Personal Data Processing Policy

Policy of RPE Petroline-A LLC regarding the processing of personal data on the website httpsː//www.pla.ru
Approved by Order of RPE Petroline-A LLCNo. 22/25 dated November 10, 2025.
"On approval of the document defining the Personal Data Processing Policyonthe company's website."

1. General Provisions

1.1. This document (hereinafter referred to as the Policy) defines the policy of RPE Petroline-A LLC (hereinafter referred to as the Operator) regarding the processing of personal data on the company's official website located at httpsː//www.pla.ru and defines the purposes, content, and procedure for processing personal data, measures aimed at protecting personal data, as well as procedures aimed at identifying and preventing violations of the legislation of the Russian Federation in the field of personal data.

1.2. This policy on the processing of personal data has been drawn up in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as the Law on Personal Data). This policy is an integral part of the main document: "Personal Data Processing Policy of RPE Petroline-A LLC".

1.3. This Policy of the Operator regarding the processing of personal dataapplies to information that the Operator receives about visitors to the website httpsː//www.pla.ru via feedback forms.

2. Basic Concepts Used in the Policy

2.1. Personal data - any information relating directly or indirectly to a specific or identifiable individual (personal data subject).

2.2. Operator - a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and/or carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, and actions (operations) performed with personal data.

2.3. Processing of personal data - any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

2.4. Automated processing of personal data - processing of personal data using computer technology.

2.5. Dissemination of personal data - actions aimed at disclosing personal data to an indefinite circle of persons.

2.6. Provision of personal data - actions aimed at disclosing personal data to a specific person or a specific circle of persons.

2.7. Blocking of personal data - temporary cessation of processing of personal data (except in cases where processing is necessary to clarify personal data).

2.8. Destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the material carriers of personal data are destroyed.

2.9. Depersonalization of personal data - actions as a result of which it becomes impossible, without using additional information, to determine the ownership of personal data to a specific personal data subject.

2.10. Personal data information system - a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

2.11. Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual, or a foreign legal entity.

3. Basic Rights and Obligations of the Operator

3.1. The Operator has the right to:

• Receive from the User reliable information and/or documents containing personal data;
• In the event of the User's withdrawal of consent to the processing of personal data, as well as sending a request to cease processing personal data, the Operator has the right to continue processing personal data without the user's consent if there are grounds specified in the Law on Personal Data;
• Independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations provided for by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
• Transfer personal data to the bodies of inquiry and investigation, and other authorized bodies on the grounds provided for by the current legislation of the Russian Federation.

3.2. The Operator is obliged to:

• Provide the User, upon their request, with information concerning the processing of their personal data;
• Organize the processing of personal data in accordance with the procedure established by the current legislation of the Russian Federation;
• Respond to appeals and requests from Users and their legal representatives in accordance with the requirements of the Law on Personal Data;
• Report to the authorized body for the protection of the rights of personal data subjects, upon request from this body, the necessary information within the time limits established by law;
• Publish or otherwise ensure unrestricted access to this Policy regarding the processing of personal data;
• Take legal, organizational, and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions in relation to personal data;
• Stop the transfer (dissemination, provision, access) of personal data, stop processing and destroy personal data in the manner and in cases provided for by the Law on Personal Data;
• Fulfill other duties provided for by the Law on Personal Data.

4. Basic Rights and Obligations of Users

4.1.  Users have the right to:

Receive information concerning the processing of their personal data, except in cases provided for by federal laws. The information is provided to the User by the Operator in an accessible form and must not contain personal data relating to other personal data subjects, unless there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;

• Require the Operator to clarify their personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing, as well as take measures provided by law to protect their rights;
• Stipulate a condition of prior consent when processing personal data for the purpose of promoting goods, works, and services on the market;
• Withdraw consent to the processing of personal data, as well as to send a request to cease processing personal data;
• Appeal against unlawful actions or inaction of the Operator in the processing of their personal data to the authorized body for the protection of the rights of personal data subjects or in court;
• Exercise other rights provided for by the legislation of the Russian Federation.

4.2.  Users are obliged to:

• Provide the Operator with reliable data about themselves;
• Inform the Operator about the clarification (updating, modification) of their personal data.

Persons who have provided the Operator with unreliable information about themselves, or information about another personal data subject without the latter's consent, shall be held liable in accordance with the legislation of the Russian Federation.

5. Purposes of personal data processing

• Collection of information about user actions on the website;
• Use of cookies to identify registered users of the website, maintain statistics on website users and their requests, count the number of website visitors, and assess the technical capabilities of the website;
• Improving user interaction with the website;
• Processing inquiries from website users and representatives of counterparties:
• Formulating responses to requests from the User/representative of the counterparty via email and/or by phone;
• Informing the User/representative of the counterparty via email and/or by phone;
• High-quality targeted provision of services to the counterparty;
• Promotion of goods and services (with consent);
• Purposes arising from the objectives of the activity provided for by the Operator's constituent documents;
• For the Operator to carry out business activities by selling goods and services using the website, including for the purposes of:
• Selling goods and services to the Client;
• Conducting promotional campaigns, organizing contests, sweepstakes, and other incentive events (including determining winners, delivering prizes);
• Client participation in loyalty programs;
• Providing Clients with the opportunity to leave reviews on the website, as well as the opportunity to view reviews from other Clients;
• Ensuring communication with the Client, establishing feedback with the Client, including providing the Client with the opportunity to send notifications, messages, requests, and information regarding the use of the website and the possibility of purchasing goods on the website, providing Clients with the opportunity to receive support via the hotline phone and email;
• Sending informational messages to Clients about goods and services, about events organized by the Operator, about goods, works, services of the Operator's partners and third parties;
• Conducting statistical and other research by the Operator through the website and the Operator's Client services based on anonymized data, forming statistical reports.
• Advertising the Operator and its goods and services;
• Representing the interests of the Operator in state bodies and local self-government bodies.

6. Categories of personal data subjects

6.1.  website visitors;

6.2.  Individuals - Clients of the Operator purchasing goods and services from the Operator;

6.3.  Representatives and employees of legal entities - Clients of the Operator;

6.4.  Candidates for vacant positions.

7. Categories of processed data

7.1.  Personal data of a general category is subject to processing on the website:

• In the "Price Request" form:
• Name;
• Contact phone number;
• Email;
• Company name.

• In the "Technical Assistance" form:
• Name;
• Contact phone number;
• Email;

• In questionnaires:
• Name;
• Position;
• Contact phone number;
• Email;
• Company name.

7.2.  Automatically collected information:

• IP address;
• Cookies;
• Browser data;
• Technical characteristics of equipment;
• website pages visited, time and date of access.

8. Legal grounds for processing personal data

8.1.  When processing personal data, the Operator is guided by:

• The Constitution of the Russian Federation;
• The Civil Code of the Russian Federation;
• The Labor Code of the Russian Federation;
• Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and Information Protection";
• Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
• Decree of the Government of the Russian Federation No. 1119 of November 1, 2012 "On approval of requirements for the protection of personal data during their processing in personal data information systems";
• Order of the Federal Service for Technical and Export Control No. 21 of February 18, 2013 "On approval of the Composition and content of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems";
• Decree of the Government of the Russian Federation No. 687 of September 15, 2008 "On approval of the regulation on the specifics of processing personal data carried out without the use of automation tools";
• The Operator's Charter;
• This Policy;
• Consents to the processing of personal data received by the Operator from personal data subjects.

9. Processing of personal data 

9.1.  Actions with personal data:

• Collection, recording, copying, systematization of personal data;
• Accumulation and storage of data;
• Use, dissemination, analysis, and updating of information;
• Depersonalization, blocking, and destruction of personal information.

9.2.  Methods of processing:

• The Operator processes personal data using automation tools and without using them, complying with the requirements for automated and non-automated processing of personal data provided for by Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" and regulatory legal acts adopted in accordance with it;
• Explicit collection of data that the user fills in manually via feedback forms;
• If inaccuracies in personal data are detected, the User can update them independently by sending a notification to the Operator's email address main@pla.ru marked "Updating personal data";
• Automatic data collection. Many data are collected without the explicit consent of the user. Such methods include, for example, collecting IP addresses, cookies and trackers, device data, behavioral data.

9.3.  When processing personal data, the accuracy of personal data, their sufficiency, and, in necessary cases, relevance in relation to the purposes of processing personal data is ensured. The Operator takes necessary measures and/or ensures their adoption to delete or clarify incomplete or inaccurate data.

9.4.  The Operator does not process special categories of personal data concerning racial, national origin, political opinions, religious or philosophical beliefs, or intimate life.

9.5.  The Operator does not place personal data of the personal data subject in publicly available sources without their prior consent.

9.6.  Storage of personal data. Processing periods.

• Storage of personal data is carried out in a form that allows identifying the personal data subject for no longer than required by the purposes of processing personal data, unless the storage period for personal data is established by federal law, a contract to which the personal data subject is a party, beneficiary, or guarantor;
• Storage and processing may be interrupted at the client's first request.

9.7.  Conditions for termination of processing.

• The condition for terminating the processing of personal data may be the achievement of the purposes of processing personal data, the expiration of the consent of the personal data subject, the withdrawal of consent by the personal data subject or a request to cease processing personal data, as well as the detection of unlawful processing of personal data;
• The User may at any time withdraw their consent to the processing of personal data by sending a notification to the Operator via email to the Operator's email address main@pla.ru marked "Withdrawal of consent to the processing of personal data";
• Processed personal data is destroyed or depersonalized upon achievement of the processing goals or in case of loss of need to achieve these goals, unless otherwise provided by federal law.

9.8.  Security of personal data

9.8.1. The security of personal data processed by the Operator is ensured through a set of legal, organizational, and technical measures that meet the requirements of legislation on personal data protection.

9.8.2. The Operator takes care of the safety of personal data and takes measures to prevent unauthorized access to it:

• Limits the circle of employees who have access to data and defines their positions. The list includes:
• HR department employees (personal data of applicants);
• Accounting department employees;
• Secretary-clerk (personal data of counterparties, individuals);
• Sales department managers;
• Technical support engineers, programmers, and lawyers;
• Appoints a person responsible for compliance with legislation in the field of data protection;
• Approves a list of documents containing personal data;
• Develops internal documents on data protection and monitors their implementation;
• Familiarizes employees with regulations and local acts on data protection, conducts regular checks of knowledge and compliance with requirements. All employees who have access to personal data must be familiar with them;
• Organizes rational placement of workplaces to prevent unauthorized access to information;
• Approves a list of persons entitled to access premises where data is stored;
• Establishes a procedure for destroying information;
• Identifies and eliminates violations of data protection requirements;
• Conducts preventive work with employees to prevent disclosure of personal data.

9.9.  Data protection.

• Identification of threats to the security of personal data during their processing;
• Application of organizational and technical measures to ensure security, corresponding to the requirements and levels of protection established by the Government of the Russian Federation;
• Use of information security tools that have passed conformity assessment;
• Use of data destruction tools that have passed conformity assessment and have the appropriate function;
• Assessment of the effectiveness of security measures before putting the system into operation;
• Accounting of machine data storage media;
• Detection and response to unauthorized access, including prevention and elimination of consequences of computer attacks;
• Recovery of data damaged or destroyed due to unauthorized access;
• Establishment of rules for access to data and recording of all actions with them;
• Monitoring of security measures and the level of security of the system.

9.10.  Data storage.

• Information about personal data received by the Operator is confidential and protected by law;
• The Operator guarantees the safety of personal data;
• Personal data is stored in a form that allows identifying the subject no longer than necessary for the purposes of processing. If the storage period is not established by federal law, contract, or agreement, the Operator terminates it as soon as it becomes possible;
• If the User discovers inaccuracies in their data, they can update them independently. To do this, you need to send a notification to the Operator's email address: main@pla.ru, with the subject line "Updating personal data".

10. Cross-border transfer of personal data

10.1.  Cross-border transfer of Users' personal data is not carried out by the Operator.

11. Final provisions

11.1.  The User can obtain any clarifications on issues of interest regarding the processing of their personal data by contacting the Operator via email at main@pla.ru;

11.2.  This document will reflect any changes to the Operator's policy on the processing of personal data. The Policy is valid indefinitely until replaced by a new version;

11.3.  The current version of the Policy is freely available on the Internet at https://www.pla.ru/eng/politika-konfidencialnosti/.