Approved by Order of the General Director

LETTEROS LLC
No. 1/PD/2024 dated March 15, 2024

Policy regarding the processing of personal data Limited Liability Company “LETEROS”

PREAMBLE

This policy regarding the processing of personal data (hereinafter referred to as the Policy) defines the basic principles, conditions, purposes, methods of processing, implemented measures for the protection of personal data and other information, rights Internet users (hereinafter referred to as the User) in progress use of the site https://letteros.com/ (hereinafter referred to as the Site), access to which is provided by the Limited Liability Company

“LETTEROS» (Taxpayer Identification Number:7806587362; OGRN:1217800087075, hereinafter referred to as Society, Administrator, Operator), to ensure respect for and protection of the rights and freedoms of every person and, in particular, the right to privacy, personal and family secrets, protection of honor, dignity and good name.

This Policy governs the terms of confidentiality and processing of personal data between User and Society when using the Site, as well as concluding and executing contracts between them.

Policy applies to all information, including personal data within the meaning of the current legislation of the Russian Federation, which the Administrator may receive from the User in the process of using the Site.

This Policy applies to all Users who provide their personal data to the Administrator during any access and (or) use of the Site, and in respect of which the Administrator processes personal data.

Before using the Site Administrator, the user is obliged to familiarize himself with the contents of this document. Each time you access and/or actually use the Site or its individual functions, the User agrees with this Policy in full, without reservations or exceptions. Acceptance of the terms of the Policy by the User is an explicit, substantive, definite and non-abstract consent of the User to the processing of personal data.

1. TERMS AND DEFINITIONS

1. For the purposes of this Policy, unless the context otherwise requires, the terms below have the following meanings and are an integral part of it:

1.1.1. Personal Information — any information relating to a directly or indirectly identified or identifiable individual.

1.1.2. Processing of Personal Data — is any action (operation) or set of actions (operations) with Personal Data performed using automation tools or without their use. Processing of Personal Data includes, but is not limited to, collection, recording, systematization, accumulation, storage, clarification (updating, modification, extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

1.1.3. Site — means the website located at https://letteros.com/.

1.1.4. User — is the subject of personal data, the person using the Site.

1.1.5. Society, Administrator, Operator — Limited Liability Company «LETTEROS» (Taxpayer Identification Number:7806587362; OGRN:1217800087075), being the operator of Personal Data.

1.2. The Policy may use other terms not defined in clause 1.1 of this document. In this case, the interpretation of such terms is made in accordance with the text of the Policy.

1.3. Terms used in this Policy in the singular (depending on the context) have the same meaning in the plural and vice versa. The headings in this Policy are highlighted for convenience only and do not affect its interpretation.

2. GENERAL PROVISIONS

2.1. This Policy has been developed in accordance with the Constitution of the Russian Federation, the Civil Code of the Russian Federation, Federal Law dated July 27, 2006 No. 149-FZ “On information, information technologies and information protection”, Federal Law dated July 27, 2006 No. 152- Federal Law “On Personal Data”, other federal laws.

2.2. The purpose of developing the Policy is to determine the procedure for processing and protecting Users’ Personal Data, ensuring the protection of the rights and freedoms of individuals and citizens when processing their Personal Data, including the protection of rights to privacy, personal and family secrets.

2.3. This Policy comes into force from the moment of its approval and is valid indefinitely until it is replaced by a new Policy.

2.4. The Policy may be changed and/or supplemented unilaterally by the Site Administrator without any special notice (consent) of Users. The current version of the Policy is posted on the Internet at: https://letteros.com/privacy-policy/.

2.5. All changes and additions to this Policy come into force the next day after the new version of the Policy is posted at: https://letteros.com/privacy-policy/.

2.6. Continued use of the Site after changes and/or additions to this Policy will constitute the User’s acceptance and consent to such changes and/or additions.

2.7. If the User does not agree with the terms and conditions of the Policy and the rules for using the Site, he must immediately stop using the Site. Otherwise, use of the Site will mean the User’s unconditional and unconditional consent to the terms of this Policy.

2.8. By providing Users with the opportunity to use the Site, the Administrator, acting reasonably and in good faith, assumes that the User:

• before using the Site, carefully read the terms of this Policy;
• has all the necessary rights to register and log in to the Site and use its functionality;
• by starting to use the Site, he expressed his agreement with the terms of this Policy and assumed the rights and obligations specified in it;
• understands that information transferred to him by another User cannot be deleted by him independently;
• understands and is aware that in the process of using the Site, information posted by the User about himself may be available to other Users, while the Operator is not responsible for the actions of third parties;
• regularly checks the terms of this Policy for changes and/or additions.

2.9. With each access and/or actual use of the Site, the User:

• agrees with this Policy in full, without reservations or exceptions;
• confirms that this Policy will apply to his use of the Site from the moment of access and/or actual use;
• assumes the rights and obligations regulated by this Policy, which is an agreement between the User and the Administrator;
• confirms and agrees that this Policy shall apply to all personal data transmitted by it to the Administrator.

2.10. This Policy applies only to the Administrator and the Administrator’s Site. The Administrator does not control and is not responsible for third party sites to which a visitor or user can follow links available on the Site.

2.11. The processing of Personal Data may be carried out by the Administrator jointly with another operator for the processing of Personal Data.

2.12. The Administrator is the Operator for the processing of Personal Data, except in cases where the functions for processing Personal Data are transferred to another person on the basis of an agreement concluded with such person.

3. PURPOSE OF COLLECTION AND PROCESSING OF PERSONAL DATA

3.1. Personal data is processed by the Operator solely for the purposes for which it was provided, including for:

• conclusion, execution, modification and termination of contracts with the Operator;
• identification of the User registered on the Site to place an order and (or) conclude an Agreement;
• provision of consulting, information and other services;
• communications with other Users and the Administrator;
• receiving consulting support;
• warnings and suppression violations of contracts concluded with the Administrator, and other illegal or unauthorized actions of Users or third parties;
• organizations participation of Users in events and surveys organized by the Administrator;
• compliance with the requirements of the legislation of the Russian Federation;
• analyzing data in order to improve the functionality and quality of the Site;
• organizing the storage and destruction of information sources, including those containing Personal Data of Users;
• ensuring the functioning and security of the Site;
• improving the functioning of the Site;
• development of new Site tools;
• ensuring interaction between the User and the Administrator within the framework of marketing offers that may be of interest to the User (except in cases where the User has refused marketing mailings, or the Administrator is allowed to distribute them by virtue of applicable law);
• verifying the User’s identity in order to protect against fraud and confirm the legality of using the Site;
• achieving other goals with the consent of Users.

4. RIGHTS AND OBLIGATIONS OF THE PARTIES

4.1. The operator has the right:

4.1.1. Independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the legislation of the Russian Federation in relation to Personal Data;

4.1.2. Entrust the processing of Personal Data to another person with the consent of the User, unless otherwise provided by federal law, on the basis of an agreement concluded with this person;

4.1.3. If the User withdraws consent to the processing of Personal Data, the Operator has the right to continue processing Personal Data without the User’s consent if there are legal grounds for doing so.

4.2. The operator is obliged:

4.2.1. Organize the processing of Personal data in accordance with the requirements of the legislation of the Russian Federation;

4.2.2. Respond to requests and requests from Users in accordance with the requirements of the legislation of the Russian Federation;

4.2.3. Report to the authorized body for the protection of Users’ rights (Federal Service for Supervision in the Field of Communications, Information Technologies and Mass Communications (Roskomnadzor)) at the request of this body the necessary information in accordance with current legislation.

4.3. The user has the right:

4.3.1. Receive information regarding the processing of his Personal Data;

4.3.2. Require the Operator to clarify his Personal Data, block it or destroy it if the Personal Data is incomplete, outdated, or inaccurate. If inaccuracies in personal data are identified, the User can update them independently by sending a notification to the Operator to the Operator’s email address [email protected] marked “Updating personal data”.

4.3.3. Refuse to process the User’s Personal Data by the Operator by sending a corresponding request to [email protected] “Withdrawal of consent to the processing of personal data.” In this case, the User is obliged to stop using the Site;

4.3.4. Take measures provided by law to protect your rights.

4.4. The user is obliged:

4.4.1. Provide reliable, complete and up-to-date information on all issues requested on the Site;

4.4.2. Strictly comply with all requirements of the legislation of the Russian Federation;

4.4.3. Comply with the requirements and comply with the terms of this Policy and other documents posted on the Site;

4.4.4. Do not use the information located on the Site for the purpose of distribution;

4.4.5. Do not use obscene language, erotic, offensive images and texts, information and statements that contain threats, provoke cruelty, hatred, disrespect or may lead to illegal actions, as well as other information and other statements that do not comply with generally accepted standards of morality and ethics;

4.4.6. Do not take actions that may restrict access to the Site.

4.5. Failure to include in this Policy any of the rights and (or) obligations of the Operator and/or User established by current legislation and other regulatory legal acts cannot be considered as a waiver of the exercise of these rights or the fulfillment of these obligations.

4.6. Control over compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing the processing of personal data by the Operator.

4.7. Responsibility for violation of the requirements of the legislation of the Russian Federation and regulations of the Company in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation

5. LIST OF PERSONAL DATA PROCESSED

5.1. The Operator has the right to collect the following categories of Personal Data of the User:

• information provided by the User during registration and/or authorization on The site, in particular, first name, last name, telephone number, email address;

• information that is specified by the User for the purpose of placing an order and (or) concluding an agreement with the Administrator, in particular, but not limited to, last name, first name, patronymic, company name, email address, postal address, office address, mobile phone number, bank details;

• electronic data (HTTP headers, IP address, cookies, web beacons/pixels tags, browser ID data, hardware and software information);

• information posted by the User when sending a message to the service Administrator support;

• date and time of access to the Site;
• information about the User’s activity while using the Site, about behavioral actions of the User;

• other User information necessary for processing in accordance with terms and conditions governing the use of the Site.

5.2. The operator also has the right to store:

• agreements concluded between Users and the Administrator;
• applications for concluding a contract sent by users;
• recordings of telephone conversations and email correspondence.

5.3. The operator also processes technical and other information that automatically transmitted by the device with which the User uses Site saved in cookies that were sent to the device, information about the browser and its settings, date and time of access to the Site, addresses of requested pages, actions User on the Site, addresses of the page on which the advertising unit is located, referrer (address of the previous page), technical characteristics of the device User, IP address and other similar information. The operator processes the above information in order to improve the technical capabilities of the Site, study the analysis of user activity, and optimize the functioning of the Site.

The Site also collects and processes anonymized data about visitors (including cookies) using Internet statistics services (Yandex Metrica, Google Analytics and others).

Disabling cookies may result in the inability to access parts of the Site that require authorization. Operator uses cookie technology – small text files placed on the User’s computer (tablet, smartphone) in order to analyze his user activity. The information collected using cookies cannot identify the User, but can help the Operator improve the operation of the Site. Information about the Visitor’s use of this Site, collected through cookies, will be processed to evaluate site use, compile reports on site activity, and provide other services.

The user can refuse the use of cookies by selecting the appropriate settings in the browser. However, this may affect the operation of some features of the Site. By using the Site, the Visitor agrees to the processing of data about him in the manner and for the purposes specified above.

The Operator collects statistics about the IP addresses of Users. This information is used to identify and solve technical problems and to monitor the legality of financial payments.

6. PROCEDURE FOR OBTAINING (COLLECTING) PERSONAL DATA

6.1. The Operator receives all Personal Data of the User with his written consent, except in cases provided for by the legislation of the Russian Federation.

6.2. Consent to the processing of Personal Data is provided by the User in electronic or simple written form and is specific, substantive, informed, conscious and unambiguous.

6.3. The User’s consent to the processing of Personal Data is valid for five years from the date of its acceptance. After the expiration of the specified period, the consent is considered extended for every next five years in the absence of information about its withdrawal by the User.

6.4. Processing of the User’s Personal Data without his consent is carried out in the following cases:

• at the request of authorized state bodies in cases provided for by the legislation of the Russian Federation;
• if the Personal Data is publicly available;
• if their processing is carried out for the purpose of concluding and executing an agreement, one of the parties to which is the User himself;
• if the processing of Personal Data is carried out for statistical purposes, subject to the mandatory anonymization of Personal Data;
• in other cases provided by law.

6.5. The Operator does not receive or process the User’s Personal Data about his race, nationality, political views, religious or philosophical beliefs, health, or intimate life.

6.6. The User guarantees that the Personal Data he provides to the Operator is accurate. The Operator is not responsible for the unreliability of Personal data and other information provided by Users.

7. GROUNDS FOR PROCESSING PERSONAL DATA

7.1. The Operator processes Personal Data and other information provided User at:

• registration and conclusion of agreements with the Administrator, sending applications for the conclusion of agreements with the Administrator;
• each access and/or actual use of the Site;
• subscribing to the Administrator’s newsletters;
• completing surveys and participating in studies organized by the Administrator;
• contacting the Administrator’s support service;
• implementation of rights and obligations arising from the legislation of the Russian Federation.

7.2. The Operator processes Personal Data and other information provided User, if at least one of the following conditions is met:

• processing is carried out with the consent of the User;
• processing is necessary for the conclusion, execution, modification or termination of contracts concluded between the Administrator and User;
• processing is carried out in connection with participation in legal proceedings or for the execution of an act subject to execution in accordance with the legislation on enforcement proceedings;
• processing is necessary to exercise the rights and legitimate interests of the Administrator, other Users or third parties;
• processing is necessary to perform the functions, powers and duties assigned to the Administrator by the legislation of the Russian Federation.

7.3. Processing of Personal Data is carried out based on the principles:

• the legality of the purposes and methods of processing Personal Data;
• limiting the processing of Personal Data to the achievement of specific, predetermined and legitimate purposes;
• preventing the processing of Personal Data incompatible with the purposes of collecting Personal Data;
• compliance of the purposes of processing Personal Data with the purposes predetermined and stated when collecting Personal Data, as well as with the powers of the Operator;
• compliance of the volume and nature of the Personal Data processed, methods of processing Personal Data for the purposes of processing Personal Data.

8. PROTECTION OF USERS’ PERSONAL DATA

8.1. The protection of the User’s Personal Data is carried out at the expense of the Administrator in the manner established by the legislation of the Russian Federation.

8.2. The Operator takes all possible and necessary legal, technical and organizational measures in order to protect the User’s Personal Data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, as well as from other unlawful actions. These measures, in particular, include:

• obtaining consent from Users to process their Personal Data, except for cases provided for by the legislation of the Russian Federation;
• analysis of the security status of the Site;
• detection and prevention of intrusions into the functioning of the Site;
• monitoring actions with Personal data;
• other measures provided for by legislation in the field of Personal Data.

8.3. Access to the User’s Personal Data may also be provided to the Administrator’s employees who need Personal Data in connection with the performance of their job duties.

9. TRANSFER OF PERSONAL DATA TO THIRD PARTIES.

9.1. In the manner prescribed by current legislation, the User’s Personal Data may be transferred to third parties to achieve the goals specified in Section 3 of this Policy. Such third parties may include:

• Any government body of the Russian Federation, government body of the constituent entities of the Russian Federation, local government body and other official bodies, including regarding which the Administrator is obliged to provide information in accordance with applicable law Russian Federation upon request;
• third parties, if the User has agreed to the transfer of Personal Data;
• in other cases, provided for by law.

10. STORAGE AND DESTRUCTION OF INFORMATION

10.1. The storage of Personal Data means the existence of records in information systems and on tangible media.

10.2. The User’s Personal Data may be stored for as long as it is necessary to fulfill the purposes for which it was collected, unless otherwise provided by federal laws of the Russian Federation.

10.3. The Operator closes access and prohibits the use of Personal Data that is no longer required to use the Site, support Users, improve the quality of service and other operational purposes. Such data is used solely to comply with these requirements, ensure security, and detect and prevent fraud.

10.4. The Operator may retain certain information if necessary to further its legitimate business interests, such as preventing fraud and ensuring the safety and security of Users.

10.5. Destruction of the User’s Personal Data implies termination of any access to Personal Data.

10.6. If the User’s Personal Data is destroyed, the Administrator’s employees cannot access his Personal Data of the subject in the information systems of the Site.

10.7. When Personal Data is destroyed, Personal Data in information systems is anonymized. Destroyed Personal Data can not be restored.

10.8. The operation of destroying Personal data is irreversible.

11. PUBLIC DATA

11.1. The Operator prohibits collecting, extracting, recording, systematizing, storing, transmitting, distributing, copying, reproducing or otherwise using for any other commercial or non-commercial purposes the data that the User has made publicly available.

11.2. The Operator is not responsible for the actions of third parties in relation to any information posted on the Site in the public domain, including its accuracy.

11.3. The user bears all risks associated with such posting of publicly available information.

12. TERMS FOR PROCESSING PERSONAL DATA

12.1. The Operator stops processing Personal Data:

• upon achievement of the purposes of processing or in case of loss of the need to achieve these purposes;
• if there are no other legal grounds for processing Personal Data provided for by the legislation of the Russian Federation;
• upon expiration of the User’s consent to the processing of Personal Data or in the event of withdrawal of such consent, unless there are other legal grounds for processing provided for by the legislation of the Russian Federation;
• in case of detection of unlawful processing of Personal data, if it is impossible to ensure the legality of processing;
• in case of liquidation of the Administrator.

12.2. Upon expiration of the storage period, Personal Data may be anonymized in information systems and destroyed on paper in the manner established by the current legislation of the Russian Federation.

13. USER REQUESTS

13.1. Users has the right to send their requests to the Administrator, including requests regarding the use of their Personal Data, by sending a message to:

• in simple written form to the following address: 195027, St. Petersburg, st. Yakornaya, 13, letter A, room/ext. room 8-N/16, office 409
• in electronic form to the Administrator’s email: [email protected]

13.2. The administrator undertakes to consider and send a response to the received request User within the time limits established by law.

14. INFORMATION ABOUT THE ADMINISTRATOR:

Limited Liability Company “LETEROS”

TIN:7806587362

OGRN:1217800087075

Address:195027, St. Petersburg, st. Yakornaya, 13, letter A, room/ext. room 8-N/16, office 409

e-mail: [email protected]

Publication date: March 15, 2024

Effective date: March 15, 2024