REGULATION

on the Protection of Personal Data of Visitors

to the Web Resources of LLC "FC Rubin"

Regulation on the Protection of Personal Data of Visitors to the Web Resources of LLC FC "Rubin" 1. General ProvisionsThe Regulation on the Protection of Personal Data of Visitors to the Web Resources of LLC FC "Rubin" is developed in accordance with the requirements of Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006 (hereinafter referred to as the Personal Data Law). This Regulation establishes the procedures for processing personal data and the measures undertaken by LLC FC "Rubin," INN 1661055547, OGRN 1181690013120, registered at 420036, Kazan, Kopylova St., 2, to ensure the security of personal data when using electronic services on the Internet.
The Regulation on the Protection of Personal Data of Visitors to the Web Resources of LLC FC "Rubin" (hereinafter referred to as the Regulation) defines the key principles, objectives, conditions, and methods of personal data processing, as well as the categories of data subjects and types of personal data processed by LLC FC "Rubin" (hereinafter referred to as the Operator). It also outlines the Operator’s functions in personal data processing, the rights of data subjects, and the security measures implemented to protect personal data.
The Operator considers the protection of human and civil rights and freedoms in the processing of personal data, including the rights to privacy, personal, and family secrecy, as its top priority and an essential condition for its activities.
This Regulation takes effect upon approval by the General Director and remains in force until an updated version is approved or this document is revoked.
This Regulation applies to all information that the Operator may receive about visitors to the following websites and mobile applications of LLC FC "Rubin":

• https://www.rubin-kazan.ru/
• https://dnevnik.rubin-kazan.ru/
• https://www.rubin-kazan.ru/tickets/
• https://store.rubin-kazan.ru/
• https://www.rubin-kazan.ru/academy/
• https://www.rubin-kazan.ru/fans/rubin-na-svyazi/
• https://rubin-dfl.ru/
• https://rubin-junior.ru/
• https://eastcup-kazan.com/
• FC "Rubin" mobile application

In case of any contradictions between this Regulation and the current Russian legislation on personal data, the provisions of the latter shall prevail.
For all matters not regulated by this Regulation, the provisions of Russian personal data legislation shall apply.
The responsibility for maintaining this Regulation in an up-to-date state lies with the document’s developer within LLC FC "Rubin."

2. Terms and DefinitionsThis document uses the following local terms and abbreviations:

• Automated Processing of Personal Data – processing of personal data using computing technology.
• Blocking of Personal Data – temporary suspension of personal data processing (except in cases where processing is necessary for the clarification of personal data).
• Website – a collection of graphical and informational materials, as well as software and databases, ensuring their availability on the Internet.
• Personal Data Information System – a system comprising personal data stored in databases and the information technologies and technical means ensuring their processing.
• Anonymization of Personal Data – actions that make it impossible to determine, without additional information, the ownership of personal data by a specific User or another personal data subject.
• Processing of Personal Data – any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
• Operator – a state authority, municipal authority, legal entity, or individual that independently or jointly with other persons organizes and (or) carries out the processing of personal data, as well as determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data.
• Personal Data – any information relating directly or indirectly to an identified or identifiable User of the Operator's websites.
• Personal Data Authorized by the Data Subject for Distribution – personal data that has been made available to an unlimited number of persons by the data subject through the provision of consent for the processing of personal data authorized for distribution, in accordance with the Personal Data Law (hereinafter referred to as Personal Data Authorized for Distribution).
• User – any visitor to the Operator's websites.
• Provision of Personal Data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
• Distribution of Personal Data – any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data available to an unlimited group of persons, including the publication of personal data in mass media, placement in information and telecommunication networks, or providing access to personal data in any other way.
• Destruction of Personal Data – any actions resulting in the irreversible elimination of personal data with no possibility of restoring their content within a personal data information system and/or the destruction of physical personal data carriers.

2.1 Main Rights and Obligations of the Operator 3.1 The Operator has the right to:

• Receive accurate information and/or documents containing personal data from the data subject.
• Continue processing personal data in cases where the data subject withdraws their consent, provided there are legal grounds as stipulated in the Personal Data Law.
• Independently determine the scope and list of measures necessary and sufficient to fulfill its obligations under the Personal Data Law and applicable regulatory legal acts, unless otherwise specified by federal law.
• Modify the terms of this Policy and other Regulatory Documents at any time without prior notice to the User. The current version of this Policy is available at: https://www.rubin-kazan.ru/. The risk of not reviewing the updated version of the Policy and Regulatory Documents lies with the User. Continued use of the Operator’s websites and mobile applications after changes to the Policy or Regulatory Documents constitutes acceptance of their updated version.

2.2 The Operator is obligated to:

• Provide the data subject with information regarding the processing of their personal data upon request.
• Organize the processing of personal data in compliance with the current legislation of the Russian Federation.
• Respond to inquiries and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law.
• Submit the necessary information to the authorized body for the protection of personal data subjects’ rights within 30 days upon request.
• Publish or otherwise ensure unrestricted access to this Policy regarding personal data processing.
• Implement legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as other unlawful actions.
• Cease the transfer (distribution, provision, access) of personal data, terminate processing, and destroy personal data in cases and procedures stipulated by the Personal Data Law.
• Fulfill other obligations stipulated by the Personal Data Law.

4.1 The Operator undertakes to process the following personal data:Last name, first name, patronymic;

• Gender;
• Age (date of birth);
• Email address;
• Mobile phone number;
• Postal address;
• Login and password.

Additionally, anonymized data about visitors (including "cookie" files) is collected and processed on the website through internet analytics services (such as Yandex Metrica and others).
4.2 The aforementioned data is collectively referred to as Personal Data in this Policy.
4.3 The Operator does not process special categories of personal data concerning race, ethnic origin, political views, religious or philosophical beliefs, or intimate life.
4.4 User consent for the processing of personal data authorized for distribution is obtained separately from other consents for processing personal data. The conditions provided for in Article 10.1 of the Personal Data Law, in particular, are observed. The requirements for the content of such consent are established by the authorized body for the protection of personal data subjects' rights.
4.4.1 The User provides consent for the processing of personal data authorized for distribution directly to the Operator.
4.4.2 The Operator must publish information about the processing conditions, prohibitions, and conditions for processing personal data authorized for distribution no later than three working days after receiving the User's consent.
4.4.3 The transmission (distribution, provision, access) of personal data authorized for distribution by the data subject must be stopped at any time upon the request of the data subject. This request must include the full name (if available), contact information (phone number, email address, or postal address) of the data subject, as well as a list of personal data whose processing should be stopped. The specified personal data may only be processed by the Operator to whom the request was sent.
4.4.4 Consent for the processing of personal data authorized for distribution ceases to be effective upon the Operator’s receipt of the request specified in paragraph 4.4.3 of this Policy regarding the processing of personal data.

5.1 The processing of personal data is carried out on a lawful and fair basis.
5.2 The processing of personal data is limited to achieving specific, predetermined, and lawful purposes. Personal data processing that is incompatible with the purposes for which the data was collected is not allowed.
5.3 The merging of databases containing personal data, which is processed for incompatible purposes, is not permitted.
5.4 Only personal data that meets the objectives of their processing will be processed.
5.5 The content and scope of the processed personal data must be aligned with the declared purposes of processing. The processing of personal data that is excessive in relation to the stated purposes of processing is not allowed.
5.6 When processing personal data, its accuracy, sufficiency, and, where necessary, relevance to the objectives of processing must be ensured. The Operator takes necessary measures and/or ensures measures are taken to remove or clarify incomplete or inaccurate data.
5.7 Personal data is stored in a form that allows for the identification of the data subject, but no longer than necessary to achieve the purposes of processing personal data, unless the retention period is determined by federal law, an agreement to which the data subject is a party, a beneficiary, or an agent. Processed personal data is destroyed or anonymized once the processing objectives are met or if there is no longer a need to achieve those objectives, unless otherwise provided by federal law.

6.1 Purpose of Personal Data Processing of the User:

• Compliance with and execution of contracts for the purchase of goods, tickets, subscriptions, certificates, services provided, or any other agreements between the User and LLC "FC Rubin";
• Informing the User about goods, tickets, subscriptions, certificates, services provided by LLC "FC Rubin" or any other partner brand/company (activities related to e-commerce, as well as other directions), via email or other similar electronic communication channels (e.g., SMS), and making phone calls;
• Providing the User with access to services, information, and/or materials contained on the websites of LLC "FC Rubin".

6.2 The Operator also has the right to send notifications to the User about new services, special offers, and various events. The User can always opt out of receiving informational messages by disabling them in their personal account settings.
6.3 Anonymized User data collected through internet statistics services is used to gather information about User activities on the site, improve the quality of the website and its content.

7. Legal Grounds for Personal Data Processing
7.1 The legal grounds for processing personal data by the Operator are:

• The Civil Code of the Russian Federation;
• Federal Law No. 149-FZ of July 27, 2006, "On Information, Information Technologies, and Information Protection";
• Federal Law No. 152-FZ of July 27, 2006, "On Personal Data";
• Government Decree of the Russian Federation No. 512 of July 6, 2008, "On the Approval of Requirements for Material Carriers of Biometric Personal Data and Technologies for Storing Such Data Outside of Personal Data Information Systems";
• Government Decree of the Russian Federation No. 1119 of November 1, 2012, "On the Approval of Requirements for the Protection of Personal Data during Its Processing in Personal Data Information Systems";
• Government Decree of the Russian Federation No. 687 of September 15, 2008, "On the Approval of the Regulation on the Specifics of Personal Data Processing, Carried Out without the Use of Automation Tools";
• Order No. 21 of the Federal Service for Technical and Export Control (FSTEK) of Russia, dated February 18, 2013, "On the Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data during Its Processing in Personal Data Information Systems";
• Charter documents of the Operator;
• Agreements concluded between the Operator and the subject of personal data;
• Federal laws and other regulatory legal acts in the field of personal data protection;
• User consent for the processing of their personal data, including consent for the processing of personal data allowed for dissemination.

7.2 The Operator processes personal data of the User only when the data is filled out and/or sent by the User independently via special forms located on the Operator's websites. By filling out the corresponding forms and/or sending their personal data to the Operator, the User expresses consent to this Policy.
7.3 The Operator processes anonymized data about the User if this is allowed in the User's browser settings (with cookies saved and JavaScript technology enabled).
7.4 The subject of personal data independently decides to provide their personal data and gives consent freely, by their own will, and in their own interest.

8.1 Personal Data Processing Methods
Personal data is processed by the Operator using the following methods: non-automated processing of personal data; automated processing of personal data with or without transmitting the obtained information via information and telecommunications networks; mixed processing of personal data.
8.2 Actions Performed by the Operator with Personal Data
The actions performed by the Operator with personal data include: collection, systematization, accumulation, storage, clarification (updating, modification), use, transfer, anonymization, blocking, destruction, and any other actions in accordance with the current legislation of the Russian Federation.
8.3 Consent for Processing Personal Data
Personal data is processed by the Operator upon receiving the consent of the subject of personal data (hereinafter referred to as the "Consent"), except in cases established by Russian Federation law where personal data can be processed without such consent.
8.4 Voluntary Provision of Personal Data
The subject of personal data independently decides to provide their personal data and gives consent freely, at their own will, and in their own interest.
8.5 Form of Consent
Consent is given in any form that allows confirmation of its receipt. In cases specified by Russian Federation law, consent is provided in writing.
8.6 Conditions for Ceasing Personal Data Processing
The processing of personal data may cease upon achieving the objectives of personal data processing, expiration of the consent's validity, or the withdrawal of consent by the subject of personal data, as well as in cases of unlawful processing of personal data.
8.7 Withdrawal of Consent
Consent can be withdrawn by sending a written notification that contains the information specified in paragraph 4.4.3 of this Provision, directed to the Operator via registered mail or using the feedback form at https://www.rubin-kazan.ru/fans/rubin-na-svyazi/ with the subject line "Withdrawal of Consent for Personal Data Processing."
8.8 Protection of Personal DataThe Operator takes or ensures the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, and any other unlawful actions with respect to personal data.
8.9 Storage of Personal Data
Personal data is stored in a form that allows identifying the subject of personal data for a period no longer than is necessary for the purposes of processing personal data, unless the storage period is set by federal law, a contract, or the subject of personal data is a party, beneficiary, or guarantor under the contract.
8.10 Updating Personal Data
If inaccuracies are found in personal data, the user may update them independently by sending a notification to the Operator via the feedback form at https://www.rubin-kazan.ru/fans/rubin-na-svyazi/ with the subject line "Update of Personal Data."
8.11 Database Storage Location
When storing personal data, the Operator uses databases located within the territory of the Russian Federation.

9.1 The User agrees that LLC FC "Rubin" has the right to transfer personal data, including surname, first name, patronymic, year, month, date of birth, gender, email address, phone number to third parties, including courier services, postal organizations (including electronic), electronic communications operators, for the purpose of fulfilling the User's order placed on the website, including the delivery of the Product, provision of services, transfer of documentation or email messages:

• JSC "Russian Post" (125252, Moscow, municipal district of Khorohevsky, 3rd Peschanaya Street, building 2A.)
• LLC "BOXBERRY SOFT" (620100, Russia, Sverdlovsk region, Yekaterinburg, Sibirsky Trakt street, building 12, block 1, office 501)
• LLC "Information Technologies 9" (420125, Republic of Tatarstan, Kazan, Azat Abbasov street, building 23A)
• 9.2 The User agrees that LLC FC "Rubin" has the right to transfer personal data, including the unique identifier in the loyalty system, unique identifier in the mobile application, mobile phone number and/or email address, date of birth, gender, indicator of having a child, solely for the purpose of segmenting users by various characteristics:LLC "Yandex" (119021, Moscow, Lev Tolstoy Street, 16)
• LLC "Information Technologies 9" (420125, Republic of Tatarstan, Kazan, Azat Abbasov street, building 23A)
• LLC "Oktarin Processing" (420107, Republic of Tatarstan, Kazan, Ostrovsky Street, building 87, office 3015)
• LLC "QYTIKETS" (127299, Moscow, municipal district of Voykovsky, Volkov Cosmonaut Street, building 6A, room XXV, floor/room 2/11)

The Operator and other persons who have access to personal data are obliged not to disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law.

The organization and implementation of internal control over the compliance of the Operator's departments with the legislation of the Russian Federation, local regulatory acts in the field of personal data, including requirements for the protection of personal data, are ensured by the person responsible for organizing the processing of personal data at the Operator.

12.1 The User can obtain any clarifications on questions related to the processing of their personal data by contacting the Operator via the feedback form at https://www.rubin-kazan.ru/fans/rubin-na-svyazi/.
12.2 Any changes to the Personal Data Protection Policy of the web resources of LLC FC "Rubin" will be reflected in this document. The Policy remains in effect indefinitely until it is replaced with a new version.
12.3 The current version of the Policy is publicly available on the Internet at https://www.rubin-kazan.ru/.