Company’s Personal Data Protection Policy

1. General provisions

This document has been developed in accordance with the requirements of the Federal Law of the Russian Federation No. 152-FZ dated 27.07.2006 «On Personal Data» and defines the policy regarding the processing of personal data. The legal basis for the processing of personal data is the exercise of authority to organize the hiring of seafarers on ships of foreign shipowners.

2. Principles and conditions

of personal data processing Personal data processing is carried out on the basis of the following principles:

• • • processing of personal data is carried out on a legal and fair basis;
    • the processing of personal data is limited to the achievement of specific, predetermined and legitimate goals. Processing of personal data incompatible with the purposes of personal data collection is not allowed;
    • it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
    • only personal data that meet the purposes of their processing are subject to processing;
    • the content and volume of the processed personal data correspond to the stated purposes of processing. The processed personal data is not redundant in relation to the stated purposes of their processing;
    • when processing personal data, the accuracy of personal data, their sufficiency, and, if necessary, relevance in relation to the purposes of personal data processing is ensured;
    • the storage of personal data is carried out in a form that allows to determine the subject of personal data, no longer than the purposes of personal data processing require, unless the period of personal data storage is established by federal law, an agreement to which the party, beneficiary or guarantor is the subject of personal data. The processed personal data is subject to destruction or depersonalization upon achievement of the processing goals or in case of loss of the need to achieve these goals, unless otherwise provided by federal law.

The processing of personal data is carried out on the basis of the conditions provided for by the Federal Law of the Russian Federation No. 152-FZ of 27.07.2006 «On Personal Data».

3. Rights of personal data subjects

The subject of personal data has the right to demand clarification of his personal data, their blocking or destruction if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing, as well as to take measures provided by law to protect their rights.

In order to exercise the above rights, a personal data subject may, in accordance with the procedure established by Article 14 of the Federal Law of the Russian Federation No. 152-FZ of 27.07.2006 «On Personal Data», contact the company with a corresponding request.

If the subject of personal data believes that the Company processes his personal data in violation of the requirements of the Federal Law of the Russian Federation No. 152-FZ of 27.07.2006 «On Personal Data» or otherwise violates his rights and freedoms, the subject of personal data has the right to appeal the actions or inaction of the Company to a higher authority, to the prosecutor’s office or in a judicial all right.

In addition, the current legislation may impose restrictions and other conditions relating to the rights mentioned above.

4. Transfer of personal data

The Company does not provide or disclose information containing personal data of personal data subjects to a third party without the written consent of the personal data subject, except in cases where it is necessary to prevent threats to life and health, as well as in cases established by the legislation of the Russian Federation.

5. Measures to ensure the protection of personal data

The Company takes the necessary organizational and technical measures to protect personal data. The measures taken are based on the requirements of Articles 18.1, 19 of the Federal Law of the Russian Federation No. 152-FZ of 27.07.2006 «On Personal Data», as well as on the requirements of the resolutions of the Government of the Russian Federation establishing a list of measures aimed at ensuring the fulfilment of obligations provided for by Federal Law of the Russian Federation No. 152-FZ of 27.07.2006 «On Personal Data».

In order to coordinate actions to ensure the security of personal data, the company implements organizational and technical measures.

The following organizational measures have been implemented:

• • • persons responsible for organizing the processing of personal data, as well as for ensuring the security of personal data in personal data information systems have been appointed;
    • local acts on the organization and conduct of work to ensure the security of personal data have been developed and implemented.
    • Technical measures are being implemented aimed at:
    • prevention of unauthorized access to personal data processed in personal data information systems;
    • backup and recovery of personal data, software, information security tools in information systems of personal data modified or destroyed due to unauthorized access to them;
    • other necessary security measures.

6. Confidentiality guarantees

Employees of the company who, in connection with the performance of their functions, have become aware of the personal data of personal data subjects, are warned of possible disciplinary, administrative, civil or criminal liability in case of violation of the norms and requirements of the current legislation regulating the rules of processing and protection of personal data.

7. Responsibility

In case of non-compliance with the provisions of this document, the company is liable in accordance with the current legislation of the Russian Federation.

8. Final provisions

This document is publicly available.

This document is subject to change in the following cases:

• • • when changing the legislation of the Russian Federation in the field of personal data protection;
    • based on the results of monitoring compliance with the requirements for processing and ensuring the security of personal data;
    • by the decision of the management.

If significant changes are made to this document, unrestricted access to them will be provided to all interested subjects of personal data.