Personal Data Processing Policy

APPROVED
by Order of Grainrus LLC
dated January 12, 2026 No. 4/16PD-01

1. General Provisions

1.1. This Policy has been developed in order to define the legal grounds, purposes and methods of personal data processing at Grainrus LLC, the categories and list of personal data processed and contains other provisions related to the processing and protection of personal data, in accordance with the current legislation of the Russian Federation.

1.2. For the purposes of this Policy, the terms established by Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter — Law No. 152-FZ) are used.

1.3. For the purposes of implementing this Policy, Grainrus LLC develops local regulatory acts specifying issues of personal data processing and protection.

1.4. This Policy is the basis for the development and updating by Grainrus LLC of local regulatory acts defining the policy of personal data processing therein.

2. Principles and Legal Grounds for Personal Data Processing

2.1. Personal data processing at Grainrus LLC is carried out in accordance with the principles established by Article 5 of Law No. 152-FZ.

2.2. The legal grounds for personal data processing at Grainrus LLC are:

provisions of regulatory legal acts, in execution of and in accordance with which Grainrus LLC carries out personal data processing, including the Constitution of the Russian Federation, the Labor Code of the Russian Federation, the Civil Code of the Russian Federation, the Tax Code of the Russian Federation, Federal Law No. 14-FZ dated February 8, 1998 “On Limited Liability Companies”, Federal Law No. 402-FZ dated December 6, 2011 “On Accounting”, Federal Law No. 27-FZ dated April 1, 1996 “On Individual (Personalized) Accounting in Mandatory Pension Insurance and Mandatory Social Insurance Systems”, Federal Law No. 400-FZ dated December 28, 2013 “On Insurance Pensions”, Law No. 152-FZ, Federal Law No. 149-FZ dated July 27, 2006 “On Information, Information Technologies and Information Protection”;
other regulatory legal acts of the Russian Federation and authorized public authorities;
the Charter of Grainrus LLC and local regulatory acts of Grainrus LLC;
agreements concluded between Grainrus LLC and the personal data subject or a third party, under which the personal data subject is a beneficiary or guarantor;
consents of personal data subjects to personal data processing, executed taking into account the requirements of the legislation of the Russian Federation for the relevant category of personal data.

3. Purposes of Personal Data Processing at Grainrus LLC, Categories and List of Personal Data Processed, Categories of Subjects Whose Personal Data is Processed, Methods, Terms of Their Processing and Storage, and Procedure for Destruction of Personal Data

3.1. Personal data of personal data subjects is processed at Grainrus LLC for the following purposes:

performance by Grainrus LLC of functions, powers and duties provided for by the legislation of the Russian Federation and the Charter of Grainrus LLC;
regulation of labor and other relations directly related to them with employees;
recruitment of personnel to fill positions at Grainrus LLC, formation of a personnel reserve at Grainrus LLC;
provision of additional guarantees and compensation to employees of Grainrus LLC and members of their families;
preparation, conclusion, execution and termination of a civil law contract to which Grainrus LLC is a party;
consideration of appeals from citizens of the Russian Federation and other individuals;
ensuring access control and internal facility regime at the facilities of Grainrus LLC;
coverage of the activities of Grainrus LLC on websites administered by Grainrus LLC on the Internet information and telecommunications network;
organization of socially significant and corporate events of Grainrus LLC;
formation of reference materials for internal information support of the activities of Grainrus LLC.

3.2. Depending on the tasks and functions performed by the structural divisions of Grainrus LLC, the purposes of personal data processing may be specified (including indication of additional information determining the specifics of personal data processing) by local documentation regulating personal data processing within the purposes defined by this Policy.

3.3. The categories of personal data subjects whose personal data is processed at Grainrus LLC in order to ensure the implementation of the personal data processing purposes specified in paragraph 3.1 of this Policy include:

employees of Grainrus LLC;
family members and close relatives of employees of Grainrus LLC, including insured (subject to insurance) under voluntary medical insurance contracts concluded by Grainrus LLC;
candidates for positions at Grainrus LLC;
family members and close relatives of candidates for positions at Grainrus LLC;
former employees of Grainrus LLC;
persons accepted for internship at Grainrus LLC;
individuals nominated for encouragement by Grainrus LLC;
contractors of Grainrus LLC (individuals);
representatives of contractors of Grainrus LLC (legal entities);
individuals in the chain of owners of contractors of Grainrus LLC, including beneficiaries;
persons who are members of the management bodies of Grainrus LLC and bodies controlling the financial and economic activities of Grainrus LLC (including participants of the company, ultimate beneficiaries, etc.);
individuals who are customers (participants in procurement) of goods, works, services carried out by Grainrus LLC;
participants and winners of marketing promotions, competitions and other events held by Grainrus LLC;
visitors admitted to the facilities of Grainrus LLC;
individuals sending appeals to Grainrus LLC;
users of websites administered by Grainrus LLC on the Internet information and telecommunications network;
other individuals who have provided their personal data for the purposes of their processing provided for in paragraph 3.1 of this Policy.

3.4. The categories and list of personal data processed at Grainrus LLC for each of the categories of personal data subjects specified in paragraph 3.3 of this Policy are determined in accordance with the legislation of the Russian Federation and international treaties of the Russian Federation, local regulatory acts of Grainrus LLC taking into account the purposes of personal data processing specified in paragraph 3.1 of this Policy, and include:

surname, name, patronymic (if any) (including previous surnames, names and (or) patronymics (if any) in case of their change); date and place of birth; date of death; information contained in identity documents; gender; citizenship (including citizenship of a foreign state, nationality); registration address; actual residence address; taxpayer identification number; individual personal account insurance number; information contained in military registration documents; information contained in education and qualification documents; place of work; information on the position held; address of performing the labor function remotely; data on labor activity; income information; information on inclusion in the personnel reserve; information on participation in management bodies of legal entities; information on marital status; information on family composition; information contained in award documents; information on social benefits provided in accordance with the legislation of the Russian Federation and local regulatory acts of Grainrus LLC; information on knowledge of foreign languages; information on academic degree and academic title; information on certification results; information on disciplinary sanctions; information contained in the employment contract; information on state or municipal service; information on stay abroad; other information specified in the autobiography; subscriber phone number (business, personal); email address; information on dependents; bank card account number; photograph; data generated when visiting websites administered by Grainrus LLC (cookies); other information that meets the purposes of personal data processing specified in paragraph 3.1 of this Policy and provided by the personal data subject;

personal data included in the category of “special categories of personal data” — information on the presence or absence of a criminal record; information on health status in cases provided for by the legislation of the Russian Federation.

Processing of special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, intimate life is not carried out at Grainrus LLC.

Processing of biometric personal data (information that characterizes physiological and biological features of a person, on the basis of which it is possible to establish his identity, and which is used to establish the identity of the personal data subject) is not carried out at Grainrus LLC.

Processing of personal data permitted by the personal data subject for dissemination is carried out at Grainrus LLC on the basis of the consent of the personal data subject for dissemination in compliance with the prohibitions and conditions for personal data processing established by the personal data subject.

3.5. For each purpose of personal data processing specified in paragraph 3.1 of this Policy, one of the following methods of personal data processing is used — automated, non-automated, or mixed:

automated — using computing equipment and special network directories intended for work with confidential information and (or) in personal data information systems;
non-automated — by maintaining logs, files in accordance with the file index and recording personal data on other paper carriers in accordance with documentation regulating personal data processing at Grainrus LLC;
mixed — a combination of the specified methods.

3.6. The terms of processing and storage of personal data of the categories of personal data subjects specified in paragraph 3.3 of this Policy are determined in accordance with the requirements of the legislation of the Russian Federation and local regulatory acts of Grainrus LLC regulating these issues, as well as the provisions of the contract to which the personal data subject is a party, beneficiary or guarantor, and in their absence — the consent of the personal data subject to personal data processing.

At the same time, personal data processing and storage are carried out no longer than required by the purposes of personal data processing, unless otherwise established by the legislation of the Russian Federation.

3.7. Grainrus LLC monitors the terms of personal data processing and storage.

Documents and (or) other material carriers containing personal data, as well as personal data contained in personal data information systems, file network directories or on external rewritable electronic carriers, are destroyed upon achieving the processing purposes or upon occurrence of other legal grounds:

in case of loss of necessity to achieve the purpose of personal data processing, unless otherwise established by the contract to which the personal data subject is a party, beneficiary or guarantor, and (or) other applicable regulatory legal acts of the Russian Federation;
upon detection of unlawful personal data processing;
in case of withdrawal by the personal data subject of consent to personal data processing, unless otherwise provided by the legislation of the Russian Federation;
upon expiration of the personal data processing period established when collecting personal data;
in case of an appeal from the personal data subject with a requirement to terminate personal data processing, except for cases established by Law No. 152-FZ.

The procedure and methods for destruction of personal data are determined by local regulatory acts of Grainrus LLC in the field of personal data and confidential records management depending on the methods of personal data processing and material carriers on which personal data is recorded and stored.

4. Conditions and Procedure for Personal Data Processing at Grainrus LLC

4.1. Personal data processing at Grainrus LLC is allowed in cases established by Article 6 of Law No. 152-FZ.

4.2. Grainrus LLC does not disclose personal data to third parties and does not disseminate personal data without the consent of the personal data subject, unless otherwise provided by Law No. 152-FZ.

4.3. Grainrus LLC has the right to entrust personal data processing to another person with the consent of the personal data subject on the basis of a contract concluded with this person in accordance with the requirements of Part 3 of Article 6 of Law No. 152-FZ.

4.4. For the purposes of internal information support, directories and other sources may be created at Grainrus LLC, into which, with the written consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation, his personal data may be included.

4.5. Access to personal data processed at Grainrus LLC is allowed only to persons included in the list of persons admitted to personal data processing established by local documentation of Grainrus LLC (hereinafter — the List).

4.6. Transfer of personal data of employees of Grainrus LLC and other subjects whose personal data is processed at Grainrus LLC to third parties is allowed with the written consent of these personal data subjects, except for cases when this is necessary in order to prevent a threat to the life and health of personal data subjects, as well as in other cases provided for by the Labor Code of the Russian Federation and other federal laws.

4.7. Grainrus LLC has the right to carry out cross-border transfer of personal data in accordance with the requirements of Law No. 152-FZ and international treaties of the Russian Federation, on the grounds established by local documentation regulating personal data processing and within the purposes defined by this Policy.

5. Rights of Personal Data Subjects

The rights of personal data subjects are determined by the current legislation of the Russian Federation and include the right to:

receive information about their personal data processed at Grainrus LLC in the amount of information provided for by Article 14 of Law No. 152-FZ. A personal data subject may send an appeal to Grainrus LLC in writing to the postal address: 119048, Moscow, Uchebny lane, 4 bld.1, or by email to request@grainrus.com in the manner provided for by Law No. 152-FZ;
access their personal data processed at Grainrus LLC, except for cases provided for by Law No. 152-FZ;
clarify their personal data processed at Grainrus LLC, block or destroy them if the personal data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
withdraw consent to personal data processing provided to Grainrus LLC;
take measures provided by law to protect their rights;
appeal the action or inaction of Grainrus LLC carried out in violation of the requirements of the legislation of the Russian Federation in the field of personal data to the authorized body for the protection of the rights of personal data subjects or to the court;
send a requirement to Grainrus LLC to stop the transfer (dissemination, provision, access) of their personal data previously permitted by the personal data subject for dissemination;
exercise other rights provided for by the legislation of the Russian Federation.

6. Measures Taken by Grainrus LLC to Ensure Fulfillment of the Operator’s Duties in Personal Data Processing

6.1. Grainrus LLC takes necessary and sufficient measures aimed at ensuring fulfillment of the operator’s duties provided for by the legislation of the Russian Federation in the field of personal data, which include:

appointment of a person responsible for organizing personal data processing at Grainrus LLC;
issuance of local regulatory acts in the field of personal data processing and protection;
publication of this Policy on websites administered by Grainrus LLC on the Internet information and telecommunications network, including on pages of websites through which personal data is collected;
obtaining consents of personal data subjects to personal data processing, except for cases provided for by the legislation of the Russian Federation;
providing personal data subjects or their representatives with information on the availability of personal data relating to the relevant subjects, providing the opportunity to familiarize themselves with this personal data upon appeal and (or) receipt of requests from these personal data subjects or their representatives, unless otherwise established by the legislation of the Russian Federation;
carrying out internal control over compliance of personal data processing with the provisions of Law No. 152-FZ and regulatory legal acts adopted in accordance with it, requirements for personal data protection, this Policy, local regulatory acts of Grainrus LLC;
conducting an assessment of the harm that may be caused to personal data subjects in case of violation of the legislation of the Russian Federation on personal data, as well as the ratio of this harm and the measures taken by Grainrus LLC aimed at ensuring fulfillment of duties provided for by the legislation of the Russian Federation in the field of personal data;
organization of training and methodological work with employees of Grainrus LLC whose positions are included in the List;
separation of personal data processed without the use of automation from other information, in particular by recording them on separate material carriers of personal data, in special sections or on fields of forms (blanks);
ensuring separate storage of personal data and their material carriers, the processing of which is carried out for different purposes and which contain different categories of personal data;
ensuring the security of personal data when transmitting them via open communication channels;
storage of material carriers of personal data in compliance with conditions ensuring the safety of personal data and excluding unauthorized access to them;
termination of personal data processing and destruction of personal data in cases provided for by the legislation of the Russian Federation in the field of personal data;
other measures provided for by the legislation of the Russian Federation in the field of personal data.

6.2. Measures to ensure the security of personal data during their processing in personal data information systems are established in accordance with local regulatory acts of Grainrus LLC regulating issues of ensuring the security of personal data during their processing in personal data information systems of Grainrus LLC.

7. Internal Control of Compliance of Personal Data Processing with Law No. 152-FZ, Regulatory Legal Acts, Personal Data Protection Requirements, This Policy and Local Regulatory Acts of Grainrus LLC

7.1. Internal control of compliance of personal data processing with the provisions of Law No. 152-FZ and regulatory legal acts adopted in accordance with it, personal data protection requirements, this Policy and local regulatory acts of Grainrus LLC is carried out by the person responsible for organizing personal data processing at Grainrus LLC in the manner determined by local regulatory acts of Grainrus LLC in the field of personal data.

7.2. Persons guilty of violating the provisions of the legislation of the Russian Federation and local regulatory acts of Grainrus LLC in the field of personal data bear disciplinary, administrative, civil and criminal liability in accordance with the legislation of the Russian Federation.