Policy

1.1. This Policy of Hype Limited Liability Company regarding the processing of personal data (hereinafter referred to as the Policy) has been developed in compliance with the requirements of paragraph 2, part 1, article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data" (hereinafter referred to as the Personal Data Law) in order to ensure the protection of human and civil rights and freedoms during the processing of personal data, including the protection of the rights to privacy, personal and family secrets.

1.2. The Policy applies to all personal data processed by Hype Limited Liability Company (hereinafter referred to as the Operator, Hype LLC).

1.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.

1.4. In compliance with the requirements of part 2, article 18.1 of the Personal Data Law, this Policy is published for public access on the Internet on the Operator's website and is also placed in the Operator's office on a information board for public access and review.

1.5. Basic concepts used in the Policy:

personal data — any information relating directly or indirectly to an identified or identifiable natural person (subject of personal data);

personal data operator (operator) — a state body, municipal body, legal entity, or individual, independently or jointly with others, organizing and (или) performing the processing of personal data, as well as determining the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data;

personal data processing — any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools.

Processing of personal data includes, among other things:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• rectification (updating, changing);
• extraction;
• use;
• transfer (provision, access);
• blocking;
• deletion;
• destruction;

automated processing of personal data — processing of personal data by means of computer technology;

provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons;

blocking of personal data — temporary termination of personal data processing (except for cases where processing is necessary to rectify personal data);

destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which physical media of personal data are destroyed;

personal data information system — a set of personal data contained in databases and the information technologies and technical means that ensure its processing.

website — the Operator's website on the Internet (address: https://www.hypepro.tv/).

1.6. Basic rights and obligations of the Operator.

1.6.1. The Operator has the right to:

1) independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;

2) delegate the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with such person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data provided for by the Personal Data Law, maintain the confidentiality of personal data, and take necessary measures aimed at ensuring the fulfillment of obligations provided for by the Personal Data Law;

3) in the event that the personal data subject withdraws consent to the processing of personal data, the Operator is entitled to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Personal Data Law.

1.6.2. The Operator is obliged to:

1) organize the processing of personal data in accordance with the requirements of the Personal Data Law;

2) respond to appeals and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;

3) report to the authorized body for the protection of the rights of personal data subjects (Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) upon request of this body the necessary information within 10 working days from the date of receipt of such request. This period may be extended, but by no more than five working days. To do this, the Operator must send a reasoned notification to Roskomnadzor indicating the reasons for extending the period for providing the requested information;

4) in the manner determined by the federal executive body authorized in the field of security, ensure interaction with the state system for detection, prevention, and elimination of the consequences of computer attacks on information resources of the Russian Federation, including informing it about computer incidents that resulted in the illegal transfer (provision, distribution, access) of personal data.

1.7. Basic rights of the personal data subject. The personal data subject has the right to:

1) receive information regarding the processing of their personal data, except for cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form, and it should not contain personal data relating to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;

2) require the operator to rectify their personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained, or is not necessary for the stated purpose of processing, as well as to take measures provided by law to protect their rights;

3) give prior consent to the processing of personal data for the purpose of promoting goods, works, and services on the market;

4) appeal to Roskomnadzor or in court against unlawful actions or inaction of the Operator during the processing of their personal data.

1.8. Control over the fulfillment of the requirements of this Policy is carried out by an authorized person responsible for organizing the processing of personal data at the Operator, who also ensures that the Operator's employees directly involved in the processing of personal data are familiar with the provisions of the legislation of the Russian Federation on personal data and this Policy.

1.9. The liability of Hype LLC for violation of the requirements of the legislation of the Russian Federation and regulatory acts in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2.1. Processing of personal data is limited to achieving specific, predetermined, and lawful purposes. Processing of personal data that is incompatible with the purposes of personal data collection is not permitted.

2.2. Only personal data that meets the purposes of its processing is subject to processing.

2.3. The Operator processes personal data for the following purposes:

2.3.1. personnel and accounting management;

2.3.2. ensuring compliance with the labor legislation of the Russian Federation;

2.3.3. ensuring compliance with the tax legislation of the Russian Federation;

2.3.4. ensuring compliance with the pension legislation of the Russian Federation;

2.3.5. ensuring compliance with the insurance legislation of the Russian Federation;

2.3.6. participation of an individual in constitutional, civil, administrative, or criminal proceedings, as well as proceedings in arbitration courts;

2.3.7. preparation, conclusion, and execution of civil law contracts;

2.3.8. execution of a judicial act;

2.3.9. promotion of goods, works, and services on the market;

2.3.10. recruitment (selection of applicants) for vacant positions of the Operator;

2.3.11. issuance of powers of attorney to the Operator's representatives;

2.3.12. preparation of responses to requests from state authorities, local self-government bodies, arbitration/financial managers, law enforcement agencies, prosecution authorities, security agencies, control and supervisory authorities, notaries, and advocates;

2.3.13. ensuring compliance with corporate legislation (fulfillment of the Operator's duties provided for by the Civil Code of the Russian Federation and the Federal Law "On Limited Liability Companies");

2.4. Processing of employees' personal data may be carried out exclusively for the purposes of ensuring compliance with laws and other regulatory legal acts.

3.1. The legal basis for the processing of personal data is a combination of regulatory legal acts, in pursuance of and in accordance with which the Operator processes personal data, including:

• The Constitution of the Russian Federation;
• The Civil Code of the Russian Federation;
• The Labour Code of the Russian Federation;
• The Tax Code of the Russian Federation;
• Federal Law No. 14-FZ dated February 8, 1998, "On Limited Liability Companies";
• Federal Law No. 402-FZ dated December 6, 2011, "On Accounting";
• Federal Law No. 167-FZ dated December 15, 2001, "On Mandatory Pension Insurance in the Russian Federation";
• other regulatory legal acts governing relations associated with the Operator's activities;

3.2. The legal grounds for the processing of personal data also include:

• the Charter of Hype LLC;
• the achievement of purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and performance of the functions, powers, and duties assigned to the Operator by the legislation of the Russian Federation;
• the execution of a contract to which the personal data subject is a party, beneficiary, or guarantor, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor. A contract concluded with a personal data subject may not contain provisions that restrict the rights and freedoms of the personal data subject;
• the execution of a judicial act, an act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;
• participation in constitutional, civil, administrative, or criminal proceedings, as well as proceedings in arbitration courts;
• the consent of personal data subjects to the processing of their personal data;
• other grounds provided for by the Personal Data Law.

4.1. The content and volume of the processed personal data must correspond to the stated processing purposes provided for in Section 2 of this Policy. The processed personal data should not be excessive in relation to the stated purposes of their processing.

4.2. Categories of processed personal data, categories of personal data subjects whose data are processed in a volume corresponding to the processing purposes:

4.2.1. Personnel and accounting management

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; income; gender; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; document data contained in the birth certificate; settlement account number; personal account number; profession; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); military duty status, military registration details; education details; health status details.

Categories of subjects whose personal data are processed: Employees; Relatives of employees; Former employees; Counterparties; Representatives of counterparties; Clients; Legal representatives.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion.

4.2.2. Ensuring compliance with the labor legislation of the Russian Federation

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; income; gender; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; document data contained in the birth certificate; personal account number; profession; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); military duty status, military registration details; education details; health status details.

Categories of subjects whose personal data are processed: Employees; Relatives of employees; Former employees.

Legal basis for personal data processing: processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data; processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and performance of functions, powers, and duties assigned to the operator by the legislation of the Russian Federation.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.3. Ensuring compliance with the tax legislation of the Russian Federation

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; income; gender; SNILS; INN; citizenship; identity document data; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization).

Categories of subjects whose personal data are processed: Employees; Former employees; Counterparties; Clients.

Legal basis for personal data processing: processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and performance of functions, powers, and duties assigned to the operator by the legislation of the Russian Federation.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.4. Ensuring compliance with the pension legislation of the Russian Federation

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; income; gender; registration address; SNILS; citizenship; identity document data; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); health status details.

Categories of subjects whose personal data are processed: Employees; Former employees.

Legal basis for personal data processing: processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and performance of functions, powers, and duties assigned to the operator by the legislation of the Russian Federation.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.5. Ensuring compliance with the insurance legislation of the Russian Federation

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; income; gender; registration address; SNILS; INN; citizenship; identity document data; personal account number; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); health status details.

Categories of subjects whose personal data are processed: Employees; Former employees; Counterparties; Clients.

Legal basis for personal data processing: processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and performance of functions, powers, and duties assigned to the operator by the legislation of the Russian Federation.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.6. Participation of a person in constitutional, civil, administrative, criminal proceedings, and proceedings in arbitration courts

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; income; gender; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; settlement account number; personal account number; profession; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); education details; health status details.

Categories of subjects whose personal data are processed: Employees; Former employees; Counterparties; Representatives of counterparties; Clients; Legal representatives.

Legal basis for personal data processing: processing of personal data is carried out in connection with the participation of a person in constitutional, civil, administrative, criminal proceedings, and proceedings in arbitration courts.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.7. Preparation, conclusion, and execution of a civil law contract

Categories of personal data

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; email address; residential address; registration address; phone number; INN; citizenship; identity document data; settlement account number; personal account number; profession; photo/video image of the face; human voice data.

Categories of subjects whose personal data are processed: Counterparties; Representatives of counterparties; Clients; Legal representatives.

Legal basis for personal data processing: processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data; processing of personal data is necessary for the execution of a contract to which the personal data subject is a party, beneficiary, or guarantor, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor. A contract concluded with a personal data subject may not contain provisions that restrict the rights and freedoms of the personal data subject.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.8. Execution of a judicial act

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; income; email address; registration address; phone number; SNILS; INN; citizenship; identity document data; settlement account number; personal account number.

Categories of subjects whose personal data are processed: Employees; Relatives of employees; Former employees; Counterparties; Representatives of counterparties; Clients; Beneficiaries under contracts; Legal representatives.

Legal basis for personal data processing: processing of personal data is necessary for the execution of a judicial act, an act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.9. Promotion of goods, works, and services on the market

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; email address; registration address; phone number; citizenship; identity document data; driver's license data; profession; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); education details; photo/video image of the face.

Categories of subjects whose personal data are processed: Employees; Counterparties; Representatives of counterparties; Clients.

Legal basis for personal data processing: processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.10. Recruitment (selection of applicants) for vacant positions of the operator

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; marital status; email address; residential address; registration address; phone number; citizenship; profession; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); military duty status, military registration details; education details; photo/video image of the face.

Categories of subjects whose personal data are processed: Applicants.

Legal basis for personal data processing: processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data.

List of actions: collection; recording; rectification (updating, changing); use; transfer (provision, access); deletion; destruction.

4.2.11. Issuance of powers of attorney to representatives of the operator

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; gender; registration address; citizenship; identity document data; position.

Categories of subjects whose personal data are processed: Employees; Counterparties; Representatives of counterparties.

Legal basis for personal data processing: processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.12. Preparation of responses to requests from state authorities, local self-government bodies, arbitration/financial managers, law enforcement agencies, prosecution authorities, security agencies, control and supervisory authorities, notaries, and advocates.

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; social status; income; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; driver's license data; settlement account number; personal account number; profession; position; employment details (including work experience, current employment data indicating the name and settlement account of the organization); military duty status, military registration details; education details; photo/video image of the face.

Categories of subjects whose personal data are processed: Employees; Former employees; Counterparties; Representatives of counterparties; Clients; Beneficiaries under contracts.

Legal basis for personal data processing: processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and performance of functions, powers, and duties assigned to the operator by the legislation of the Russian Federation.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.2.13. Ensuring compliance with corporate legislation (fulfillment of duties by the Operator provided for by the Civil Code of the Russian Federation and the Federal Law "On Limited Liability Companies").

Personal data: surname, first name, patronymic; year of birth; month of birth; date of birth; income; email address; residential address; registration address; phone number; INN; citizenship; identity document data; personal account number.

Categories of subjects whose personal data are processed: other categories of personal data subjects whose personal data are processed: participants of the Company and their representatives.

Legal basis for personal data processing: processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data; processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, for the implementation and performance of functions, powers, and duties assigned to the operator by the legislation of the Russian Federation.

List of actions: collection; recording; systematization; accumulation; storage; rectification (updating, changing); extraction; use; transfer (provision, access); blocking; deletion; destruction.

4.3. The Operator's processing of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which their identity can be established) is carried out in accordance with the legislation of the Russian Federation.

4.4. The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or private life, except for cases provided for by the legislation of the Russian Federation.

5.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. Personal data processing is performed with the consent of the personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.

5.3. The Operator processes personal data for each processing purpose in the following ways: mixed processing of personal data, with transfer via the internal network of the legal entity, and with transfer via the Internet.

5.4. Access to personal data processing is granted to the Operator's employees whose job duties include the processing of personal data.

5.5. Personal data processing for each processing purpose specified in clause 2.3 of the Policy is carried out by:

• obtaining personal data in oral and written form directly from the personal data subjects;
• entering personal data into the journals, registers, and information systems of the Operator;
• using other methods of personal data processing.

5.6. Disclosure to third parties and distribution of personal data without the consent of the personal data subject is not permitted, unless otherwise provided by federal law. Consent to the processing of personal data authorized by the personal data subject for distribution is executed separately from other consents of the personal data subject to the processing of their personal data.

The requirements for the content of the consent to the processing of personal data authorized by the personal data subject for distribution are approved by Order of Roskomnadzor No. 18 dated February 24, 2021.

5.7. The transfer of personal data to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia, and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

5.8. The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including:

• appointment of a person responsible for organizing the processing of personal data;
• issuance of local acts on personal data processing, establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation and eliminating the consequences of such violations;
• ensuring the application of legal, organizational, and technical measures to ensure the security of personal data in accordance with Article 19 of the Federal Law "On Personal Data";
• conducting internal control over the compliance of personal data processing with the Federal Law "On Personal Data," regulatory legal acts adopted in accordance with it, requirements for personal data protection, the operator's policy regarding personal data processing, and the operator's local acts;
• ensuring an assessment of the harm that may be caused to personal data subjects in case of violation of the Federal Law "On Personal Data," and the correlation of the specified harm with the measures taken to ensure the fulfillment of obligations provided for by the Federal Law "On Personal Data";
• familiarizing employees directly involved in personal data processing with the provisions of the legislation of the Russian Federation on personal data, including requirements for personal data protection, documents defining the operator's policy regarding personal data processing, local acts on personal data processing, and providing training to the specified employees;
• identifying threats to the security of personal data during its processing in personal data information systems;
• applying models of actual threats and implementing measures to neutralize them;
• ensuring the accounting of machine-readable media of personal data, exercising control over the measures taken to ensure the security of personal data and the level of security of personal data information systems;
• restricting the access of unauthorized persons to premises intended for personal data processing;
• assigning personal passwords for logging into computers at each workplace (accounts with passwords), installing antivirus software on computers, and providing a safe for storing personal files of employees and personal data of individuals;
• organizing a security regime for the premises where the personal data information system is located, preventing uncontrolled entry or presence in these premises by persons who do not have the right to access them;
• ensuring the safety of personal data media;
• approving a document defining the list of persons whose access to personal data processed in the personal data information system is necessary for the performance of their official (labor) duties;
• using information protection tools that have passed the conformity assessment procedure with the requirements of the legislation of the Russian Federation in the field of information security, in cases where the use of such tools is necessary to neutralize actual threats.

5.9. The Operator stores personal data in a form that allows identifying the personal data subject for no longer than required by each purpose of personal data processing, unless the storage period for personal data is established by federal law or a contract.

5.9.1. Personal data on paper media is stored at Hype LLC during the storage periods for documents as provided for by the legislation on archival affairs in the Russian Federation (Federal Law No. 125-FZ dated October 22, 2004, "On Archival Affairs in the Russian Federation," and the List of typical administrative archival documents generated in the course of activities of state bodies, local self-government bodies, and organizations, indicating their storage periods (approved by Rosarkhiv Order No. 236 dated December 20, 2019)).

5.9.2. The storage period for personal data processed in personal data information systems corresponds to the storage period for personal data on paper media.

5.10. The Operator terminates the processing of personal data in the following cases:

• the fact of their unlawful processing is detected. Period — within three working days from the date of detection;
• the purpose of their processing is achieved;
• the term of consent has expired or the consent of the personal data subject to the processing of specified data has been withdrawn, when the Personal Data Law requires processing only with consent.

5.11. Upon achievement of the purposes of personal data processing, or in case the personal data subject withdraws consent for processing, the Operator terminates the processing of such data if:

• otherwise is not provided for by a contract to which the personal data subject is a party, beneficiary, or guarantor;
• the Operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
• otherwise is not provided for by another agreement between the Operator and the personal data subject.

5.12. When a personal data subject contacts the Operator with a demand to terminate the processing of personal data, the processing is terminated within a period not exceeding 10 working days from the date the Operator receives the corresponding request, except for cases provided for by the Personal Data Law. The specified period may be extended, but by no more than five working days. To do this, the Operator must send a reasoned notification to the personal data subject indicating the reasons for the extension.

5.13. During the collection of personal data, including through the Internet, the Operator ensures the recording, systematization, accumulation, storage, rectification (updating, changing), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Personal Data Law.

6.1. Confirmation of the fact of personal data processing by the Operator, legal grounds and purposes of personal data processing, as well as other information specified in Part 7 of Article 14 of the Personal Data Law, are provided by the Operator to the personal data subject or their representative within 10 working days from the date of the request or receipt of an inquiry from the personal data subject or their representative. This period may be extended, but by no more than five working days. To do this, the Operator shall send a reasoned notification to the personal data subject indicating the reasons for extending the period for providing the requested information.

The information provided shall not include personal data relating to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data.

The request must contain:

• the number of the primary identity document of the personal data subject or their representative, information on the date of issue of the specified document and the issuing authority;
• information confirming the participation of the personal data subject in relations with the Operator (contract number, date of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator;
• the signature of the personal data subject or their representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator provides the information specified in Part 7 of Article 14 of the Personal Data Law to the personal data subject or their representative in the same form in which the corresponding appeal or request was sent, unless otherwise indicated in the appeal or request.

If the appeal (request) of the personal data subject does not reflect all the necessary information in accordance with the requirements of the Personal Data Law, or if the subject does not have the right of access to the requested information, a reasoned refusal is sent to them.

The right of a personal data subject to access their personal data may be restricted in accordance with Part 8 of Article 14 of the Personal Data Law, including if the access of the personal data subject to their personal data violates the rights and legitimate interests of third parties.

6.2. In the event that inaccurate personal data is identified upon the appeal of a personal data subject or their representative, or upon their request or the request of Roskomnadzor, the Operator shall block the personal data relating to this personal data subject from the moment of such appeal or receipt of the specified request for the verification period, provided that blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

In the event that the fact of inaccuracy of personal data is confirmed, the Operator, based on the information provided by the personal data subject or their representative or Roskomnadzor, or other necessary documents, shall rectify the personal data within seven working days from the date of submission of such information and lift the blocking of the personal data.

6.3. In the event that unlawful processing of personal data is identified upon the appeal (request) of a personal data subject or their representative or Roskomnadzor, the Operator shall block the unlawfully processed personal data relating to this personal data subject from the moment of such appeal or receipt of the request.

6.4. Upon detection by the Operator, Roskomnadzor, or another interested person of the fact of unlawful or accidental transfer (provision, distribution) of personal data (access to personal data), which resulted in a violation of the rights of personal data subjects, the Operator shall:

• within 24 hours — notify Roskomnadzor of the incident, the alleged causes that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, as well as provide information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
• within 72 hours — notify Roskomnadzor of the results of the internal investigation of the identified incident and provide information about the persons whose actions caused it (if any).

6.5. Procedure for the destruction of personal data by the Operator.

6.5.1. Conditions and terms for the destruction of personal data by the Operator:

• achievement of the purpose of personal data processing or loss of the need to achieve this purpose — within 30 days;
• achievement of the maximum storage periods for documents containing personal data — within 30 days;
• submission by the personal data subject (their representative) of confirmation that the personal data was obtained illegally or is not necessary for the stated purpose of processing — within seven working days;
• withdrawal by the personal data subject of consent to the processing of their personal data, if its storage is no longer required for the purpose of its processing — within 30 days.

6.5.2. Upon achievement of the purposes of personal data processing, as well as in the event that the personal data subject withdraws consent for their processing, the personal data is subject to destruction if:

• otherwise is not provided for by a contract to which the personal data subject is a party, beneficiary, or guarantor;
• the operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
• otherwise is not provided for by another agreement between the Operator and the personal data subject.

6.5.3. The destruction of personal data is carried out by a commission established by order of the General Director of Hype LLC.

6.5.4. Methods for the destruction of personal data are established in the local regulatory acts of the Operator.

7.1. The Operator's Website does not collect or process personal data of users, except for the use of cookies. The purpose of cookie processing is to ensure the correct operation of the website, improve its functionality, and provide traffic analytics.

7.2. A Website User is a natural person using the website to review information or for other purposes, without providing personal data through forms or other means.

7.3. Cookies are a small piece of data sent by a web server and stored on the user's device, which the browser sends to the server each time the website is accessed. The use of cookies is necessary to ensure the correct operation of the website and analyze traffic.

7.4. Website Services are interactive components used to improve user experience and analytics (e.g., visit counters). The use of such services implies the user's consent to the policy of such website services regarding the use of cookies; refusal to use cookies is possible through browser settings.

7.5. The website does not collect or request personal information from users through feedback forms or registration. All interactions with the website occur without the user providing their personal data.

7.6. When visiting the website, technical data is automatically collected: IP address, country of IP registration, the domain name from which the user came, the pages of the website visited, as well as information about the browser and operating system via cookie technology and scripts of third-party analytical services (e.g., visit counters). These data are used exclusively for analyzing traffic statistics and improving the website's performance.

7.7. Since the website does not collect users' personal data (other than cookies), no transfer of such data to third parties is carried out. Cookies may be used by third-party services for analytics (e.g., Google Analytics); however, these services operate in accordance with their own privacy policies.

7.8. Only technical data (e.g., IP addresses and statistical indicators) necessary for the functioning of the website and the analysis of its operation are stored. Users do not provide or transmit personal data to the Operator.

7.9. The data used by the Operator (mainly cookies and technical information) are applied for:

• ensuring the correct operation of the website;
• traffic analysis;
• improving user experience;
• ensuring website security.

7.10. Due to the absence of personal data collection, the website's liability for its loss or disclosure is limited only to the use of cookies within the framework of the described Operator's policy.

8.1. All relations regarding the processing of personal data that are not covered by this Policy shall be governed by the provisions of the legislation of the Russian Federation.

8.2. The Operator has the right to make amendments to this Policy.

8.3. When amendments are made, the current edition shall indicate the date of the last update. A new version of the Policy shall enter into force from the moment of its approval and execution in the prescribed manner, and, where necessary, after being brought to the attention of employees or other interested parties.

8.4. Since this Policy is provided only in paper form and is not published on the website, it is available for review at the place of work or upon request from the company's authorized person.