Privacy and Personal Data Processing Policy at Fornex

Terms and Definitions

In this Privacy and Personal Data Processing Policy (hereinafter, the Policy), the following terms shall have the following meanings:

Controller – Sole Proprietor Oleg Alexandrovich Lavkov, located at: 9 Sergeya Makeeva St., Bld. 4, Apt. 59, Moscow, 123100, Russia, who processes personal data and determines the purposes of such processing, the composition of personal data to be processed, and the actions performed with data via the website https://fornex.com/ru (the Website).

User – a natural person (data subject) who:

provided their personal data on the Controller’s Website, including legal representatives;
submitted a request, complaint, proposal, or statement to the Controller;
is an employee of the Controller or a job candidate.

Policy – this document governing the procedures for processing and securing personal data.

General Provisions

We collect, use, and protect personal data (information directly or indirectly related to you) that you provide while using our Website, through any device or communication form, in accordance with this Policy.

By using our Website and providing us with your personal data, you consent to its processing in accordance with this Policy.

Legal Grounds for Processing

The Controller processes personal data on the basis of:

The Constitution of the Russian Federation;
The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108, signed in Strasbourg on January 28, 1981);
Federal Law of the Russian Federation No. 152-FZ of July 27, 2006 “On Personal Data”;
Other applicable federal laws and regulations of the Russian Federation that establish the conditions and specific features of personal data processing and ensure the security and confidentiality of such information;
And your consent, given when registering or using the Website.

What Data We Collect and Why

Through the Website, we collect the following personal data from both unregistered and registered users:

Purpose of Personal Data Processing	Personal Data Collected
Informing about the Controller, our services and events, conducting surveys, providing you with news materials, maintaining communication with you.	Personal data you provide via forms on the website: name, phone, email, and when subscribing to news.
Fulfilling contracts between you and the Controller, such as the User Agreement and terms of specific services; fulfilling the Controller’s legal obligations; registering you on the Website to provide access to its sections, including account creation.	Personal data you provide for registration and contract conclusion: last name, first name, patronymic, date and place of birth, email address, password, phone number, address, TIN, passport or other ID document details, payment card and other payment information, and any other information you provide.
Recruitment and selection of candidates for employment with the Controller.	Personal data you provide in response to our job vacancies: name, phone number, email address, age, education and work experience details, address, and other personal data.
Compiling website visit statistics; ensuring the operation and security of the Website; improving the Controller’s services.	Technical data automatically transmitted by your device when using the website, including: device model, OS and browser information, IP address, cookies, browser, date and time of visit, search history.

Methods of Data Processing

Data is processed both automatically and manually through: collection, recording, systematization, accumulation, storage, updating, retrieval, transmission (provision/access), anonymization, blocking, deletion, and destruction.

We do not publicly disclose your personal data. Automated processing does not serve as the sole basis for decision-making that affects your legal rights or interests or otherwise impacts your rights and lawful interests.

The Controller carries out the recording, systematization, accumulation, storage, updating (renewal, modification), and retrieval of personal data of Russian citizens using databases located within the territory of the Russian Federation.

Data Retention Periods

We retain your data until the purposes of processing are achieved, or:

- you request its deletion or the cessation of processing; - the data is found to be unlawfully obtained or unnecessary; - there are no other lawful grounds for processing under the legislation of the Russian Federation.

After the expiration of data retention periods, personal data shall be subject to destruction or blocking.

Your Rights

To safeguard your rights and freedoms, we undertake, upon your request, to:

- Confirm whether we process your data and provide it within 10 business days (with a possible justified extension up to 5 more days); - Disclose the source and scope of your personal data, as well as the measures taken by the Controller to fulfill its obligations in the field of personal data processing in accordance with legal requirements; - Rectify, block, or delete data that is incomplete, outdated, inaccurate, or unlawfully obtained and notify you about the measures taken; - Inform about any completed or intended cross-border transfers of personal data; - Provide the name and location of the organizations that have third-party access to your personal data and to which such data may be disclosed with your consent; - Provide the full name and address of the individuals to whom the processing of your personal data may be entrusted with your consent; - Unsubscribe you from newsletters; - Cease processing of your personal data within 30 days of receiving your consent withdrawal, unless other legal grounds apply in accordance with the legislation of the Russian Federation.

How We Protect Your Data

We take all necessary legal, organizational, and technical measures required by Russian law, including:

- Regular assessment of security measures; - Identification and mitigation of current threats, related to the processing of your personal data in information systems; - Prevention and response to unauthorized access, cyberattacks, and incidents related to personal data security; - Adoption of internal data protection regulations; - Staff training and access control.

Third-Party Access

Your personal data may only be disclosed to third parties with your consent, unless otherwise required by law.

Cross-Border Data Transfers

We may transfer your data to foreign countries. We are committed to ensuring the security of your data in the context of cross-border data transfers. We implement all appropriate safeguards to ensure the confidentiality and protection of your personal data.

Transfers to countries without adequate protection are only allowed with your written consent or to perform a contract to which you are a party, or otherwise as permitted under the legislation of the Russian Federation on personal data.

Third-Party Links

Our Website may contain links to third-party websites or services that are not under our control. We are not responsible for the security and/or confidentiality of any information collected by such third-party websites and/or services.

Policy Updates

This Policy may be updated from time to time. We recommend checking for changes periodically. Continued use of the Website implies your acceptance of the updates.

Contact Us

If you have any questions or requests related to this Policy or the processing of your personal data, please contact us at: support@fornex.com