EMILISA Free Zone Company
(EMILISA FZCO)

CONDITIONS
Policy on personal data processing

APPROVED
By Order of the General Manager of EMILISA FZCO

1.GENERAL PROVISIONS

1.1 EMILISA FZCO pays special attention to the protection of personal data during their processing and respects the observance of the rights of personal data subjects.

1.2 The Policy explains to personal data subjects how and for what purposes their personal data are collected, used or otherwise processed, as well as reflects the rights of personal data subjects and the mechanism of their realization.

The Policy does not apply to the processing of personal data in the course of employment and administrative procedures (in relation to employees and former employees), video surveillance, as well as the processing of cookies on the EMILISA FZCO website.

1.3 Postal address of EMILISA FZCO: UAE, Dubai, IFZA Business Park, DDP, premises 17239 — 001;

1.4 This Policy uses terms and their definitions in the meaning defined by the UAE.

1.5 EMILISA FZCO shall be responsible for the following

1.6 EMILISA FZCO shall process only those personal data that are necessary for fulfillment of the stated purposes and shall not allow their excessive processing.

2. PURPOSES, CATEGORIES OF PERSONAL DATA SUBJECTS WHOSE DATA ARE PROCESSED, LIST OF PROCESSED PERSONAL DATA, LEGAL GROUNDS AND TERMS OF PERSONAL DATA PROCESSING

2.1 EMILISA FZCO processes personal data of personal data subjects for the purposes, in the scope, on legal grounds and within the terms applicable to each category of personal data subjects according to Appendix 1 to this Policy.

3. AUTHORIZED PERSONS.

TRANSBOUNDARY TRANSFER OF PERSONAL DATA

3.1 EMILISA FZCO entrusts the processing of personal data to authorized persons. The list of authorized persons processing personal data on behalf of EMILISA FZCO is contained in Appendix 2 to this Policy.

3.2 EMILISA FZCO carries out cross-border transfer of personal data to ensure continuous communication with users of social networks and messengers (Instagram, TikTok, Telegram, YouTube video hosting).

Trans-border transfer of personal data to the territory of a foreign state may be carried out by EMILISA FZCO, if:

• in the territory of the foreign state the proper level of protection of the rights of personal data subjects is ensured — without restrictions in the presence of legal grounds provided by the Law;
• on the territory of a foreign state the appropriate level of protection of the rights of personal data subjects is not ensured, including:

1) when the consent of the personal data subject is given, provided that the personal data subject is informed of the risks arising from the lack of an adequate level of protection;

2) when placing information about its activity in the global computer network Internet;

3) when the processing of personal data is necessary for the fulfillment of duties (powers) stipulated by legislative acts.

4.RIGHTS OF PERSONAL DATA SUBJECTS

4.1 The subject of personal data has the right:

4.1.1. to withdraw his consent, if for the processing of personal data EMILISA FZCO appealed to the subject of personal data to obtain consent. The right to withdraw consent cannot be exercised when processing is carried out on other legal grounds (for example, in accordance with legal requirements or on the basis of a contract);

4.1.2. to receive information regarding the processing of his/her personal data by EMILISA FZCO, containing:

—          location of EMILISA FZCO;

• confirmation of the fact of processing the personal data of the applicant by EMILISA FZCO;
• personal data and the source of their receipt;
• legal grounds and purposes of personal data processing;
• the period for which consent is given (if the processing of personal data is carried out on the basis of consent);
• name and location of the authorized person(s);

other information provided by law.

4.1.3. require EMILISA FZCO to make changes to their personal data if the personal data is incomplete, outdated or inaccurate. For these purposes, the personal data subject shall attach the relevant documents and (or) their duly certified copies confirming the need to make changes to personal data;

4.1.4. to receive information from EMILISA FZCO on the provision of their personal data processed by EMILISA FZCO to third parties once a calendar year free of charge, unless otherwise provided by Law and other legislative acts;

4.1.5. require EMILISA FZCO to stop processing its personal data free of charge, including their deletion, in the absence of grounds for processing personal data provided for by Law and other legislative acts;

4.1.6. to appeal against actions (inaction) and decisions of EMILISA FZCO that violate its rights when processing personal data, in accordance with the procedure established by law.

4.2. In order to exercise their rights related to the processing of personal data by EMILISA FZCO, the personal data subject submits a written application to EMILISA FZCO at the postal address specified in subparagraph 1.3 of paragraph 1 of this Policy, or in the form of an electronic document.

Such a statement must contain:

• the surname, proper name, patronymic (if any) of the subject of personal data, the address of his place of residence (place of stay);
• the date of birth of the personal data subject;
• statement of the essence of the requirements of the personal data subject;
• the identification number of the personal data subject, in the absence of such a number – the number of the identity document of the personal data subject, in cases where this information was indicated by the personal data subject when giving his consent or the processing of personal data is carried out without the consent of the personal data subject;
• a personal signature (for a written application) or an electronic digital signature (for an application in the form of an electronic document) of the personal data subject.

EMILISA FZCO does not consider applications from personal data subjects received by other means (e-mail, phone, etc.).

4.3. For assistance in exercising the rights related to the processing of personal data by EMILISA FZCO, the subject of personal data may contact the person responsible for internal control over the processing of personal data in EMILISA FZCO.

Annex 1

to the Policy on personal data processing

personal data

Purposes, scope, legal basis and terms of personal data processing by EMILISA FZCO

PROVISION OF INFORMATION AND CONSULTING SERVICES. RECEIVING ANSWERS VIA FEEDBACK FORM ON INTERNET RESOURCES

Categories of personal data subjects whose data are processed	persons authorized to sign the contract. 2. Participants in webinars and/or seminars. 3. Entities that are recipients of information and counseling services. 4. Subjects who are recipients of answers via feedback form on Internet resources.
List of processed personal data	Surname, first name, patronymic of the person, personal signature, other personal data (if necessary)
Legal basis for processing personal data	In case of concluding a contract with a natural person — processing on the basis of a contract with the personal data subject. 2. In case of concluding a contract with a legal entity — processing of personal data which is necessary for the fulfillment of obligations (powers) provided for by legislative acts 3. When providing answers through the feedback form on Internet resources — consent of the personal data subject.
Retention period of personal data	3 years after the expiration of the contract, tax authorities audit tax compliance. If the tax authorities have not conducted an audit of tax compliance — 10 years after the end of the contract term.

PLACEMENT OF INFORMATION ON THE ACTIVITIES OF EMILISA FZCO ON THE OFFICIAL WEBSITE, SOCIAL NETWORKS AND MESSENGERS

Categories of personal data subjects whose data are processed	Persons participating in EMILISA FZCO events
List of processed personal data	Image of the personal data subject; surname, first name, patronymic; position; other information
Legal basis for processing personal data	If the personal data subject is the main object of the posted information (filming) — personal data processing based on the consent of the personal data subject
Retention period of personal data	until published on social networks and messengers

PROVISION OF INFORMATION TO MASS MEDIA ON THE ACTIVITIES OF EMILISA FZCO

Categories of personal data subjects whose data are processed	Employees
List of processed personal data	Image of the personal data subject; surname, first name, patronymic; position; other information
Legal basis for processing personal data	In case of realization of the employee’s labor function — processing of personal data in the course of the personal data subject’s labor activity, in cases provided for by the legislation. In other cases — consent
Retention period of personal data	Term of consent — for the period of employment

MAINTAINING A DOCUMENT FLOW ACCOUNTING SYSTEM

Categories of personal data subjects whose data are processed	Persons whose information is contained in the documents registered in the document flow accounting system
List of processed personal data	Surname, proper name, patronymic, other information contained in the registered document
Legal basis for processing personal data	Processing of personal data is necessary for fulfillment of duties (powers) stipulated by legislative acts
Retention period of personal data	According to the Law

CONCLUSION AND EXECUTION OF CIVIL CONTRACTS

Categories of personal data subjects whose data are processed	Persons authorized to sign the contract
List of processed personal data	Surname, first name, patronymic or initials of the person, position of the person who signed the contract, other data in accordance with the terms of the contract (if necessary)
Legal basis for processing personal data	In case of concluding a contract with a natural person — processing on the basis of a contract with the personal data subject . 2. In case of concluding a contract with a legal entity — processing of personal data is necessary for the fulfillment of obligations (powers) stipulated by legislative acts.
Retention period of personal data	3 years after the expiration of the contract, tax authorities audit tax compliance. If the tax authorities have not conducted an audit of tax compliance — 10 years after the end of the contract term.