Personal Data Privacy Policy of Open Joint Stock Company “Hlebprom”

I. Why this Policy was developed and adopted:

This Personal Data Privacy Policy (hereinafter referred to as the Policy) has been developed in compliance with the requirements of clause 2 of part 1 of article 18.1 of Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 (hereinafter referred to as the Personal Data Law).

This Policy uses the terms and definitions set out in Appendix No. 1.

The Policy is a public document and, in compliance with the requirements of the Personal Data Law, is published in the public domain on the Websites (the list of the Company's current websites is set out in Appendix No. 2, hereinafter referred to as the Websites).

II. The scope of this Policy:

We store, protect and process in accordance with this Policy all information that you provide to us on our Websites (the list of the Company's current websites is attached in Appendix No. 2), as well as via the hotline and email indicated on the Company's Websites.

III. The purpose of this Policy:

We respect the privacy of individuals and value our consumers, therefore, when using our websites, we store, protect and process your Personal Information in strict accordance with Russian legislation.
In this regard, this Policy has been adopted to clarify the following objectives:
1. Why and how we process your Personal Information;
2. What tools you can use to reduce the amount of Personal Information the Company collects about you;
3. What are your rights and obligations in relation to the processing of Personal Information;
4. What are the Company's responsibilities under this Policy.

IV. Who processes your Personal Information:

Company (Operator): Hlebprom OJSC, OGRN (Primary State Registration Number): 1027402543728; INN (Taxpayer Identification Number): 7448027569, Location: 454014, Chelyabinsk region, Chelyabinsk, Molodogvardeytsev Str., 2A.

V. What Personal Information the Company processes:

The Company may collect the following categories of Personal Information about you when you use our websites:

1. Personal Information that can only be provided by you: First name, last name, patronymic, telephone number, email (address).

2. Electronic data (HTTP headers, IP address, cookies, web beacons (pixel tags), browser ID data, hardware and software information, Wi-Fi network data), geolocation information, and the date and time of access to the websites.

3. Information about your activity on our Websites (for example, the history of search queries for the company's products).

4. Other information about you that is necessary for processing in accordance with the terms and conditions governing the use of specific Websites or Yandex Services.

The operator uses the following web analysis tools: Yandex Metrica.

VI. What purposes we pursue by processing your Personal Information:

The content and volume of the personal data to be processed comply with the below-mentioned objectives of processing. We do not collect data for the purpose of user profiling to the extent that it may significantly affect your rights and freedoms. We also do not purposefully collect sensitive personal information (such as racial origin, political views, health information). We may not process your Personal Information without sufficient legal grounds to do so.

Accordingly, the Company processes your Personal Information only for the following purposes:

VII. How we protect your Personal Information:

In most cases, your Personal Information is processed automatically without access to it by any of the Company's employees.
In cases where your Personal Information must be provided to employees of the Company who need it to perform their tasks, such access is provided strictly in accordance with the purposes specified in Section VI of this Policy.
To protect and ensure the confidentiality of data, all Company employees comply with internal rules and procedures regarding the processing of Personal Information and follow all technical and organizational security measures that apply to the protection of your Personal Information.
The Company has implemented sufficient technical and organizational measures to protect Personal Information from unauthorized, accidental or illegal disclosure or access, loss, alteration, unfair use, destruction as well as other illegal forms of processing. These security measures were implemented in compliance with the current technological level, the cost of their implementation, the risks associated with the processing and nature of Personal Information.

VIII. Who we may share your Personal Information with:

For the purposes of the Company fulfilling its obligations under the user agreement, to improve the convenience of your use of the Website (only for the purposes set out in this paragraph), your Personal Information may be transferred, with your consent, to third parties, including YANDEX LLC, which provides the Yandex Metrica web analytics service.

Law enforcement agencies in order to ensure the protection of the rights and legitimate interests of the Company in cases where you violate the functional operation of the Websites by gaining illegal access.

IX. What is meant by the processing of Personal Information, where your Personal Information is stored and processed:

Your Personal Information processing includes, inter alia: collection; recording; systematization; accumulation; storage; clarification (updating, modification); extraction; use; transfer (distribution, provision, access); depersonalization; blocking; deletion; destruction.

The operator does not carry out cross-border transfer of personal data. The database containing your personal information is located in the territory of the Russian Federation.

X. How long we retain your Personal Information:

We will store your Personal Information for as long as necessary to achieve the purpose for which it was collected, or to comply with the requirements of legislation and regulations.
If you wish to have any of your Personal Information removed from our database, you may contact the Company in writing (at the address specified in Section IV).
Your Personal Information shall be destroyed or depersonalized upon achievement of the processing goals or in case of loss of the need to achieve these goals, unless otherwise provided for by the federal law.

XI. Your rights and the procedure for providing your consent to this Policy:
You have the right:
1. to review the information that our Company stores about you;
2. to request the deletion of your Personal Information or part of it, and to revoke consent to the processing of your personal information (the procedure is specified below);
3. if you believe that any information that our Company stores about you is incorrect or incomplete, you can report this and the Company itself will correct your Personal Information.
In cases provided for by Russian legislation, you may also have other rights not specified above.
The Company may use the Personal Information provided by you only in cases where you agree with this provision, as well as with this Company Policy.

Your consent can be obtained in two ways:
1. In oral form, for example, when communicating via telephone, email addresses.
2. In electronic form by continuing to use the Website and checking the box or a similar button on the relevant Company Website, for example, the “Understood” button (the text of your Consent is attached in Appendix No. 3).

XII. The procedure for revoking consent to the processing and deletion of your personal information:

To revoke your consent to the processing of personal information and delete personal information, please contact us in the following ways:
— in writing with a corresponding request to Hlebprom OJSC at the address: 454014, Chelyabinsk, Molodogvardeytsev Str., 2A or 127254, Moscow, Rustaveli Str., 14, building 6;
— by sending a message to the e-mail address indicated on the Websites (hotline@hlebprom.ru).
If you send a written request, you must indicate: information confirming your registration on the Website (if any), as well as information confirming the fact that Hlebprom OJSC is processing your Personal Information so that we can identify you, satisfy your withdrawal of consent to the processing of personal information and delete all information.

XIII. ADDITIONAL TERMS AND CONDITIONS

We do not check the accuracy of the Personal Information you provide. In our activities, we assume that you provide accurate and sufficient personal data and keep this information up to date.
You personally bear full responsibility for the consequences of providing false or invalid personal data.
We may make changes to this Policy at our discretion, including, but not limited to, in cases where the relevant changes are related to changes in legislation, as well as when the relevant changes are related to changes in the operation of the Websites.
We undertake not to make material changes, impose additional encumbrances or restrictions on your rights established by this Policy, without notifying you thereof. In such case, you will be additionally informed of such changes by means of a corresponding notice on the Websites (for example, via a pop-up window or banner) before such changes come into effect, or such notice may be sent to you via other communication channels (for example, by e-mail if you have provided us with your contact information).
The new version of the Policy is published online on each of the Websites (see Appendix No. 2 to the Policy).
All suggestions or questions regarding this Policy in respect to the processing of personal data should be communicated in the feedback form on the website www.hlebprom.ru or by phone number and email address indicated on the Websites.



Appendix No. 1 to the Personal Data Privacy Policy of Open Joint Stock Company “Hlebprom”

Terms and Definitions

1. Automated processing of personal data — processing of personal data using computer technology;
2. Biometric personal data — information that characterizes the physiological and biological characteristics of a person, on the basis of which his or her identity can be established;
3. Blocking of personal data — temporary cessation of processing of personal data (except in cases where processing is necessary to clarify personal data);
4. Personal data information system — a set of personal data contained in databases and the information technologies and technical means that ensure their processing;
5. Depersonalization of personal data — actions as a result of which it is impossible to determine without the use of additional information the ownership of personal data by a specific Subject of personal data;
6. Operator — a person who, independently or jointly with other persons, organizes and (or) carries out the processing of personal data.
7. Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
8. Personal Data/Personal Information:

8.1. any information relating directly or indirectly to a specific or determinable Subject (User) of personal data, which such Subject provides about itself in the process of using the Websites and its services, including the personal data of the User (information required for the provision of Services is marked in a special way), other information is provided by the User at his-her discretion;

8.2. data that is automatically transferred to the Website services during their use with the help of software installed on the User’s device, including the IP address, cookie data, information about the User’s browser (or other program used to access the services), technical characteristics of the equipment and software used by the User, date and time of access to the services, addresses of requested pages and other similar information;

8.3. other information about the User, the processing of which is provided for by the Agreement on the Use of the Website or determined by current legislation.

9. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons;
10. Distribution of personal data — any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or familiarizing an unlimited number of persons with personal data, including disclosure of personal data in the media, posting on information and telecommunications networks or providing access to personal data in any other way;
11. Subject of personal data (Subject/User) — an individual to whom the relevant personal data relates, a visitor to the Company's Website.
12. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to a government body of a foreign state, foreign individual or foreign legal entity;
13. Destruction of personal data — any actions as a result of which personal data are destroyed irrevocably with the impossibility of further restoration of the content of personal data in the personal data information system and (or) as a result of which tangible media of personal data are destroyed.
14. Cookies – a small piece of data sent by a web server that is received and processed by the device you use to access the Websites. Cookies store and send back to the Websites information that helps you work with the Websites and allows us to remember your preferences over time, such as browser settings, what language you prefer to view the Website in, which will be useful the next time you visit the Operator's Websites or to recognize your account. Cookies can be disabled in your browser settings. By continuing to use the Website without changing your settings, you agree to the use of your cookies.

15. IP address – in the scope of this Privacy Policy, a unique network address of a node in a computer network that uses the IP protocol.

Appendix No. 2 to the Personal Data Privacy Policy of Open Joint Stock Company "Hlebprom"

Websites, services through which the Operator can collect personal data in the process of their use by Subjects.

1. Corporate website of Hlebprom OJSC — www.hlebprom.ru
2. Website of the Dr. Korner Company brand — https://drkorner.ru
3. Website of the BAKERTON Company brand — www.bakerton.ru

hereinafter collectively and/or individually (in relation to the relevant website) – the “Website”.