Personal data processing policy

1. The Operator has developed this Policy in order to:

   1. protect the rights and freedoms of the User in the course of processing their Personal data;
   2. strictly and consistently comply with the applicable «Personal data» legislation.
2. The Operator processes Personal data:

   • on the basis of consent to the processing of personal data given through Service forms;
   • on the basis of consent to marketing communications given through a Service form;
   • using technologies, web protocols, «cookie» files and web beacons.

The Operator processes Personal data for the following purposes:

1. The Personal data processed by the Operator is neither biometric nor falls into any special categories of Personal data.
2. List of Personal data processed by the Operator:

   Purpose	Personal data	Processing period
   Sending newsletters	name; email address	until consent is withdrawn or the Service is discontinued
   AdStreamer SSP pricing consultation	email address	until consent is withdrawn or the Service is discontinued
   Registration in the AdStreamer SSP account	email address	until access rights end or consent is withdrawn
   Support of the AdStreamer SSP account	email address	until access rights end or consent is withdrawn

1. Processing includes collection, recording, systematisation, accumulation, storage, refinement (updating, modification), extraction, use, transfer (distribution, provision, access), blocking, deletion and destruction.
2. Collection of Personal data. The Operator collects Personal data:

   1. through Service forms filled in by the User;
   2. by means of communication channels, including telephone, email and messengers;
   3. automatically via technologies, web protocols, «cookie» files and web beacons that are activated only when the User enters their data.
3. Storage of Personal data. The Operator stores Personal data:

   1. exclusively on properly secured electronic media;
   2. using databases;
   3. within the Service using automated processing, except where non-automated processing is required to comply with the law;
   4. for the period specified in clause 3.2 of the Policy for all processing purposes.
4. Access to Personal data. The Operator grants access to Personal data only to its authorised employees.
5. The Operator does not distribute or share Users’ Personal data with third parties without their written consent, except in the following cases:

   1. when transferring data to separate, independently operating applications and databases that are part of the Service;
   2. to prevent or stop unlawful actions by the User and to protect the legitimate interests of the Operator and third parties, as well as in cases provided for by law;
   3. upon a justified request from courts, state security bodies, the prosecutor’s office, police or investigative authorities in cases provided for by regulatory acts.
6. The Operator updates Personal data if their inaccuracy is confirmed.
7. The Operator destroys Personal data in the following cases:

   1. when there is a threat to the security of the Service;
   2. when the Personal data retention period has expired;
   3. when the purposes of Personal data processing have been achieved;
   4. upon the User’s request.
8. The Operator deletes all information received from the User if the User withdraws their consent to Processing. From that moment the right to use the Service terminates.
9. The Operator destroys Personal data by formatting the storage medium so the data cannot be recovered.

1. The User has the following rights:

   Right	Description
   Access to Personal data	The User has the right to request a copy of the personal data held by the Operator.
   Updating Personal data	The User may ask the Operator to correct inaccurate or incomplete Personal data.
   Withdrawal of consent	The User may withdraw their consent to Processing at any time.
   Deletion of Personal data	The User may request deletion of their data, except where the Operator is required by law to retain it.
   Appeal	The User may appeal against the Operator’s actions or inaction.
   Requests	The User has the right to send the Operator a request for information about Processing. All requests are submitted in the manner provided for by this Policy.

2. The User warrants that:

   1. the Personal data provided is accurate, up to date and does not violate any laws;
   2. if the Personal data provided relates to a third party — consent from that third party has been obtained for the transfer of their Personal data to the Operator for Processing.

1. The Operator is obliged to:

   1. provide, upon the User’s request, information about Processing or a reasoned refusal;
   2. take measures necessary and sufficient to fulfil the obligations established by law;
   3. at the User’s request, update, block or delete the processed Personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed for the stated purpose of Processing;
   4. ensure the lawfulness of Processing. If the lawfulness of Processing cannot be ensured, the Operator is obliged, within a period not exceeding 10 business days from the date when the unlawful Processing was identified, to destroy or arrange for the destruction of the Personal data;
   5. within a period not exceeding 30 days from the date the User withdrew their consent, stop Processing and destroy the Personal data if its retention is no longer required for Processing purposes. An exception applies when Processing may be continued in accordance with the law.

1. The Operator ensures the implementation of the legal, organisational and technical measures necessary and sufficient to protect Personal data.
2. Legal measures include, but are not limited to:

   1. the Operator’s development of internal documents implementing the requirements of Russian law, including this Policy, and its publication on the Service;
   2. refusal to use any Processing methods that do not match the purposes pre-defined by the Operator.
3. Organisational measures include:

   1. appointing a person responsible for organising Processing;
   2. periodic assessment of risks related to the Processing process;
   3. conducting periodic audits to internally verify that Processing complies with the law.
4. Technical measures:

   1. preventing, including through internal investigations, any unauthorised access to systems where Personal data is stored;
   2. backing up and restoring Personal data and the operability of technical means, software and information protection tools in Personal data information systems;
   3. other necessary security measures.

1. The User or their representative may send the Operator any inquiries or requests, including those regarding Processing, or withdraw consent to Processing, in the form of an electronic document, by emailing: informer@adstreamer.net.
2. The request must contain the following information:

   1. information confirming the User’s relationship with the Operator — email address;
   2. details of the representative and proof of their authority if the request is made by the User’s representative;
   3. the signature of the User or their representative.
3. The Operator will review and respond to the request within 10 business days from the date the request is received.
4. All correspondence received by the Operator, including inquiries in written or electronic form, is considered restricted-access information and is not disclosed without the User’s written consent.

1. This Policy applies exclusively to the Service and does not apply to other internet resources.
2. The Policy applies to all Personal data received by the Operator.
3. The Operator is not liable for the actions of third parties that obtained access to Personal data due to the User’s fault.
4. The Operator does not verify:

   • the legal capacity of the User;
   • the accuracy of the submitted Personal data.