Privacy and Personal Data Processing Policy

In this Privacy and Personal Data Processing Policy (hereinafter, the Policy), the following terms have the following meanings:

Controller – Sole Proprietor Oleg Alexandrovich Lavkov, located at: 9 Sergeya Makeeva St., Bldg. 4, Apt. 59, Moscow 123100, Russia, who processes personal data and determines the purposes of processing, the composition of the personal data to be processed, and the actions performed with personal data via the website https://fornex.com/ (the Website).

User – a natural person (data subject) who:

• provided their personal data on the Controller’s Website, including their legal representatives;
• submitted an enquiry, complaint, proposal, or application to the Controller.

Policy – this document, which sets out the procedures for processing and securing personal data.

By using our Website and providing us with your personal data, you consent to its processing in accordance with this Policy.

The Controller processes personal data on the basis of:

• the Constitution of the Russian Federation;
• the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108, concluded in Strasbourg on 28 January 1981);
• Federal Law of the Russian Federation No. 152-FZ of 27 July 2006 "On Personal Data";
• other federal laws and regulations of the Russian Federation that set out the cases and specific features of personal data processing and ensure the security and confidentiality of such information;
• and your consent, given when registering on or using the Website.

We do not make your data publicly available. Automated processing of personal data is not the sole basis for any decisions that could produce legal consequences for you or otherwise affect your rights and legitimate interests.

The Controller carries out the recording, systematization, accumulation, storage, updating (renewal, modification), and retrieval of personal data of citizens of the Russian Federation using databases located within the territory of the Russian Federation.

• you request that we stop processing your personal data or that we destroy it;
• the personal data being processed was obtained unlawfully or is no longer necessary for the stated purpose of processing;
• unlawful processing of personal data is identified and its lawfulness cannot be ensured;
• there are no other legal grounds for processing provided for by the legislation of the Russian Federation.
  
  

Once the retention periods expire, the personal data is subject to destruction or blocking.

• confirm whether we process your personal data and provide it within 10 business days of your enquiry or of receiving a request from you or your representative; this period may be extended by no more than 5 business days, in which case we will send you a reasoned notice stating the grounds for the extension;
• inform you of the source and the composition of the personal data we process;
• provide information on the legal grounds, purposes, periods, and methods of processing your personal data, as well as the measures the Controller takes to fulfill its obligations regarding personal data processing in accordance with legal requirements;
• rectify, block, or destroy personal data that is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purpose of processing, and notify you of the measures taken;
• inform you of any cross-border transfers of personal data that have been carried out or are intended;
• provide the name and location of the organizations that have access to your personal data and to which it may be disclosed with your consent;
• provide the full name and address of the persons to whom the processing of your personal data may be entrusted with your consent;
• unsubscribe you from our newsletter upon request;
• stop processing your personal data within 30 days of receiving the withdrawal of your consent, unless there are other legal grounds for processing provided for by the legislation of the Russian Federation.

• regularly assessing the effectiveness of the security measures in place;
• identifying and mitigating current threats related to the processing of your personal data in information systems;
• detecting unauthorized access to personal data, as well as detecting, preventing, and remediating the consequences of cyberattacks on information systems, and responding promptly to personal data security incidents;
• adopting internal regulations on personal data security;
• familiarizing the Controller’s employees who have access to personal data with this Policy and the internal regulations, and controlling access to the data.

A cross-border transfer of personal data to countries that do not provide adequate protection of personal data is only permitted with your written consent, or to perform a contract to which you are a party, or in other cases provided for by the legislation of the Russian Federation on personal data.