Personal data processing policy

1.1. This Personal Data Processing Policy (hereinafter referred to as the Policy) adopted by Grotex LLC (PSRN 1107847033535, TIN 7814459396, legal address: Russia, 195279, St. Petersburg, Industrial ave., d. 71, bldg. 2, lit. A) (hereinafter referred to as Grotex), defines the basic principles, objectives, procedure and conditions for processing personal data of subjects, measures to ensure the security and protection of personal data.

1.2. This Policy has been developed in accordance with the requirements of the Constitution of the Russian Federation, on based on the requirements of the Federal Law of the Russian Federation dated July 27, 2006 No. 152-FZ “On personal data” and other legislative and regulatory legal acts of the Russian Federation in the field of personal data and published for unlimited access on the Grotex website at: www.solopharm.com.

1.3. When processing personal data, Grotex proceeds from the need to ensure the protection of rights and freedoms person and citizen in accordance with the requirements of the legislation of the Russian Federation, guarantees maintaining confidentiality in relation to the received personal data, subject to the provisions of this Policy and undertakes to use them only for the purposes specified in the Policy.

1.4. Compliance with the Policy is the main condition for the processing of personal data and is mandatory for everyone Grotex employees.

1.5. The policy is aimed at ensuring the protection of the rights and freedoms of man and citizen when processing it personal data, including the protection of the rights to privacy, personal and family a secret determination of the policy of Grotex as an operator regarding the processing of personal data. Policy governs relations between Grotex and citizens arising from the processing of their personal data by Grotex using automation tools or without the use of such tools.

2. TERMS AND DEFINITIONS, COMPOSITION OF PERSONAL DATA

2.1. The terms and definitions used in the Policy are interpreted in accordance with the Federal Law dated 07/27/2006 No. 152-FZ "On Personal Data" (hereinafter - the Federal Law "On Personal Data") and other regulatory legal acts of the Russian Federation.

2.2. Personal data - any information relating directly or indirectly to a specific or defined to an individual (subject of personal data) (hereinafter referred to as PD).

PD and their categories may differ in the degree of certainty and definability of the subject of PD and depend on the actual possibility of determining on their basis a specific person and citizen (subject).

Data that does not identify the identity of a person and a citizen, or does not allow to determine such a personality even With the application of any procedures are not PD, and their processing is not related to the need to comply legislation of the Russian Federation on PD. This information may include information such as gender, age, position, profession, hobby, etc., and information that appears in connection with the widespread penetration the Internet into everyday life, as long as such information does not allow identification person and citizen.

2.3. Processing of personal data (hereinafter referred to as PD processing) - any action (operation) or set actions (operations) performed with the use of automation tools or without the use of such funds with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

2.4. Operator - a state or municipal body, a legal entity or an individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data. For the purposes of the Policy, Grotex is the operator.

2.5. PD subjects are certain or identifiable (determinable) individuals. Grotex performs the processing and protection of personal data (including last name, first name,nature, date of birth, place work, profession, position, contact phone number, e-mail address, etc.) of customers and contractors Grotex, consumers of goods produced and supplied by Grotex, participants in events held Grotex, employees of counterparties, employees of potential counterparties, visitors to the Grotex website(s), A also personal data received by the Grotex corporate mail address ending with @grotexmed.com (hereinafter referred to as Corporate Mail), entities that have expressed their consent to the processing personal data (hereinafter - Consent) by sending information through the selected forms on the pages of the Site, departures e-mail, filling out the consent in writing. The moment of acceptance of Consent is marking the corresponding field in the Form and clicking on the submit button of the Form on any page of the Site, as well as clicking on a button to send an e-mail containing the personal data of the subject to the address of the Corporate mail, obtaining written consent.

2.6. While using the Grotex website, reading texts and downloading other information, automatic registration of certain data about the computer from which the site visitor is browsing website Grotex. When using the website, Grotex collects the following information:

• date and time of site visit;
• the number of pages visited, their names, and the duration of viewing;
• IP address assigned to the device to access the Internet;
• type of browser and operating system;
• URL of the site from which the transition was made.

3.1. Grotex processes PD for the purpose of manufacturing pharmaceutical products, chemical products, carrying out activities in the wholesale trade of pharmaceutical and medical products, trade and purchasing and trade and intermediary activities, including in the foreign market, as well as in the domestic market, holding marketing analysis and research, implementation of marketing and advertising activities, implementation scientific research and development in the field of natural (chemical, biological, medical, pharmaceutical) sciences, and other activities provided for by the Charter of Grotex, quality improvement activities, fulfillment of the requirements of the legislation of the Russian Federation, implementation of contractual, civil law relations with individuals in accordance with the Civil Code of the Russian Federation, conducting statistical and other research.

3.2. When receiving PD from individuals specified in this Policy and starting their processing, Grotex becomes operator. PD processing is carried out by Grotex in compliance with the principles, conditions and rules, envisaged PD legislation, as well as in accordance with this Policy in the following main cases:

3.2.1. The processing of personal data is carried out with the consent of the subject of the PD to the processing of his PD. For inclusion any PD to publicly available sources of PD and / or transfer of PD to third parties, it is necessary to obtain the specified consent in writing or in the form of an email, or obtaining consent through the site. TO this case applies in particular to the processing of PD:

• participants conducted by Grotex or with its direct participation in educational and scientific events in order to take into account the number of participants, analyze their professional interests, ensure the current V Grotex security level, including the current access control and control of its compliance, video surveillance and video recording on the territory and in the premises where Grotex is located; ensure informing about ongoing Grotex events, ongoing research, ongoing projects and their results; promotion of goods, works, services of Grotex on the market, including through the implementation of direct contacts with subjects of PD, as well as using means of communication;
• heads, representatives, employees of organizations, legal entities - counterparties or potential counterparties under contracts, agreements and contracts (hereinafter collectively referred to as contracts), customers, consumersvisitors to the Grotex website in order to prepare for the conclusion of contracts and the execution of such contracts, keeping records of concluded contracts, in order to analyze, study quality, the level of activity carried out by Grotex;
• Sending reference and marketing information to users of the site by sending messages to the e-mail address specified by the website visitor; enabling users For feedback from Grotex; providing users of the site with advice on issues related to goods produced by Grotex, for the purpose of marketing activities and support for users of the site, and also for other purposes that do not contradict the current legislation of the Russian Federation and the conditions agreements between Grotex and the respective users of the site.

3.2.2. Processing of PD is necessary for the implementation and fulfillment of the obligations imposed by the legislation of the Russian Federation on Grotex as an operator, functions, powers and responsibilities.

3.2.3. PD processing is necessary for industrial, entrepreneurial, scientific, research activities, provided that this does not violate the rights and legitimate interests of the subject of personal data;

3.2.4. PD processing is carried out for statistical or other research purposes.

3.3. All the above PD of the subjects are processed to the extent and within the time limits stipulated by the relevant consents to the processing of PD, including those expressed in the text of civil law contracts, and / or in regulatory legal acts, and/or local regulatory acts of Grotex, and/or arising from such regulatory legal acts and local regulatory acts of Grotex, or within the time period necessary for achievements specified purposes. The above conditions for processing PD are not exhaustive. Provided consent for PD processing may supplement or otherwise change the purposes, scope, methods and terms of PD processing.

3.4. The processing of PD of other persons is carried out with their consent, if they actually interact with Grotex, including in the form of emerging or existing legal relations. Unless otherwise stated in Politics concluded agreements or consents provided by PD subjects to the processing of PD, Grotex uses such PD solely for the purposes for which they were provided by Grotex.

3.5. Grotex employees who process PD on behalf of Grotex, well in advance of processing PD, must be convinced of its admissibility and legitimacy, ascertain about the possession of Grotex relevant powers and/or consents of PD subjects. In the absence of such authority and/or consents the specified Grotex employee must ensure that consent is obtained from the subject whose PD is processed planned. In this regard, he can:

• provide for in various electronic registration forms, e-mail correspondence, telephone conversations, personal meetings, obtaining consent for the processing of PD from the relevant subjects PD with mandatory fixation of such consent in any document allowing to confirm the fact of its receipt form, in including with subsequent personal confirmation of consent by such subjects in writing form;
• Use the recommended written consent form, which is available from your immediate head, head of the service to which the employee is assigned or in the Grotex financial service legal department.

3.6. Whenever obtaining the necessary consent for the processing of PD is not possible and there are sufficient grounds to believe that the processing of PD may violate the rights of the subject (-s) of the PD, the relevant employee Grotex notifies in any fixed way (on paper, by corporate e-mail, facsimile, sms) about this to his immediate supervisor and the head of the service, for which the employee is assigned, in order to develop a reasonable approach to the processing of PD or to establish the impossibility of their processing.

Heads of structural subdivisions of Grotex, in the direct activity of which the treatment PD subjects, ensure that all necessary measures are taken to comply with the legality of PD processing, including includingobtaining consents for processing and, if necessary, the development of local regulations, defining conditions for processing PD of the respective groups of subjects. These powers can be delegated heads of structural subdivisions of Grotex to other employees of Grotex.

3.7. Unless otherwise indicated, by submitting its PD to Grotex, the PD subject accepts the terms of the Policy and topics disposes of them most freely, by his own will and in his own interest, is aware of the consequences of their provision And expresses its consent to their processing for the purposes for which they are provided, as well as in purposes compliance by Grotex with normative and non-normative legal acts adopted in the Russian Federation; execution of decisions, orders and requests of public authorities that carry out certain functions and powers of the founder of Grotex, as well as other public authorities and their officials; ensure informing about ongoing Grotex events, ongoing research, ongoing projects and their results; promotion of goods, works, services of Grotex on the market, including through the implementation of direct contacts with PD subjects, including through means of communication; implementation of the Grotex statutory activities; as well as the accumulation of information about persons interacting with Grotex by collecting, recording, systematizing, accumulation, storage, clarification (updating, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction, committed, including using automation tools. The volume of processed PD in the specified case is limited to the data provided by the PD subjects independently with their consent, the period PD processing is not limited until the PD subject declares the withdrawal of his consent to the processing of his PD. Despite the wide range of actions allowed with PD, for which such consent is given, when PD processing by Grotex is limited to the achievement of specific, predetermined, legitimate purposes and is not allows redundancy of their processing. Grotex does not sell or lease PD V some objective form. PD processing at Grotex outside of the above cases, in the absence of consent of PD subjects to their processing is prohibited.

3.8. Responsible in Grotex for organizing the processing of personal data is an employee appointed by by order of the General Director of Grotex.

4.1. Only those persons who are specified or defined in the Policy or internal local acts of Grotex, persons who, in accordance with the procedure established by this Policy appropriate powers have been delegated.

4.2. Other Grotex employees may access PD for the purpose of reading and preparing methodological, analytical, summary and other materials in terms of issues related to the activities of such persons or structural subdivisions of Grotex to which they belong. Access by third-party employees to PD may be carried out solely on the condition that Grotex provides the obligations of such persons to preserve confidentiality, non-disclosure of relevant PD to other persons.

4.3. Persons guilty of violating the procedure for processing PD shall bear the Federation responsibility. With regard to Grotex employees who violated the procedure for processing PD, there may be disciplinary sanctions applied.

5.1. PD protection is the adoption of legal, organizational and technical measures aimed at:

• ensuring the protection of PD from unauthorized access, destruction, modification, blocking, copying, providing, distributing, as well as from other illegal actions in relation to PD;
• observance of confidentiality of PD;
• implementation of the right to access PD.

5.2. Grotex ensures the effective operation of the PD protection system, which includes organizational and (or) technical measures determined taking into account actual threats to the security of PD and information technology, used in information systems.

5.3. Protection of PD stored in electronic databases and information systemsemah grotex, from unauthorized access, distortion and destruction of information, as well as from other illegal action, is provided by the differentiation of access rights using an account and a password system.

5.4. The organization of storage of PD in Grotex is carried out in a manner that excludes their loss or illegal use.

5.5. To regulate the access of Grotex employees to PD, documents, including electronic, other material media, databases and information systems containing PD, in order to exclude unauthorized access of third parties, employees who process PD in Grotex by position, obliged observe and ensure:

• strict selective and reasonable distribution of documents, other material carriers, containing PD, between employees;
• rational placement of workers' workplaces, which excludes uncontrolled usage PD;
• knowledge by relevant employees of the requirements of regulatory legal and local regulations on protecting information and maintaining the confidentiality of such information;
• the presence of the necessary conditions in the room for working with documents, other material media, bases data and information systems containing PD;
• determination and regulation of the composition of employees who have the right to access databases and informational systems containing PD;
• organization of the procedure for the destruction of material media containing PD and its observance;
• timely detection of violations of the requirements of the permissive system of access to PD;
• work in the structural unit to prevent the loss and disclosure of personal data when working with them;
• restriction of access to documents, other material media, databases and information systems, containing PD.

5.6. All measures to ensure the confidentiality of PD during their processing apply as to material media and PD presented in electronic format.

5.7. Personal data protection measures applied by Grotex include:

• appointment of a person responsible for organizing the processing of personal data;
• the application of legal, technical and organizational measures to ensure the security of personal data;
• Assessing the harm that may be caused to personal data subjects in the event of a breach requirements legislation, the ratio of harm and security measures taken by Grotex;
• use of secure premises with limited access to host information servers personal data systems, as well as the use of lockable cabinets for storing paper media personal data;
• Familiarization of Grotex employees directly involved in the processing of personal data with provisions of the legislation of the Russian Federation on personal data;
• control over the measures taken to ensure the security of personal data.

6.1. The Grotex site(s) collects typical session log information, including IP address, type and language browser, as well as data on the time of visit and the address of the websites from which the transition was made links. In order to ensure effective management of the site and to assist in setting up user Grotex interface may use cookies (small text files stored in visitor's browser) or web beacons (web beacons - electronic images) together with tracking pixels (tracking pixels) that allow the site to count the number of visitors to certain page and provide access to certain cookies. Collected sample information is used solely for statistical purposes. Grotex does not use personal data for personal identification any of the users. However, upon authorization of registered users on the Grotex website Maybe use this information in combination with information obtained through data analysis tools And cookies in order to analyze howthe user is using the site.

6.2. By using the site, the user consents to Grotex being able to upload cookies to user's device according to the conditions described above.

6.3. The user has the ability to manage cookies by accessing the browser settings. When deleting cookies, all data about the User's preferences will be deleted, including the preference for failure from the use of cookies. If you block cookies, changes may affect user interface, and some site components may become unavailable.

7.1. The subject of personal data has the right:

• to demand clarification of their personal data, their updating, blocking or destruction;
• to receive a list of their personal data processed by Grotex, the source of their receipt, information about terms of processing their personal data, including the terms of their storage, and other information about processing your personal data;
• Require notification of all persons who have previously been given incorrect or incomplete personal information data about any corrections or additions made;
• appeal in the prescribed manner against illegal actions or omissions in the processing of it personal data.

7.2. PD subjects undertake to provide only reliable data about themselves.

7.3. Consent to the processing of personal data is issued by the PD Subjects for the entire period required by Grotex For achieve the purposes of processing.

7.4. Consent to the processing of personal data may be withdrawn by the PD Subject by sending written applications to the Grotex address: 195279 Russia, St. Petersburg, Industrialny pr., 71, building 2, letter A or to the Corporate Mail address (grtx@grotexmed.com).

7.5. Persons who transmitted information to Grotex through the website about another subject of personal data, without having this consent of the subject, whose personal data was transferred, are liable in accordance with legislation of the Russian Federation.

8.1. This Policy is subject to change or addition in cases of making appropriate changes. or additions to the current legislation of the Russian Federation on personal data, and may also be modified at any time at the sole discretion of Grotex. The current version of the Policy is always available in Grotex For viewing by the general public on the site at: www.solopharm.com.

8.2. All relations involving Grotex relating to the processing and protection of personal data and not received directly reflected in this Policy are governed by the provisions of the current legislation of the Russian Federation on personal data.

8.3. Control over the fulfillment of the requirements of this Policy is carried out by the person responsible for organization personal data processing Grotex.