POLICY REGARDING PROCESSING OF PERSONAL DATA OF A LIMITED LIABILITY COMPANY MICRO-CREDIT COMPANY «A MONEY»

1. General provisions

This Policy on the Processing of Personal Data (hereinafter referred to as the Policy) is designed to comply with the requirements of Art. 2.2.1. 18.1Federal Law of 27.07.2006 152-FL «On Personal Data» (hereinafter - Law on Personal Data) to ensure the protection of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy, Personal and family secrets are designed to provide unrestricted access to information regarding the processing of personal data, as well as to information about the implemented requirements for the protection of personal data in LLC MCC "A MONEY".

This Policy is an extract from the Regulation on Processing and Protection of Personal Data of LLC MCC "A MONEY" and describes the procedure of processing and protection of personal individuals in connection with the implementation of labour relations, conclusion of contracts and performance of contractual obligations of LLC MCC "A MONEY".

Personal data are classified as confidential information and protected from unauthorized, including accidental, access to it.

2. Basic concepts in the field of personal data

Personal data refers to any information relating directly or indirectly to a certain or defined individual, including:

- Name, first name, patronymic;

- Date and place of birth;

- Registration address, residence address;

- Marital, social and property status;

- Education, profession, income;

- E-mail address;

- User identifiers;

- Photographs, images (user's photograph; photo of the user's identity document; photo of the user with the user's identity document);

- Phone number;

- Financial information;

- ID confirmation documents;

- Actions in the mobile application or on the company’s website;

- Web search history;

- Application error reports;

- Application diagnostic information;

- Device identifiers or other identifiers;

- Information about user’s device (including name and version of the operating system, cookies, IP address, information about the browser used (browser type and version) and language, date and time of access to the site, Internet addresses of web pages visited by the user, subject of the information placed on the Company’s web resources visited by the user, number of pages viewed, length of stay on the site, list of accounts attached to the device, User Agent, source of the ads traffic, session identifier, authorization/registration time, token, time of each system-specific token check, mobile application version, service date/time).

The following concepts are also used in this Policy:

Automated processing of personal data — processing of personal data using computer tools.

Personal Data Information System — a set of personal data contained in databases and providing their processing information technologies and technical means.

Anonymization of personal data — actions that make it impossible without the use of additional information to determine the ownership of personal data by a particular subject of personal data.

Processing of personal data — any action performed with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (distribution, provision, access), anonymization, blockage, deletion and/or destruction.

Personal Data Operator — a legal entity, independently or jointly with third parties organizing and processing personal data, as well as determining the purposes of processing, composition of personal data and actions with it;

Provision of personal data — actions aimed at disclosure of personal data to a certain person or a certain circle of persons.

Personal Data Dissemination — actions aimed at disclosing personal data to an undetermined circle of persons.

The subject of personal data is an individual whose personal data is processed by the personal data operator.

The destruction of personal data is the action that makes it impossible to restore content of the personal data in the system or that destroys the material carriers of personal data.

3. Personal data processing

- Personal data, include photographs, images (user's photograph; photo of the user's identity document; photo of the user with the user's identity document), is collected directly from the individual (subject of this personal data). If the provision of personal data is required by law, the subject of personal data shall be informed of the legal consequences of the refusal to provide such data.

Obtaining personal data from a third party is possible only if there are legal grounds. The individual is thereof notified upon receipt of personal data from a third party.

The acquisition and processing of personal data of an individual on his political, religious or private beliefs is not permitted. In cases where processing of such information is necessary in connection with the performance of contractual obligations, it can be obtained and processed only with the written consent of the individual or his legal representative.

The processing of personal data is carried out in cases when the consent of the individual to the processing of his personal data is received or in other cases stipulated by the legislation.

The processing of personal data is carried out solely for the following purposes:

1. Loan provision;

2. Acquisition of customer’s credit score;

3. Provision of financial services to individuals;

4. Fulfilment of treaty obligations;

5. Payments to clients;

6. Employment relations with employees of the Company;

7. Documenting information to prevent and counter the legalization (laundering) of proceeds of criminal activities and the financing of terrorism;

8. Processing of complaints, applications. claims;

9. Recovery of overdue debts;

10. Provision of information at the request of relevant services and public authorities in cases provided for by existing legislation;

11. Accounting;

12. Execution of judicial acts, acts of other State bodies or officials;

13. Administrative and economic activities;

14. Improvement of the quality of the website and mobile application;

15. Provision of information of a notification or marketing nature, including new financial products, services, carried out promotions, events;

16. Account management and user identification;

17. Improving service quality, content and advertisement. Processing of personal data is carried out only by employees of the operator, approved by the management in the established order.

Personal data is processed on both physical (paper) and electronic (personal data information systems, machine media) carriers.

Personal data shall be stored in a form that allows identification of the subject of personal data, no longer than is required by the purpose of processing personal data, if the retention period of personal data is not established by law or by contract, to which the subject of personal data is a party.

Personal data shall be kept confidential.

Personal data shall be destroyed or anonymized upon achievement of the purposes of processing or in case of loss of necessity to achieve these purposes, unless otherwise provided by legislation.

The transfer of personal data to a third person is carried out only with the consent of the subject of personal data or in cases expressly provided for by law.

The disclosure of personal data to a third person without the written consent of the relevant subject is not permitted, except when necessary to protect the life, health or other vital interests of the subject of personal data.

The disclosure of personal data to a third person for commercial purposes without the written consent of the relevant entity is prohibited. Processing of personal data for the purpose of promotion of goods, works, services in the market, as well as for the purpose of political agitation is carried out only with the prior consent of the subject.

The right of access to personal data processed in LLC MCC A MONEY is given to:

- CEO of the LLC MCC A MONEY;

- Other employees of the LLC MCC A MONEY for whom the processing of personal data is necessary for performing their workplace duty.

Employees are admitted to personal data in accordance with an established procedure.

Any subject whose personal data is processed in LLC MCC A MONEY has the right to access his personal data, including the following information:

- confirmation of the processing of one’s own personal data;

- Legal grounds and purposes for processing his personal data;

- The purposes and methods used by the operator for processing personal data;

- The name and location of the operator, details of individuals or companies who have access to personal data (except operator’s employees) or to whom personal data may be disclosed on the basis of a contract with the operator or on the basis of legislation;

- The list of personal data processed relating to the subject and the source of such data;

- Processing time and retention period for personal data;

- the procedure of exercising the rights provided for the individual by law;

- the name of the person performing the processing of personal data on behalf of the operator, if the processing is entrusted to a third party.

4. Rights and obligations of subjects of personal data

4.1. The person whose personal data is processed by LLC MCC A MONEY has:

• A right to withdraw previously given consent to processing of personal data;

• A right to receive information relating to processing of personal data;

• A right to request clarification of personal data, its blocking or destruction if personal data is incomplete, outdated, unreliable, illegally obtained, not necessary for the stated purpose of processing; and to demand termination of processing of personal data if the purpose of such processing is achieved by LLC MCC A MONEY.

4.2. If another procedure of interaction between LLC MCC A MONEY and the subject of personal data is not stipulated by an appropriate document between them (for example, agreement or text of consent for processing of personal data, to exercise these rights, the subject of personal data is required to send a statement to LLC MCC A MONEY as follows:

• in written form, signed by his own hand signature — via post or carrier at the following address: 107078, Moscow, VN.TER.G. MUNICIPAL DISTRICT OF KRASNOSELSKY, UL MASHA PORYAEVA, D. 7, STR. A, FLOOR/COUNTY./COM. 8/5-6B/805-806; whether

• as an electronic document — via e-mail addressed to support@adengi.ru. Such a statement must contain a description of the requirements of the subject of personal data, as well as the following information:

• Full name (including patronymic) of the subject of personal data;

• the ID number of a document certifying the identity of the subject of personal data or his representative, the date of issue of the said document and the issuing body, or other data allowing an unambiguous identification of the subject of personal data;

• information confirming the participation of the subject of personal data in relations with the society, or information that otherwise confirms the fact of processing of personal data of LLC MCC A MONEY;

• signature of the subject or his representative.

According to art. 9, arts. 2, arts. 4 and 5. 21 Federal Law «On Personal Data» LLC MCC A MONEY have the right to continue processing of personal data if there are other legal grounds.

4.3. The subject of personal data also has the right to appeal actions (omissions) and decisions of LLC MCC A MONEY violating its rights in the processing of personal data to the authorized body for the protection of rights of subjects of personal data (Roskomnadzor) and to the court in the manner established by the legislation of the Russian Federation.

5. Personal data protection

When processing personal data, the necessary legal, organizational and technical measures shall be taken to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as other unlawful actions in relation to personal data, in accordance with the requirements of Article 19 of the Federal Law of July 27, 2006 152-FZ «On personal data».

6. Responsibility

For violation of the requirements established by the legislation of the Russian Federation, the Regulations and other local acts of the LLC MCC A MONEY, employees and other persons who have access to personal data shall have disciplinary, administrative, civil, legal and criminal liability in accordance with the federal laws of the Russian Federation.

7. Final provisions

This Policy shall take effect from the moment of its adoption and shall remain active indefinitely. Changes to the Policy are made by separate acts of LLC MCC A MONEY. This policy should be made accessible to all stakeholders, including personal data subjects and authorities with a monitoring and oversight role conserning personal data.