This Personal Data Processing Policy was prepared in compliance with the provisions of Federal law dated 27.07.2006 No. 152-FZ “On Personal Data” (hereinafter referred to as the Personal Data Law) and determines the personal data processing procedure and the measures aimed at ensuring security of personal data undertaken by SPH LLC (hereinafter also referred to as “Operator”, “Company”).
1.1. The Operator sets the compliance with human and citizen’s rights and liberties in their personal data processing including protection of rights to integrity of private life, personal and family secrets, as its most important goal and condition underlying its activities.
1.2. This Operator’s Personal Data Processing Policy (hereinafter referred to as the Policy) shall apply to all the information which the Operator may obtain about visitors to the website https://sph.ru/.

2.1. Automated processing of personal data shall mean personal data processing using computer devices.
2.2. Blocking of personal data shall mean temporary cessation of personal data processing (except for cases where processing is required to update personal data).
2.3. Website shall mean an aggregate of graphical and informational materials as well as computer programs and databases which make them accessible on the Internet at the network address https://sph.ru/ (hereinafter also referred to as “Website”).
2.4. Personal data information system shall mean an aggregate of personal data contained in the databases of personal data and the information technologies and hardware which ensure procession thereof.
2.5. De-personalization of personal data shall mean actions resulting in impossibility to determine, without use of additional information, ownership of personal data by a specific User or by another subject of personal data.
2.6. Personal data processing shall mean any action (operation) or an aggregate of actions (operations) performed using automation devices or without using such devices with respect to personal data including collection, recording, systemization, accumulation, storage, updating (renewal, modification), retrieval, use, transmission (distribution, provision, access), de-personalization, blocking, removal, destruction of personal data.
2.7. Operator shall mean a state authority, a municipal authority, a legal entity or a natural person which organizes on its own or together with other persons and/or which engages in personal data processing as well as defines the goals for personal data processing, list of personal data subject to processing, actions (operations) performed with respect to personal data.
2.8. Personal data shall mean any information related directly or indirectly to an identified or identifiable Website User.
2.9. Personal data allowed by the personal data subject to be disseminated shall mean the personal data, access to which has been granted to an unlimited range of persons by the personal data subject by giving consent to the personal data processing allowed by the personal data subject to be disseminated according to the procedure established by the Personal Data Law (hereinafter referred to as personal data allowed to be disseminated).
2.10. User shall mean any visitor to the Website.
2.11. Provision of personal data shall mean actions aimed at disclosure of personal data to an identified person or an identified range of persons.
2.12. Dissemination (distribution) of personal data shall mean any actions aimed at disclosure of personal data to an indefinite range of persons (transmission of personal data) or for familiarization with personal data by an indefinite range of persons including publication of personal data in mass media, posting on information and telecommunications networks or provision of access to personal data by any other means.
2.13. Trans-border transmission of personal data shall mean transmission of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
2.14. Destruction of personal data shall mean any actions resulting in irretrievable destruction of personal data without further recovery of the contents of personal data in the information system of personal data, and/or destruction of physical storage media of personal data.
2.15. Web Analytics Services shall mean means of assessing, analyzing and monitoring visits, online ratings, and other similar tools.
2.16. Statistical information shall mean the information collected only in de-personalized form and processed in aggregated (summarized) form. It is collected by Web Analytics Services.

3.1. Operator may:
- obtain, from the personal data subject, veracious information and/or documents which contain personal data;
- in the event the personal data subject recalls consent to the personal data processing, or forwards a request to stop personal data processing, the Operator may continue to process personal data without consent of the personal data subject, provided that there are reasons in place set out in the Personal Data Law;
- determine, at its discretion, the composition and list of the measures required and sufficient to ensure that the responsibilities are fulfilled as listed in the Personal Data Law and regulatory legal acts adopted in accordance therewith unless the Personal Data Law or other Federal laws provide otherwise.
3.2. The Operator shall:
- provide to the personal data subject, at his/her request, the information relating to his/her personal data processing;
- organize the personal data processing following the procedure established by applicable law of the Russian Federation;
- reply to the communications and requests of the personal data subjects and their legal representatives (attorneys) in conformity with the requirements of the Personal Data Law;
- report to the authorized body for protection of rights of the personal data subjects at the request of this body the necessary information within 10 days from the receipt date of such a request;
- publish or otherwise provide unlimited access to this Personal Data Processing Policy;
- take legal, organizational and technical measures aimed at protecting personal data against illegal or accidental access thereto, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as against other unlawful actions with respect to personal data;
- discontinue transmission (dissemination, provision, access to) of personal data, cease processing and destroy the personal data according to the procedure and in the cases provided for by the Personal Data Law;
- exercise other responsibilities provided for by the Personal Data Law.

4.1. The personal data subjects may:
- obtain the information concerning the processing of their personal data except for the cases provided for by the Federal laws. The information shall be furnished to the personal data subject by the Operator in accessible form and shall not contain the personal data related to other personal data subjects except for the cases where there are lawful grounds for such personal data to be disclosed. The list of the information and the procedure of obtaining it are established by the Personal Data Law;
- require that the operator updates his/her personal data, blocks them or destroys them in the event that the personal data are incomplete, obsolete, inaccurate, obtained illicitly or are unnecessary for the declared purpose of processing, as well as take the measures provided for by the law with the aim to protect his/her rights;
- stipulate the condition of preliminary consent authorizing the personal data processing for purposes of promoting goods, works and services in the market;
- recall the consent allowing personal data processing, as well as send a request to stop personal data processing;
- file an appeal with the authorized body for protection of personal data subjects’ rights or resort to judicial procedure against unlawful actions or inaction of the Operator in their personal data processing;
- exercise other rights contemplated by the laws of the Russian Federation.
4.2. The personal data subjects shall:
- furnish truthful data about themselves to the Operator;
- inform the Operator when their personal data are updated (renewed, modified).
4.3. The persons who have provided the Operator with untrue data about themselves or details about another personal data subject without the latter’s consent shall bear liability under the law of the Russian Federation.

5.1. The personal data shall be processed on a legal and fair basis.
5.2. Personal data processing shall be limited to achievement of the specific pre-determined and lawful goals. Personal data processing incompatible with the purposes of collecting personal data shall not be allowed.
5.3. It shall not be permitted to consolidate the databases containing personal data whose processing is being done for the purposes incompatible with each other.
5.4. Personal data which meet the purposes of their processing shall only be subject to processing.
5.5. The contents and scope of the personal data being processed shall correspond to the declared aims of processing. No redundancy of personal data being processed in relation to the declared (stated) aims for their processing shall be allowed.
5.6. When processing personal data, it shall be ensured that the personal data are accurate, sufficient and, in certain cases, relevant to the aims for which they are processed. The Company shall take necessary measures and/or cause such measures to be taken with the aim of removing or updating incomplete or inaccurate data.
5.7. Storage of personal data shall be arranged in the form allowing identification of the subject of personal data for a time period which shall not be longer than required by the aims for processing of personal data if the storage period of the personal data is not established by a Federal law, or by an agreement, the party whereto or whose beneficiary or guarantor whereunder is the personal data subject. The personal data being processed shall be destroyed or de-personalized upon achieving the aims for processing or in the event the necessity to achieve those aims is obviated, unless a Federal law provides otherwise.

Aim of processing:

• Informing the User by sending him/her e-mails
• Registering visitors for the Company’s events;
• Processing a subscription to mailing of informational letters and special offers;
• Informing of updates in the sections with products and services, as well as informing of new data on the website at the user’s request.
• Building up data on job-seekers to fill vacancies

Personal data:

• User’s full name;
• User’s e-mail address;
• company name;
• telephone;
• ·registration address (in case the order is placed in the name of an individual);
• legal address (in case the order is placed in the name of a legal entity);
• details pertaining to the products of interest.

Legal reasons:
Federal Law “On Information, Information Technologies and Protection of Information” dated 27.07.2006 No. 149-FZ

Types of personal data processing:

• collection;
• recording;
• systemization;
• accumulation;
• storage;
• updating (renewal, modification);
• retrieval;
• use;
• removal;
• destruction.

7.1. Personal data shall be processed with the consent of the personal data subject authorizing his/her personal data processing.
7.2. Personal data processing is necessary to achieve the aims stated by the international treaty of the Russian Federation or the law, for exercise of functions, powers and obligations assigned to the operator by the law of the Russian Federation.
7.3. Personal data processing is necessary for dispensation of justice, execution of the judicial act, the act of another body or official subject to execution under the law of the Russian Federation on enforcement proceedings.
7.4. Personal data processing is necessary to perform an agreement, a party whereto or a beneficiary or guarantor whereunder is the personal data subject, as well as to make an agreement at the personal data subject’s initiative or an agreement whereunder the personal data subject is a beneficiary or guarantor.
7.5. Personal data processing is necessary to exercise the rights and legal interests of the Company or third parties or to achieve publicly significant goals, provided this does not infringe the rights and freedoms of the personal data subject.
7.6. Personal data are processed, access to which to an unlimited range of persons has been granted by the personal data subject or at his/her request (hereinafter referred to as publicly available personal data).
7.7. Personal data are processed, which are subject to publication or mandatory disclosure under a Federal law.

Security of personal data processed by the Operator shall be ensured by taking legal, organizational and technical measures necessary to comply, in full scope, with the requirements of the applicable law in the area of personal data security.
8.1. The Operator shall ensure security of personal data and take all the necessary measures preventing access to personal data by unauthorized persons.
8.2. Personal data of the User shall never, under whatever circumstances, be transferred to third persons, except for the cases connected with compliance with the applicable law or in the case where the personal data subject has given consent to the Operator to transfer data to third persons to perform their obligations under civil law contracts.
8.3. In the event inaccuracies are found in the personal data, the User may update them on his/her own by sending the Operator a notice to the Operator’s e-mail address info@sph.ru marked as “Updating personal data”.
8.4. The time period for personal data processing shall depend on whether the goals have been achieved for which the personal data have been collected unless a different time frame is contemplated by the agreement or applicable law.
The User may, at any time, recall his/her consent to the personal data processing by sending the Operator a notice by e-mail to the Operator’s e-mail address info@sph.ru marked as “Recall of consent to personal data processing”.
8.5. All the information collected by third-party services including payment systems, communications devices and other service providers shall be stored and processed by the above mentioned persons (Operators) pursuant to their User agreements and Confidentiality Policy. The personal data subject and/or the said documents. The Operator shall not be responsible for actions taken by third parties including service providers mentioned in this clause.
8.6. The bans imposed by the personal data subject on transfer (except for provision of access) as well as on processing or conditions for processing (except obtaining access) of personal data allowed for distribution, shall not be in effect in the cases where personal data are processed for state, public and other interests stipulated by the law of the Russian Federation.
8.7. The Operator, when processing the personal data, shall keep the personal data confidential.
8.8. Storage of personal data shall be arranged by the Operator in the form allowing identification of the subject of personal data for a time period which shall not be longer than required by the aims for processing of personal data if the storage period of the personal data is not established by a Federal law, or by an agreement, the party whereto or whose beneficiary or guarantor whereunder is the personal data subject.
8.9. The condition for cessation of the personal data processing may be the achievement of the goals for the personal data processing, expiry of the validity period of the personal data subject’s consent, recall of consent by the personal data subject or the requirement to stop personal data processing, as well as when unlawful personal data processing is found.

9.1. The Operator shall collect, record, systemize, accumulate, store, update (renew, modify), retrieve, use, transmit (disseminate, provide, access), de-personalize, block, remove and destroy personal data.
9.2. The Operator shall perform the automated personal data processing with or without receipt and/or transmission of received information on informational and telecommunications networks.

10.1. The Operator shall, prior to starting to engage in the activities of trans-border transmission of personal data, notify the authorized body for protection of personal data subject’s rights of his/her intention to carry out trans-border transmission of personal data (such notice shall be sent separately from the notice of intention to perform the personal data processing).
10.2. The Operator shall, prior to serving the above mentioned notice, obtain the relevant particulars from the authorities of a foreign state, foreign individuals, foreign legal entities for whom the trans-border transmission of personal data is planned to be destined.

The Operator and other persons who have obtained access to personal data shall not disclose to third parties and distribute personal data without the consent of the personal data subject, unless a Federal law provides otherwise.

12.1. The Web Analytics Services shall be used for assessment of the number of visitors to the Website, Website popularity assessment as a whole, and that of its individual sections among the target audiences, for a study of the target audiences’ interest in the services and products of the Company and solution of other similar problems of marketing and analytical nature. The Company may use Yandex.Metrics (https://metrika.yandex.ru) and other services of similar purpose.
12.2. Connection of the Website to the Web Analytics Services shall be made using the appropriate method envisaged by the regulations of the relevant Web Analytics Service. In most cases, for this purpose, the source code of the Website shall be added to the source code (script) provided by the Service. The script shall ensure that the Web Analytics Service is able to directly collect the information needed for operation. The Company shall not engage on its own in collection and transmission of the information for processing to the Web Analytics Services using any other method or for any purposes different from those set out in clause 12.1 of this Policy.
12.3. The operation principle of the Web Analytics Services shall consist in collection of data about visits to the Website and Users’ activity. In particular, the Web Analytics Services may record and process the data about the websites visited earlier, version and type of browsers, operating systems and devices of the Users, language settings, time zone, displays and other settings of the Users’ devices, supported version of Flash plugin, availability and support of JavaScript, cookie files, geographical regions from which the Users enter the Website, expected interests of Users, viewings of webpages, the time spent at the Website, files downloads and other data (hereinafter referred to as “Statistical Information”).
12.4. Statistical Information shall only be collected in de-personalized form and processed in aggregated (summarized) form, i.e. Statistical Information may not be referred to a directly or indirectly identified or identifiable individual. For the purpose of ruling out the possibility of identifying the Users as specific physical persons, the Company shall never disclose to the Web Analytics Services the Users’ personal data, which may be known to the Company pursuant to the Policy in relation to personal data processing, and shall never consolidate the Statistical Information or relate it with to the said personal data.
12.5. The may can obtain access to Statistical Information through personal accounts provided by the Web Analytics Services. That said, the Statistical Information shall be furnished to the Company in processed and aggregated (summarized) form in the format of reports. The Company shall be allowed to process the said Statistical Information only for the purposes identified in clause 12.1 of the Policy.
12.6. The Web Analytics Services may use various hardware for receipt of Statistical Information, including cookie files, web beacons, IP addresses, Java scripts, etc. The above mentioned devices shall not contain or receive Users’ personal data.
12.7. Cookie files shall mean small text files which are saved on the device used by the User for operation with the Website (personal computer, smartphone, tablet computer, etc.). These files can contain the information which is necessary for operation of Web Analytics Services or Website. For example, the information about the browser settings, the webpages viewed, the settings of the Website interface, etc. The Web Analytics Services usually use cookie files for the following tasks: technical tasks (ensuring operation of Web Analytics Services); analytical tasks (researching behavior and interests of the Website audiences, as well as other indicators which characterize the Website popularity); commercial tasks (marketing and advertising). More detailed reference information about cookie files can be found at the publicly available information sources, for example, here: https://yandex.ru/support/browser/personal-data-protection/cookies.html.
12.8. Web beacons shall mean graphics files with minimum size (1 pixel). Such a file can be loaded by the User’s browser together with the Website. Web beacons are used for receipt of technical details about the User’s device, for example, about operating system, time of opening and downloading of Website, IP address, etc. Web beacons can also be used for delivery of cookie files to the User’s device.
12.9. Java script shall mean the source code to be provided by the Web Analytics Services and posted at the websites on the Internet. For example, Java script allows accounting for events and actions which take place at the Website without changing URL- address of Website (for example, events which are not related to transfer from one webpage to another, or from one website to another website).
12.10. The Company may use its own cookie files to ensure normal functioning of the Website, particularly, for fulfilment of technical tasks, for example: organization of navigation through the Website, demonstration of cookie banner, ensuring protection against threats to informational security. Saving cookie files for these tasks is mandatory for Users who operate the Website because otherwise its normal functioning may be disrupted. Such disruptions of the functioning, among other things, may entail risks for informational security (for example, be conducive to hacker attacks against the Website).
12.11. The User may, at his/her discretion, refuse to accept cookie files on his/her device. For that purpose, the User may refuse to use the Website or make appropriate settings on his/her browser.
In case acceptance of cookie files is refused and other hardware is used, the Company cannot, for technical reasons, guarantee to Users that they will be able to use all the functions of the Website.

13.1. The User can get any clarifications as to the questions of interest pertaining to his/her personal data processing by contacting the Operator by e-mail info@sph.ru.
13.2. This document will include any amendments to Personal Data Processing Policy made by the Operator. The Policy shall be in effect indefinitely until its replacement with a new version.
13.3. The current version of the Policy in the public domain is posted on the Internet at https://sph.ru/privacy