152-FZ

Personal Data Processing Policy

GarantPlus ltd. · Yaroslavl, Russia · revision of ___ 2026

A template that requires review by a lawyer. This document follows the standard structure of Federal Law No. 152-FZ and is filled in with the company details. Before publication, verify the list of data actually collected, the list of third parties and the retention periods, set the approval date and, if required, file a notification with Roskomnadzor.

1. General provisions

This Personal Data Processing Policy (hereinafter — the Policy) has been drawn up in accordance with the requirements of Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and defines the procedure for processing personal data and the measures taken to ensure its security by GarantPlus ltd. (hereinafter — the Operator).

The Operator regards the observance of human and civil rights and freedoms when processing personal data — including the protection of the rights to privacy and to personal and family confidentiality — as the most important goal and condition of carrying out its activities.

This Policy applies to all information that the Operator may obtain about visitors of the website on which this Policy is published.

2. Information about the Operator

Full name: GarantPlus ltd.
Short name: GarantPlus ltd.
TIN (INN): 7606075014
Tax registration code (KPP): 760601001
PSRN (OGRN): 1097606004660
Registered address: 150043, Yaroslavl, 54A Chkalova St., office 205B, Russia
Actual address: 150057, Yaroslavl, 37 Slepneva St., office 12, Russia
Phone: +7 4852 593-060
Email: alvis@otx.ru
Person responsible for organizing personal-data processing: ___ (full name, position, contact)

3. Key definitions

Personal data — any information relating directly or indirectly to a specified or identifiable natural person (the personal-data subject).
Processing of personal data — any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer, depersonalization, blocking, deletion and destruction.
Operator — a legal entity that, independently or jointly with others, organizes and/or carries out the processing of personal data.
User — a visitor of the Operator's website.
Cookies — a small piece of data sent by a web server and stored on the user's device.
Depersonalization — actions that make it impossible to attribute personal data to a specific subject without using additional information.

4. Categories of personal data processed

The Operator may process the following personal data of the User:

surname, first name, patronymic;
organization name and job title;
contact phone number;
email address;
information voluntarily provided by the User in the comment field of the contact form (including the PBX brand and the approximate number of employees);
depersonalized data about website visits collected by web-analytics services (IP address, browser type and version, operating system, referral source, pages viewed, cookies).

___ Verify this list against what your forms, call tracking and analytics systems actually collect. If call recording of customer conversations is used, add it as a separate item, stating the purpose and the retention period.

The Operator does not process special categories of personal data (racial or ethnic origin, political views, religious or philosophical beliefs, health, sex life) or biometric personal data.

5. Purposes of processing personal data

handling inquiries and requests submitted via the forms on the website;
preparing a commercial proposal, cost estimate and technical solution at the User's request;
concluding and performing contracts, warranty and technical support;
informing the User about the Operator's products and services — subject to a separate consent;
improving the website and analyzing usability — on the basis of depersonalized data.

6. Legal grounds for processing

consent of the personal-data subject to the processing of their personal data (Art. 6, part 1, clause 1 of 152-FZ), expressed by ticking the box in the form on the website;
performance of a contract to which the personal-data subject is a party (Art. 6, part 1, clause 5 of 152-FZ);
federal laws and other regulatory legal acts of the Russian Federation;
the Operator's constituent and internal documents.

7. Collection, storage and destruction

The security of personal data is ensured through the implementation of legal, organizational and technical measures necessary to meet the requirements of the legislation of the Russian Federation on personal-data protection.

Personal data is stored in a form that allows the personal-data subject to be identified for no longer than the purposes of processing require, unless the retention period is established by federal law or a contract. The retention period for data received via the website forms is ___ (for example, 3 years from the date of the last contact), after which it is destroyed or depersonalized.

Databases containing the personal data of citizens of the Russian Federation are located on the territory of the Russian Federation (Art. 18, part 5 of 152-FZ).

The User may withdraw consent to the processing of personal data at any time by sending the Operator a notice to alvis@otx.ru marked “Withdrawal of consent to the processing of personal data”.

8. Transfer of personal data to third parties

The Operator does not sell or transfer personal data to third parties, except in cases expressly provided for by the legislation of the Russian Federation, and except where contractors are engaged, on confidentiality terms, to operate the website and handle inquiries:

___ hosting provider (name, TIN);
___ customer relationship management system (CRM);
___ web-analytics services;
___ telephony / call-tracking service, if used.

___ This list must be completed: transferring data to a contractor without listing it in the Policy and without a data-processing instruction is a violation of 152-FZ.

The Operator does not carry out cross-border transfer of personal data.

9. Rights of the personal-data subject

The User has the right to:

obtain information concerning the processing of their personal data;
demand the rectification, blocking or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
withdraw consent to the processing of personal data;
appeal the Operator's actions or inaction to the authorized body for the protection of the rights of personal-data subjects (Roskomnadzor) or in court.

Requests should be sent to alvis@otx.ru or to the Operator's postal address. The response time is no more than 30 days from the date the request is received.

10. Use of cookies

The website uses cookies for the correct operation of the interface and to collect depersonalized visit statistics. The User may disable the storage of cookies in their browser settings; some website features may then become unavailable.

11. Final provisions

The User may obtain any clarifications on matters of interest concerning the processing of their personal data by contacting the Operator at alvis@otx.ru.

Any changes to the Operator's personal-data processing policy will be reflected in this Policy. The Policy is effective indefinitely until replaced by a new version. The current version of the Policy is freely available at ___ (page URL).

Revision of ___ 2026