Personal Data Processing Policy

1. General Provisions
This Personal Data Processing Policy (hereinafter referred to as the "Policy") is drafted in accordance with Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter — the "Personal Data Law") and defines the procedure for processing personal data and the measures taken by “TOP MARINE-South” Co Ltd (hereinafter — the "Operator") to ensure the security of personal data.
1.1. The Operator considers compliance with human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy, personal and family secrets, as the most important goal and condition for its activities.
1.2. This Policy applies to all information that the Operator may obtain about visitors to the website https://topmarine-south.ru/en.

2. Key Terms Used in the Policy
2.1. Automated processing of personal data — processing of personal data using computer technology.
2.2. Blocking of personal data — temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify personal data).
2.3. Website — a set of graphic and informational materials, as well as computer programs and databases, ensuring their availability on the Internet at https://topmarine-south.ru/en.
2.4. Personal data information system — a set of personal data contained in databases and the information technologies and technical means ensuring their processing.
2.5. Depersonalization of personal data — actions that make it impossible to determine the ownership of personal data to a specific User or other data subject without using additional information.
2.6. Processing of personal data — any action (operation) or a set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
2.7. Operator — a state or municipal authority, legal or natural person that, independently or jointly with others, organizes and/or carries out the processing of personal data, and also determines the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data.
2.8. Personal data — any information relating directly or indirectly to a specific or identifiable User of the website https://topmarine-south.ru/en.
2.9. Personal data allowed for dissemination by the data subject — personal data access to which has been provided by the data subject by giving consent for the processing of such data in accordance with the Personal Data Law.
2.10. User — any visitor to the website https://topmarine-south.ru/en.
2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons.
2.12. Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite circle of persons (transfer of personal data) or at making personal data known to an unlimited circle of persons, including publication in the media, placement in information and telecommunications networks, or granting access to personal data by any other means.
2.13. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to a foreign authority, foreign individual, or foreign legal entity.
2.14. Destruction of personal data — any actions that result in the irreversible destruction of personal data with the impossibility of further restoration of the content of personal data in the information system and/or destruction of tangible media containing personal data.

3. Main Rights and Obligations of the Operator
3.1. The Operator has the right to:
— receive reliable information and/or documents containing personal data from the data subject;
— continue processing personal data without the consent of the data subject if there are grounds specified in the Personal Data Law in the event of withdrawal of consent or a request to stop processing;
— independently determine the composition and list of measures necessary and sufficient to ensure compliance with the requirements of the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.
3.2. The Operator is obliged to:
— provide the data subject, upon request, with information regarding the processing of their personal data;
— organize the processing of personal data in accordance with the legislation of the Russian Federation;
— respond to inquiries and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
— notify the authorized body for the protection of the rights of personal data subjects upon request within 10 days from the date of receipt of such request;
— publish or otherwise provide unrestricted access to this Policy;
— take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as from other unlawful actions;
— cease the transfer (distribution, provision, access), processing, and destruction of personal data in the manner and in cases provided for by the Personal Data Law;
— fulfill other obligations stipulated by the Personal Data Law.

4. Rights and Obligations of Personal Data Subjects
4.1. Personal data subjects have the right to: — receive information related to the processing of their personal data, except as provided by federal laws; — demand clarification, blocking, or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing; — condition prior consent when processing data for marketing purposes; — withdraw consent to the processing of personal data and request termination of processing; — lodge complaints with the authorized data protection authority or take legal action against unlawful actions or inaction by the Operator; — exercise other rights provided by Russian Federation law.
4.2. Personal data subjects are obliged to: — provide accurate personal data to the Operator; — notify the Operator of updates or changes to their personal data.
4.3. Individuals who provide false information or data about another person without their consent are liable under Russian Federation law.

5. Principles of Personal Data Processing
5.1. Processing is carried out lawfully and fairly.
5.2. Processing is limited to achieving specific, lawful objectives.
5.3. Databases with incompatible processing purposes are not merged.
5.4. Only data relevant to the stated purpose is processed.
5.5. The content and volume of processed data must match the processing goals.
5.6. Data must be accurate, sufficient, and up to date; inaccurate or incomplete data must be corrected or removed.
5.7. Personal data is stored only as long as required by the purpose of processing or relevant law. Once the goal is achieved or no longer necessary, the data is destroyed or anonymized.

6. Purpose of Personal Data Processing
Purpose: Feedback Form Submission
Personal data: Full name, email address, phone numbers
Legal basis: Federal Law No. 149-FZ “On Information, Information Technologies and Information Protection” of July 27, 2006
Types of processing: Collection, recording, systematization, accumulation, storage, destruction, and anonymization

7. Conditions for Personal Data Processing
7.1. Data is processed with the subject’s consent.
7.2. Data is processed when necessary to fulfill legal obligations.
7.3. Data is processed for judicial purposes or to enforce legal acts.
7.4. Data is processed under contracts with the data subject or at their initiative.
7.5. Data is processed to protect the Operator’s or third parties’ legitimate interests if it does not infringe upon the data subject’s rights.
7.6. Publicly available data is processed.
7.7. Data subject to disclosure under federal law is processed.

8. Procedure for Collection, Storage, Transfer, and Other Types of Processing
The Operator ensures data security through legal, organizational, and technical measures as required by law.
8.1. The Operator protects personal data from unauthorized access.
8.2. Personal data is never shared with third parties unless required by law or consent is given.
8.3. Users can update their data by emailing rostov@topmarine-south.ru with the subject “Data Update.”
8.4. Data is stored as long as necessary for processing purposes, unless otherwise specified by law or contract. Consent may be withdrawn by emailing “Consent Withdrawal” to rostov@topmarine-south.ru.
8.5. Third-party services process their data under their privacy policies. The Operator is not responsible for such third parties.
8.6. Restrictions on data dissemination do not apply if processing is required for public interest.
8.7. The Operator ensures confidentiality. 8.8. Data is stored in identifiable form no longer than required. 8.9. Processing ends upon achievement of goals, expiration of consent, withdrawal, or detection of unlawful processing.

9. List of Actions Performed with Personal Data
9.1. The Operator collects, records, systematizes, accumulates, stores, clarifies, extracts, uses, transfers, anonymizes, blocks, deletes, and destroys personal data.
9.2. The Operator may automate processing and transfer data through communication networks or without them.

10. Cross-Border Data Transfer
10.1. Prior to cross-border data transfer, the Operator notifies the authorized authority.
10.2. The Operator obtains required assurances from foreign parties regarding data protection before submitting such a notice.

11. Confidentiality of Personal Data
The Operator and others with access to personal data must not disclose or disseminate it without the subject’s consent, unless required by law.

12. Final Provisions
12.1. Users can contact the Operator for clarification at rostov@topmarine-south.ru.
12.2. Changes to this Policy will be reflected in this document. The Policy remains effective until replaced. 12.3. The current version is available at https://topmarine-south.ru/en/privacy.