The User has the right to:

1.9.1.1. Receive information regarding the processing of their personal data, except in cases stipulated by federal laws. Information is provided to the User by the Operator in a naccessible form and must not contain personal data related to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining ita re established by Law. about personal data.

1.9.1.2. To require the Operator to clarify his personal data, block it or destroy it ifthe personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also to take measures to protect itas provided bylaw. their rights.

1.9.1.3. In the event of detection of inaccuracies in personal data, the User can update them independently by sending a notification to the Operator’semail address info@labmgmu.ru with the subject “Update” personal data.”

1.9.1.4. To revoke consent to the processing of personal data.

1.9.1.5. To exercise other rights provided for by the legislation of the Russian Federation.

1.9.2. The User is obliged to:

1.9.2.1. Provide the Operator with a ccurate information about yourself.

1.9.2.2. Notify the Operator about clarification (update, change) of your personal data.

1.9.2.3. The User is obliged to post information wisely and responsibly. own personal data on the Site.

1.10. Persons who have provided the Operator with false information a bout themselves or information about another personal data subject without the latter’sconsent shall be liable in accordance with the legislation of the Russian Federation.

2. PURPOSES OF COLLECTING AND PROCESSING PERSONAL DATA.

2.1. The processing of personal data is limited to a chieving specific, predetermined, and legitimate purposes. Processing of personal data incompatible with the purposes for which itwas collected is prohibited.

2.2. Only personal data that meets the purposes of their processing are subject to processing.

2.3. The Site A dministration processes the User’sdata for the following purposes:

• ensuring high-quality information services, including, but not limited to without limitation, conducting mailings of advertising and informational materials;
• informing the User by sending emails;
• interaction with the User, including processing requests and User requests;
• conducting marketing, statistical and other a nalysis;
• targeting a dvertising materials posted on the Site;
• conclusion, execution and termination of civil law contracts;
• the processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or third parties or for the achievement of socially significant goals, provided that this does not violate the rights and freedoms of the subject of personal data;
• providing the User with access to services, information and (or) materials contained on the Site.

2.4. The Operator also reserves the right to send the User notifications about new products and services, special offers, and various events. The User can always opt out of receiving informational messages by sending an email to the Operator a tinfo@labmgmu.ru with the subject line “Opt-out of notifications a bout new products and services and special offers.”

3. LEGAL BASIS FOR PERSONAL DATA PROCESSING.

3.1. The legal basis for the processing of personal data are federal laws and other regulatory legal acts in the field of personal data protection, in pursuance of which and in accordance with which the Operator carries out the processing personal data.

3.2. The Site Administration processes the User’sdata, taking into account the nature its core business, based on the statutory and other documents regulating it, and with the consent of the User to the processing of his personal data.

3.3. The legal basis for processing personal data is a lso agreements concluded between the Operator and the User.

3.4. The User independently decides whether to provide itpersonal data and gives consent freely, ofhis own free will and inhis own interests.

4. VOLUME AND CATEGORIES OFPROCESSED PERSONAL DATA

DATA.

4.1. The content and volume of personal data processed must correspond to the stated processing purposes, as set out inSection 2 of this Policy. The personal data processed must not be excessive in relation to the stated processing purposes.

4.2. The Site A dministration receives and processes User data ina volume and form that both a llows and does not a llow direct or indirect identification of a specific individual (hereinafter referred to a s “Anonymous Data”).

4.3. The Site A dministration processes the following categories of data:

• data provided by the User himself with his consent and at his discretion;
• anonymized data received by the Site A dministration through third-party software used on the Site to receive and transmit anonymized User data (for example, but not limited to, Google Analytics or Yandex.Metrica visitor statistics systems).

4.4. The data provided by the User may include:

• last name, first name, patronymic;
• date and place of birth;
• passport details;
• registration address a tthe place of residence;
• email address;
• contact information;
• other data provided by the User at his/her own discretion, as well as personal data provided by the User, necessary for conclusion and execution of contracts;
• technical and statistical information: IP address of the User’scomputer, location and time of a ccess, information provided by the User’sbrowser, including device type, browser version, operating system, referring site data, etc. The composition and scope ofanonymized data obtained through

4.5. software is determined by their copyright holders and depends on the software settings used by the User. Such data may include, but isnot limited to:

• browser data ( type, version, cookies);
• device data and its location;
• operating system data (type, version, screen resolution);
• request data (time, source, I Paddress data).

4.6. The User a ssumes full responsibility for the volume and content of the personal data provided to the Site Administration and to an unspecified number of persons, maintaining the confidentiality of their personal data through the settings of their device and operating system, the appropriate e -mail address, etc.

4.7. The Operator’sprocessing of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which his or her identity can be established) is carried out in accordance with the legislation of the Russian Federation.

4.8. The operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, or intimate life, except in cases stipulated by the legislation of the Russian Federation.

4.9. The processing of personal data permitted for distribution, from among the special categories of personal data specified in paragraph 1 of Article 10 of the Law on Personal Data, is permitted subject to the prohibitions and conditions stipulated inA rticle 10.1 of the Law on Personal Data. The User’sconsent to the processing of personal data permitted for distribution is issued separately from other consents to the processing of their personal data. The conditions stipulated, in particular, by A rticle 10.1 of the Law onPersonal Data are met. Requirements for the content of such consent are established by Roskomnadzor.

5. PROCEDURE AND CONDITIONS FOR PROCESSING PERSONAL DATA.

5.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. The processing of personal data is carried out with the consent of the User to the processing ofhis personal data, a swell as without such consent in cases stipulated by the legislation of the Russian Federation.

5.3. The processing of the User’spersonal data begins from the moment they are receipt.

5.4. When processing personal data, the operator ensures confidentiality of personal data.

5.5. The Operator processes personal data for each processing purpose in the following ways:

• non-automated processing of personal data;
• automated processing of personal data with or without the transfer of received information via information and telecommunication networks;
• mixed processing of personal data.

5.6. By remaining on the Website and receiving information services, the User consents to the processing of their data, both anonymized and personal, by the Website A dministration, as well a sto the general public’saccess to a nonymized data. A nonymized data becomes publicly available from the moment it is provided by the User or received via software.

5.7. The Site A dministration shall not be liable for third parties’ compliance with the legislation of the Russian Federation in the area of information and personal data protection, as well a sother legal norms.

5.8. The Site A dministrator is not responsible for the actions of third parties, who have gained access to the User’spersonal data due to the latter’sfault.

5.9. The Site Administration receives data in the following ways:

• from the User with his consent and a this discretion;
• via software.

5.10. The Website Administration stores personal data and protects the confidentiality of personal data in accordance with the current legislation of the Russian Federation, a swell a sin accordance with the Operator’sinternal regulations and procedures.

5.11. Protection is provided in relation toall received personal data. except when the data:

• obtained from open sources;
• in relation to which the User’sdevice has appropriate settings that a llow open data exchange.

5.12. The Site A dministration has the right to transfer the User’spersonal data to third parties in the following cases:

• the user has consented to the transfer ofhis personal data to a third party face;
• at the request of the court or other authorized state bodies, in accordance with the current legislation of the Russian Federation;
• to protect the rights and interests of the Site A dministration in the event of a violation by the User, in accordance with the current legislation of the Russian Federation.

5.13. Disclosure and distribution of personal data to third parties without the User’sconsent is prohibited, unless otherwise provided by federal law. Consent to the processing of personal data a uthorized for distribution by the User is issued separately from other consents to the processing of their personal data. Requirements for the content of consent to the processing of personal data, permitted by the subject of the personal data for distribution, are approved by Order No. 18 of Roskomnadzor dated February 24, 2021.

5.14. The Operator shall take the necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including:

• identifies threats to the security of personal data during their processing;
• adopts local regulations and other documents governing relations in the field of processing and protection of personal data;
• appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;
• creates the necessary conditions for working with personal data;
• organizes work with information systems in which personal data is processed;
• stores personal data in conditions that ensure their safety and prevent unauthorized access to them;
• organizes training for the Operator’semployees who carry out processing personal data.

5.15. The Operator shall store personal data ina form that a llows the User to be identified for nolonger than is required for each processing purpose. personal data, ifthe storage period for personal data isnot established by federal law or a greement.

5.16. The operator shall cease processing personal data in the following cases:

• the fact of their illegal processing is revealed. Deadline – within 3 (three) working days from the date of detection;
• the purpose of their processing has been a chieved;
• the User’sconsent to the processing of the specified data has expired orhas been revoked, when, a ccording to the Law on Personal Data, the processing of these data is permitted only with consent.

5.17. Upon a chieving the goals of processing personal data, as well as in the event of the User’swithdrawal of consent to their processing, the Operator stops processing these data if:

• unless otherwise provided by the a greement to which the User is a party, beneficiary or guarantor;
• The Operator does not have the right to carry out processing without the consent of the User on the grounds provided for by the Law onPersonal Data or other federal laws;
• unless otherwise provided by another agreement between the Operator and the User.

5.18. I fthe purpose of processing personal data is achieved, the Operator is obliged to stop processing personal data or ensure its cessation ( if the processing of personal data is carried out by another person a cting on behalf of the Operator) and destroy personal data or ensure their destruction (if the processing of personal data is carried out by a nother person acting on behalf of the Operator) within a period not exceeding 30 ( Thirty) days from the date of a chieving the purpose of processing personal data, unless otherwise provided by an a greement to which the User is a party, beneficiary or guarantor, or a nother agreement between the Operator and the User, or if the Operator does not have the right to process personal data without the consent of the User on the grounds provided for by this Federal Law or other federal laws.

5.19. I fthe User requests the Operator to cease processing personal data within a period not exceeding 10 ( ten) business days from the date the Operator receives the relevant request, the processing of personal data will cease, except in cases stipulated by the Personal Data Law. This period may beextended, but byno more than 5 ( five) business days. To this end, the Operator must send the User a reasoned notice. indicating the reasons for extending the deadline.

5.20. When collecting personal data, including through the Internet information and telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification ( updating, modification), and extraction of the User’spersonal data using databases located on the territory of the Russian Federation, except for cases specified in the Law onPersonal Data data.

6. UPDATING, CORRECTION, DELETION, DESTRUCTION OFPERSONAL DATA, RESPONSES TO REQUESTS

OF PERSONAL DATA SUBJECTS FOR ACCESS TOPERSONAL DATA.

6.1. Confirmation of the fact that the Operator is processing personal data, the legal basis and purposes for processing personal data, a swell as other information specified in paragraph 7 ofA rticle 14 of the Personal Data Law, shall be provided by the Operator to the User or their representative within 10 ( ten) business days of the User’sor their representative’srequest or receipt of the request. This period may beextended, but byno more than 5 ( five) business days. For this purpose, the Operator shall send the User a reasoned notice stating the reasons for the extension of the deadline for providing the requested information.

6.2. The information provided does not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosure of such personal data.

6.3. The request must contain:

• the number of the main document certifying the identity of the User orhis/her representative, information about the date of issue of the specified document and the issuing a uthority;
• information confirming the User’sparticipation in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator;
• signature of the User orhis representative.

6.4. The request may be sent in the form of a nelectronic document and signed. electronic signature ina cc or dance with the legislation of the Russian Federation.

6.5. The Operator shall provide the information specified in paragraph 7 ofArticle 14 of the Law onPersonal Data to the User or his representative in the form in which the relevant request or appeal was sent, unless otherwise specified in the request or a ppeal.

6.6. I fthe User’srequest (appeal) does not contain all the necessary information in accordance with the requirements of the Law on Personal Data orthe User does not have the right to a ccess the requested information, then hewill be sent a reasoned refusal.

6.7. The User’sright to a ccess his personal data may be limited in accordance with paragraph 8 ofArticle 14 of the Law on Personal Data, including if the User’saccess to his personal data violates the rights and legal interests of third parties.

6.8. I nthe event that inaccurate personal data is discovered upon the User’s or their representative’srequest, orat their request, or at the request of Roskomnadzor, the Operator shall block the personal data related to this User from the moment of such request or receipt of the specified request for the verification period, unless blocking the personal data violates the rights and legitimate interests of the User or third parties.

6.9. I nthe event that the fact of inaccuracy of personal data is confirmed, the Operator, based on information provided by the User orhis representative or Roskomnadzor, or other necessary documents, clarifies the personal data within 7 (seven) business days from the date of submission of such information and removes the blocking of the personal data.

6.10. In the event of a change in the User’spersonal data, the Operator is obligated to notify Roskomnadzor of a ll changes that occurred during the specified period nolater than the 15th day of the month following the month in which such changes occurred.

6.11. In the event of detection of unlawful processing of personal data upon request ( application) from the User or his/her representative orRoskomnadzor, the Operator shall block the unlawfully processed personal data related to this User from the moment of such request or receipt of the request.

6.12. If the Operator, Roskomnadzor or another interested party discovers an unlawful or accidental transfer (provision, distribution) of personal data ( access to personal data) that has resulted in a violation of the User’srights, the Operator:

• within 24 hours – notifies Roskomnadzor about the incident that occurred, the alleged reasons that led to the violation of the User’srights, the a lleged damage caused to the User’srights and the measures taken to eliminate the consequences incident, and also provides information a bout the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
• within 72 hours – notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information a bout the persons whose actions caused it ( if any).

6.13. Procedure for destruction of personal data by the Operator.

6.13.1. Conditions and terms for destruction of personal data by the Operator:

• achievement of the purpose of processing personal data or loss of necessity achieve this goal within 30 (Thirty) days;
• achieving the maximum storage period for documents containing personal data – within 30 (Thirty) days;
• provision by the User (his representative) of confirmation that the personal data was obtained illegally oris not necessary for the stated purpose of processing – within 7 (Seven) working days;
• the User’srevocation of consent to the processing ofhis personal data, if storage for the purpose of their processing isno longer required – within 30 (Thirty) days.

6.14. Upon a chieving the purpose of processing personal data, as well as in the event of the User’swithdrawal of consent to their processing, personal data are subject to destruction if:

• unless otherwise provided by the a greement to which the beneficiary is a party or a guarantor for which the User is a guarantor;
• the operator does not have the right to carry out processing without the consent of the User on the grounds provided for by the Law on Personal Data or other federal laws;
• unless otherwise provided by another a greement between the Operator and the User.

6.15. The Operator destroys personal data in cases stipulated byArticle 21 of the Law on Personal Data. Destruction is carried out ina cc or dance with the requirements established byRoskomnadzor.

6.16. I fit is not possible to destroy personal data within the period specified in paragraphs 3 – 5.1 ofA rticle 21 of the Law onPersonal Data, the Operator shall block such personal data or ensure their blocking (if the processing of personal data is carried out by another person acting on behalf of the Operator) and ensure the destruction of personal data within a period of no more than 6 ( Six) months, unless another period is established by federal laws.

6.17. Methods for destruction of personal data are established in local regulatory acts of the Operator.

7. POLICY APPLICABILITY AND CHANGES.

7.1. The current version of the Policy dated August 8, 2023 (Order of the Director General No. 136) is posted on the Website at labmgmu.ru.

7.2. This document will reflect any changes to the Operator’spersonal data processing policy.

7.3. The Site Administration reserves the right to unilaterally a mend the Policy without prior or subsequent notice to the User.

7.4. This policy is valid indefinitely until it is replaced by a new version. New version The Policy comes into force from the moment it is posted on the Website.