of the Autonomous Non-Profit Organization Center for Support of Cultural and Educational Initiatives «ORBITA»

1. General Provisions
1.1. This Privacy Policy (hereinafter – the Policy) defines the procedure for processing and protecting the personal data of users of the official website of the Autonomous Non-Profit Organization Center for Support of Cultural and Educational Initiatives «ORBITA» (hereinafter – the Operator, the Organization, ANO «ORBITA»).
1.2. This Policy has been developed in accordance with the current legislation of the Russian Federation on personal data, including:

• Federal Law No. 152-FZ dated July 27, 2006 «On Personal Data» (hereinafter – 152-FZ);
• Decree of the Government of the Russian Federation No. 1119 dated November 1, 2012 «On Approval of Requirements for the Protection of Personal Data When Processed in Personal Data Information Systems»;
• Decree of the Government of the Russian Federation No. 687 dated September 15, 2008 «On Approval of the Regulation on the Specifics of Personal Data Processing Performed Without the Use of Automation Tools».

1.3. This Policy applies to all information that the Operator may obtain about users during their use of the Organization’s website on the Internet, as well as through feedback forms, subscriptions, and other forms of interaction.
1.4. Use of the website by the User constitutes unconditional acceptance of this Privacy Policy and the terms of processing of the User’s personal data.
1.5. In accordance with Part 2 of Article 18.1 of Federal Law No. 152-FZ, the Operator is obliged to publish or otherwise provide unrestricted access to the document defining its policy on personal data processing.
1.6. This Policy is subject to review and update in the event of changes in the legislation of the Russian Federation on personal data.
Operator:

• Full name: Autonomous Non-Profit Organization Center for Support of Cultural and Educational Initiatives «ORBITA»
• Abbreviated name: ANO «ORBITA»
• TIN: 4205435360 / KPP: 420501001
• PSRN: 1264200006168
• Legal address: 650071, Russia, Kemerovo Region – Kuzbass, Kemerovsky Municipal District, Kemerovo, Bulvar Kedrovy, 3, Apt. 29.

2. Basic Concepts
2.1. Personal data – any information relating directly or indirectly to a specific or identifiable individual (personal data subject).
2.2. Operator – a legal entity that independently or jointly with other persons organizes and carries out the processing of personal data, and also determines the purposes of processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
2.3. Processing of personal data – any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
2.4. User – an individual who visits the Operator’s website and provides their personal data.

3. Principles of Personal Data Processing
3.1. Personal data processing is carried out on the basis of the following principles:

• personal data processing is carried out on a lawful and fair basis;
• personal data processing is limited to the achievement of specific, predetermined, and lawful purposes;
• processing of personal data that is incompatible with the purposes of collection is not permitted;
• merging of databases containing personal data processed for mutually incompatible purposes is not allowed;
• the content and scope of processed personal data correspond to the stated purposes of processing;
• accuracy, sufficiency, and, where necessary, relevance of personal data in relation to the purposes of their processing are ensured;
• personal data is stored in a form that permits identification of the data subject for no longer than required by the purposes of processing;
• processed personal data shall be destroyed or anonymized upon achievement of the processing purposes or if the need for achieving such purposes is lost.

4. Purposes of Personal Data Processing
4.1. The Operator processes Users’ personal data for the following purposes:

• providing feedback to Users, including sending responses to requests and inquiries;
• performance of contracts and agreements with Users (if any);
• notifying Users about the Organization’s activities, events, projects, and other happenings (subject to the User’s separate consent);
• collecting website visit statistics, analyzing and improving the website’s performance;
• carrying out the Organization’s statutory activities in the field of supporting cultural and educational initiatives.

5. Categories of Personal Data Processed
5.1. The Operator may process the following personal data of Users:

• last name, first name, patronymic;
• contact phone number;
• email address;
• IP address;
• cookie data (if used);
• other information that the User voluntarily provides through forms on the website.

5.2. The Operator does not process special categories of personal data (concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, or intimate life).
5.3. The Operator processes the User’s personal data only if such data are submitted by the User themselves through forms located on the Organization’s website.

6. Legal Grounds for Personal Data Processing
6.1. The legal grounds for processing personal data are:

• consent of the personal data subject to the processing of their personal data (Article 6 of Federal Law No. 152-FZ);
• performance of a contract to which the personal data subject is a party or beneficiary or guarantor (clause 2, part 1, article 6 of 152-FZ);
• requirements of federal laws (clauses 3–6, part 1, article 6 of 152-FZ).

6.2. Consent to the processing of personal data must be drawn up as a separate document and may not be included as an integral part of the text of a contract, user agreement, or other documents.
6.3. On all website forms where the User enters their data, a clear request for consent is displayed. The User independently checks a box in a dedicated field.

7. Procedure and Conditions for Personal Data Processing
7.1. Personal data processing is carried out using automation tools and without such tools, in compliance with confidentiality requirements.
7.2. The Operator takes the necessary organizational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions.
7.3. Personal data protection measures include:

• encryption of transmitted data (TLS protocol);
• backup;
• restricting employee access to personal data in accordance with their job responsibilities;
• use of information security tools.

7.4. The Operator has the right to entrust the processing of personal data to another person on the basis of a processing agreement. In such case, the Operator remains liable to the personal data subject for the actions of that person.
7.5. In accordance with Federal Law No. 156-FZ dated June 24, 2025, storage and processing of personal data of citizens of the Russian Federation outside the country is prohibited, except for cases provided for by law.
7.6. Organizers of information dissemination on the Internet are required to store on the territory of the Russian Federation information about users, their registration, authorization, and other actions for 3 years from the date of termination of such actions (from January 1, 2026).

8. Retention Periods for Personal Data
8.1. Users’ personal data are stored:

• for the period necessary to achieve the purposes of their processing;
• for the period established by federal law or contract;
• until deletion upon the User’s request or upon termination of the contract. In the latter case – for 3 (three) years from the date of termination of the contract.

8.2. Upon achievement of the processing purposes or if the need for achieving such purposes is lost, personal data shall be destroyed or anonymized.

9. Rights of Personal Data Subjects
9.1. The User, as a personal data subject, has the right:

• to obtain information concerning the processing of their personal data (Article 14 of 152-FZ);
• to have their personal data updated, blocked, or destroyed if they are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
• to withdraw consent to the processing of personal data;
• to appeal the Operator’s actions or inaction to the authorized body for the protection of personal data subjects’ rights (Roskomnadzor) or in court.

9.2. To exercise their rights, the User may contact the Operator by sending a written request to the Organization’s registered address or via the feedback form on the website.

10. Confidentiality of Personal Data
10.1. Confidentiality of personal data is a mandatory requirement for the Operator and other persons who have gained access to personal data not to disclose to third parties or distribute personal data without the consent of the personal data subject, unless otherwise provided by federal law.
10.2. The Operator ensures the confidentiality of personal data and takes all necessary measures to prevent their disclosure.
10.3. Transfer of personal data to third parties is permitted only:

• with the consent of the personal data subject;
• in cases provided for by federal law;
• within the framework of a personal data processing agreement.

11. Liability for Violation of Legal Requirements
11.1. The Operator shall be liable for violation of the requirements of the legislation of the Russian Federation on personal data in accordance with the legislation of the Russian Federation.
11.2. Administrative liability is provided for violation of the established procedure for processing personal data under Article 13.11 of the Code of Administrative Offenses of the Russian Federation, including:

• for failure to submit or late submission of a notification to Roskomnadzor – a fine of 100,000 to 300,000 rubles;
• for non-compliance with localization requirements for personal data of Russian citizens – a fine of 1 to 6 million rubles;
• for a personal data breach – fines of 3 to 20 million rubles, depending on the scale of the breach;
• for failure to notify Roskomnadzor of a personal data breach – a fine of 1 to 3 million rubles.

11.3. In the event of a repeated personal data breach, a turnover-based fine of 1% to 3% of the company’s annual revenue is applied, but not less than 20 million rubles and not more than 500 million rubles.

12. Final Provisions
12.1. This Policy is a publicly available document. Unrestricted access to the Policy is provided by publishing it on the Organization’s website.
12.2. The Operator reserves the right to make changes to this Policy. When changes are made, the date of the last update shall be indicated in the header of the Policy.
12.3. The new version of the Policy becomes effective as soon as it is posted on the website, unless otherwise provided by the new version of the Policy.
12.4. All issues related to personal data processing not covered by this Policy shall be governed in accordance with the legislation of the Russian Federation.
12.5. For all matters concerning personal data processing, Users may contact the Operator:

• by mail: 650071, Russia, Kemerovo Region – Kuzbass, Kemerovsky Municipal District, Kemerovo, Bulvar Kedrovy, 3, Apt. 29.
• by email: [provide the Organization’s email address]
• by phone: [provide the Organization’s phone number]

Date issued: 26.06.2026
This Policy becomes effective upon its publication on the website of ANO «ORBITA».