Personal Data Processing Policy

1. General Provisions

This Personal Data Processing Policy (hereinafter – the Policy) is drawn up in accordance with Federal Law No. 152‑FZ of 27 July 2006 “On Personal Data” (the “Personal Data Law”) and defines the procedure for processing personal data and the measures taken by AP Trade Group (hereinafter – the Operator) to ensure the security of personal data.

1.1. The Operator's primary goal and condition for carrying out its activities is to respect the rights and freedoms of every individual when processing their personal data, including the right to privacy, personal and family secrets.

1.2. This Policy applies to all information that the Operator may obtain about visitors to the website https://aptrade.ru/.

2. Definitions Used in the Policy

2.1. Automated Processing of Personal Data — processing of personal data using computer technology.

2.2. Blocking of Personal Data — temporary cessation of the processing of personal data (except where processing is necessary to clarify personal data).

2.3. Website — a collection of graphic and information materials as well as software and databases that ensure their availability on the Internet at https://aptrade.ru/.

2.4. Personal Data Information System — a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

2.5. Depersonalisation of Personal Data — actions that make it impossible, without additional information, to identify the personal data as belonging to a specific User or other personal data subject.

2.6. Processing of Personal Data — any action (operation) or set of actions performed with personal data, whether using automation tools or not, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion, and destruction of personal data.

2.7. Operator — a state or municipal body, legal entity or individual which, independently or jointly with others, organises and/or carries out the processing of personal data, and also determines the purposes of personal data processing, the composition of personal data to be processed, and the actions performed with personal data.

2.8. Personal Data — any information relating directly or indirectly to a specific or identifiable User of the website https://aptrade.ru/.

2.9. Personal Data Made Public by the Data Subject — personal data to which an unlimited number of persons are granted access by the data subject by giving consent to the processing of personal data for dissemination, in the manner prescribed by the Personal Data Law (hereinafter – "public personal data").

2.10. User — any visitor to the website https://aptrade.ru/.

2.11. Provision of Personal Data — actions aimed at disclosing personal data to a specific person or group of persons.

2.12. Dissemination of Personal Data — any actions aimed at disclosing personal data to an indefinite circle of persons (transfer of personal data) or at making personal data available to an unlimited number of persons, including publication in the media, posting on information and telecommunication networks, or providing access in any other way.

2.13. Cross‑Border Transfer of Personal Data — transfer of personal data to the territory of a foreign state, to a foreign state authority, foreign individual or foreign legal entity.

2.14. Destruction of Personal Data — any actions resulting in the irreversible destruction of personal data with no possibility of further recovery of their content in the personal data information system and/or in the destruction of tangible media containing personal data.

3. Main Rights and Obligations of the Operator

3.1. The Operator has the right to:

— receive from the personal data subject reliable information and/or documents containing personal data;

— if the personal data subject withdraws consent or requests termination of processing, continue processing personal data without consent where permitted by the Personal Data Law;

— independently determine the composition and list of measures necessary and sufficient to ensure fulfilment of the obligations stipulated by the Personal Data Law and related regulations, unless otherwise provided by federal law.

3.2. The Operator must:

— provide the personal data subject, upon request, with information concerning the processing of their personal data;

— organise personal data processing in accordance with current Russian legislation;

— respond to requests from personal data subjects or their legal representatives in accordance with the Personal Data Law;

— provide the authorised personal data protection authority, upon request, with necessary information within ten days of receiving such request;

— publish or otherwise ensure unrestricted access to this Policy;

— take legal, organisational, and technical measures to protect personal data from unauthorised or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and any other unlawful actions;

— cease transfer, processing, and destroy personal data in the cases provided for by the Personal Data Law;

— in case of unlawful or accidental disclosure of personal data resulting in violation of Users' rights, notify the authorised body within 24 hours and take other measures prescribed by law;

— perform other duties stipulated by the Personal Data Law.

4. Main Rights and Obligations of Personal Data Subjects

4.1. Personal data subjects have the right to:

— obtain information concerning the processing of their personal data, except as provided by federal laws;

— request that the Operator clarify, block, or destroy personal data that are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose;

— require prior consent for processing personal data for marketing goods, works, or services;

— withdraw consent to the processing of personal data;

— appeal unlawful actions or omissions of the Operator to the authorised body or in court;

— exercise other rights provided for by Russian law.

4.2. Personal data subjects must:

— provide the Operator with accurate data about themselves;

— notify the Operator of any clarification (updating, modification) of their personal data.

4.3. Persons who provide inaccurate information about themselves or another personal data subject without their consent bear responsibility in accordance with Russian law.

5. Principles of Personal Data Processing

5.1. Personal data shall be processed on a lawful and fair basis.

5.2. Processing of personal data is limited to achieving specific, pre‑defined, and lawful purposes. Processing incompatible with the purposes of data collection is not permitted.

5.3. It is not permitted to combine databases containing personal data processed for incompatible purposes.

5.4. Only personal data that meet the purposes of their processing are subject to processing.

5.5. The content and scope of processed personal data must correspond to the stated purposes. Excessive processing of personal data in relation to the stated purposes is not permitted.

5.6. Accuracy, sufficiency, and, where necessary, relevance of personal data shall be ensured during processing. The Operator takes measures to delete or clarify incomplete or inaccurate data.

5.7. Personal data are stored in a form that allows identification of the data subject for no longer than required by the processing purposes, unless a longer period is prescribed by federal law or contract. Upon achieving the processing purposes, data are destroyed or depersonalised.

6. Purposes of Personal Data Processing

6.1. Purpose: conclusion, execution and termination of civil law contracts. Personal data: full name, phone numbers. Categories: individuals (customers). Legal basis: charter, contract, Civil Code of the Russian Federation, Federal Law No. 149‑FZ, subject's consent. Processing types: collection, recording, storage, etc. Methods: mixed. Period: until goal achieved or consent withdrawn. Storage: secured. Destruction: permanent and irreversible.

6.2. Purpose: marketing research. Same data, categories, legal bases, processing types, methods, storage and destruction conditions as in 6.1.

6.3. Purpose: provide access to site services/materials. Data: name, phone, email. Categories: registered/unregistered users. Legal basis, processing types, methods, storage — same as above.

6.4. Purpose: collect statistics via Yandex Metrica. Data: cookies, IP, clicks, country, browser, etc. Category: all visitors. Conditions same as 6.1. Additional: possible transfer to Yandex; opt-out available via browser settings or plugin.

7. Conditions for Processing Personal Data

7.1. Processing of personal data is carried out with the consent of the subject of personal data.

7.2. Processing is necessary to achieve the purposes provided by international treaties or Russian law, or to carry out functions and duties assigned by legislation.

7.3. Processing is required for the administration of justice or execution of a judicial act or an act of another authority or official under Russian enforcement law.

7.4. Processing is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, or for the conclusion of such a contract at the initiative of the data subject.

7.5. Processing is necessary for the legitimate interests of the operator or third parties, or for the achievement of socially significant goals, provided that the rights and freedoms of the data subject are not violated.

7.6. Processing is carried out on personal data made publicly available by the subject or at their request (hereinafter – publicly available personal data).

7.7. Processing is carried out on personal data subject to publication or mandatory disclosure under federal law.

8. Procedure for the Collection, Storage, Transfer, and Other Types of Personal Data Processing

8.1. Security is ensured through legal, organisational and technical measures.

8.2. Data is not shared with third parties unless required by law or contract.

8.3. Cookies and web analytics (Yandex Metrica) are used; consent is given upon first visit.

8.4. Users can send a notification to update their data via email.

8.5. Storage period — until the goal is reached, unless otherwise stipulated.

8.6. Third-party services (e.g. payment systems) bear their own responsibility.

8.7–8.10. Confidentiality is maintained, access restricted, and processing ends upon goal completion or consent withdrawal.

9. List of Actions Performed on Personal Data

9.1. Collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, depersonalisation, blocking, deletion, destruction.

9.2. Automated processing with or without network transfer.

10. Cross-Border Transfer of Personal Data

10.1. Prior to transfer — notification to Roskomnadzor.

10.2. Operator must obtain data from the foreign party before transfer.

11. Confidentiality of Personal Data

Operator and other persons with access to data must not disclose it without the subject's consent, unless otherwise provided by law.

12. Final Provisions

12.1. User may request clarification via the email ap@aptrade.ru.

12.2. Changes to this Policy will be reflected in this document. The current version is available online.

12.3. The Policy is valid indefinitely until replaced with a new version.