PERSONAL DATA PROCESSING POLICY

This Personal Data Processing Policy sets out the procedure for processing and protecting the personal data of users of the website https://exunion.ru/ (commercial name: EXUNION), as well as persons contacting Individual Entrepreneur Albert Islyamovich Muratov, abbreviated name: IE Muratov A.I., TIN 165039416900, Primary State Registration Number of Individual Entrepreneur (OGRNIP) 325169000161493, hereinafter referred to as the Operator, through the website, by telephone, email, messengers, or by other means.

This Policy has been developed in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and other regulatory legal acts of the Russian Federation in the field of personal data protection.

1. Key Definitions

Personal Data means any information relating directly or indirectly to an identified or identifiable individual.
Operator means Individual Entrepreneur Albert Islyamovich Muratov, who independently or jointly with other persons organizes and carries out the processing of personal data and determines the purposes of processing, the scope of personal data to be processed, and the actions performed with such data.
User means an individual who visits https://exunion.ru/, submits an application or inquiry, or acts as a representative of a potential or existing client, partner, contractor, or other counterparty of the Operator.
Processing of Personal Data means any action or set of actions performed with personal data, including collection, recording, systematization, accumulation, storage, clarification, use, transfer, provision, anonymization, blocking, deletion, and destruction of personal data.
Website means the website located at https://exunion.ru/.

2. General Provisions

The Operator processes personal data lawfully, fairly, and only to the extent necessary to achieve specific, predetermined, and lawful purposes.
The Operator does not combine databases containing personal data processed for incompatible purposes and does not process data that is excessive in relation to the stated purposes.
The Operator takes the necessary legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions.
Visiting publicly accessible pages of the Website does not in itself constitute consent to the processing of personal data voluntarily provided by the User. When data is submitted through forms on the Website, consent to its processing is obtained separately through the relevant form provided on the Website, unless another lawful basis for processing applies.

3. Categories of Data Subjects and Personal Data Processed

The Operator may process personal data of Website visitors, persons submitting inquiries, and representatives of potential and existing clients, partners, contractors, and other counterparties.
Depending on the method of interaction, the following data may be processed:

• surname, first name, and patronymic, if voluntarily provided by the User;
• telephone number;
• email address;
• organization name, job title, and other information concerning the User’s professional role, if provided by the User;
• the content of an inquiry, project description, needs, tasks, or other information voluntarily provided by the User through a form, email, message, or during negotiations;
• business correspondence and communication data necessary for preparing a proposal, entering into a contract, and performing contractual obligations;
• technical data automatically transmitted when using the Website, including IP address, browser information, device and operating system information, date and time of visit, pages viewed, cookies, and other similar technical data.

The Operator does not request passport details, health information, biometric data, or special categories of personal data through general Website forms. Users are advised not to submit such information through the contact form unless its provision is required by law or by the nature of a specific inquiry.

4. Purposes of Personal Data Processing

The Operator processes personal data for the following purposes:

• receiving, registering, and processing User inquiries and applications;
• communicating with Users by telephone, email, and messengers;
• conducting a preliminary assessment of a client’s needs, discussing projects, and preparing proposals regarding the scope and format of work;
• preparing commercial proposals, calculations, presentations, and other materials at the User’s request;
• conducting negotiations and entering into, performing, amending, and terminating service agreements and project work agreements;
• organizing project interaction, including communication between the client, the Operator, and engaged specialists to the extent necessary for performing the work;
• reviewing inquiries, claims, and other communications from Users and counterparties;
• complying with the requirements of the laws of the Russian Federation, maintaining records, and protecting the legitimate interests of the Operator;
• ensuring Website operation, analyzing Website traffic, and improving usability;
• sending advertising and marketing communications only where the User has provided separate consent, where such consent is required by law.

5. Legal Grounds for Personal Data Processing

The legal grounds for processing personal data include:

• the consent of the personal data subject to the processing of their personal data;
• the necessity of processing for entering into a contract at the initiative of the personal data subject or for performing a contract to which the subject is a party, beneficiary, or guarantor;
• compliance with obligations of the Operator established by the laws of the Russian Federation;
• the exercise of the rights and legitimate interests of the Operator or third parties, provided that this does not violate the rights and freedoms of the personal data subject.

6. Procedure and Conditions for Personal Data Processing

The Operator processes personal data both with and without the use of automated means.
Processing may include collection, recording, systematization, accumulation, storage, clarification, updating, modification, use, transfer, provision, access, anonymization, blocking, deletion, and destruction of personal data.
Personal data is retained no longer than necessary for the purposes of processing, contractual relationships, statutory document retention periods, or other lawful grounds. Once the purposes of processing have been achieved, the data shall be deleted or destroyed unless further retention is required by law or contract.
When collecting personal data of citizens of the Russian Federation through the Internet, the Operator ensures compliance with the requirements of Russian law regarding the use of databases located within the territory of the Russian Federation.
The Operator does not make decisions based solely on automated processing that produce legal consequences for the User or otherwise significantly affect the User’s rights and legitimate interests.

7. Transfer of Personal Data to Third Parties and Processing on Behalf of the Operator

For the purposes stated above, the Operator may transfer personal data to third parties or engage third parties to process such data only to the extent necessary and where there is a lawful basis for doing so.
Such persons and categories of recipients may include:

• website builder, hosting, and technical support services, including the infrastructure used to operate the EXUNION Website;
• application processing services, CRM systems, accounting systems, and other tools used to manage inquiries;
• email, telephony, SMS, and messenger service providers;
• web analytics services and other technical services used to support and improve the Website;
• engaged experts, specialists, contractors, and members of the project team, but only where their participation is necessary to assess an inquiry, prepare a proposal, or perform agreed work;
• government authorities and other persons in the cases and in the manner provided for by the laws of the Russian Federation.

Persons entrusted with processing personal data receive only the information necessary to perform the relevant function. The Operator takes reasonable measures to ensure the confidentiality and security of personal data in such interactions.

8. Cross-Border Transfer of Personal Data

The Operator does not carry out cross-border transfers of personal data unless necessary.
If the use of certain information, communication, or technical services results in a cross-border transfer of personal data, such transfer shall be carried out only where permitted by law and after the Operator has fulfilled the applicable requirements of the laws of the Russian Federation.

9. Cookies and Technical Data

The Website may use cookies and similar technologies necessary for proper Website operation, storing User preferences, analyzing traffic, and improving the User experience.
Web analytics systems may also be used on the Website. Such services may receive technical information relating to Website visits to the extent determined by their settings and terms of use.
Users may restrict or disable the use of cookies in their browser settings. However, certain Website functions may not operate correctly as a result.

10. Informational and Advertising Communications

The Operator may send Users messages directly related to their inquiries, negotiations, proposal preparation, or performance of contractual obligations without using the data for any other incompatible purposes.
Advertising and marketing communications are sent only where the User has provided separate consent, if such consent is required by law. The User may unsubscribe from such communications at any time by sending a request to office@exunion.ru or by using the unsubscribe method specified in the relevant message.

11. Rights of the Personal Data Subject

The personal data subject has the right to:

• obtain information concerning the processing of their personal data;
• request correction, blocking, or destruction of personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purposes of processing;
• withdraw consent to the processing of personal data;
• opt out of advertising and marketing communications;
• submit inquiries and requests to the Operator relating to the processing of personal data;
• challenge the actions or inaction of the Operator before the competent authority responsible for the protection of personal data subjects’ rights or before a court.

12. Withdrawal of Consent and Personal Data Requests

The personal data subject may withdraw consent to the processing of personal data or submit another request relating to the processing of their data by email at:
office@exunion.ru
The request should include information sufficient to identify the applicant and the relevant interaction with the Operator, for example, the applicant’s name, contact telephone number or email address, as well as the substance of the request.
Upon receipt of a withdrawal of consent, the Operator shall cease processing personal data where such processing is based on that consent, except where continued processing is permitted or required by the laws of the Russian Federation or on another lawful basis.

13. Personal Data Protection
The Operator takes necessary and sufficient measures to protect personal data, including, depending on the nature of the processing:

• restricting access to personal data and differentiating access rights;
• using user accounts, passwords, and other authentication methods;
• storing personal data in information systems and services with restricted access;
• controlling access to email, application processing systems, CRM systems, telephony, and other services used;
• applying organizational and technical measures to protect data against unlawful access, loss, alteration, and dissemination;
• deleting or destroying personal data after the purposes of processing have been achieved, unless further retention is required by law.

14. Operator Contact Details

Personal Data Operator: Individual Entrepreneur Albert Islyamovich Muratov
Abbreviated name: IE Muratov A.I.
TIN: 165039416900
OGRNIP: 325169000161493
Commercial name: EXUNION
Website: https://exunion.ru/
Email for personal data processing inquiries: office@exunion.ru
Phone: +7 (965) 600-23-32

15. Final Provisions

The Operator reserves the right to amend this Policy. A new version of the Policy shall take effect from the moment it is published on the Website, unless otherwise specified in the new version.
The current version of the Policy is permanently available at:
https://exunion.ru/

Publication date: 18 September 2026