PERSONAL DATA PROCESSING POLICY

1. Preamble

This personal data processing policy (the "Policy") of Ikon Shina Limited Liability Company (the "Operator") establishes the purposes, scope, and methods of processing the personal data of individuals who are not employees of the Operator, and is published in open access in accordance with the requirements of Federal Law of the Russian Federation No. 152-FZ "On Personal Data" dated July 27, 2006.

Processing of personal data means any action (operation) or set of actions (operations) performed on personal data, whether or not using automation tools.

The processing of personal data is limited to the achievement of specific, predetermined, and lawful purposes. Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted.

This Policy applies to the website https://attartyres.com, This version of the Policy is effective from January 16, 2025.

2. Rights of the personal data subject

In accordance with Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006 (the "Personal Data Law" or "152-FZ"), the personal data subject has the right to:

• access their personal data;
• request clarification of their personal data;
• request the blocking and deletion of their personal data;
• appeal actions or omissions of the operator;
• appeal decisions made solely on the basis of automated processing of personal data;
• withdraw their consent to the processing of personal data.

To exercise these rights, the personal data subject may send a written request to the Operator, indicating identification document details of the subject or their representative (document type, series and number, issuing authority and date of issue), the full name of the subject or their representative, information on the nature of the relationship with the Operator confirming the fact that the subject's personal data is being processed, and the signature of the subject or their representative.

The request may be sent to the Operator's registered address: 188640, Russia, Leningrad Region, Vsevolozhsk, Avtomobilnaya St., 14.

3. Purposes of personal data processing

This section describes the purposes and periods for processing the personal data of Site users. Within the purposes listed, the Operator will collect, record, systematize, accumulate, store, clarify (update, modify), retrieve, use, transfer (provide, grant access to), block, delete, and destroy personal data. The data processed for these purposes does not belong to special categories or biometric personal data under Articles 10–11 of Federal Law No. 152-FZ, and is processed using automated means.

The purposes of personal data processing are:

3.1 Providing the user with information about the Operator, the goods sold, the services provided, and ongoing promotions and special offers.

The following personal data is processed to achieve this purpose:

• last name, first name, patronymic;
• date of birth;
• phone number;
• email address.

The legal basis for processing this personal data is Consent to the processing of personal data in accordance with Clause 1, Part 1, Article 6, and Part 1, Article 9 of Federal Law No. 152-FZ.

This data is stored and processed for the entire term of the Consent to the processing of personal data and is destroyed within 30 days after withdrawal of the Consent, in accordance with Part 4, Article 21 of Federal Law No. 152-FZ, by deletion from information systems using the system's built-in tools.

3.2 Concluding and performing a civil-law contract

• last name, first name, patronymic;
• phone number;
• email address;
• delivery address.

The legal basis for processing this personal data is the contract, in accordance with Clause 5, Part 1, Article 6, and Part 1, Article 9 of Federal Law No. 152-FZ.

This data is stored and processed for the entire term of the contract and for 5 years after its performance for the purposes of accounting and tax reporting, in accordance with Article 23 of the Tax Code of the Russian Federation and Article 29 of Federal Law No. 402-FZ "On Accounting."

Upon expiry of these processing periods, personal data is destroyed by deletion from information systems using the system's built-in tools

3.3 Analyzing the level of visitor interest in the website and the quality of the service provided by the Operator.

The Site uses cookie processing technology — small text files in which the browser records data from websites visited by the user. This data is used to collect information about visitors' actions on the site in order to improve the quality of its content and functionality.

Users may change their browser settings at any time so that the browser stops saving cookies and notifies them when cookies are sent. In this case, some services and features of the Site may stop working or may not work correctly.

The Operator's cookie policy is also published at https://www.attartyres.com/cookie-policy/

The Site may use website traffic statistics services (Yandex.Metrica, Google Analytics) and other similar tools that collect and analyze anonymized information to determine the level of visitor interest in the site.

3.4 Preparing responses to complaints and claims.

• last name, first name, patronymic;
• phone number;
• email address;
• date of birth;
• city and region of residence;
• passport details

The legal basis for processing this personal data is Consent to the processing of personal data in accordance with Clause 1, Part 1, Article 6, and Part 1, Article 9 of Federal Law No. 152-FZ, or a contract in accordance with Clause 5, Part 1, Article 6, and Part 1, Article 9 of Federal Law No. 152-FZ.

This data is stored and processed for the entire term of the Consent to the processing of personal data and is destroyed within 30 days after withdrawal of the Consent, in accordance with Part 4, Article 21 of Federal Law No. 152-FZ, by deletion from information systems using the system's built-in tools.

3.5 Processing of personal data by third parties

In order to provide services and improve their quality, and to achieve the stated purposes of personal data processing, the Operator may engage third parties to process personal data or transfer information to them.

The Operator has the right to engage third parties to process personal data on the basis of an agreement concluded with such persons. Persons processing personal data on the Operator's instructions undertake to comply with the principles and rules for processing and protecting personal data set out in Federal Law No. 152-FZ "On Personal Data."

For each third party, the agreement defines the list of personal data, the list of actions (operations) to be performed on the personal data by the legal entity processing the personal data, and the processing purposes; it establishes the obligation of such person to maintain confidentiality and ensure the security of personal data during processing, and sets out requirements for protecting the personal data being processed.

4. Confidentiality of personal data

The Operator does not disclose to third parties or distribute the personal data of Site users without their consent, except in cases provided for by applicable law.

5. Protection of personal data

The Operator takes measures necessary and sufficient to ensure fulfillment of the obligations set out in the Federal Law "On Personal Data" and the regulatory legal acts adopted in accordance with it.

The Operator independently determines the composition and list of measures necessary and sufficient to ensure fulfillment of such obligations, in particular:

а) a person responsible for organizing the processing of personal data has been appointed;

b) local regulations on the processing and protection of personal data have been developed and approved;

• threats to the security of personal data during their processing in personal data information systems have been identified;
• rules have been established governing access to data processed in the personal data information system, and registration and recording of all actions performed on personal data in the personal data information system is ensured.

d) monitoring is carried out of the measures taken to ensure the security of personal data and the level of protection of personal data information systems;

e) an assessment is made of the harm that could be caused to the personal data subject in the event of a violation of the requirements of applicable Russian law, and of the correlation between such harm and the measures taken by the Operator to ensure fulfillment of the obligations set out in applicable Russian law;

f) conditions are observed that prevent unauthorized access to physical media containing personal data and ensure the safekeeping of personal data;

g) employees of the Operator who directly process personal data have been familiarized with the provisions of Russian legislation on personal data, including the requirements for the protection of personal data, and with local regulations on the processing and protection of personal data.

To ensure the confidentiality of information and the protection of personal data, the Operator maintains an appropriate IT environment and takes all measures necessary to prevent unauthorized access.

6.Changes to the Policy

The Operator reserves the right to amend the Policy at any time and asks users to regularly review updates to the Policy on their own. The Operator will notify users of changes to the Policy, by available means, if such changes are material.