PERSONAL DATA
PROCESSING POLICY
FOR WEBSITE USERS

General Provisions

1. This Personal Data Processing Policy of Encore Resort Limited Liability Company (OGRN 1226900009423, INN 6950262206, registered address: Office 1306, Floor 13, 29 Smolensky Lane, Tver, Tver Region, 170100, Russian Federation) (hereinafter referred to as the “Company”) concerning users of the Company’s website (hereinafter referred to as the “Policy”) has been developed pursuant to Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006 (hereinafter referred to as the “Personal Data Law”), for the purpose of ensuring the protection of human and civil rights and freedoms when processing personal data, including the right to privacy and the protection of personal and family secrets.

2. This Policy establishes the procedure for processing personal data and the measures taken by the Company to ensure the security of personal data.

3. The Policy applies to all information containing personal data that the Company may obtain:

   • through the website https://encore-resort.ru/;
   • when contacting the Company by email or telephone or through feedback forms;
   • when entering into and performing contracts;
   • through other interactions with personal data subjects within the scope of the Company’s activities.

4. This Policy is a publicly available document. In accordance with Part 2, Article 18.1 of the Personal Data Law, this Policy is published and freely accessible online on the Company’s website at https://encore-resort.ru/.

5. Terms relating to the processing of personal data are used in this Policy with the meanings established by the Personal Data Law.

6. This Policy is binding on all employees of the Company.

7. Liability for violations of the requirements of Russian legislation and the Company’s internal regulations concerning the processing and protection of personal data shall be determined in accordance with the applicable laws of the Russian Federation.

8. This Policy is approved by order of the General Director of the Company.

9. All relations involving the Company concerning the processing and protection of personal data that are not regulated by this Policy shall be governed by the applicable legislation of the Russian Federation concerning personal data.

10. The Company does not carry out cross-border transfers of personal data.

Terms and Definitions

For the purposes of this Policy, the following terms are used:

Automated processing of personal data — processing of personal data using computer technology.

Blocking of personal data — temporary cessation of the processing of personal data, except where processing is necessary to clarify the personal data.

Personal Data Information System — a set of personal data contained in databases and information technologies and technical means ensuring their processing.

Confidentiality of personal data — a requirement binding upon the Company or any other person who has gained access to personal data not to disclose such data without the consent of the personal data subject or another lawful basis.

Anonymization of personal data — actions that make it impossible to determine, without the use of additional information, that personal data belongs to a particular personal data subject.

Processing of personal data — any action (operation) or set of actions (operations) performed with personal data using automation tools or without their use, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion and destruction of personal data.

Publicly available personal data — personal data to which access by an unlimited number of persons has been granted with the consent of the personal data subject, or personal data that is not subject to confidentiality requirements under federal laws.

Company — Encore Resort LLC, registered address: Office 1306, Floor 13, 29 Smolensky Lane, Tver, Tver Region, 170100, Russian Federation; INN 6950262206; OGRN 1226900009423. For the purposes of this Policy, the Company is the personal data controller.

Personal data — any information relating directly or indirectly to an identified or identifiable individual (personal data subject).

Personal data permitted by the personal data subject for dissemination — personal data to which access by an unlimited number of persons has been granted by the personal data subject through consent to the processing of personal data permitted for dissemination in accordance with the procedure established by the Personal Data Law.

Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

Dissemination of personal data — actions aimed at disclosing personal data to an unspecified number of persons.

Website — the Company’s official website at https://encore-resort.ru/.

Personal data subject — an individual to whom personal data relates.

Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to a governmental authority of a foreign state, a foreign individual or a foreign legal entity.

Destruction of personal data — actions resulting in the inability to restore the contents of personal data in the personal data information system and/or resulting in the destruction of physical media containing personal data.

Cookies — small text files stored on a user’s device and used for the proper functioning of the Website, saving user preferences, ensuring security, and collecting statistical and analytical information.

Principles of Personal Data Processing

1. Personal data shall be processed by the Company lawfully and fairly.

2. The processing of personal data shall be limited to achieving specific, predetermined and legitimate purposes.

3. Processing of personal data that is incompatible with the purposes for which it was collected is not permitted.

4. Databases containing personal data processed for purposes that are incompatible with each other shall not be combined.

5. When processing personal data, its accuracy and sufficiency shall be ensured and, where necessary, its relevance to the purposes of processing shall be maintained.

6. Personal data shall be stored in a form that allows the personal data subject to be identified for no longer than is required by the purposes of processing, unless another storage period is established by federal law, a contract or another legal basis.

Purposes of Personal Data Processing

1. The processing of personal data shall be limited to achieving the purposes specified in Section 4.3 of this Policy.

2. Only personal data relevant to the purposes of its processing shall be processed.

3. The Company processes personal data for the following purposes:

   a) providing access to the Website;

   b) processing inquiries, requests, messages and applications submitted through the Website;

   c) providing access to the Website’s services;

   d) informing users about the Company’s activities, services, special offers, news and events;

   e) entering into, performing, amending and terminating civil-law contracts with personal data subjects and/or persons represented by them;

   f) sending informational, advertising and marketing communications from Encore Resort LLC, including news, information about services, special offers, projects, events and other marketing materials, as well as creating and maintaining a database of recipients of such communications;

   g) recording the preferences of personal data subjects regarding the subject matter, format and methods of receiving informational, advertising and marketing communications;

   h) analyzing Website traffic and user activity, improving the structure, content and functionality of the Website, and enhancing its usability;

   i) providing technical support to Website users.

Categories of Personal Data Subjects

The Company may process personal data of the following categories of personal data subjects:

1. Website users.

2. Persons submitting inquiries, applications, requests or messages through the Website, by email, by telephone or by other means.

3. Recipients of informational, advertising and marketing materials from Encore Resort LLC, including persons who have subscribed to newsletters on the Website and/or provided consent to receive such materials by other means.

Categories and List of Personal Data Processed

1. The Company may process the following personal data:

   1. Data provided voluntarily by the personal data subject:

      • surname, first name and patronymic;
      • email address;
      • telephone number;
      • information about the company, position and place of employment;
      • contents of an inquiry, application or message;
      • other information voluntarily provided by the personal data subject.

   2. Data processed for the purpose of sending informational, advertising and marketing communications:

      • surname, first name and patronymic;
      • email address;
      • telephone number;
      • preferences regarding methods of receiving informational and marketing communications;
      • information about the personal data subject’s interest in the services, projects, events, special offers and other materials of Encore Resort LLC;
      • other information voluntarily provided by the personal data subject for the purposes of receiving informational and marketing materials.

   3. Data collected automatically when using the Website:

      • IP address;
      • browser and browser version;
      • operating system and device type;
      • interface language;
      • date and time of the Website visit;
      • pages viewed;
      • user actions on the Website;
      • duration of the Website visit;
      • source from which the user accessed the Website;
      • other technical and statistical data collected using web analytics services.

2. The Company does not intentionally process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health or intimate life, except where expressly provided for by the legislation of the Russian Federation.

3. The Company does not intentionally process biometric personal data, except where expressly provided for by the legislation of the Russian Federation.

Periods for Processing and Storage of Personal Data

1. Personal data shall be processed and stored for no longer than is required by the purposes of processing, unless another period is established by the legislation of the Russian Federation, a contract or another legal basis.

2. Unless otherwise follows from legal requirements or the nature of the relevant relationship, the Company applies the following periods:

   • data received through feedback forms, by email or by telephone — until the relevant inquiry and subsequent business correspondence have been completed, but no longer than 90 days from the date of the last interaction, unless a longer period is required to protect the Company’s rights and legitimate interests;
   • data related to entering into and performing contracts — for the duration of the contract and, after its termination, for the periods established by the legislation of the Russian Federation;
   • data processed for the purpose of sending informational, advertising and marketing communications — until consent to the processing of personal data is withdrawn and/or the recipient unsubscribes from such communications;
   • data collected automatically when using the Website, including cookies and web analytics data — for the period necessary to achieve the purposes of processing, or until the user deletes the cookies, disables them in the browser settings or withdraws consent, where applicable.

3. Once the purposes of processing have been achieved, the applicable storage periods have expired, the personal data subject has withdrawn consent, or unlawful processing has been identified, personal data shall be destroyed or anonymized unless otherwise provided by the legislation of the Russian Federation.

Procedure for Destruction of Personal Data

1. Personal data shall be destroyed by the Company in the following cases:

   • achievement of the purposes of processing personal data;
   • loss of the need to achieve the purposes of processing;
   • withdrawal by the personal data subject of consent to the processing, where there are no other lawful grounds for continuing the processing;
   • identification of unlawful processing;
   • expiration of the established storage periods.

2. Personal data shall be destroyed using methods that prevent the restoration of its contents, including:

   • deleting personal data from information systems;
   • destroying paper records and other physical media;
   • using other methods appropriate to the nature of the medium and the requirements of the legislation of the Russian Federation.

Location of Storage of Personal Data and Database Localization

1. When collecting personal data of citizens of the Russian Federation, the Company ensures the recording, systematization, accumulation, storage, clarification (updating, modification) and extraction of such personal data using databases located within the territory of the Russian Federation.

2. Personal data shall be processed in compliance with the requirements of the legislation of the Russian Federation concerning the localization of personal data.

Use of Cookies and Web Analytics Services

1. The Company uses cookies and web analytics services actually implemented on the Website for the following purposes:

   • ensuring the proper functioning of the Website;
   • ensuring Website security;
   • saving user preferences;
   • analyzing Website traffic;
   • analyzing user activity;
   • improving the structure, content and functionality of the Website;
   • enhancing usability;
   • evaluating the effectiveness of the Company’s informational, advertising and marketing materials;
   • analyzing users’ interest in the Company’s services, projects, events, special offers and other materials in anonymized and/or aggregated form.

2. Cookies may be:

   • technical — necessary for the proper functioning of the Website;
   • functional — enabling user preferences to be saved;
   • analytical — used to collect statistical information and analyze Website usage;
   • marketing — used to evaluate the effectiveness of advertising materials.

3. The Company processes data collected using cookies and web analytics services:

   • on the basis of the personal data subject’s consent where such consent is required under the legislation of the Russian Federation;
   • to ensure the functioning and security of the Website;
   • to analyze Website traffic and user activity and evaluate the effectiveness of the Company’s informational, advertising and marketing materials;
   • to pursue the Company’s legitimate interests, provided that this does not violate the rights and freedoms of the personal data subject.

4. The user may refuse the use of cookies by changing their browser settings and may also delete cookies previously stored on their device.

5. The user may also use tools for blocking the relevant web analytics services where such tools are provided by the respective services.

6. If cookies are disabled, certain Website functions may not operate correctly or may become unavailable.

7. By continuing to use the Website after a notification regarding the use of cookies has been displayed and/or by taking actions confirming consent through the Website interface, the user gives consent to the processing of data collected using cookies and web analytics services to the extent, in the manner and for the purposes provided for by this Policy, unless otherwise established by the legislation of the Russian Federation.

Procedures and Methods of Personal Data Processing

1. Personal data shall be processed both using automation tools and without using such tools.

2. The Company may perform the following actions with personal data:

   • collection;
   • recording;
   • systematization;
   • accumulation;
   • storage;
   • clarification (updating, modification);
   • extraction;
   • use;
   • transfer (provision, access);
   • anonymization;
   • blocking;
   • deletion;
   • destruction.

3. The Company ensures the confidentiality of personal data and does not disclose personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law.

4. For the purpose of sending informational, advertising and marketing communications, the Company may collect personal data through subscription forms on the Website, feedback forms on the Website, requests or inquiries submitted by personal data subjects, as well as by other means, provided that the prior consent of the personal data subject is obtained where such consent is required by the legislation of the Russian Federation. The Company processes such personal data only to the minimum extent necessary and provides the personal data subject with the opportunity to unsubscribe from such communications at any time using the method specified in the relevant communication or by contacting the Company using the contact details specified in this Policy.

5. A personal data subject’s refusal to receive informational, advertising and marketing communications does not affect their ability to use the Website, unless otherwise required by the technical features of the relevant service.

6. The Company may engage third parties to process personal data where there are grounds provided for by law, provided that an agreement is concluded containing provisions on confidentiality, personal data security, the list of actions to be performed with personal data and the purposes of processing.

7. A person processing personal data on behalf of the Company shall comply with the requirements of the legislation of the Russian Federation concerning personal data and the provisions of this Policy.

8. The Company does not make decisions that produce legal consequences for a personal data subject or otherwise affect their rights and legitimate interests solely on the basis of automated processing of personal data, except where provided for by law.

Rights and Obligations of the Personal Data Subject

1. The personal data subject has the right to:

   • receive information concerning the processing of their personal data, except in cases provided for by the legislation of the Russian Federation. The list of information and the procedure for obtaining it are established by the Personal Data Law. Information provided to the personal data subject must not contain personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such data;
   • require the Company to clarify, block or destroy their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and to take measures provided for by law to protect their rights and legitimate interests.

2. The personal data subject is obliged to:

   • provide complete and accurate personal data;
   • immediately notify the Company of any changes to information constituting personal data.

Rights and Obligations of the Company

1. The Company has the right to:

   • independently determine the composition and list of measures necessary and sufficient to fulfill its obligations established by the Personal Data Law and regulatory legal acts adopted pursuant thereto, unless otherwise provided by the Personal Data Law or other federal laws;
   • entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by applicable legislation, on the basis of an agreement concluded with such person;
   • if a personal data subject withdraws consent to the processing of personal data, continue processing such personal data without consent where there are grounds specified in the Personal Data Law.

2. The Company is obliged to:

   • organize the processing and protection of personal data in accordance with the requirements of the legislation of the Russian Federation;
   • respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the legislation of the Russian Federation;
   • provide the authorized body responsible for protecting the rights of personal data subjects (Roskomnadzor), at its request, with the necessary information within 10 (ten) business days from the date of receipt of such request. This period may be extended by no more than 5 (five) business days, provided that the Company sends Roskomnadzor a reasoned notification specifying the reasons for the extension;
   • in accordance with the procedure established by the federal executive authority authorized in the field of security, organize interaction with the state system for detecting, preventing and eliminating the consequences of cyberattacks on information resources of the Russian Federation, including reporting computer incidents that have resulted in unlawful transfer (provision, dissemination or access to) personal data.

Measures to Ensure Personal Data Security

1. The Company takes necessary and sufficient legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions.

2. Such measures include, in particular:

   • appointment of a person responsible for organizing the processing of personal data;
   • appointment of a person responsible for ensuring the security of personal data in personal data information systems;
   • adoption of internal regulations concerning the processing and protection of personal data;
   • identification of security threats associated with the processing of personal data;
   • use of information security measures that have undergone a conformity assessment procedure, where required;
   • restriction of employees’ access to personal data;
   • accounting for physical and electronic media containing personal data;
   • detection of unauthorized access to personal data and taking the necessary measures;
   • restoration of personal data modified or destroyed as a result of unauthorized access;
   • establishment of rules governing access to personal data;
   • registration and recording of actions performed with personal data in information systems;
   • monitoring and assessment of the effectiveness of the security measures applied;
   • ensuring the security of premises where media containing personal data and means of processing such data are located.

Procedure for Requests from Personal Data Subjects

1. A personal data subject has the right to submit to the Company a request, inquiry or demand concerning the processing of their personal data.

2. A request from a personal data subject must contain the information required by law, including the number of the primary identity document of the personal data subject or their representative, information concerning the date of issue of such document and the authority that issued it, information confirming the personal data subject’s participation in legal relations with the Company or otherwise confirming the fact that the Company processes the personal data, as well as the signature of the personal data subject or their representative. A request may be submitted in electronic form and signed with an electronic signature in accordance with the applicable legislation.

3. The Company shall provide the personal data subject with information concerning the processing of their personal data within 10 business days from the date of receipt of the request. This period may be extended by no more than 5 business days, provided that the personal data subject is sent a reasoned notification specifying the reasons for the extension.

4. If a personal data subject submits a request to clarify, block or destroy personal data or to cease its processing, the Company shall consider such request in accordance with the procedure and within the time limits established by the applicable legislation.

5. A personal data subject may withdraw their consent to receive informational, advertising and marketing communications at any time, including by using the unsubscribe functionality contained in the relevant communication or by contacting the Company using the contact details specified in this Policy.

Contact Information

1. All suggestions, requests, inquiries and demands concerning the processing of personal data may be submitted to the Company:

   • by mail: Office 1306, Floor 13, 29 Smolensky Lane, Tver, Tver Region, 170100, Russian Federation;
   • by email: info@encoreresort.ru.

   Regarding the withdrawal of consent to receive informational, advertising and marketing communications, a personal data subject may also contact the Company at info@encoreresort.ru.

2. Requests shall be considered by the Company in accordance with the procedure and within the time limits established by the applicable legislation.