Personal Data Processing Policy

1. General provisions

This Policy is adopted by DS.Med LLC (the "Operator") to protect the rights and freedoms of data subjects when their personal data is processed, including the rights to privacy and to personal and family confidentiality. It is developed in accordance with Russian Federal Law No. 152-FZ "On Personal Data" and follows internationally recognised data protection principles.

Key terms. "Personal data" means any information relating to an identified or identifiable natural person (the data subject). "Processing" means any operation performed on personal data, with or without automation: collection, recording, systematisation, accumulation, storage, clarification, extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction. "Operator" means the entity that organises and/or carries out processing and determines its purposes, the composition of the data and the operations performed.

2. Purposes of processing

• HR administration and accounting;
• preparation, conclusion and performance of civil-law contracts;
• compliance with tax, pension and reporting obligations to state authorities;
• handling enquiries, preparing quotations and providing services to clients of the Operator.

Processing is limited to specific, pre-defined and lawful purposes. Processing incompatible with the purposes of collection is not permitted, and the data processed is not excessive relative to those purposes.

3. Legal grounds

Processing is based on: the Constitution of the Russian Federation; Articles 86–90 of the Labour Code of the Russian Federation; Federal Law No. 152-FZ "On Personal Data"; the Charter and internal orders of DS.Med LLC on personal data (No. 1-ПД – 4-ПД of 12 May 2025, approving the processing policy, appointing the officer responsible for personal data, approving local regulations and standard forms, and establishing the data destruction commission); contracts concluded with data subjects; and the data subject's consent where no other legal ground applies.

4. Categories of data subjects and data processed

Employees, former employees, job candidates and their relatives — data processed in connection with employment relations: identity, contact and address details, education and qualifications, work history, tax and social-insurance identifiers, and other data required by labour legislation.

Clients and counterparties (natural persons) — data obtained in connection with concluding and performing contracts: full name, contact details, address, identity document details, taxpayer number, bank account number.

Special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, intimate life) are processed only with the data subject's written consent or where required by social-assistance, labour or pension legislation. Biometric data is processed only with written consent and with the safeguards required by law.

5. Procedures and conditions of processing

• data is stored in a form allowing identification of the subject no longer than the purposes require, and is destroyed or depersonalised once the purposes are achieved;
• databases containing personal data of Russian citizens are located in the Russian Federation;
• the Operator may entrust processing to another party under a contract binding that party to the same principles and confidentiality;
• personal data is not disclosed or disseminated to third parties without the subject's consent, except where required by law (courts, investigative, tax and other authorised bodies);
• the Operator applies legal, organisational and technical measures protecting data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or dissemination.

6. Rights of the data subject

The data subject has the right to receive information about the processing of their data (confirmation of processing, purposes and legal grounds, categories of data, recipients, retention periods, information on cross-border transfers); to demand clarification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose; to withdraw consent; and to seek judicial protection, including compensation for damages and moral harm.

7. Updating, correction and destruction of data; responding to requests

The Operator provides the data subject or their representative with information about processing within 30 days of a request, and free-of-charge access to the data itself. Incomplete, inaccurate or outdated data is corrected within 7 business days of supporting evidence being provided; unlawfully obtained or unnecessary data is destroyed within the same period. Upon withdrawal of consent, achievement of the processing purposes or detection of unlawful processing, processing is stopped and the data destroyed within the statutory time limits (as a rule, within 30 days). Requests should be sent to info@ds-med.info. Related documents: Privacy Policy and Consent to the Processing of Personal Data.