Processing of Personal Data

This NSPK JSC Policy of Personal Data Processing and Protection (hereinafter, the «Policy») determines the underlying principles, objectives, terms and methods of Personal Data Processing, lists of subjects and Personal Data processed by NSPK JSC, functions of NSPK JSC in processing of Personal Data, rights of personal data subjects, as well as efforts aimed at Personal Data protection implemented by NSPK JSC.

This Policy was written in compliance with the requirements of the Constitution of the Russian Federation, Personal Data laws, statutes and regulations of the Russian Federation.

The provisions hereof provide the basis for the drafting of internal policies and procedures governing within NSPK JSC the processing and protection of Personal Data of NSPK JSC employees and other personal data subjects whose Personal Data NSPK JSC processes. The provisions hereof are elaborated within the internal NSPK JSC documents.

NSPK JSC ensures the full observance of civil and political rights of personal data subjects when processing their Personal Data, including protecting their right to privacy, personal and family secrets.

This Policy was written in compliance with the following laws, statutes and regulations of the Russian Federation:

• Federal Law of July 27, 2006 No. 152-FZ «On Personal Data»;

• The Labour Code of the Russian Federation;

• Decree of the President of the Russian Federation No. 188 of March 6, 1997 «On Approval of the List of Confidential Information»;

• Regulation of the Government of the Russian Federation No. 687 of September 15, 2008 «On Approval of the Statute on Special Aspects of Personal Data Processing Without the Use of Automation Technology»;

• Regulation of the Government of the Russian Federation No. 1119 of November 1, 2012 «On Approval of the Requirements to Personal Data Protection in the Course of its Processing in Personal Data Information Systems»;

• Order of FSTEC of Russia No. 21 of February 18, 2013 «On Approving the List and Scope of Planning and Technical Activities for Protection of Personal Data While Processing via Personal Data Information Systems»;

• The guidelines of the Federal Security Service of the Russian Federation;

• Other statutes and regulations of the Russian Federation and statutory documents of competent public authorities.

The following terms, definitions and abbreviations are used herein:

NSPK JSC — National Payment Card System Joint-Stock Company located at: 11, Bolshaya Tatarskaya Street, Moscow, 115184.

Automated Personal Data Processing — Personal Data Processing by means of computers.

Personal Data Blocking — a temporary interruption of Personal Data Processing (except where processing is required for Personal Data update or alteration).

Cardholders — private individuals who legally use payment cards as electronic payment facilities.

Domain Name — a symbol designation for addressing sites on the Internet in order to provide access to information hosted on the Internet.

Applicants — private individuals who sent applications to NSPK JSC.

Customers of Faster Payments System Participants — private individuals who entered into a banking agreement with a Faster Payments System Participant.

Mobile Application — computer software developed by NSPK JSC and designed to run at mobile devices to provide access to NSPK JSC Web Resources, goods/works/services of NSPK JSC, Mir Payment System Participants, partners (contractors) of NSPK JSC.

Personal Data Depersonalization — actions making it impossible to identify Personal Data as belonging to a certain data subject without using additional information.

Personal Data Processing — any action or a series of actions with Personal Data with or without the use of automation facilities, including Personal Data acquisition, recording, systematization, accumulation, storage, update and alteration, extraction, use, transfer (dissemination, provision, access granting), depersonalization, blocking, deleting and annihilation.

Personal Data Operator (Operator) — a state authority, municipal authority, legal entity or private individual, who, independently or jointly, arranges and/or performs Personal Data Processing, as well as defines the objectives of Personal Data Processing, the scope of Personal Data to be processed and Personal Data Processing operations. In this Policy, the Operator shall be understood to mean NSPK JSC.

Personal Data — any information directly or indirectly related to a specified private individual (data subject).

Visitors — private individuals who are issued single-use passes to access NSPK JSC premises.

Web Visitors — private individuals who are granted access to external NSPK JSC Web Resources using a Web Browser and/or NSPK JSC Mobile Application.

Regulations on NSPK JSC Operational and Payment Clearing Services — an NSPK JSC document establishing the procedure, terms and provisions of organizing interaction and obtaining operational and payment clearing services of acquisition, processing, and submission of data on transactions with bank cards to credit institutions and the state corporation Bank for Development (VEB.RF) when performing funds transfers in the Russian Federation using international payment cards, with the exception of cross-border transfers.

Regulations on NSPK JSC Operational and Payment Clearing Services within the Faster Payments System — an NSPK JSC document establishing the procedure, terms and provisions of organizing interaction and obtaining operational and payment clearing services, including services of acquisition, processing, and submission of data to credit institutions to perform funds transfers using the Faster Payments System (FPS) of the payment system of the Bank of Russia.

Mir Payment System Regulations — – a set of documents that determines conditions of participation in the Mir Payment System, performance of funds transfers, provision of payment infrastructure services, and other provisions determined by the Mir Payment System Operator under the laws of the Russian Federation.

Loyalty Program Regulations of NSPK JSC — document (s) that define (s) the conditions of participation in the Loyalty Program, and other provisions determined by the Operator under the laws of the Russian Federation.

NSPK JSC Transport Processing Platform Rules — – document (s) that define (s) the conditions of participation in NSPK JSC transport system and other provisions determined by the Operator under the laws and regulations of the Russian Federation.

Personal Data Provision — actions aimed at disclosing Personal Data to a particular person or a specific group of people.

Personal Data Dissemination — actions aimed at disclosing Personal Data to any number of unspecified persons.

Personal Data Annihilation — actions making it impossible to restore the scope of Personal Data in the Personal Data information system and/or resulting in the elimination of tangible Personal Data media.

Cookies — a set of data stored in the Web Browser settings of a personal data subject and processed by the NSPK JSC Web Resource when a personal data subject uses such a Web Resource.

Web Browser — software used by a personal data subject to view information, including Web Resources on the Internet.

Web Resource — an NSPK JSC information system that uses data provision and transmission technologies to provide information services on the Internet.

Other terms and definitions used herein are understood in accordance with the laws of the Russian Federation, Mir Payment System Regulations, Loyalty Program Regulations of NSPK JSC, Regulations on NSPK JSC Operational and Payment Clearing Services, Regulations on NSPK JSC Operational and Payment Clearing Services Within the Faster Payments System, NSPK JSC Transport Processing Platform Rules.

NSPK JSC makes a list of Personal Data processed and subject to protection in accordance with Federal Law of July 27, 2006 No. 152-FZ «On Personal Data», other regulations, as well as internal policies and procedures of NSPK JSC, with due consideration of Personal Data Processing objectives of personal data subjects specified in Section 5 hereof, and in accordance with the notification on Personal Data Processing sent by NSPK JSC to the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor)

Information constituting Personal Data is any information directly or indirectly related to an identified or identifiable individual (personal data subject).

NSPK JSC does not process special categories of Personal Data related to race, nationality, political views, religious or philosophical beliefs, intimate life.

NSPK JSC processes the Personal Data of the following subjects:

• job applicants;

• employees, including former ones;

• interns;

• relatives of employees and interns;

• affiliated persons;

• cardholders;

• Customers of Faster Payments System Participants;

• NSPK JSC Web resources visitors;

• representatives of contractors, including the contractors of Mir Payment System, FPS;

• Visitors, including attendees of events held by NSPK JSC;

• Applicants;

NSPK JSC in its capacity of a Personal Data Operator processes Personal Data for the following purposes:

• provision of intrafacility access control within NSPK JSC;

• staff recruitment (search and review of candidates for employment), including receiving and reviewing CVs and other necessary information about the candidate, conducting the necessary checks, as well as creating and maintaining an external talent pool;

• enforcement of laws and other regulations, promotion of employment, education and professional advancement for employees, ensuring personal safety of employees, control of the scope and performance of work, and safekeeping of property;

• drafting, conclusion and execution of contracts (agreements) with counterparties, including procurement procedures, due diligence, contract (agreement) management and enforcement of terms thereof;

• provision of information and consulting services through conferences and forums, training courses and webinars;

• preparation, issuance, record keeping and revocation of Powers of Attorney for NSPK JSC employees and external organizations;

• booking of tickets, hotel stays, transfers and visa processing for employees via specialized agents;

• receipt and mailing of correspondence, workflow management (preparation, flow management, systematization of internal documents, processing of applications and feedback handling), archival storage;

• provision of services for creation and revocation of certificates of digital signature verification keys;

• preparation of incident response teams lists as part of business continuity;

• fulfillment of conditions of disclosure of mandatory and additional NSPK JSC information, internal and external communication, including press relations used for fair presentation of NSPK JSC operations;

• compliance with the laws of the Russian Federation in terms of processing of affiliates’ Personal Data;

• ensuring proper operation, click stream analysis and performance optimization of NSPK JSC Web Resources and Mobile Applications to improve the quality of operation and usability, personalization of services and offers;

• development and management of customer programs, promotions, including fulfillment of conditions of participation and operation under the Loyalty Program Regulations of NSPK JSC, organization of marketing activities and promotions, provision of personalized offers and information about the Loyalty Program, promotions, advertising and other information, including Partner information for Mir Cardholders and FPS users, information about any marketing activities and promotions for Mir Cardholders and FPS users;

• implementation of payment, record-keeping of fares and benefits on public transport and operation under the NSPK JSC Transport Processing Platform Rules, as well as provision of support on organizational, operational and technical issues to Participants, Partners;

• provision of a service allowing Mir Cardholders to access airport lounges;

• scoring;

• operating in accordance with Federal Law of June 27, 2011 No. 161-FZ «On the National Payment System», the Regulations on NSPK JSC Operational and Payment Clearing Services, the Regulations on NSPK JSC Operational and Payment Clearing Services Within the Faster Payments System and FPS OPCC Standards, the Mir Payment System Regulations and Standards, including:

• ensuring reliability, efficiency and availability of funds transfer services;

• organizational and legal arrangements for accedence to the Regulations, as well as organizational and operational support to Participants and business partners;

• handling mail, requests and other correspondence from Participants, other persons and personal data subjects;

• communication with Participants, other persons, personal data subjects, including sending responses, notifications, decisions, requests and other information related to the implementation of regulations and standards;

• improving quality of services provided by the Mir Payment System Operator, their usability and ease of development of new Mir products and services;

• resolution of disputes, exceptions and emergencies, including cases of system crashes, process failures, resolution of disputes between Participants, other persons, including disputes related to Transaction performance (non-fulfillment), including cases of fraudulent use of the card arising both between Participants and between parties involved in a Transaction;

• Personal Data comparison to confirm their accuracy and allow their verification by third parties as provided by applicable law of the Russian Federation;

• prevention of unauthorized transactions, fraudulent transactions and other mis-uses, as well as investigation thereof;

• statistical and other studies based on anonymized data;

• provision of services to Mir Payment System Participants to organize Secure Authentication for Mir Cardholders and make decisions when performing transactions on the Internet;

• provision of the mobile payments service;

• provision of services to Mir Payment System Participants to identify risks inherent in performance of funds transfers without Cardholders’ consent and other risks during merchant screening.

When processing Personal Data, NSPK JSC abides by the following principles stipulated by Federal Law of July 27, 2006 No. 152-FZ «On Personal Data»:

• Personal Data of personal data subjects is processed on a legitimate and equitable basis;

• processing of Personal Data of personal data subjects is limited to achieving specific, predetermined and legitimate purposes. processing Personal Data of personal data subjects that is incompatible with the purposes of Personal Data collection is not allowed;

• databases containing Personal Data of personal data subjects that are processed for purposes incompatible with each other must not be integrated;

• only Personal Data of personal data subjects that complies with the purposes of processing is to be processed;

• the content and scope of Personal Data of personal data subjects processed by NSPK JSC meet the declared purpose of their processing;

• when processing Personal Data of personal data subjects, accuracy, sufficiency and, if necessary, relevance of Personal Data to the purpose of Personal Data Processing is ensured;

• Personal Data of personal data subjects is stored only as long as required for purposes of Personal Data Processing, as well as stipulated by federal laws and agreements where a personal data subject acts as a party, a beneficiary or a guarantor.

NSPK JSC processes Personal Data with the consent of personal data subjects, unless otherwise provided for by the laws of the Russian Federation.

NSPK JSC does not disclose to third parties nor does it disseminate Personal Data without the consent of personal data subjects, unless otherwise provided for by the laws of the Russian Federation.

NSPK JSC is entitled to charge other persons with the Personal Data Processing with the consent of the personal data subject under an agreement with such a person. The agreement must contain a list of actions (operations) with Personal Data that will be performed by the person processing Personal Data, as well as the purposes of processing, the obligation of such a person to keep Personal Data confidential and ensure Personal Data security during processing, as well as requirements to Personal Data protection under Article 19 of Federal Law of July 27, 2006 No. 152-FZ «On Personal Data».

For purposes of internal informational support, NSPK JSC can create internal reference materials which, with the written consent of the personal data subject, unless otherwise provided for by the laws of the Russian Federation, may contain their last name, first name, patronymic, photograph, place of work, position, year and place of birth, address, customer number, email address, other Personal Data conveyed by the personal data subject.

Only authorized NSPK JSC employees may have access to Personal Data processed by NSPK JSC.

NSPK JSC collects, records, systematizes, accumulates, stores, refines (updates, alters), extracts, uses, transfers (disseminates, provides, grants access), depersonalizes, blocks, deletes and annihilates Personal Data.

NSPK JSC uses the following Personal Data Processing methods:

• non-Automated Personal Data Processing;

• Automated Personal Data Processing with or without transferring the received information via data telecommunications networks;

• mixed Personal Data Processing.

The processing terms of Personal Data of personal data subjects by NSPK JSC is set forth in the internal documents of NSPK JSC with due regard for:

• specified Personal Data Processing objectives;

• terms of contracts to which a personal data subject is a party, a beneficiary or a guarantor, and contracts executed at the initiative of a personal data subject;

• order of the Federal Archival Agency of the Russian Federation of December 20, 2019 No. 236 «On Approval of the List of Standard Administrative Archival Documents Generated in the Course of Activities of Central and Local Governments and Entities, with Their Retention Periods Specified»;

• resolution of the Federal Commission for the Securities Market No. 03-33/ps of July 16, 2003 «On Procedure and Terms of Storage of Documents of Joint Stock Companies»;

• statutes of limitations on actions;

• other statutory documents of the Russian Federation.

NSPK JSC takes the legal, technical and organizational measures provided for by the laws of the Russian Federation necessary to ensure security of processed Personal Data of personal data subjects to protect Personal Data from unlawful or accidental access, annihilation, alteration, blockage, copying, provision, dissemination, as well as other illegal actions regarding Personal Data of personal data subjects.

The security of Personal Data of personal data subjects is ensured within NSPK JSC under the laws of the Russian Federation and NSPK JSC internal policies and procedures regarding processing and protection of Personal Data, namely:

• identifying threats to the security of Personal Data of personal data subjects when processing via Personal Data information systems of NSPK JSC;

• taking organizational and technical measures to ensure security of Personal Data of personal data subjects when processing them via Personal Data information systems of NSPK JSC, necessary to comply with the requirements to Personal Data security, the execution of which ensures the levels of Personal Data protection established by the Government of the Russian Federation;

• application within NSPK JSC of information security facilities approved by FSTEC and the Federal Security Service of the Russian Federation in cases when applying such facilities is required to neutralize immediate threats to Personal Data security;

• assessing the effectiveness of measures taken to ensure the security of Personal Data prior to the commissioning of the Personal Data information system of NSPK JSC;

• stock-taking of Personal Data media;

• detecting cases of unauthorized access to Personal Data of personal data subjects and taking appropriate security measures;

• restoring Personal Data of personal data subjects modified or deleted due to unauthorized access;

• setting rules of access (including access restriction) to Personal Data of personal data subjects processed in the Personal Data information systems of NSPK JSC, as well as ensuring the registration and logging of all actions performed with Personal Data in the Personal Data information systems of NSPK JSC;

• assigning NSPK JSC officers responsible for processing and protection of Personal Data of personal data subjects by orders within NSPK JSC;

• control over measures taken to ensure Personal Data security and security levels of the Personal Data information systems of NSPK JSC.

NSPK JSC uses cookies which includes processing information about Web Visitors, necessary for correct operation of NSPK JSC Web Resources and Mobile Applications, as well as to improve the operation quality and usability of NSPK JSC Web Resources and Mobile Applications, personalize services and offers for Web Visitors.

Some of the functionality of NSPK JSC Web Resources and Mobile Applications can be used for Personal Data Provision. However, to use special features of NSPK JSC Web Resources and Mobile Applications, user data, including Personal Data, have to be provided.

By checking a box or clicking a button in the electronic acceptance form provided by the NSPK JSC Web Resource and/or Mobile Application, a personal data subject agrees to processing of their Personal Data by NSPK JSC under the conditions provided for herein.

A personal data subject does not use the NSPK JSC Web Resources and/or Mobile Applications, nor do they provide their Personal Data to NSPK JSC unless they agree with the provisions of this Section of the Policy.

NSPK JSC processes Personal Data using Web Resources and Mobile Applications under the conditions set forth in Appendix 1 hereto.

NSPK JSC, in its capacity of the Personal Data Operator, is entitled to:

• seek legal redress;

• provide third parties with Personal Data of personal data subjects, as provided for in the laws of the Russian Federation (tax authorities, law enforcement bodies etc.);

• deny the provision of Personal Data in cases provided for in the laws of the Russian Federation;

• use Personal Data of personal data subjects without their consent in cases provided for in the laws of the Russian Federation.

NSPK JSC, in its capacity of the Personal Data Operator, shall:

• provide to a personal data subject, at their request, the information provided for in Part 7, Article 14 of Federal Law of July 27, 2006 No. 152-FZ «On Personal Data»;

• explain to a personal data subject the legal implications of their refusal to provide NSPK JSC with their Personal Data and/or give consent to their Personal Data Processing, provided that such provision of Personal Data to NSPK JSC by the personal data subject and/or securing of consent to Personal Data Processing by NSPK JSC is mandatory under the Federal Law;

• if Personal Data was not obtained from a personal data subject, except as provided for in Part 4, Article 18 of Federal Law of July 27, 2006 No. 152-FZ «On Personal Data», provide the following information to a personal data subject prior to such Personal Data Processing:

1) name and address of the Operator or its representative;

2) purposes of Personal Data Processing and its legal grounds;

3) intended users of Personal Data;

4) rights of a personal data subject set forth by Federal Law of July 27, 2006 No. 152-FZ «On Personal Data»;

5) source of Personal Data.

• when collecting Personal Data of personal data subjects, including via the Internet, ensure recording, systematization, accumulation, storage, refinement (update, alteration), extraction of Personal Data of personal data subjects using databases located in the Russian Federation, with the exception of cases specified in Clauses 2, 3, 4, 8, Part 1, Article 6 of Federal Law of July 27, 2006 No. 152-FZ «On Personal Data».

NSPK JSC takes reasonable measures to maintain accuracy and relevance of the available Personal Data, as well as to delete Personal Data of personal data subjects if they are obsolete, inaccurate or redundant or if the purposes of their processing have been achieved.

A personal data subject is entitled to:

• withdraw consent to Personal Data Processing;

• require that their Personal Data be refined, blocked or deleted if such Personal Data is incomplete, obsolete, inaccurate, obtained illegally or is not necessary for the stated purpose of processing, as well as take measures provided for by law to enforce their rights;

• require a list of their Personal Data processed by NSPK JSC, and their source;

• receive information on their Personal Data Processing terms, including the storage period;

• require that all persons to whom their incorrect or incomplete Personal Data was previously conveyed be notified of all exceptions, corrections or additions made to it;

• appeal to an authorized body for defense of rights of personal data subjects or to a court against the actions or inaction in processing of their Personal Data;

• seek in court the protection of their rights and legal interests, including indemnification and/or compensation for moral harm.

Personal data subjects are liable for provision of reliable information to NSPK JSC, as well as for the timely update of the data provided in case of changes.

If a personal data subject wishes to know what Personal Data NSPK JSC holds on them, or to supplement, correct, depersonalize or delete any incomplete, inaccurate or obsolete Personal Data, or wishes for NSPK JSC to stop processing their Personal Data, or has other legal claims, they can exercise such right as and when required under the laws of the Russian Federation by contacting NSPK JSC.

In some cases (e.g., if a personal data subject wants to delete their Personal Data or interrupt their processing), such request may also mean that NSPK JSC will no longer be able to provide services to such personal data subject.

To handle requests of personal data subjects, NSPK JSC may require to establish the identity of such personal data subject and request additional information confirming their relations with NSPK JSC, or information otherwise confirming the fact of Personal Data Processing by NSPK JSC. In addition, the right of a personal data subject to access its Personal Data may be abridged in accordance with the laws of the Russian Federation on Personal Data, including if access of a personal data subject to its Personal Data breaches rights and legitimate interests of third parties.

The procedure for submitting requests by personal data subjects is specified by the requirements of Federal Law of July 27, 2006 No. 152-FZ «On Personal Data»

Namely, in accordance with the specified requirements, a request by a personal data subject for information regarding their Personal Data Processing must contain:

• series and number of the personal identity document of a personal data subject (their representative), information about the issue date of the specified document and the issuing authority;

• evidence of the personal data subject’s relations with NSPK JSC (contract number, contract date, designation and/or other information) or information otherwise confirming the fact of Personal Data Processing by NSPK JSC;

• signature of the personal data subject (their representative). If a request is sent by a representative of the personal data subject, the request must contain a document (copy of the document) confirming the authority of this representative.

A personal data subject’s request regarding refinement, annihilation of their Personal Data or termination of their Personal Data Processing, as well as withdrawal of consent to their Personal Data Processing must contain:

• identifiable information of the personal data subject;

• signature of the personal data subject (their representative). If a request is sent by a representative of the personal data subject, the request must contain a document (copy of the document) confirming the authority of this representative.

Any and all request may be sent by a personal data subject in electronic form. Such requests must be verified by a digital signature under the laws of the Russian Federation.

NSPK JSC contacts for personal data subjects’ requests:

Postal address: 11, Bolshaya Tatarskaya str., Moscow, 115184; e-mail: info@nspk.ru.

This Policy is the NSPK JSC internal document which becomes effective upon approval and is publicly accessible and subject to publication (distribution) on the NSPK JSC Web Resource with the Domain Name nspk.ru (the Russian version), nspk.com (the English version).

NSPK JSC may amend this Policy. When amending the front page of this document, the latest date of an update of the version hereof is indicated. Amendments made to this Policy become effective upon approval, unless otherwise specified by the very amendments.

The current version hereof is stored as a hard copy at the location of the NSPK JSC executive body at the address: 11, Bolshaya Tatarskaya Street, Moscow, 115184.

NSPK JSC recommends that personal data subjects regularly refer to this Policy to review the current version.

NSPK JSC processes personal data using Web resources and mobile applications under the following conditions: