Personal Data Processing Policy

• General Provisions

This Policy of Limited Liability Company Analytical Company “RNC Pharma” (hereinafter – the Operator, LLC AC “RNC Pharma”) regarding the Processing of Personal Data (hereinafter – the Policy) has been developed in compliance with subparagraph 2, paragraph 1, Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter – the Personal Data Law) for the purpose of ensuring the protection of the rights and freedoms of individuals in the course of Processing their Personal Data, including protection of the right to privacy, personal and family secrecy.

The Policy serves as the basis for organizing the Processing and protection of Personal Data in LLC AC “RNC Pharma”, including for the development of internal documentation in the field of Personal Data Processing, and defines:

• the legal grounds for Personal Data Processing;
• categories of Data Subjects whose Personal Data are processed, the purposes of Personal Data Processing and the list of Personal Data being processed;
• the main principles of Personal Data Processing which the Operator follows in carrying out its activities;
• the rights and obligations of the Operator and of Data Subjects;
• the procedure and conditions for Personal Data Processing;
• the procedure for Destruction of Personal Data by the Operator;
• the basic procedure for reviewing requests from Data Subjects regarding Personal Data Processing;
• measures to ensure the Confidentiality of Personal Data and the security of Personal Data.

The Policy has been developed in accordance with the legislation of the Russian Federation in the field of Personal Data and applies to all Personal Data processed by LLC AC “RNC Pharma”.

The Policy applies to relations in the field of Personal Data Processing that have arisen after the approval of this Policy.

In accordance with paragraph 2, Article 18.1 of the Personal Data Law, this Policy is published for general access on the Internet in the information and telecommunications network at the Operator’s website.

• Basic concepts used in the Policy

Automated Processing of Personal Data – Processing of Personal Data with the use of computer technology.

Blocking of Personal Data – temporary cessation of Personal Data Processing (except where Processing is necessary for the clarification of Personal Data).

Legislation of the Russian Federation – the body of regulatory legal acts of the Russian Federation, which defines the cases and specific features of Personal Data Processing, as well as establishes requirements for Personal Data Processing.

Personal Data Information System – a set of Personal Data contained in databases and information technologies and technical means that ensure their Processing.

Other Personal Data – Personal Data that do not relate to Special Categories of Personal Data or to Biometric Personal Data.

Confidentiality of Personal Data – a mandatory requirement for LLC AC “RNC Pharma” or another person granted access to Personal Data not to permit their disclosure without the consent of the Data Subject or other lawful basis.

Depersonalization of Personal Data – actions as a result of which it becomes impossible, without the use of additional information, to determine whether Personal Data belong to a specific Data Subject.

Personal Data Processing / Processing – any action (operation) or set of actions (operations) performed with Personal Data with or without the use of automated means. Personal Data Processing includes, inter alia:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating, modification);
• extraction;
• use;
• transfer (dissemination, provision, access);
• depersonalization;
• blocking;
• deletion;
• destruction.

Processing of Personal Data without the use of automated means (non-automated Processing of Personal Data) – Processing of Personal Data carried out with the direct participation of a person.

Personal Data Operator (Operator) – a government authority, municipal authority, legal entity or natural person who, independently or jointly with others, organizes and/or carries out Personal Data Processing, as well as determines the purposes of Personal Data Processing, the composition of Personal Data to be processed and the actions (operations) performed with Personal Data; LLC AC “RNC Pharma”.

Person Responsible for the Organization of Personal Data Processing – a person appointed by order of the General Director who organizes the adoption of legal, organizational and technical measures in order to ensure proper performance of the functions related to the organization of Personal Data Processing at LLC AC “RNC Pharma” in accordance with the provisions of the legislation of the Russian Federation in the field of Personal Data.

Personal Data – any information relating to a directly or indirectly identified or identifiable individual (Data Subject).

Website Users – users of the Internet service of LLC AC “RNC Pharma” and of software provided by the Operator.

Provision of Personal Data – actions aimed at disclosure of Personal Data to a specific person or a specific circle of persons.

Employee – a person who has an employment relationship with LLC AC “RNC Pharma” under an employment contract.

Dissemination of Personal Data – actions aimed at disclosure of Personal Data to an indefinite circle of persons.

Roskomnadzor – the authorized authority for the protection of the rights of Personal Data Subjects.

Data Subject – an individual who is directly or indirectly identified or identifiable on the basis of Personal Data relating to him or her.

Special Categories of Personal Data – Personal Data concerning race, nationality, political views, religious or philosophical beliefs, state of health, intimate life, as well as information on criminal record.

Destruction of Personal Data – actions as a result of which it becomes impossible to restore the content of Personal Data in the Personal Data Information System and/or as a result of which tangible media containing Personal Data are destroyed.

Former Employee – an individual who previously had an employment relationship with LLC AC “RNC Pharma” under an employment contract.

• Regulatory documents

List of regulatory documents:

• Labour Code of the Russian Federation;
• Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;
• Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and Information Protection”;
• Decree of the Government of the Russian Federation No. 687 of 15 September 2008 “On the Approval of the Regulation on the Particularities of Processing Personal Data Carried Out Without the Use of Automation Means”;
• Decree of the Government of the Russian Federation No. 1119 of 1 November 2012 “On the Approval of Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems”;
• other regulatory legal acts of the Russian Federation and regulatory documents of executive authorities.

Legal grounds for Personal Data Processing:

The set of legal acts in pursuance of and in accordance with which LLC AC “RNC Pharma” carries out Personal Data Processing:

• Labour Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Civil Code of the Russian Federation;
• Federal Law No. 14-FZ of 08 February 1998 “On Limited Liability Companies”;
• Federal Law No. 167-FZ of 15 December 2001 “On Compulsory Pension Insurance in the Russian Federation”;
• Federal Law No. 27-FZ of 01 April 1996 “On Individual (Personalized) Record-Keeping in the System of Compulsory Pension Insurance”;
• Federal Law No. 402-FZ of 06 December 2011 “On Accounting”;
• Decree of the Government of the Russian Federation No. 687 of 15 September 2008 “On the Approval of the Regulation on the Particularities of Processing Personal Data Carried Out Without the Use of Automation Means”;
• Federal Law No. 323-FZ of 21 November 2011 “On the Fundamentals of Health Protection of Citizens in the Russian Federation”;
• Federal Law No. 422-FZ of 27 November 2018 “On Conducting an Experiment on the Establishment of a Special Tax Regime ‘Tax on Professional Income’”;
• other regulatory legal acts of the Russian Federation and regulatory documents of executive authorities.

Consent to Personal Data Processing, including the consent of applicants for vacant positions to the Processing of Personal Data, the consent of Employees to the Processing of Personal Data, the consent of clients to the Processing of Personal Data, the consent of Website Users, the consent of other Data Subjects.

Processing of Personal Data is necessary to achieve the purposes stipulated by an international treaty of the Russian Federation or by law, to exercise and perform functions, powers and obligations imposed on the Operator by the legislation of the Russian Federation.

Processing of Personal Data is necessary for the performance of a contract to which the Data Subject is a party, beneficiary or guarantor, if Personal Data Processing is required for the conclusion of such contract or for the performance of obligations thereunder.

• Categories of Data Subjects whose Personal Data are processed by the Operator

Processing of Personal Data is limited to the achievement of specific, predetermined and lawful purposes. Processing of Personal Data that is incompatible with the purposes of Personal Data collection is not permitted.

LLC AC “RNC Pharma” carries out Processing of Personal Data lawfully obtained and belonging to:

• job candidates (applicants) and Employees of LLC AC “RNC Pharma”;
• Former Employees of LLC AC “RNC Pharma”, close relatives/family members of Employees of LLC AC “RNC Pharma”;
• counterparties, representatives of counterparties, including individual entrepreneurs and self-employed persons;
• Users of the website of LLC AC “RNC Pharma”;
• respondents/medical/pharmaceutical workers.

• Purposes of Personal Data Processing

The Operator Processes Personal Data for the following purposes:

• carrying out its activities in accordance with the charter of LLC AC “RNC Pharma”;
• implementation of labour legislation of the Russian Federation in the framework of labour and related relations, including: recruitment and selection of candidates for employment with the Operator, ensuring personal safety of Employees, monitoring the quantity and quality of work performed, safeguarding property, maintaining HR and accounting records, completing and submitting to authorized bodies the required reporting forms, arranging for the registration of Employees in the systems of compulsory pension and social insurance (ensuring compliance with tax and pension legislation of the Russian Federation), providing Employees with additional guarantees and compensations, providing information to a credit institution for issuing a bank card and transferring salary to it, payroll, organizing Employee training (professional development);
• ensuring access control at LLC AC “RNC Pharma”;
• preparation, conclusion, amendment and termination of civil-law contracts, including with self-employed persons and individual entrepreneurs;
• promotion of goods, works and services on the market.

• List of Personal Data processed at LLC AC “RNC Pharma”

The list of Personal Data processed at LLC AC “RNC Pharma” is determined in accordance with the legislation of the Russian Federation and with the local acts of LLC AC “RNC Pharma”, taking into account the purposes of Personal Data Processing specified in Clause 5 of the Policy and in accordance with the notification on Personal Data Processing submitted by the Operator to Roskomnadzor.

The purposes of Personal Data Processing and the corresponding categories and lists of Personal Data processed, as well as categories of Data Subjects, are set out in Appendix 1 to this Policy, which forms its integral part.

• Principles of Personal Data Processing

Personal Data Processing by the Operator is carried out on the basis of the following principles:

• legality of the purposes and methods of Personal Data Processing;
• good faith of LLC AC “RNC Pharma” as a Personal Data Operator, which is achieved through compliance with the requirements of the legislation of the Russian Federation regarding Personal Data Processing;
• correspondence of the composition and volume of Personal Data processed;
• ensuring the accuracy of Personal Data, their sufficiency and, where necessary, relevance in relation to the purposes of Personal Data Processing.

Employees of the Operator authorized to Process Personal Data are obliged to:

• know and strictly comply with the provisions of:
  • the legislation of the Russian Federation in the field of Personal Data;
  • this Policy;
  • local acts of LLC AC “RNC Pharma” on Personal Data Processing and security;
• Process Personal Data only within the scope of their job duties;
• not disclose Personal Data processed at LLC AC “RNC Pharma”;
• report actions of other persons that may lead to violation of the provisions of this Policy;
• report known facts of violation of the requirements of this Policy to the Person Responsible for the Organization of Personal Data Processing at LLC AC “RNC Pharma”.

• Basic rights and obligations of the Operator and the Data Subject

The Operator has the right to:

• independently determine the composition and list of measures necessary and sufficient to ensure the performance of the obligations stipulated by the Personal Data Law and by regulatory legal acts adopted pursuant thereto, unless otherwise provided by the Personal Data Law or other federal laws;
• entrust Personal Data Processing to another person with the consent of the Data Subject, unless otherwise provided by federal law, on the basis of a contract concluded with such person. The person engaged in Personal Data Processing on behalf of the Operator must comply with the principles and rules of Personal Data Processing stipulated by the Personal Data Law, maintain the Confidentiality of Personal Data and take necessary measures to ensure the performance of obligations stipulated by the Personal Data Law;
• in the event of withdrawal by the Data Subject of consent to Personal Data Processing, continue Processing of Personal Data without the Data Subject’s consent if grounds specified in the Personal Data Law are present;
• exercise other rights provided by the legislation of the Russian Federation.

The Operator is obliged to:

• when Processing Personal Data, comply with the requirements of the legislation of the Russian Federation regarding the Processing and protection of Personal Data, including the requirements applicable to the collection of Personal Data;
• take measures to ensure the security of Personal Data during their Processing;
• respond to requests and inquiries of Data Subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
• fulfil the obligations to remedy violations of the legislation of the Russian Federation if such violations were committed during Personal Data Processing, as well as fulfil obligations concerning the clarification, Blocking and Destruction of Personal Data in cases stipulated by the legislation of the Russian Federation;
• perform other obligations stipulated by the legislation of the Russian Federation.

The Data Subject has the right to:

• freely, by his or her will and in his or her interest, give consent to Personal Data Processing, taking into account the requirements of the legislation of the Russian Federation regarding the form and content of consents to Personal Data Processing;
• receive information relating to the Processing of his or her Personal Data, except in cases stipulated by federal laws. Information is provided to the Data Subject by the Operator in an accessible form and must not contain Personal Data relating to other Data Subjects, unless there are lawful grounds for disclosure of such Personal Data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
• require the Operator to clarify Personal Data, block or destroy them if Personal Data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the declared purpose of Processing, as well as to take measures provided by law to protect his or her rights;
• address a demand to the Operator to cease Processing of his or her Personal Data and to withdraw previously given consent to Personal Data Processing;
• appeal to Roskomnadzor or to a court against unlawful actions or omissions of the Operator in relation to Personal Data Processing;
• exercise other rights provided by the legislation of the Russian Federation.

• Procedure and conditions for Personal Data Processing

Personal Data Processing is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.

Personal Data Processing is carried out with the consent of Data Subjects to the Processing of their Personal Data, as well as without such consent in cases provided for by the legislation of the Russian Federation.

LLC AC “RNC Pharma” carries out Personal Data Processing with the use of automated means and without the use of automated means, as well as mixed Processing, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (Provision, access) of Personal Data for the time necessary to achieve the purposes of Personal Data Processing.

Employees of the Operator whose job duties include Personal Data Processing are admitted to Personal Data Processing.

Disclosure and Dissemination of Personal Data to third parties without the consent of the Data Subject is not permitted, unless otherwise provided by federal law. When Personal Data are disclosed (provided) to third parties, the requirements for the protection of processed Personal Data are observed.

Consent to Personal Data Processing permitted by the Data Subject for Dissemination is formalized separately from other consents of the Data Subject to the Processing of his or her Personal Data.

Transfer of Personal Data to law-enforcement and investigative authorities, the Federal Tax Service and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

Personal Data are stored in a form that makes it possible to identify the Data Subject for no longer than required by the purposes of Personal Data Processing, unless the period of Personal Data storage is established by federal law or by a contract to which the Data Subject is a party, beneficiary or guarantor.

Personal Data on paper media are stored at LLC AC “RNC Pharma” for the periods specified by the legislation on archiving in the Russian Federation for such documents.

The period of storage of Personal Data processed in Personal Data Information Systems corresponds to the period of storage of Personal Data on paper media.

The Operator ceases Personal Data Processing in the following cases:

• an instance of unlawful Processing is identified. Period – within three working days from the date of identification;
• the purpose of Processing has been achieved;
• the validity period has expired or the Data Subject’s consent to the Processing of Personal Data has been withdrawn in cases where the Personal Data Law permits Processing only with consent.

Upon achieving the purposes of Personal Data Processing and also in the event of withdrawal by the Data Subject of consent to such Processing, the Operator ceases Processing of such Personal Data if:

• otherwise is not stipulated by a contract to which the Data Subject is a party, beneficiary or guarantor;
• the Operator is not entitled to carry out Processing without the Data Subject’s consent on grounds stipulated by the Personal Data Law or other federal laws;
• otherwise is not stipulated by another agreement between the Operator and the Data Subject.

When a Data Subject lodges a request with the Operator demanding that Personal Data Processing be ceased, Processing shall be stopped within a period not exceeding 10 working days from the date on which the Operator receives the relevant request, except in cases stipulated by the Personal Data Law. This period may be extended, but by no more than five working days, in which case the Operator must send to the Data Subject a reasoned notification specifying the reasons for the extension.

If inaccurate Personal Data are identified following a request from the Data Subject or his or her representative, or at their request, or following a request from Roskomnadzor, the Operator shall block the Personal Data relating to that Data Subject from the moment of such request or receipt of such request for the period of verification, provided that the Blocking of Personal Data does not violate the rights and legitimate interests of the Data Subject or third parties.

If the inaccuracy of Personal Data is confirmed, the Operator, on the basis of the information provided by the Data Subject or his or her representative or by Roskomnadzor, or other necessary documents, shall clarify the Personal Data within seven working days from the date the information is provided and shall remove the Blocking of Personal Data.

If unlawful Processing of Personal Data is identified following a request by the Data Subject or his or her representative or by Roskomnadzor, the Operator shall block the unlawfully processed Personal Data relating to that Data Subject from the moment of such request or receipt of such request.

If the Operator, Roskomnadzor or another interested party identifies an instance of unlawful or accidental transfer (Provision, Dissemination) of Personal Data (access to Personal Data) resulting in a violation of the rights of Data Subjects, the Operator shall:

• within 24 hours notify Roskomnadzor of the incident, the presumed causes of the violation of the rights of Data Subjects, the presumed harm caused to the rights of Data Subjects, and the measures taken to eliminate the consequences of the incident, and shall provide details of the person authorized by the Operator to liaise with Roskomnadzor on matters related to the incident;
• within 72 hours notify Roskomnadzor of the results of the internal investigation of the incident identified and provide information on the persons whose actions caused the incident (if available).

• Procedure for Personal Data Destruction by the Operator

Conditions and time periods for Personal Data Destruction by the Operator:

• achievement of the purpose of Personal Data Processing or loss of necessity to achieve that purpose – within 30 days from the date of achievement/loss of the purpose of Personal Data Processing;
• expiry of the maximum retention periods for documents containing Personal Data – within 30 days from the date of expiry of such periods;
• submission by the Data Subject (or his or her representative) of confirmation that Personal Data were obtained unlawfully or are not necessary for the stated purpose of Processing – within seven working days from the date such confirmation is submitted;
• withdrawal by the Data Subject of consent to the Processing of his or her Personal Data, if their retention for the purpose of Processing is no longer necessary – within 30 days from the date of receipt of such withdrawal.

Upon achieving the purposes of Personal Data Processing, as well as in the event of withdrawal by the Data Subject of consent to such Processing, Personal Data are subject to Destruction if:

• otherwise is not stipulated by a contract to which the Data Subject is a party, beneficiary or guarantor;
• the Operator is not entitled to carry out Processing without the Data Subject’s consent on grounds stipulated by the Personal Data Law or other federal laws;
• otherwise is not stipulated by another agreement between the Operator and the Data Subject.

Personal Data Destruction is carried out by a commission established by an order of the General Director of LLC AC “RNC Pharma”.

Methods of Personal Data Destruction are established in the local regulations of the Operator.

• Responses to Data Subject requests for access to Personal Data

Confirmation of the fact of Personal Data Processing by the Operator, the legal grounds and purposes of Personal Data Processing, as well as other information specified in paragraph 7, Article 14 of the Personal Data Law, are provided by the Operator to the Data Subject or his or her representative within 10 working days from the date of the request or receipt of the Data Subject’s or his or her representative’s request. This period may be extended, but by no more than five working days. To this end the Operator shall send to the Data Subject a reasoned notification specifying the reasons for extending the period for providing the requested information. The information provided shall not include Personal Data relating to other Data Subjects, unless there are lawful grounds for the disclosure of such Personal Data.

The Data Subject’s request must contain:

• the number of the main identity document of the Data Subject or his or her representative, information on the date of issue of that document and the issuing authority;
• information confirming the participation of the Data Subject in relations with the Operator (contract number, date of conclusion, conditional verbal designation and/or other information) or information otherwise confirming the fact of Personal Data Processing by the Operator;
• the signature of the Data Subject or his or her representative.

The Data Subject’s request may be submitted in the form of an electronic document signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator provides the information specified in paragraph 7, Article 14 of the Personal Data Law to the Data Subject or his or her representative in the same form in which the corresponding request was made, unless otherwise specified in the request.

If the request of the Data Subject does not include all the information required under the Personal Data Law or if the Data Subject does not have the right of access to the requested information, the Data Subject shall be sent a reasoned refusal.

The Data Subject’s right of access to his or her Personal Data may be restricted in accordance with paragraph 8, Article 14 of the Personal Data Law, including when the Data Subject’s access to his or her Personal Data violates the rights and legitimate interests of third parties.

• Measures aimed at ensuring compliance with obligations in relation to Personal Data Processing

The Operator independently determines the composition and list of measures necessary and sufficient to ensure the performance of obligations stipulated by the Personal Data Law and by regulatory legal acts adopted pursuant thereto, unless otherwise provided by the Personal Data Law or other federal laws.

At LLC AC “RNC Pharma” the following measures are taken to ensure compliance with the obligations stipulated by the Personal Data Law in the field of Personal Data Processing:

• the Person Responsible for the Organization of Personal Data Processing is appointed;
• the Policy on Personal Data Processing, local acts on Personal Data Processing and local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation, as well as eliminating the consequences of such violations are issued;
• legal, organizational and technical measures are applied to ensure the security of Personal Data in accordance with Article 19 of the Personal Data Law;
• internal control is exercised over compliance of Personal Data Processing with the Personal Data Law and with regulatory legal acts adopted pursuant thereto;
• an assessment is made of the harm that may be caused to Data Subjects in the event of violation of the requirements of the federal legislation of the Russian Federation on Personal Data, and the correlation is determined between such harm and the measures taken by LLC AC “RNC Pharma” to ensure compliance with the obligations stipulated by the Personal Data Law and by regulatory legal acts adopted pursuant thereto;
• Employees of LLC AC “RNC Pharma” directly engaged in Personal Data Processing are familiarized with the provisions of the legislation of the Russian Federation on Personal Data, including the requirements for Personal Data protection, with documents defining the policy of LLC AC “RNC Pharma” in relation to Personal Data Processing, and with local acts of LLC AC “RNC Pharma” on Personal Data Processing, and/or such Employees are trained.

• Measures aimed at ensuring compliance with obligations in relation to Personal Data protection

The Personal Data protection system of LLC AC “RNC Pharma” comprises a set of legal, organizational and technical measures aimed at neutralizing current threats to Personal Data security during their Processing.

Measures to ensure the security of Personal Data during their Processing in Personal Data Information Systems of LLC AC “RNC Pharma” are determined and applied taking into account the established levels of security of Personal Data during their Processing in Personal Data Information Systems of LLC AC “RNC Pharma” in accordance with Decree of the Government of the Russian Federation No. 1119 of 01 November 2012 “On the Approval of Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems”. The selection and implementation of protection tools within the Personal Data protection system during their Processing in Personal Data Information Systems of LLC AC “RNC Pharma” are carried out in accordance with the requirements of the legislation of the Russian Federation in the field of Personal Data.

Protection of Personal Data during their Processing in Personal Data Information Systems of LLC AC “RNC Pharma” against unlawful or accidental access, Destruction, modification, Blocking, copying, Provision, Dissemination, as well as against other unlawful actions with respect to Personal Data, is ensured by the application of an interrelated set of measures and protection tools, in particular:

• threats to Personal Data security during their Processing in Personal Data Information Systems are identified;
• organizational and technical measures are applied to ensure the security of Personal Data during their Processing in Personal Data Information Systems aimed at neutralizing current threats to Personal Data security in accordance with the legislation of the Russian Federation;
• the effectiveness of the measures taken to ensure the security of Personal Data is assessed prior to the commissioning of a Personal Data Information System;
• accounting of machine media containing Personal Data is maintained;
• activities are carried out to detect instances of unauthorised access to Personal Data and to take appropriate measures, including measures to detect, prevent and eliminate the consequences of computer attacks on Personal Data Information Systems and to respond to computer incidents in such systems;
• the possibility of restoring Personal Data modified or destroyed as a result of unauthorized access is ensured;
• rules for access to Personal Data processed in a Personal Data Information System are established, and registration and accounting of actions performed with Personal Data in a Personal Data Information System are ensured;
• control is exercised over the measures taken to ensure the security of Personal Data.

• Final provisions

Control over compliance with the requirements of this Policy is exercised by the authorized person – the Person Responsible for the Organization of Personal Data Processing at the Operator.

Persons found guilty of violating the rules governing Personal Data Processing and the protection of Personal Data processed at LLC AC “RNC Pharma” bear liability as stipulated by the legislation of the Russian Federation.

APPENDIX 1

List of purposes of Personal Data Processing and the corresponding categories and list of Personal Data processed, and categories of Data Subjects whose Personal Data are processed

This Appendix defines the purposes of Personal Data Processing by the Operator and the corresponding categories and list of Personal Data processed, as well as the categories of Data Subjects whose Personal Data are processed.

The Operator may process Personal Data of the following categories of Data Subjects:

• Employees, relatives of Employees, Former Employees – for the purposes of HR and accounting records:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; social status; property status, income; gender; email address; home address; registered address; telephone number; SNILS (individual insurance account number); taxpayer identification number (INN); citizenship; identity document details; driving license details; identity document details valid outside the Russian Federation; details contained in a birth certificate; bank card details; current account number; personal account number; occupation; position; information about employment history (including years of service, current employment details with indication of the name and current account of the organization); military liability and military registration data; information about education.

Other Personal Data – information about family composition; social benefits; information about additional guarantees and compensations on grounds provided for by the legislation of the Russian Federation; information about previous workplaces; information about business trips; data on transfers; information about dismissal (termination of an employment contract); data on incentive decisions and disciplinary actions; data on vacations; working schedule and conditions; data on qualification or special knowledge, including professional development and retraining; knowledge of foreign languages; data on awards, honorary titles; information on hours worked; information on vacation payments; information on temporary incapacity; sick-leave certificate data; information on the amount of temporary incapacity benefits; information on participation in legal entities; information on alimony and other financial obligations; information on briefings; messenger address; social network profile address.

• Applicants (candidates for employment) – for the purposes of selecting candidates for vacant positions at the Operator:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; social status; property status, income; gender; email address; home address; registered address; telephone number; SNILS; INN; citizenship; identity document details; driving license details; identity document details valid outside the Russian Federation; details contained in a birth certificate; occupation; position; information about employment history (including years of service, current employment details with indication of the name and current account of the organization); military liability and military registration data; information about education.

Other Personal Data – data on qualification or special knowledge, including professional development and retraining; knowledge of foreign languages; social benefits; information about additional guarantees and compensations on grounds provided for by the legislation of the Russian Federation; information about previous workplaces; information about business trips; employment record book data; data on incentive decisions and disciplinary actions; information about dismissal; working schedule and conditions at previous workplaces; data on transfers at previous workplaces; data on awards, honorary titles; messenger address; social network profile address; information on professional and other personal qualities of an evaluative nature; data on hobbies/interests.

• Employees – for the purposes of compliance with tax legislation of the Russian Federation:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; income; gender; email address; home address; registered address; telephone number; SNILS; INN; citizenship; identity document details; occupation; position.

• Employees – for the purposes of compliance with pension legislation of the Russian Federation:

surname, first name, patronymic; month of birth; date of birth; year of birth; income; gender; home address; SNILS; INN; citizenship; identity document details; information about employment history (including years of service, current employment details with indication of the name and current account of the organization).

• Employees – for the purposes of providing Employees with additional guarantees and compensations, including voluntary medical insurance and life insurance:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; gender; email address; home address; registered address; telephone number; SNILS; INN; citizenship; identity document details; position.

Other Personal Data – place of work; information on voluntary medical insurance; compulsory medical insurance policy; birth certificate data; marriage certificate data; policy type; insurance contract details.

• Employees, applicants, counterparties, representatives of counterparties – for the purposes of ensuring access control in the premises of LLC AC “RNC Pharma”:

surname, first name, patronymic; year of birth; month of birth; date of birth; gender; identity document details; position; driving license details; vehicle data.

• Counterparties, representatives of counterparties – for the purposes of preparation, conclusion, amendment and termination of civil-law contracts, including with self-employed persons and individual entrepreneurs:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; social status; property status, income; gender; email address; home address; registered address; telephone number; SNILS; INN; citizenship; identity document details; driving license details; identity document details valid outside the Russian Federation; details contained in a birth certificate; bank card details; current account number; personal account number; occupation; position; information about employment history (including years of service, current employment details with indication of the name and current account of the organization); military liability and military registration data; information about education.

Other Personal Data – place of work, structural subdivision; information contained in a power of attorney; messenger address; social network profile address; details of registration as an individual entrepreneur in the Unified State Register of Individual Entrepreneurs; information on affiliation, including family composition; data from documents on education, qualification or special knowledge, including professional development and retraining; knowledge of foreign languages; tax return data; tax payment data; information on tax deduction; information on the amount of accrued and paid insurance contributions for compulsory pension insurance; information on contributions to the Federal Tax Service; information on the person performing the duties of an accountant; information on licenses; information on participation in legal entities; information on pending court cases; data from a certificate of self-employed status; data contained in a civil-law contract and in additional agreements thereto: amount of remuneration, schedule and conditions for performing work or providing services; information on professional and other personal qualities of an evaluative nature.

• Employees – for the purposes of providing information to a credit institution for issuing a bank card and transferring salary to it:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; income; gender; email address; home address; registered address; telephone number; SNILS; INN; citizenship; identity document details; position; information about employment history (including years of service, current employment details with indication of the name and current account of the organization).

• Employees – for the purposes of payroll:

surname, first name, patronymic; year of birth; month of birth; date of birth; gender; bank card details; current account number; personal account number; occupation; position; information about employment history (including years of service, current employment details with indication of the name and current account of the organization).

• Employees – for the purposes of organizing training (professional development):

surname, first name, patronymic; year of birth; month of birth; date of birth; gender; email address; home address; registered address; telephone number; SNILS; INN; citizenship; identity document details; occupation; position; information about employment history (including years of service, current employment details with indication of the name and current account of the organization); information about education.

• Website Users – for the purposes of promoting goods, works and services on the market:

surname, first name, patronymic; email address; telephone number.

• Respondents/medical/pharmaceutical workers – for the purposes of conducting marketing research:

surname, first name, patronymic; specialty; work experience in the specialty; place of work; position; date of commencement of work; duration of work; address of place of work; business telephone; business email.

The Operator does not Process Special Categories of Personal Data concerning race, nationality, political views, religious or philosophical beliefs, state of health or intimate life.