Personal data processing policy

1. General provisions

1. ANO Energy of the Future (hereinafter, the “Operator”) has developed this Personal Data Processing Policy (hereinafter, the “Policy”) in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and other laws and regulations of the Russian Federation.

2. This Policy sets out how the Operator processes the personal data of users of myfuture.energy, the terms and principles governing such processing, the rights of Users, the Operator’s obligations and the measures the Operator takes to protect personal data.

3. This Policy applies to all personal data that the Operator receives from users of the Website (hereinafter collectively, the “Users”, and individually, a “User”).

4. A User who does not agree to the terms of this Policy must immediately cease all use of the Website.

5. This Policy applies only to the Website. The Operator does not control and is not responsible for third-party websites that a User may access through links available on the Website.

2. Terms and definitions

This Policy uses the following terms and definitions:

• “Website” means the website at myfuture.energy.

• “Personal Data” (hereinafter, “PD”) means any information relating directly or indirectly to an identified or identifiable individual (the PD subject);

• “Blocking of PD” means the temporary suspension of PD processing, except where processing is necessary to clarify the PD;

• “Anonymisation of PD” means actions that make it impossible, without the use of additional information, to determine that PD relates to a particular PD subject;

• “Processing of PD” means any action or set of actions involving personal data, whether or not performed using automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (dissemination, provision or access), anonymisation, blocking, deletion and destruction of PD;

• “Operator” means the Autonomous Non-Profit Organization for Nuclear Inform Centers Development “Energy of the Future” (ANO Energy of the Future), Primary State Registration Number (OGRN) 1167700063300, Taxpayer Identification Number (INN) 7726385219, registered office at: 3 Varshavskoye Highway, Moscow 117105, Russia.

• “Provision of PD” means actions aimed at disclosing PD to a specific person or a specific group of persons;

• “Dissemination of PD” means actions aimed at disclosing PD to an indefinite group of persons (transferring PD) or making personal data available to an unlimited group of persons, including publication of PD in the media, posting it on information and telecommunications networks, or providing access to personal data by any other means.

• “User” means a visitor to the Website who is a PD subject;

• “PD Information System” means an information system containing personal data;

• “Destruction of PD” means actions that make it impossible to restore the content of PD in a PD Information System and/or result in the destruction of physical media containing PD;

• “Cookies” means data automatically transmitted to the Operator during use of the Website by software installed on the User’s device, including the IP address, geographical location, browser information, the type of operating system on the User’s device, the technical specifications of the hardware and software used by the User, and the date and time of access to the Website. By accepting the terms of the Policy, the User agrees to the use of cookies.

3. Legal grounds and purposes of personal data processing

1. The legal grounds for processing PD are:

   • The Civil Code of the Russian Federation;

   • Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;

   • Federal Law No. 149-FZ dated 27 July 2006 “On Information, Information Technologies and the Protection of Information”;

   • Other laws and regulations of the Russian Federation;

   • The Operator’s internal regulations;

   • The User’s consent to the processing of personal data.

2. The Operator processes the User’s PD solely for the following purposes:

   • registering and identifying the User on the Website and enabling the User to make full use of the Website;

   • improving service quality for Users, upgrading the Website, and carrying out statistical and other research based on anonymised information provided by the User;

   • providing the User with access to third-party websites or services of the Website’s partners in order to receive their offers, updates or services.

3. The specific scope of PD processed for the above purposes is set out in Section 5 of the Policy.

4. Terms and procedure for giving consent to the Operator’s processing of personal data

1. The Operator does not verify the PD provided by the User. Accordingly, when providing PD on the Website, the Operator assumes that the User:

   1. Has legal capacity. Where a person using the Website lacks legal capacity, the User’s legal representative, having read and accepted the terms of PD processing set out in this Policy, must give consent to the processing of PD.

   2. Provides accurate information about themselves or the person lacking legal capacity whom they represent (clause 4.1.1), to the extent necessary to use the Website. Keeps the PD they have provided accurate and up to date.

   3. Understands that information about themselves posted on the Website may become available to other Users and may be copied and disseminated by those Users in the circumstances provided for by the Policy and/or as a result of malicious software (viruses).

2. The User accepts the terms of the Policy and gives the Operator informed consent to process their PD, including by disseminating it, on the terms set out in the Policy and the laws of the Russian Federation:

   1. When registering and verifying their identity on the Website, in respect of the PD that the User provides to the Operator by completing the registration form available at myfuture.energy. The User is deemed to have consented to the processing of their PD when they click the “Register” button or make another selection in the registration field.

   2. When completing a feedback form, including an application to use the services of the Website and/or the Operator’s Partners, in respect of the PD provided by the User to the Operator when completing the feedback form on the Website or through electronic services. The User is deemed to have consented to the processing of the PD entered in the feedback form when they click the button confirming submission of the application. Such buttons may be labelled “Send”, “Submit an application”, “Register”, “Request a consultation” or similar.

   3. When subscribing to information and news materials from the Operator by completing the subscription form available online at myfuture.energy, the User is deemed to have consented to the processing of their PD when they tick the box marked “I agree to the terms of PD processing”.

   4. Whenever the User uses the Website, they consent to the processing of PD automatically transmitted to the Operator by software installed on their device.

3. By taking the actions specified in clause 4.2 of this Policy, the User gives the Operator consent to process the relevant PD listed in Section 5 of this Policy, including its collection, recording, systematisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (dissemination, provision to third parties or access), anonymisation, blocking, deletion and destruction, with or without automated means, for the purposes set out in Section 3 of this Policy.

4. The User’s consent to the processing of PD under this Policy takes effect on the date it is given and remains valid for as long as is necessary to achieve the purposes of PD processing or until it is withdrawn by the User, unless otherwise provided by the laws of the Russian Federation. The User may withdraw their consent to the processing of PD under this Policy at any time. The User may withdraw consent previously given to the Operator for the processing of PD in either of the following ways:

   • by sending the relevant statement by post to: 3 Varshavskoye Highway, Moscow 117105, Russia;

   • by sending the relevant statement as an electronic document to the following email address: info@myfuture.energy.

5. Personal data processed by the Operator

1. The Operator processes Users’ PD on the following terms:

PURPOSE OF PD PROCESSING	SCOPE OF PD PROCESSED
Registration on the Website (clause 3.2.1)	- surname and first name; - email address; - telephone number; - date of birth; - sex;
Identification on the Website (clause 3.2.1)	● email address
Improving the quality of service provided to Users and upgrading the Website (clause 3.2.2)	● cookies
Statistical and other research based on anonymised information (clause 3.2.2)	● cookies
Providing the User with access to third-party websites or services of the Website’s partners in order to receive their offers, updates or services (clause 3.2.3)	- surname and first name; - email address;

6. Personal data processing

1. The Operator processes PD in accordance with the following principles:

   • Lawfulness and fairness;

   • Limiting the processing of PD to specific, predetermined and lawful purposes;

   • Not processing PD in a manner incompatible with the purposes for which the Operator collected it;

   • Not combining databases containing PD processed for mutually incompatible purposes;

   • Processing only the PD necessary for the purposes of processing;

   • Ensuring that the content and scope of the PD processed are consistent with the stated purposes of processing;

   • Not processing PD that is excessive in relation to the stated purposes of processing;

   • Ensuring that PD is accurate, sufficient and up to date for the purposes of processing;

   • Destroying or anonymising PD once the purposes of processing have been achieved or are no longer relevant, when a User requests the destruction of PD, or when a User withdraws consent to the processing of PD.

2. The Operator processes Users’ PD – including recording, systematisation, accumulation, storage, clarification (updating or amendment) and retrieval – using databases located in the Russian Federation.

3. The Operator processes Users’ PD using automated means and without such means.

4. The Operator and any other persons granted access to personal data must not disclose PD to third parties or disseminate it without the consent of the PD subject, unless otherwise provided by the laws of the Russian Federation.

5. The Operator’s processing of a User’s PD includes collection, recording, systematisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (dissemination, provision to third parties or access), anonymisation, blocking, deletion and destruction.

6. The Operator stores Users’ PD electronically. When processing PD for the purpose of performing obligations under agreements with a User, the Operator may retrieve PD and store it on physical media. The Operator stores such PD for the period prescribed by the laws of the Russian Federation.

7. The Operator stores PD until the first of the following events occurs:

   • Until it is destroyed by the Operator following the User’s withdrawal of consent to personal data processing or request for the destruction of personal data;

   • Until the term of the consent expires (clause 4.4 of the Policy).

8. The Operator may transfer PD to the following third parties in accordance with the requirements of the laws of the Russian Federation or with the consent of the PD subject:

   • Partners such as website and application owners, advertising networks and other partners that provide the Operator with services relating to the placement and display of advertising on websites or in programmes, products or services owned or controlled by those partners;

   • Partners engaged by the Operator to provide services to Users;

   • Partners for the purpose of providing Users with tailored offers to enter into civil-law agreements.

9. The Operator may transfer personal data to the third parties specified in clause 6.8 of the Policy only if:

   • The third party processes PD using databases located in the Russian Federation;

   • The third party maintains the confidentiality of PD during its processing and use and undertakes not to disclose or disseminate Users’ PD without their consent;

   • The third party guarantees the following measures to ensure the security of PD during processing: the use of information security tools; the detection and recording of unauthorised access to personal data; measures to restore PD; restricted access to personal data; the registration and logging of actions involving personal data; and monitoring and assessment of the effectiveness of the measures used to protect PD;

   • The permitted methods of processing PD are collection, recording, systematisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (dissemination, provision or access), anonymisation, blocking, deletion and destruction;

   • The third party must not transfer or disseminate PD.

Measures taken by the Operator to protect personal data

The Operator takes the necessary and sufficient legal, organisational and technical measures to protect information provided by Users against unlawful or accidental access, destruction, alteration, blocking, copying or dissemination, and against other unlawful actions by third parties. These measures include, in particular:

• appointing a person responsible for PD processing;

• implementing organisational and technical measures to ensure the security of PD processed in information systems;

• monitoring unauthorised access to PD and taking measures to prevent similar incidents in future;

• monitoring the measures taken to ensure PD security and the level of protection of PD information systems.

8. User rights

1. The User decides freely, voluntarily and in their own interests whether to provide their PD and consent to its processing. The User gives consent to the processing of PD in the manner set out in clause 4.2 of this Policy.

2. The User has the right to obtain information from the Operator concerning the processing of their PD.

3. The User may submit requests and demands to the Operator (hereinafter, a “Request”), including in relation to the use of their PD and the withdrawal of consent to PD processing. The User may submit a Request in either of the following ways:

   • in writing to the Operator’s address (Section 11 of the Policy);

   • as an electronic document, such as a scan or photograph of the document. The document must be sent from the email address provided by the User when registering on the Website to the Operator’s email address: info@myfuture.energy.

9. Updating, correction, deletion and destruction of personal data

1. In accordance with the procedure prescribed by the laws of the Russian Federation, the Operator must inform the User or their legal representative whether it holds PD relating to that User and must allow them to access that PD within 10 (ten) days of receiving a request from the User or their representative. The Operator may extend this period by no more than 5 (five) working days, provided that it sends the User a reasoned notice explaining the grounds for the extension.

2. The Operator must allow the User or their legal representative to access PD relating to the User free of charge.

3. Within no more than 7 (seven) working days of the User or their legal representative providing information confirming that PD is incomplete, inaccurate or out of date, the Operator must make the necessary amendments.

4. Within no more than 7 (seven) working days of the User or their legal representative providing information confirming that PD was obtained unlawfully or is unnecessary for the stated purpose of processing, the Operator must destroy that PD. The Operator must also notify the User or their legal representative of the changes made and measures taken, and take reasonable steps to notify any third parties to whom the User’s PD has been transferred.

5. If the Operator confirms that PD is inaccurate, it must use the information provided by the User, their legal representative or the authority responsible for protecting the rights of PD subjects, or other necessary documents, to correct the PD or ensure that a person acting on its instructions corrects it within 7 (seven) working days of receiving that information, and must then unblock the PD.

6. The Operator must cease processing PD, or ensure that a person acting on the Operator’s instructions ceases processing it:

   • if it identifies unlawful processing by the Operator or a person acting on its instructions, within no more than 3 (three) working days of identifying it;

   • if the User withdraws consent to the processing of their PD;

   • once the Operator has achieved the purpose of PD processing.

7. The Operator must destroy the User’s PD, or ensure that a person acting on its instructions destroys it, within no more than 30 (thirty) days after achieving the purpose of PD processing.

8. If the Operator cannot destroy PD within the period specified in clause 9.7 of the Policy, it must block the PD, or ensure that a person acting on its instructions blocks it, and must destroy it within no more than 6 (six) months, unless the laws of the Russian Federation prescribe a different period.

10. Amendments to the Policy

1. The Operator reserves the right to amend the Policy. The User must review the Policy each time they use the Website.

2. A new version of the Policy takes effect when the Operator posts it in the relevant section of the Website. The User accepts the Policy and its terms by continuing to use the Website or its services after the Operator publishes a new version. A User who does not agree to the terms of the Policy must immediately stop using the Website and its services.

3. All comments and/or questions concerning this Policy should be sent to the Operator at info@myfuture.energy.

4. Appendix No. 1 to the Privacy Policy sets out the procedure for responding to such requests.

11. Operator details

Autonomous Non-Profit Organization for Nuclear Inform Centers Development “Energy of the Future” (ANO Energy of the Future) 

Registered office: 3 Varshavskoye Highway, Moscow 117105, Russia 

Taxpayer Identification Number (INN): 7726385219 

Tax Registration Reason Code (KPP): 772601001 

Primary State Registration Number (OGRN): 1167700063300 

Appendix No. 1 to the Personal Data Processing Policy

REGULATIONS on Responding to Requests from Personal Data Subjects or Their Legal Representatives

1. General provisions

1. These Regulations on Responding to Requests from Personal Data Subjects or Their Legal Representatives (hereinafter, the “Regulations”) have been developed in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” (hereinafter, “Federal Law No. 152-FZ”) and the Code of Administrative Offences of the Russian Federation, and form an appendix to the Privacy Policy.

2. These Regulations establish the procedure for recording and considering requests from personal data subjects or their legal representatives (hereinafter, “requests”), the relevant time limits and the sequence of steps.

2. Rights of personal data subjects

1. A personal data subject has the right to receive information concerning the processing of their personal data, including:

   1. confirmation that the Operator processes personal data;

   2. the legal grounds and purposes of personal data processing;

   3. the purposes and methods of personal data processing used by the Operator;

   4. the Operator’s name and location, and information about persons, other than the Operator’s employees, who have access to personal data or to whom the Operator may disclose personal data under an agreement with the Operator or pursuant to Federal Law No. 152-FZ;

   5. the personal data that the Operator processes in relation to the relevant personal data subject and the source from which the Operator obtained it, unless Federal Law No. 152-FZ provides for a different procedure for providing such data;

   6. the periods for which the Operator processes personal data, including storage periods;

   7. the procedure by which the personal data subject may exercise the rights provided for by Federal Law No. 152-FZ;

   8. information about any completed or proposed cross-border transfer of data;

   9. the corporate name or surname, first name and patronymic, and address of any person whom the Operator instructs to process personal data, where the Operator has entrusted or will entrust such processing to that person;

   10. other information provided for by Federal Law No. 152-FZ or other federal laws.

   11. Federal laws may restrict a personal data subject’s right of access to their personal data, including where:

       • personal data, including personal data obtained through operational-search, counter-intelligence and intelligence activities, is processed for national defence, state security or law-enforcement purposes;

       • authorities process personal data after detaining the personal data subject on suspicion of committing an offence, charging them in criminal proceedings or imposing a preventive measure before bringing charges, except where the criminal procedure laws of the Russian Federation permit the suspect or accused person to access such personal data;

       • the processing of personal data complies with legislation on combating the legalisation (laundering) of proceeds of crime and the financing of terrorism;

       • the personal data subject’s access to their personal data infringes the rights and legitimate interests of third parties;

       • the processing of personal data takes place in cases provided for by Russian transport security legislation to ensure the stable and safe operation of the transport system and to protect individuals, society and the state from unlawful interference with transport infrastructure.

       • A personal data subject may require the Operator to correct, block or destroy their personal data if it is incomplete, out of date, inaccurate, obtained unlawfully or unnecessary for the stated purpose of processing, and may take any measures provided by law to protect their rights.

   3. Procedure for handling requests from personal data subjects or their legal representatives

   1. The information referred to in Article 14(7) of Federal Law No. 152-FZ must be provided to the personal data subject in an accessible form and must not contain personal data relating to other personal data subjects, unless there are lawful grounds for disclosing such personal data.

   2. The Operator provides the information referred to in Article 14(7) of Federal Law No. 152-FZ to the personal data subject or their legal representative when they contact the Operator or when the Operator receives a request from the personal data subject or their legal representative.

   3. The Operator’s employees who are responsible for organising personal data processing and whose duties include processing personal data must consider the requests.

   4. The Operator’s authorised officers must ensure:

      • objective, comprehensive and timely consideration of the request;

      • measures to restore or protect the infringed rights, freedoms and legitimate interests of personal data subjects;

      • written responses addressing the substance of the request.

   5. The person responsible for organising the Operator’s personal data processing registers requests from personal data subjects or their legal representatives.

   6. The Operator registers all requests on the day of receipt.

   7. The Operator must inform the personal data subject or their legal representative whether it holds personal data relating to that subject and allow them to access it within ten working days of receiving a request from the personal data subject or their legal representative.

   8. If the Operator refuses, following an enquiry or request, to inform the personal data subject or their legal representative whether it holds personal data relating to that subject, it must provide a reasoned written response within seven working days of receiving the enquiry or request.

   9. The person responsible for organising personal data processing determines the procedure and time limits for considering registered requests and issues written instructions to the persons handling each request.

   10. The Operator must allow the personal data subject or their legal representative to access personal data relating to that subject free of charge.

   11. Within no more than seven working days of the personal data subject or their legal representative providing information confirming that personal data is incomplete, inaccurate or out of date, the Operator’s authorised officers must make the necessary amendments.

   12. Within no more than seven working days of the personal data subject or their legal representative providing information confirming that personal data was obtained unlawfully or is unnecessary for the stated purpose of processing, the Operator’s authorised officers must destroy that personal data.

   13. The Operator must notify the personal data subject or their legal representative of the amendments made and measures taken, and take reasonable steps to notify any third parties to whom that subject’s personal data has been transferred.

   14. If an enquiry or request from the personal data subject or their legal representative, or a request from the authority responsible for protecting the rights of personal data subjects, reveals unlawful processing, the Operator’s authorised officers must block the unlawfully processed personal data relating to that subject from the date of receiving the enquiry or request and for the duration of the review.

   15. If an enquiry or request from the personal data subject or their legal representative, or a request from the authority responsible for protecting the rights of personal data subjects, reveals inaccurate personal data, the Operator’s authorised officers must block the personal data relating to that subject from the date of receiving the enquiry or request and for the duration of the review, provided that doing so does not infringe the rights and legitimate interests of the personal data subject or third parties.

   16. If the Operator’s authorised officers identify unlawful processing of personal data, they must cease it within no more than three working days. If the Operator’s authorised officers cannot make the processing of personal data lawful, they must destroy the personal data, or ensure its destruction, within no more than ten working days of identifying the unlawful processing.

   17. The Operator must notify the personal data subject or their legal representative that it has remedied the infringements or destroyed the personal data. Where the authority responsible for protecting the rights of personal data subjects forwarded the enquiry from the personal data subject or their legal representative, or sent the request, the Operator must also notify that authority.

   18. Where necessary, the Operator conducts appropriate reviews to verify the facts stated in requests, in accordance with the laws of the Russian Federation.

   19. Following each review, the Operator prepares a reasoned conclusion containing an objective analysis of the materials collected. If a review identifies conduct or an omission by an employee of the Operator that may constitute an administrative or criminal offence, the Operator must refer the information immediately to the law-enforcement authorities. The results of the review are reported to the head of the Operator.

   20. The person responsible for organising personal data processing directly monitors compliance with the procedure established by law and these Regulations for considering requests from personal data subjects or their legal representatives.

   21. Any officers responsible for a breach of the established procedure for considering requests are liable in accordance with the laws of the Russian Federation.