Appendix No. 1

to Order No. 43-p dated 01.10.2026

On Approval of the Personal Data Processing Policy, Cookie Policy, and Consent Forms

 

APPROVED

by order of the Director General

Autonomous Non-Profit Organization «Smolensk Region Export Support Center»

dated 05.10.2026 No. 43-p

 

POLICY

on Personal Data Processing

of the Autonomous Non-Profit Organization «Smolensk Region Export Support Center»

Version dated 05.10.2026

 

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter referred to as the «Policy») specifies, for each purpose of personal data processing, the categories and list of personal data processed, categories of data subjects, legal grounds, methods and periods of processing and storage, the procedure for destruction of personal data, as well as the rights of personal data subjects and measures to protect personal data at the Autonomous Non-Profit Organization «Smolensk Region Export Support Center» (hereinafter referred to as the «Operator» or the «Center»).

1.2. This Policy has been developed in accordance with Clause 2 of Part 1 and Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 «On Personal Data» (hereinafter referred to as the «Personal Data Law») and applies to all personal data processed by the Operator and obtained through the websites and https://ved.export67.com (hereinafter collectively referred to as the «Website»), Yandex Forms, as well as by telephone, email, on paper, and through personal contact.

1.3. The Policy is published on the Website and is freely accessible at /privacy_policy/ and https://ved.export67.com/privacy_policy/. The Cookie Policy (Appendix No. 1) forms an integral part of this Policy.

1.4. Where required, consent to the processing of personal data is obtained separately from the Policy and other documents (Part 1 of Article 9 of the Personal Data Law). Visiting the Website does not, in itself, constitute consent to the processing of personal data.

1.5. This Policy does not apply to third-party websites linked from the Website (including exportcenter.ru and exportedu.ru). Personal data on those websites is processed by their respective owners.

2. Key Terms

2.1. The terms used in this Policy have the meanings established by Article 3 of the Personal Data Law, including:

• personal data (PD) — any information relating directly or indirectly to an identified or identifiable natural person (personal data subject);
• personal data processing — any action (operation) or set of actions performed on personal data, with or without automated means, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction;
• provision of personal data — actions aimed at disclosing personal data to a specific person or a defined group of persons;
• dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons;
• blocking of personal data — temporary suspension of personal data processing (except where processing is necessary to clarify personal data);
• destruction of personal data — actions making it impossible to restore the contents of personal data in an information system and/or resulting in destruction of physical data carriers;
• cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign natural person, or a foreign legal entity;
• cookies — small pieces of data stored on a visitor’s device by the Website or a third-party service and read upon subsequent visits.

3. Information About the Operator

Name	Autonomous Non-Profit Organization «Smolensk Region Export Support Center» (ANO «Smolensk Region Export Support Center»)
Registration details	Taxpayer Identification Number (INN) 6732143784, Primary State Registration Number (OGRN) 1176733007186, Tax Registration Reason Code (KPP) 673201001
Registered address (location)	23 Engels Street, Smolensk, Smolensk Region, 214014, Russia
Mailing address	23 Normandie-Niemen Street, 2nd Floor, Smolensk, Smolensk Region, 214030, Russia
Telephone, email	+7 (4812) 67-20-90, info@export67.com
Person responsible for organizing personal data processing	Evgeny Viktorovich Sitkov, Deputy Director General for Exporter Relations, appointed by Order No. 43-p dated 05.10.2026. Requests should be sent to info@export67.com with the subject «Personal Data» or to the Operator’s mailing address
Registration number in the register of personal data operators	67-17-000851

4. Legal Grounds and Principles of Processing

4.1. The Operator processes personal data on the basis of and in compliance with the Constitution of the Russian Federation, the Labor Code of the Russian Federation, the Tax Code of the Russian Federation, the Personal Data Law, Federal Law No. 7-FZ of 12.01.1996 «On Non-Profit Organizations», Federal Law No. 209-FZ of 24.07.2007 «On the Development of Small and Medium-Sized Enterprises in the Russian Federation», Federal Law No. 402-FZ of 06.12.2011 «On Accounting», Federal Law No. 125-FZ of 22.10.2004 «On Archival Affairs in the Russian Federation», the Center’s Charter, contracts and agreements to which the data subject is a party, and the consent of personal data subjects.

4.2. Processing is carried out lawfully and fairly and is limited to achieving specific, predetermined, legitimate purposes. Processing incompatible with the purposes of collection, combining databases processed for incompatible purposes, and processing personal data excessive in relation to the stated purposes are prohibited (Article 5 of the Personal Data Law).

4.3. Personal data is stored in a form permitting identification of the data subject for no longer than required by the purposes of processing, unless a retention period is established by federal law or contract. Personal data is destroyed once the purposes of processing have been achieved or the need to achieve them no longer exists.

5. Categories of Personal Data

5.1. The Operator does not process special categories of personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life. Health information is processed only in relation to employees and to the extent prescribed by labor legislation (Clause 2.3 of Part 2 of Article 10 of the Personal Data Law).

5.2. The Operator does not process biometric personal data. Photographs and videos posted on the Website are not used to establish identity.

5.3. The Website and the Operator’s forms are not intended for persons under 18 years of age. If such data is received, the Operator destroys it, except where consent has been given by a legal representative.

6. Purposes of Processing; Categories and List of Personal Data; Categories of Data Subjects; Grounds and Retention Periods

The following conditions are established for each processing purpose. Personal data obtained for one purpose is not used for another purpose without a separate legal basis.

6.1. Review of Inquiries and Applications, and Provision of Advice

on Export Activities

Categories of data subjects	Individuals who have submitted inquiries; individual entrepreneurs; representatives (managers and employees) of legal entities that have submitted inquiries
List of personal data	Surname, first name, patronymic (or first name); email address; telephone number; city; name of organization or individual entrepreneur, position; content of inquiry and other information provided by the data subject in the inquiry
Sources	«Submit an Application» form on the Website, email, telephone, written inquiry or in-person request
Legal grounds	Consent of the personal data subject (Clause 1 of Part 1 of Article 6 of the Personal Data Law); for inquiries received outside the Website, also preparation to provide a service at the initiative of the data subject (Clause 5 of Part 1 of Article 6 of the Personal Data Law)
Processing method	Combined manual and automated processing with transmission via the Operator’s internal network and the Internet
Processing and retention period	1 (one) year from the date a response to the inquiry is sent, or until withdrawal of consent if withdrawn earlier. Destruction is performed in accordance with Section 8 of the Policy.

 

6.2. Review of Applications, Conclusion and Performance of Service Agreements and Contracts,

including Organizing Participation in Events, Business Missions, Exhibitions, Training Programs, and Competitions

Categories of data subjects	Individuals registered as self-employed; individual entrepreneurs; managers and contact persons (representatives) of business entities; event participants and their representatives
List of personal data	Surname, first name, patronymic; position; telephone number; email address; name of organization or individual entrepreneur, INN, OGRNIP (for individual entrepreneurs); information about products, their classification (HS/EAEU Commodity Nomenclature of Foreign Economic Activity code), target countries, and the year export activities began; information about services of interest; for recipients of commercial services, bank details; signature; other information required by event registration forms or competition questionnaires
Sources	«Service Application» and «Submit an Application» forms on the Website, event registration forms on the Website and in Yandex Forms, paper applications and questionnaires, email
Legal grounds	Consent of the personal data subject (Clause 1 of Part 1 of Article 6 of the Personal Data Law); conclusion and performance of a contract to which the personal data subject is a party or beneficiary (Clause 5 of Part 1 of Article 6 of the Personal Data Law); performance of functions assigned to the Operator under Russian Federation law (Clause 2 of Part 1 of Article 6; Federal Law No. 209-FZ)
Processing method	Combined manual and automated processing with transmission via the Operator’s internal network and the Internet
Processing and retention period	If the service was not provided: 30 (thirty) days from the decision on or withdrawal of the application. If the service was provided: 5 (five) years after the end of the year in which it was provided (Article 29 of Federal Law No. 402-FZ of 06.12.2011 «On Accounting»; List of Standard Administrative Archival Documents approved by Order No. 236 of the Federal Archival Agency dated 20.12.2019). For registration for an event where participation is not recorded as a service provided: 1 (one) year after the event date. Destruction is performed in accordance with Section 8 of the Policy.

 

6.3. Recording Services and Support Measures Provided, Preparing Reports

and Maintaining Registers of Recipients of Services and Support Measures

Categories of data subjects	Individuals registered as self-employed, individual entrepreneurs; managers and contact persons (representatives) of business entities
List of personal data	Surname, first name, patronymic; position; name of organization or individual entrepreneur, INN; contact telephone number and email address; type, form, amount and duration of support provided; information on export activity results required for reporting
Legal grounds	Performance of functions and obligations assigned to the Operator by Russian Federation legislation and agreements concluded with executive authorities of the Russian Federation or a constituent entity of the Russian Federation (Clause 2 of Part 1 of Article 6 of the Personal Data Law; Article 8 of Federal Law No. 209-FZ)
Recipients	Founder: Ministry of Economic Development of the Smolensk Region; JSC Russian Export Center (including through the «GOSUSLUGI VED» information system); authorities and organizations authorized to maintain the unified register of small and medium-sized enterprises receiving support
Processing method	Combined manual and automated processing with transmission via the Operator’s internal network and the Internet
Processing and retention period	5 (five) years after the end of the year in which reporting is submitted, unless a different period is established by an agreement concluded with executive authorities of the Russian Federation or a constituent entity thereof. Destruction is performed in accordance with Section 8 of the Policy.

 

6.4. Providing Information on Support Measures, Events and Center Services (Information Mailing List)

Categories of data subjects	Persons who have separately consented to receive the mailing list
List of personal data	Surname, first name, patronymic (or first name); email address; name of organization
Legal grounds	Separate consent of the personal data subject (Clause 1 of Part 1 of Article 6 and Article 15 of the Personal Data Law); Article 18 of Federal Law No. 38-FZ of 13.03.2006 «On Advertising»
Processing method	Automated processing with transmission over the Internet
Processing and retention period	Until withdrawal of consent (unsubscription), but no more than 3 (three) years from the date consent was obtained. Destruction is performed in accordance with Section 8 of the Policy.

 

6.5. Collection of Website Traffic Statistics and Analysis of Website Use

Categories of data subjects	Website visitors who have consented to the use of analytics cookies
List of personal data	Cookies and visitor identifiers (ClientID); IP address; browser, operating system and device information; screen resolution; language; date and time of visit; pages viewed and actions taken on them; referral source; approximate location determined from the IP address
Legal grounds	Consent of the personal data subject expressed through the Website cookie banner (Clause 1 of Part 1 of Article 6 of the Personal Data Law)
Processing method	Automated processing using the Yandex Metrica service, with transmission over the Internet
Processing and retention period	Until withdrawal of consent, but no more than 12 (twelve) months from the date it was obtained. Destruction is performed in accordance with Section 8 of the Policy. See the Cookie Policy for details.

 

6.6. Publication on the Website and in the Center’s Official Communities of Information

About Competition Participants and Winners, and Event Photo and Video Materials

Categories of data subjects	Competition participants and winners, event participants, Center employees
List of personal data	Surname, first name, patronymic; position; name of organization; likeness in photographs and videos (not used to establish identity)
Legal grounds	Separate consent to the processing of personal data authorized by the data subject for dissemination (Article 10.1 of the Personal Data Law)
Processing method	Combined manual and automated processing with transmission over the Internet
Processing and retention period	Until withdrawal of consent, but no more than 3 (three) years from the date of publication. Destruction is performed in accordance with Section 8 of the Policy.

 

6.7. Personnel and Accounting Records, Performance of Employment Contracts

Categories of data subjects	Current and former employees; employees’ family members where provided for by law
List of personal data	Surname, first name, patronymic; date and place of birth; sex; citizenship; identity document details; registered and residential address; SNILS (individual insurance account number); INN; information on education, qualifications and employment history; marital status and family members; military registration information; income information and bank details; contact details; health information to the extent provided for by labor legislation
Legal grounds	Clauses 2 and 5 of Part 1 of Article 6, Clause 2.3 of Part 2 of Article 10 of the Personal Data Law; Labor Code of the Russian Federation; Tax Code of the Russian Federation; Federal Law No. 402-FZ; Federal Law No. 27-FZ of 01.04.1996; Federal Law No. 53-FZ of 28.03.1998; employee consent for the transfer of data to a bank and for dissemination
Processing method	Combined manual and automated processing with transmission via the Operator’s internal network and the Internet (including when submitting reports)
Processing and retention period	During the term of the employment contract; after its termination, according to document retention requirements: personnel records for 50 (fifty) years (Article 22.1 of Federal Law No. 125-FZ of 22.10.2004 «On Archival Affairs in the Russian Federation»), accounting records for 5 (five) years. Destruction is performed in accordance with Section 8 of the Policy.

 

6.8. Recruitment

Categories of data subjects	Candidates for vacant positions
List of personal data	Surname, first name, patronymic; date of birth; contact details; education, qualifications, and work experience; other information provided by the candidate in their résumé
Legal grounds	Consent of the data subject (Clause 1 of Part 1 of Article 6)
Processing method	Combined manual and automated processing
Processing and retention period	30 (thirty) days from the date of a decision regarding the candidate; where the candidate consents to inclusion in the talent pool, 1 (one) year. Destruction is performed in accordance with Section 8 of the Policy.

 

6.9. Conclusion and Performance of Contracts with Counterparties

Categories of data subjects	Individuals who are parties to civil-law contracts; individual entrepreneurs; representatives of counterparties
List of personal data	Surname, first name, patronymic; position; contact details; for individuals who are parties to a contract: identity document details, registered address, INN, SNILS, bank details
Legal grounds	Clause 5 of Part 1 of Article 6 (conclusion and performance of a contract); Clause 2 of Part 1 of Article 6 (Tax Code of the Russian Federation; Federal Law No. 402-FZ)
Processing method	Combined manual and automated processing with transmission via the Operator’s internal network and the Internet
Processing and retention period	5 (five) years after the end of the year in which the contract was performed. Destruction is performed in accordance with Section 8 of the Policy.

 

7. Processing Procedure and Conditions

7.1. The Operator performs the following operations on personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction. Dissemination takes place only in the cases specified in Clause 6.6 and only with consent under Article 10.1 of the Personal Data Law.

7.2. Recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation (Part 5 of Article 18 of the Personal Data Law). The Website database is hosted by WebCanape (Twins LLC, INN: 6731067957). The Operator does not use foreign services (including forms, cloud storage, email services, or messengers) to collect or store personal data.

7.3. The Operator does not transfer personal data across borders. The Website does not use foreign analytics software, advertising pixels, or other services that transfer data outside the Russian Federation.

7.4. The Operator entrusts personal data processing to the following entities under contracts containing the conditions stipulated by Part 3 of Article 6 of the Personal Data Law (the list of personal data and operations performed, purposes of processing, obligation to maintain confidentiality, ensure security in accordance with Article 19 of the Law, and notify the Operator of incidents):

• Yandex LLC (INN 7736207543, 16 Leo Tolstoy Street, Moscow, 119021, Russia) — Yandex Metrica web analytics service (purpose 6.5) and Yandex Forms service (purpose 6.2); data is stored on servers in the Russian Federation;
• WebCanape (Twins LLC, INN: 6731067957) — hosting of the Website and its database, and technical support for the Website.

7.5. The Operator provides personal data without the data subject’s consent in cases prescribed by law: to the founder, JSC Russian Export Center, and authorities and organizations maintaining registers of support recipients (purpose 6.3); tax authorities, the Social Fund of Russia, and military registration and enlistment offices (purpose 6.7); courts, law enforcement agencies, and other government bodies upon request within their statutory powers. Employees’ personal data is transferred to a bank for salary payments with their consent.

7.6. The Operator records consent received via the Website forms, including the date and time, the form used, and the version of the consent text.

8. Procedure for Destruction and Blocking of Personal Data

8.1. Personal data is destroyed within no more than 30 (thirty) days after the purpose of processing has been achieved, the period specified in Section 6 has expired, or consent has been withdrawn, unless otherwise provided by federal law or contract (Parts 4 and 5 of Article 21 of the Personal Data Law). If unlawful processing that cannot be remedied is identified, data is destroyed within no more than 10 (ten) business days (Part 3 of Article 21). If a data subject requests termination of processing, processing shall cease within no more than 10 (ten) business days, with a possible extension of 5 (five) business days (Part 5.1 of Article 21).

8.2. If destruction is not possible within the specified period, the Operator blocks the personal data and destroys it within no more than 6 (six) months, unless a different period is established by federal law (Part 6 of Article 21).

8.3. Personal data stored electronically is destroyed by irreversible deletion from the Website database, email accounts, Yandex Metrica and Yandex Forms services, and the Operator’s accounting and file systems. Paper records are destroyed by shredding.

8.4. Destruction is carried out by a commission appointed by an order of the Operator. Destruction is confirmed by a certificate of personal data destruction. For automated processing, an extract from the event log is attached to the certificate. Documentation requirements are established by Roskomnadzor Order No. 179 of 28.10.2022. Certificates and log extracts are retained for 3 (three) years.

8.5. If inaccurate personal data or unlawful processing is identified, the Operator blocks the relevant data for the duration of the investigation. Corrections are made within no more than 7 (seven) business days from the date supporting information is provided.

9. Rights of Personal Data Subjects

9.1. A personal data subject has the right to:

• obtain the information specified in Part 7 of Article 14 of the Personal Data Law, including the purposes, legal grounds, methods, and periods of processing, and persons to whom data has been provided or processing entrusted;
• request correction, blocking, or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose;
• withdraw consent to the processing of personal data;
• request termination of personal data processing, including termination of mailings (Article 15);
• appeal the Operator’s actions or omissions to Roskomnadzor or a court.

9.2. A request shall be submitted in writing to the Operator’s mailing address or as an electronically signed document to info@export67.com. The request must contain: the number of the primary identity document of the data subject or their representative, information on the date of issue and issuing authority; information confirming the data subject’s relationship with the Operator (for example, application date or contract number); and the signature of the data subject or their representative.

9.3. The Operator responds to a request within 10 (ten) business days of receipt. This period may be extended by no more than 5 (five) business days if a reasoned notice is sent to the data subject.

9.4. Consent may be withdrawn by sending a request to info@export67.com or to the Operator’s mailing address. Withdrawal of consent does not affect the processing of personal data carried out on other lawful grounds.

10. Measures to Ensure Personal Data Security

10.1. The Operator takes the measures stipulated by Articles 18.1 and 19 of the Personal Data Law, including:

• appointing a person responsible for organizing personal data processing;
• issuing internal regulations on personal data processing and obtaining employees’ signed acknowledgment of them;
• conducting internal checks of compliance of personal data processing with legal requirements;
• assessing potential harm to data subjects (Roskomnadzor Order No. 178 of 27.10.2022);
• identifying security threats and the required level of personal data protection in information systems (Resolution No. 1119 of the Government of the Russian Federation dated 01.11.2012) and applying organizational and technical safeguards (Order No. 21 of the Federal Service for Technical and Export Control of Russia dated 18.02.2013);
• restricting access to personal data, maintaining an inventory of machine-readable media, ensuring data backup and recovery, and using a secure HTTPS connection on the Website;
• ensuring separate storage of physical media containing personal data processed for different purposes (Resolution No. 687 of the Government of the Russian Federation dated 15.09.2008).

10.2. If unlawful or accidental transfer (provision, dissemination, access) of personal data is identified, the Operator notifies Roskomnadzor of the incident within 24 (twenty-four) hours and reports the results of its internal investigation within 72 (seventy-two) hours (Part 3.1 of Article 21 of the Personal Data Law).

11. Final Provisions

11.1. The Policy is approved by order of the Center’s Director General and enters into force on the date of approval. The previously published «Privacy Policy» ceases to be effective on that date.

11.2. The Policy is reviewed whenever legislation or the purposes or conditions of personal data processing change, but at least once a year. A new version is published on the Website no later than its effective date.

11.3. Questions related to personal data processing should be sent to the person responsible for organizing personal data processing at info@export67.com.

 

Appendix No. 1. Cookie Policy for export67.com and ved.export67.com.