PERSONAL DATA PROCESSING POLICY
Stock Company CROCUS INTERNATIONAL(short title SC CROCUS)
Krasnogorsk subsidiary Crocus Expo
1. General provisions
1. This Policy in relation to the processing of personal data (hereinafter referred to as the
Policy) has been applied by the Krasnogorsk subsidiary Crocus Expo of Stock Company
CROCUS INTERNATIONAL (short title SC CROCUS) and developed in compliance with theFederal Law as of July 27, 2006 No. 152-FZ on Personal Data (hereinafter referred to as the
Personal Data Law). The purpose of this Federal Law is to provide protection of humanrights and liberties while processing personal data, including the right ofintegrity, personal and family secrecy.
1.2. This Policy is part of the General Policy of SC CROCUS in relation to the processing of
personal data.
The Policy applies to all personal data processed by SC CROCUS Krasnogorsk subsidiary
Crocus Expo of (hereinafter referred to as the Operator).
1.3. The Policy applies to the relations in the field of personal data processing incurred by
the Operator both before and after the approval of the Policy.
1.3.1. The Policy does not apply to relations:- arising during the processing of personal data of the Operator's employees, since such
relations are settled by a separate local act, which is also part of the General Policy related
to the processing of personal data of SC CROCUS;- to which the Federal Law of 27.07.2006 No. 152-FZ on Personal Data does not apply (clause
2, article 1).
1.4. Pursuant to the requirements of chapter 2 article 18.1 of the Personal Data Law, thePolicy shall be freely accessible on the Internet information and telecommunication
network on the Operator's websites.
1.5. The following main terms are used in the Policy:
Personal data - any information referring directly or indirectly to a particular or identified
private entity (data subject);
Operator of personal data (operator) - the state body, municipal body, legal entity or private
entity that, independently or in conjunction with other entities, organizes and (or) processes
personal data and determines the purposes of personal data processing, the composition of
the personal data to be processed, and the actions (operations) performed during personal
processing;
Personal data processing - any action (operation) or a combination of actions (operations)performed both automatically and without the use of such means with personal data.
Personal data processing also includes:- collection;- recording;- arrangement;- accumulation;- storage;- rectification (updating, changing);- extraction;- use;- transfer (including distribution, provision, access);- anonymizing;- blocking;- deletion;

- destruction.
Automated personal data processing - the processing of personal data by means ofcomputer technology;
distribution of personal data – actions related to making data available to the public;
provision of personal data – actions related to making data available to a particular entity
or the public;
blocking of personal data – the temporary cessation of personal data processing (with the
exception of cases when the processing is needed for personal data rectification);
destruction of personal data – actions performed on personal data contained in an
information system that make restoration of such data impossible and (or) actions aimed at
the physical destruction of physical media of personal data;
anonymization of personal data – actions performed on personal data that make it
impossible to determine the identity of the subject without the use of information in
addition to such anonymized data;
personal data information system – a database that contains personal data and theinformation technologies and hardware used for their processing.
1.6. Basic rights and obligations of the Operator.
1.6.1. The Operator is entitled:- independently determine the composition and list of measures necessary and sufficient toensure the fulfillment of obligations stipulated by the Personal Data Law and regulatory
legal acts adopted in accordance with it, unless otherwise stipulated by the Personal Data
Law or other federal laws;- to assign the processing of personal data to another entity with the consent of the data
subject, unless otherwise stipulated by federal laws, on the basis of a contract concluded
with that entity. An entity conducting the processing of personal data on the instruction of
the Operator is obliged to comply with the principles and regulations for the processing of
personal data stipulated by federal laws;- In the event that a data subject withdraws their consent to the processing of personaldata, the Operator is entitled to continue the processing of the personal data without theconsent of the data subject if any of the grounds specified in the Personal Data Law areapplicable.
1.6.2. The Operator carries the obligation to:- organize the processing of personal data in accordance with the requirements of the
Personal Data Law;
- respond to requests and inquiries from personal data subjects and their legal
representatives in accordance with the requirements of the Personal Data Law;
- report to the authorized body for the protection of the rights of personal data subjects(Federal Service for Supervision in the Field of Communications, Information Technologies
and Mass Media (Roskomnadzor), at the request of this body, the necessary information
within 10 office days from the date of receipt of such a request. This period can beextended, but not more than five office days. To do this, the Operator must send a
motivated notice to Roskomnadzor indicating the reasons for extending the period forproviding the requested information;- in the order determined by the federal executive body authorized in the field of security,
ensure interaction with the state system for detecting, preventing and eliminating theconsequences of computer attacks on information resources of the Russian Federation,
including informing it about computer incidents that entailed the unlawful transfer(provision, distribution, access) of personal data.
1.7. Basic rights of data subjects. A data subject is entitled:- to receive the information regarding his/her personal data processing with the exceptionof the cases stipulated by federal laws. The information shall be provided to the data
subject by the Operator in an accessible format and shall not contain personal data relating
to other data subjects, unless there are lawful grounds for the disclosure of such personal

data. The list of information and the procedure for obtaining it is established by the
Personal Data Law;
- demand that the Operator rectify, block or destroy the personal data if the personal data is
incomplete, obsolete, inaccurate, illegally obtained or not necessary for the stated purposeof processing, as well as take measures provided by law to protect his/her rights;- give preliminary consent to the processing of personal data in order to promote goods,
works and services on the market;- appeal to Roskomnadzor or in court against unlawful actions or inaction of the Operator
when processing his/her personal data.
1.8. Control over the fulfillment of the requirements of the Policy shall be carried out by anauthorized Operator’s person in charge of organizing the processing of personal data.
1.9. Liability for violation of the requirements of the legislation of the Russian Federation
and regulatory acts by SC CROCUS Krasnogorsk subsidiary Crocus Expo in the field ofprocessing and protection of personal data shall be determined in accordance with thelegislation of the Russian Federation.
2. Purposes of personal data collection
2.1. The processing of personal data is limited to the achievement of specific,
predetermined and legitimate purposes. Processing of personal data incompatible with the
purposes of personal data collection is not allowed.
2.2. Only personal data that meets the purposes of its processing are subject to processing.
2.3. The Operator shall process personal data for the following purposes:- carrying out its activities in accordance with the Regulation on SC CROCUS Krasnogorsk
subsidiary Crocus Expo and the Charter of SC CROCUS, including when concluding andexecuting contracts with counterparties;- during registration process of a personal data subject as a visitor or participant to
exhibitions and other events held at the Crocus Expo International Exhibition Center,organized by SC CROCUS Krasnogorsk subsidiary Crocus Expo on the official website of theexhibition (hereinafter referred to as the Website), at the Service Center department, andwhich can be uniquely correlated with a specific individual and his/her personal data.
- implementation of access control.
2.4. The processing of personal data of employees can be carried out exclusively for the
purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal grounds for personal data processing
3.1. The legal grounds for personal data processing shall be a set of regulatory legal acts,
pursuant to which and in accordance with which the Operator processes personal data,
including:- Constitution of the Russian Federation;- Civil Code of the Russian Federation;- Tax Code of the Russian Federation;- Federal Law of 08.02.1998 No. 14-FZ On Limited Liability Companies;- Federal Law of 06.12.2011 No. 402-FZ On Accounting;- Federal Law of 15.12.2001 No. 167-FZ On Compulsory Pension Insurance in the RussianFederation;- other regulatory legal acts regulating relations related to the Operator's activities.
3.2. The legal grounds for personal data processing is also:- Regulation on SC CROCUS Krasnogorsk subsidiary Crocus Expo and the Charter of SC
CROCUS;- contracts concluded between the Operator and personal data subjects;- consent of personal data subjects to the processing of their personal data.

4. Scope and categories of personal data processed,
categories of personal data subjects
4.1. The content and scope of personal data processed shall comply with the statedprocessing purposes stipulated in Section 2 of the Policy. The personal data being
processed should not be redundant with respect to the stated purposes of their processing.
4.2. The Operator can process personal data of the following categories of personal data
subjects.
4.2.1. For implementation of access control of individuals:- full name;- Image (photo);- passport data;
4.2.2. For clients and counterparties of the Operator (individuals) - for the purpose ofcarrying out the activities of SC CROCUS Krasnogorsk subsidiary Crocus Expo andimplementation of access control:- full name;- date and place of birth;- passport data;- address of registration at the place of residence;- contact details;- position held;- individual number of the taxpayer;- current account number;- other personal data provided by clients and counterparties (individuals) required forconclusion and execution of contracts
4.2.3. For representatives (employees) of clients and counterparties of the Operator (legal
entities) - for the purpose of carrying out their activities by SC CROCUS Krasnogorsk
subsidiary Crocus Expo:- full name;- passport data;- contact details;- position held;- other personal data provided by representatives (employees) of clients and counterparties
required for conclusion and execution of contracts.
4.3. Information concerning the biometric personal data (physiological and biologicalcharacteristics of an individual used to establish the identity of the data subject) shall be
carried out in accordance with the legislation of the Russian Federation.
4.4. The Operator does not process special categories of personal data concerning racial or
ethnic origin, political opinions, religious or philosophical beliefs, state of health, intimate
life, except for cases stipulated by the legislation of the Russian Federation.
5. Procedure and conditions of personal data processing
5.1. Personal data shall be processed by the Operator in accordance with the requirementsof the legislation of the Russian Federation.
5.2. The personal data processing is carried out with the consent of the personal data
subjects to the processing of their personal data, as well as without it in cases stipulated by
the legislation of the Russian Federation
5.3. The Operator shall process personal data for each purpose of its processing in thefollowing ways:- manual processing of personal data;- automated processing of personal data with transfer of received information via

information and telecommunication networks or without it;- mixed processing of personal data.
5.4. Employees of the Operator, whose job responsibilities include processing of personaldata, are allowed to process personal data
5.5. Processing of personal data for each processing purpose specified in clause 2.3 of the
Policy shall be carried out by:- receiving personal data in oral and written form directly from personal data subjects;- entering personal data into the Operator's logs, registers and information systems;- use of other methods of personal data processing.
5.6. Disclosure to third parties and distribution of personal data is not allowed without theconsent of the personal data subject, unless otherwise stipulated by the Federal Law.
Consent to the processing of personal data authorized by the personal data subject for
distribution shall be drawn up separately from other consents of the personal data subject
to the processing of his/her personal data.
The requirements for the content of consent to the processing of personal data allowed by
the personal data subject for distribution are approved by the Order of Roskomnadzor dated
24.02.2021 No. 18.
5.7. The transfer of personal data to the inquires and investigation authorities, the Federal
Tax Service, the Social Fund of Russia and other authorized executive bodies andorganizations is carried out in accordance with the requirements of the legislation of theRussian Federation.
5.8. The Operator shall undertake the necessary legal, organizational and technicalmeasures to protect personal data from unlawful or accidental access, destruction,
rectification, blocking, distribution and other unauthorized actions, including:- detects threats to the security of personal data during their processing;- adopts local regulations and other documents regulating relations in the field ofprocessing and protection of personal data;- appoints persons in charge of ensuring the security of personal data in the structural
subdivisions and information systems of the Operator;- creates the necessary conditions for working with personal data;- organizes recording of documents containing personal data;- organizes work with information systems in which personal data is processed;- stores personal data in conditions under which their safety is ensured and illegal access tothem is excluded;- arranges training courses for the employees of the Operator who are in charge of personal
data processing.
5.9. The Operator shall store personal data in a form that allows to determine the subject of
personal data no longer than required by each purpose of personal data processing, unlessthe term of personal data storage is established by the Federal Law, the contract.
5.9.1. Personal data on paper are stored by SC CROCUS Krasnogorsk subsidiary Crocus Expoduring retention periods which are stipulated by law.
5.9.2. The retention of personal data processed in personal data information systems
corresponds to the retention period of personal data on paper.
5.10. The Operator shall stop processing personal data in the following cases:- revealed the fact of their illegal processing. Term - within three office days from the dateof detection;- the purpose of their processing has been achieved;- the personal data subject's consent to the processing of said data has expired or iswithdrawn when, under the Personal Data Law, the processing of such data is permitted
only with the consent of the personal data subject.
5.11. Upon achievement of the purposes of the personal data processing, as well as in theevent that the personal data subject withdraws his/her consent to their processing, theOperator shall stop processing these data if:

- no other is stipulated by the contract to which the beneficiary or guarantor is the personal
data subject;- the Operator shall not be entitled to process personal data without the consent of thesubject on the grounds stipulated by the Personal Data Law or other federal laws;- no other contract between the Operator and the personal data subject provides otherwise.
5.12. If the personal data subject applies to the Operator with a request to stop personal
data processing within a period not exceeding 10 office days from the date of receipt by the
Operator of the relevant requirement, the processing of personal data shall be terminated,
except for cases stipulated by the Personal Data Law. The specified period can be extended,
but not more than five office days. To do this, the Operator must send a motivatednotification to the personal data subject indicating the reasons for extending the period.
5.13. When collecting personal data, including through the Internet information andtelecommunication network, the Operator shall ensure the recording, systematization,
accumulation, storage, rectification (updating, modification), extraction of personal data of
citizens of the Russian Federation using databases located in the territory of the RussianFederation, except for the cases specified in the Personal Data Law.
6. Update, correction, deletion, destruction of
personal data, responses to requests from subjects for accessto personal data
6.1. Confirmation of the fact of personal data processing by the Operator, legal grounds andpurposes of personal data processing, as well as other information specified in chapter 7
article 14 of the Personal Data Law, shall be provided by the Operator to the personal data
subject or his/her representative within 10 office days from the date of appeal or receipt of
the request of the personal data subject or his/her representative. This period can beextended, but not more than five office days. To do this, the Operator must send a
motivated notification to the personal data subject indicating the reasons for extending theperiod for providing the requested information.
Personal data relating to other subjects of personal data shall not be included in theinformation provided, unless there are legitimate grounds for disclosure of such personaldata.
The request must contain:- number of the main document certifying the identity of the personal data subject or
his/her representative, information on the date of issuance of the specified document andthe issuing authority;- information confirming the participation of the personal data subject in relations with the
Operator (contract number, date of conclusion of the contract, conditional verbal
designation and (or) other information), or information otherwise confirming the fact ofprocessing of personal data by the Operator;- signature of the personal data subject or his/her representative.
The request can be sent in the form of an electronic document and signed by an electronic
signature in accordance with the legislation of the Russian Federation.
The Operator shall provide the information specified in chapter 7 article 14 of the Personal
Data Law to the personal data subject or his/her representative in the form in which thecorresponding appeal or request is sent, unless otherwise indicated in the appeal orrequest.
If in the appeal (request) of the personal data subject all the necessary information is notreflected in accordance with the requirements of the Personal Data Law or the subject does
not have the rights to access the requested information, then a reasoned refusal is sent tohim.
The right of the personal data subject to access to his/her personal data may be limited inaccordance with chapter 8 article 14 of the Personal Data Law, including if the access of thepersonal data subject to his/her personal data violates the rights and legitimate interests ofthird parties.
6.2. In case of detection of inaccurate personal data when the personal data subject or
his/her representative applies or at their request or at the request of Roskomnadzor, theOperator shall block personal data relating to this subject, from the moment of such appeal
or receipt of said request for the verification period, if blocking of personal data does not
violate the rights and legitimate interests of the personal data subject or third parties.
In case of confirmation of the fact of personal data inaccuracy, the Operator shall, on thebasis of the information provided by the personal data subject or his/her representative or
Roskomnadzor, or other necessary documents, specify the personal data within seven officedays from the date of submission of such information and remove the blocking of thepersonal data.
6.3. In case of detection of illegal processing of personal data at the request (inquiry) of thepersonal data subject or his/her representative or Roskomnadzor, the Operator shall block
the illegally processed personal data relating to this personal data subject from themoment of such request or from the receipt of the inquiry.
6.4. If the Operator, Roskomnadzor or any other concerned person detects the fact of illegal
or accidental transfer (provision, distribution) of personal data (access to personal data),
which resulted in violation of the rights of personal data subjects, the Operator:- will notify within 24 hours Roskomnadzor of the incident, the alleged reasons resulting inviolation of the rights of personal data subjects, the alleged harm caused to the rights ofpersonal data subjects, and the measures taken to eliminate the consequences of theincident, as well as provide information about the person authorized by the Operator tointeract with Roskomnadzor on issues related to the incident;- will notify within 72 hours Roskomnadzor of the results of the internal investigation of thedetected incident and provide information about the persons whose actions caused it (ifany).
6.5. Procedure for destruction of personal data by the Operator.
6.5.1. Terms and conditions of destruction of personal data by the Operator:- achievement of the purpose of processing personal data or loss of the need to achieve thepurpose - within 30 days;- achievement of maximum retention period for documents containing personal data within 30 days;- provision by the personal data subject (his/her representative) of confirmation that
personal data is obtained illegally or not necessary for the stated purpose of processing within seven office days;- withdrawal by the personal data subject of consent to the processing of his/her personaldata, if their storage is no longer required for the purpose of their processing - within 30
days.
6.5.2. Upon achievement of the purpose of personal data processing, as well as in the caseof withdrawal by the personal data subject of consent to their processing, personal data
shall be destructed if:- no other is stipulated by the contract to which the beneficiary or guarantor is the personal
data subject;- the Operator shall not be entitled to process personal data without the consent of thesubject on the grounds stipulated by the Personal Data Law or other federal laws;- no other contract between the Operator and the personal data subject provides otherwise.
6.5.3. The destruction of personal data is carried out by a commission set up by the order ofthe Director of SC CROCUS Krasnogorsk subsidiary Crocus Expo.
6.5.4. Methods of destruction of personal data shall be established in local regulations of
the Operator

7. Final provisions
7.1. The Policy is approved by the order of the Director of SC CROCUS Krasnogorsk subsidiary
Crocus Expo and comes into force from the date of its signing.
7.2. The Policy may be amended and supplemented by the order of the Director of SC
CROCUS Krasnogorsk subsidiary Crocus Expo.
7.3. The current version of the Policy is posted in the public domain on the Internet at theaddress: eng.crocus-expo.ru, as well as on the official websites of exhibitions and otherevents, the Organizer of which is SC CROCUS.