Personal Data Processing Policy

1. General provisions

This Personal Data Processing Policy defines how Limited Liability Company “Scientific and Production Association Spectron” (ООО «НПО Спектрон») processes and protects personal data of website users and other persons who interact with the Operator through https://spectron-ops.ru/.

This Policy applies to the website, its Russian and English versions, online forms, feedback forms, request forms, news subscription forms, training forms, internship and vacancy forms, chat widgets, analytics tools and other means of interaction available on the website.

The Operator processes personal data in accordance with the laws of the Russian Federation on personal data, including Federal Law No. 152-FZ “On Personal Data”.

2. Data controller / operator

Operator: Limited Liability Company “Scientific and Production Association Spectron” (ООО «НПО Спектрон»).

TIN 6658494423, KPP 665801001, OGRN 1169658131720.

Legal address: 61 Listvennaya Street, Yekaterinburg, 620036, Russian Federation.

Website: https://spectron-ops.ru/.

E-mail for personal data requests: info@spectron-ops.ru.

3. Categories of data subjects

The Operator may process personal data of website visitors, representatives of legal entities, customers, potential customers, dealers, suppliers, job applicants, internship applicants, subscribers, persons submitting reviews and other persons who voluntarily provide data through the website or other communication channels.

4. Principles of processing

Personal data is processed lawfully and fairly.

Processing is limited to specific, predetermined and lawful purposes.

The Operator does not process personal data that is incompatible with the stated purposes.

The Operator processes only the data that is necessary for the relevant purpose.

The Operator takes reasonable organizational and technical measures to protect personal data.

5. Purposes, categories of data and retention periods

Request processing and commercial offers: name, company, position, phone number, e-mail, message, technical task, uploaded files and other data voluntarily provided by the user. Retention period: until the request is processed and for the period required for business correspondence, claims, accounting and legal protection.

Repair requests and technical support: name, company, contact details, equipment data, description of the issue, files and correspondence. Retention period: until completion of the request and for the period required to confirm service history and resolve potential claims.

Training and internship requests: name, contact details, company or educational institution, course or training information, comments and other data provided by the user. Retention period: until completion of communication and, where applicable, for the period required to document participation.

Vacancies: full name, phone number, e-mail, desired position, education, work experience, qualification, skills, resume, cover letter and other data provided by the applicant. Retention period: until completion of applicant review; for talent pool purposes, no longer than 12 months unless another lawful basis applies.

Reviews and feedback: name, company, position, text of the review, rating, image, voice, signature, files and other data provided for publication or consideration. Retention period: until withdrawal of consent or until the purpose of publication/consideration is achieved.

News subscription and advertising/informational messages: e-mail, phone number if provided, name, company, consent data, subscription status, mailing history and unsubscribe status. Retention period: until consent withdrawal or unsubscribe.

Website analytics and security: cookie identifiers, IP address, browser and device data, operating system, pages visited, date and time of visit, source of visit and website actions. Retention period: within the period required for analytics, security and consent management.

6. Processing operations

The Operator may perform the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification, updating, modification, extraction, use, transfer to persons processing data on behalf of the Operator, depersonalization, blocking, deletion and destruction.

Processing may be carried out with or without automated means.

7. Cookies, Yandex Metrica, chat and map services

The website uses strictly necessary cookies required for website operation, language settings, security, form operation and consent management.

Analytical cookies and Yandex Metrica may be used to analyze website traffic, sources of visits and user actions on the website. Such tools may process technical data including IP address, cookie identifiers, browser data, device data, operating system, visited URLs, date and time of visit, source of visit and website actions.

Analytical cookies and non-essential analytics tools must be launched only after the user gives consent, if such data may directly or indirectly identify the user.

The Operator does not intentionally transmit full names, phone numbers, e-mail addresses, delivery addresses, passport data, payment data, passwords or other directly identifying data to Yandex Metrica or other analytics services.

If an online chat, map widget, subscription widget or other third-party service is used, such service must be listed in this Policy and launched in accordance with the applicable consent model.

8. Recipients and processors

The Operator may engage hosting providers, website administration contractors, CRM providers, e-mail and telephony providers, analytics services, online chat providers, mailing services and other persons processing personal data on behalf of the Operator.

Such persons must process personal data only for the purposes specified by the Operator and subject to confidentiality and security requirements.

The actual list of processors and services must correspond to the services actually used on the website and in the Operator’s business processes.

9. Cross-border transfer

If personal data is transferred to foreign persons or information systems located outside the Russian Federation, the Operator shall submit a notification of intended cross-border transfer of personal data to Roskomnadzor before such transfer and comply with the requirements of Article 12 of Federal Law No. 152-FZ.

The list of countries, recipients and purposes of such transfer shall be specified in this Policy or in the Operator’s internal records. If the website uses Google Analytics or other foreign services, the Operator must separately assess the legality of such use and the need for notification and other measures.

10. Localization of databases

When collecting personal data of citizens of the Russian Federation, the Operator ensures recording, systematization, accumulation, storage, clarification and extraction of such personal data using databases located in the Russian Federation, unless otherwise permitted by law.

11. Rights of data subjects

A data subject has the right to receive information about the processing of his/her personal data, request clarification, blocking or destruction of personal data, withdraw consent, request termination of processing where applicable and exercise other rights provided by law.

Requests related to personal data may be sent to info@spectron-ops.ru or to the Operator’s legal address.

12. Withdrawal of consent

Consent may be withdrawn by sending a request to info@spectron-ops.ru or to the Operator’s legal address. After receiving the withdrawal, the Operator stops processing personal data unless another lawful basis for processing exists, and ensures deletion, destruction or blocking of data within the periods established by law.

13. Security measures

The Operator applies organizational and technical measures to protect personal data, including access control, use of passwords and role-based access, SSL/TLS where applicable, backups, limitation of access to personal data, agreements with processors and internal procedures for handling requests and incidents.

14. Policy updates

The Operator may update this Policy. The current version is published on the website. The date and version number of the Policy must be indicated on the page.

15. Priority of the Russian version

This English version is provided for the convenience of website users. In case of any discrepancy between the Russian and English versions, the Russian version shall prevail, unless otherwise required by applicable law.