Personal Data Processing Policy

1. General provisions

   This Personal Data Processing Policy (hereinafter – the "Policy") determines the policy of the VEGAS LEX Law Firm, Moscow (hereinafter – "VEGAS LEX" or "we") concerning processing of personal data of users of the website www.vegaslex.ru (hereinafter – the "Site").

   The Policy is based on the provisions of the Russian Federal Law No. 152-FZ “On Personal Data” dated 27July 2006 (hereinafter – the "Law on Personal Data").

   By staying on the Site, you agree that we process your personal data in accordance with the Policy.

   The terms used in the Policy, which have the meaning established by the Law on Personal Data, are interpreted in accordance with such law.

   This Policy applies to the processing of personal data that VEGAS LEX receives when you use the Site or send us an email at any of the email addresses published on the Site.

   We are not responsible for the processing of your personal data when you go to other sites on the Internet, including links posted on our Site.

   We reserve the right to make any changes to the Policy. The current version of the Policy is always available on the Site.

2. Cases and purposes of personal data processing and their categories

   The table below shows the cases of processing your personal data together with the categories of data and the purposes of such processing

   Processing cases	Data categories	Processing purposes
   Browsing the Site	IP address location information OS type and browser version device type and screen resolution source of access to the site OS and browser language behavior on the Site	ensuring the functioning of the Site conducting statistical research and web analytics
   Subscription to analytical materials and current events ("Registration on the website")	last name, first name email address position company name company field of activity city phone other information that the user enters into the registration form	distribution of analytical materials and information about current events sending commercial proposals for the provision of legal services
   Sending a request for legal services by filling out a form in the "Expert Consultation" tab or by sending emails to the email addresses indicated on the Site	company name full name email address the direction and area of practice of interest the text of the request data extracted from files submitted by the user other data provided by the user at their own discretion	sending commercial proposals for the provision of legal services conclusion of contracts for the provision of legal services
   Applying for a job by filling out the form in the "Career and Training" section or by sending emails to the email addresses listed on the Site	full name email address phone data from the attached resume other data provided by the user at their own discretion	evaluation of an applicant for an internship or filling a vacant position sending an offer to complete an internship or enter into an employment contract conclusion of an employment contract
   Registration for events ("Applying for participation")	company name full name post email address phone	providing an opportunity to participate in the event sending commercial offers for the provision of legal services
   Giving feedback on events ("Event Feedback")	name and surname company name email address comment on the event	consideration of requests and suggestions for further events sending commercial offers for the provision of legal services
   Sending information from the Site to the email address when clicking the "share" button on the Site	full name recipient's email address comment	analysis of the nature of requested information conducting statistical research and web analytics

   We assume that the data you provide is complete and reliable.

   We do not process special categories of personal data, as well as biometric personal data.

3. Grounds for processing personal data

   We process your personal data on the following legal grounds:

   1. your consent to the processing of personal data;
   2. processing is necessary to fulfill the duties assigned to VEGAS LEX by Russian legislation;
   3. processing is necessary for the conclusion or execution of a contract to which you are a party, beneficiary or guarantor;
   4. processing is necessary for the exercise of the rights and legitimate interests* of VEGAS LEX or third parties;
   5. other grounds provided for by Russian legislation.

   *By the legitimate interests of VEGAS LEX, we mean, inter alia, the following: (a) providing legal services, (b) improving the quality of services, (c) managing business relationships with clients, including its development, (d) improving the operation of our Site

4. Methods of processing personal data

   We may process your personal data by all legal means, including by collecting, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

   When processing your personal data, we use both automated and non-automated processing tools.

   When collecting personal data, we provide recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of Russian citizens using databases located on the territory of the Russian Federation.

5. Cookies and other user data

   When visiting the Site, you consent to VEGAS LEX processing cookies and other user data, namely: IP address, location information, OS type and version, browser type and version, device type and screen resolution, source of access to the site, OS and browser language, behavior on the Site. This is necessary for the functioning of the Site, conducting statistical research and web analytics, including using third-party services.

   If you do not want your data to be processed, change the appropriate settings of your browser or leave the Site.

6. Access of third parties to personal data

   To solve business problems, VEGAS LEX engages third parties who can access your data. By staying on the Site and (or) providing your personal data, you consent to the transfer of your personal data to such third parties.

   At the same time, we include in our contracts with such third parties the obligations of the latter to ensure the protection, confidentiality and legality of the processing of your personal data. Third parties are not allowed to process your personal data for any purposes other than those expressly provided by contracts concluded with them.

   We may also transfer your data to third parties in cases where the law requires so.

7. Storage and destruction of data

   We store data for as long as it is necessary to achieve the purpose of processing personal data or to comply with the requirements of Russian legislation.

   We calculate the retention periods of your personal data taking into account the retention periods of internal documentation, as well as the limitation periods during which claims may be filed.

   We will destroy your data within 30 calendar days from the moment of: (a) achieving the purpose of personal data processing, (b) revoking your consent to personal data processing or expiring of the consent (if consent is the only legal basis for data processing), (c) issuing a legal order (requirement) by an authorized body, (d) expiration of the data storage period, (e) identification of the illegality of further processing of personal data.

8. Measures to protect personal data

   To protect your data, we take the necessary legal, organizational and technical measures, including:

   1. appoint a person responsible for the processing of personal data;
   2. develop and adopt local regulations governing the processing of personal data, including measures to protect them, and familiarize employees with such documents;
   3. limit the circle of persons who have access to personal data, explain the responsibilities of such persons in connection with access to relevant data;
   4. ensure the confidentiality of your data by signing non-disclosure agreements with employees and other persons who have access to it;
   5. keep records of persons who have access to information systems through which your data is processed, as well as actions performed in these systems;
   6. block and delete invalid accounts of persons who had access to your data;
   7. use modern technical means of data protection (including access rights management systems, firewalls, means of secure remote access to information systems, antivirus programs);
   8. ensure the safety of your data when using information systems (including data backup and uninterruptible power supply of devices used in these systems);
   9. protect from unauthorized access the premises in which the information systems in which your data is processed are located (including by installing locks on the doors of such premises, using access control systems and video surveillance systems);

9. Your rights in connection with the personal data processing

   You have the following rights with respect to your personal data:

   1. the right to receive information about the processing of your personal data;
   2. the right to request clarification of personal data when they are changed or an error is detected;
   3. the right to request the blocking or destruction of personal data in the cases provided for by law;
   4. the right to withdraw your consent to the processing of personal data;
   5. the right to refuse our newsletters, delete your personal account on the Site;
   6. other rights in accordance with the Law on Personal Data.

   If you contact us with a written request regarding your personal data, we may ask you to confirm your identity.

   To exercise your rights, as well as on other issues, including clarification of the provisions of this Policy, if there are comments and suggestions, please send us a written request to our postal address: 52 bld. 5 Kosmodamianskaya emb., Moscow, 115054, or by e-mail to: vegaslex@vegaslex.ru.