of Limited Liability Company “MedTechSolutions”
Regarding the Processing of Personal Data

This Policy of LLC “MedTechSolutions” regarding the processing of personal data (hereinafter – the Policy) has been developed in accordance with Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter – the Personal Data Law) and applies to all personal data that LLC “MedTechSolutions” (hereinafter – the Operator) may obtain from a personal data subject.
The Policy applies to relations in the field of personal data processing that arose at the Operator both before and after the approval of this Policy.
This Policy is a publicly available document declaring the principles of the Operator’s activities in the processing and protection of personal data and is published in open access on the Internet on the Operator’s website elevate-construction.ru (hereinafter – the Website).

For the purposes of this Policy, personal data shall mean:

• Personal data received by the Operator for the performance of a contract to which the personal data subject is a party, beneficiary, or guarantor.
• Personal data received by the Operator in connection with employment relations.
• Personal data received by the Operator during registration (including the registration process) of Website users.

The terms and conditions for termination of processing and storage of personal data shall be determined in accordance with the procedure established by the legislation of the Russian Federation.

The Operator collects, processes, and stores personal data for the following purposes:

• Performance of a contract. In accordance with Clause 5, Part 1, Article 6 of the Personal Data Law, processing of personal data necessary for the performance of a contract to which the personal data subject is a party, beneficiary, or guarantor, as well as for the conclusion of a contract initiated by the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor, shall be carried out without the consent of the personal data subject.
• Implementation of employment relations.
• Fulfillment of the functions, powers, and duties imposed on the Operator by the legislation of the Russian Federation, including Articles 23 and 24 of the Constitution of the Russian Federation; the Personal Data Law; the Federal Law “On Information, Information Technologies and Information Protection”; and other regulatory requirements in the field of personal data processing and protection.
• Identification of Website users, provision of effective customer support, and informing users about new products, special promotions, offers, and services of the Operator.

The Operator processes, uses, retrieves, and stores personal data using automation tools (including databases) and without the use of automation tools.
The Operator has the right to transfer personal data to third parties in the following cases:

• The personal data subject has explicitly expressed consent to such actions.
• The transfer is предусмотрена by the legislation of the Russian Federation within the established procedure.

When processing personal data, the Operator is guided by the Personal Data Law, other regulatory requirements of the Russian Federation in the field of personal data protection, and this Policy.
The Operator processes personal data of Website users with their consent provided by users and/or their legal representatives through implicit (conclusive) actions on the Website, including but not limited to placing an order, registering a personal account, creating a login and password, and subscribing to promotional and informational newsletters.

The personal data subject has the right to obtain information regarding the processing of their personal data, including:

• Confirmation of the fact of personal data processing by the Operator.
• Legal grounds and purposes of personal data processing.
• Methods of personal data processing used by the Operator.
• Name and location of the Operator; information about persons (except Operator’s employees) who have access to personal data or to whom personal data may be disclosed on the basis of a contract or federal law.
• Processed personal data relating to the relevant personal data subject and the source of such data.
• Terms of personal data processing and storage.
• The procedure for exercising the rights provided by the Personal Data Law.
• Information about cross-border data transfers carried out or planned.
• Name, surname, patronymic, and address of the person processing personal data on behalf of the Operator, if such processing is assigned.

Information provided to a personal data subject must not contain personal data relating to other subjects, except where legal grounds for disclosure exist.
In accordance with Clause 3, Article 14 of the Personal Data Law, such information may be provided to the personal data subject or their legal representative upon request. The request must contain the information specified in Clause 3, Article 14 of the Law.
The personal data subject has the right to require the Operator to clarify, block, or destroy personal data if such data are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose, as well as to take other measures provided by law to protect their rights.

Ensuring an adequate level of security of personal data information systems, confidentiality, integrity of processed data, and safety of data carriers at all stages of processing is a key condition for achieving the Operator’s objectives.
The Operator has established conditions and information protection regimes that ensure the security of processed personal data.
In accordance with Russian legislation, the Operator has developed and implemented a set of organizational, administrative, functional, and planning documents regulating personal data security.
Security regimes for personal data processing and premises protection have been implemented.
A person responsible for organizing personal data processing has been appointed.
The Operator has:

• Defined categories of personnel authorized to process personal data;
• Developed instructions for data handling, antivirus protection, and emergency response;
• Established personnel requirements and responsibility levels;
• Conducted staff training and awareness programs;
• Implemented access control systems;
• Installed protection against unauthorized access to workplaces, networks, and databases;
• Installed protection against malicious software;
• Established regular data backup procedures;
• Ensured encrypted data transmission via public networks;
• Organized internal control systems and regular compliance audits.

The current paper version of the Policy is stored at:
125445, Moscow, municipal district Levoberezhny, Smolnaya Street, 50A, building 3, office 34.
The electronic version of the current Policy is available on the Operator’s website in the section “Personal Data Processing Policy.”

The Policy is approved and enacted by an official order signed by the head of the Operator.
The Operator has the right to amend this Policy. When amendments are made, the date of the latest revision shall be indicated in the title. The new version shall enter into force upon publication on the Operator’s Website unless otherwise provided therein.
This Policy and relations between the personal data subject and the Operator shall be governed by the legislation of the Russian Federation.

Last update: 1 October, 2025