Personal Data Processing Policy

Version dated 16 August 2026.

1. General Provisions

1.1. This Policy defines the procedure and conditions for the processing of personal data by Joint Stock Company “Octoglass” (JSC “Octoglass”) (hereinafter — the “Operator”) and has been developed in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and other applicable regulatory legal acts of the Russian Federation.

1.2. The Policy applies to personal data processed by the Operator with and without the use of automation tools, including data obtained through the website https://octoglass.ru/ and its language sections.

1.3. The Policy is published for free access on the Operator’s website. For specific processing purposes, the Operator may use separate consents and notices. Consent to the processing of personal data is executed separately from other documents and consents in cases provided for by law.

1.4. In this Policy, terms are used in the meanings established by Federal Law No. 152-FZ, including “personal data”, “processing of personal data”, “operator”, “provision”, “dissemination”, “blocking”, “deletion”, “destruction”, “depersonalisation”, and “personal data information system”.

2. Principles of Personal Data Processing

• processing is carried out on a lawful and fair basis;
• the purposes of processing are determined in advance and are specific and lawful;
• processing incompatible with the purposes of personal data collection is not permitted;
• the composition and volume of data correspond to the stated purposes; excess data are not requested;
• the Operator ensures the accuracy and relevance of personal data to the extent necessary for the purposes of processing;
• personal data are stored no longer than required by the purposes of processing or by the periods established by law or contract;
• upon achievement of the purposes, the data are destroyed or depersonalised, unless there is another lawful ground for their further processing.

3. Categories of Data Subjects, Purposes and Composition of Processed Data

3.1. Website Visitors and Persons Submitting Enquiries

Purposes: ensuring the operation and security of the website; processing applications and enquiries; feedback; preparation of calculations and commercial proposals; pre-contractual interaction; technical support; improvement of the website and analysis of its use; recording the fact of obtaining consents.

Depending on the form used and the user’s actions, the following may be processed:

• first name, last name and other information that the user voluntarily indicates in the form;
• telephone number, e-mail address, messenger identifier/contact;
• name of the organisation and position — if indicated by the user;
• content of the enquiry, information about a project, product, vehicle or other task, as well as files attached by the user;
• technical data: IP address, date and time of the request, information about the browser and device, page URL, technical logs, cookie identifiers and similar technologies — to the extent provided for by the Cookie Policy;
• information necessary to confirm the fact and conditions of granting consent: version of the consent text, date and time, form/page from which it was obtained, and other technical event-log information.

3.2. Clients, Prospective Clients and Counterparties — Natural Persons

Purposes: negotiations; conclusion, performance, amendment and termination of contracts; settlements; business correspondence; performance of warranty and service obligations; protection of the rights and legitimate interests of the Operator and counterparties; compliance with legal requirements.

The following may be processed: full name, contact details, address, contract and settlement details, payment and other information to the extent necessary for the conclusion and performance of a specific contract and for compliance with legal requirements.

3.3. Representatives and Employees of Legal Entities and Individual Entrepreneurs

Purposes: business communications, negotiations, conclusion and performance of contracts, organisation of access to facilities and interaction on projects. The following may be processed: full name, position, organisation, business contact details, information about powers of authority and other data necessary for the specific interaction.

3.4. Job Candidates

If the Operator receives a CV or other information about a candidate, the data are processed for consideration of the candidacy and communication with the candidate. The following may be processed: full name, contacts, information about education, qualifications, work experience and other data voluntarily provided by the candidate. Candidates are advised not to submit special categories of personal data unless required by law or by a specific vacancy.

3.5. Employees, Former Employees and Related Persons

Personal data of employees, former employees and, in cases provided for by law, members of their families are processed for compliance with the requirements of labour, tax, accounting, military registration, pension and other legislation, for HR and accounting records, for ensuring security, access control and other lawful purposes of the employer. The specific composition of the data is determined by legal requirements, employment relations and the Operator’s local acts.

3.6. Advertising Communications

For sending advertising and marketing messages, the Operator uses contact details only subject to separate prior consent to receive advertising messages and, where required, separate consent to the processing of personal data for the relevant purpose. Refusal of advertising messages does not limit the ability to submit an ordinary enquiry through the website.

4. Legal Grounds for Processing

• consent of the personal data subject;
• necessity of processing for the conclusion of a contract at the initiative of the subject or for the performance of a contract to which the subject is a party or beneficiary;
• performance of duties imposed on the Operator by the legislation of the Russian Federation;
• exercise of the rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the subject are not violated;
• other grounds expressly provided for by Federal Law No. 152-FZ and other federal laws.

5. Methods and Actions with Personal Data

The Operator carries out mixed, automated and non-automated processing of personal data, including collection, recording, systematisation, accumulation, storage, updating, retrieval, use, granting of access in cases provided for by law, depersonalisation, blocking, deletion and destruction.

The Operator does not disseminate personal data to an indefinite circle of persons without a separate lawful ground and, where required, separate consent of the subject to dissemination.

6. Transfer and Entrustment of Processing

6.1. The Operator may entrust the processing of personal data to persons providing the operation of the website, hosting, corporate e-mail, CRM/enquiry processing systems, service and analytics systems, subject to proper contractual and legal grounds. Such persons process the data only to the extent necessary to perform the assignment or provide the relevant service.

6.2. Personal data may be provided to state authorities and other persons in the cases and in the manner established by the legislation of the Russian Federation.

6.3. The current list of third-party analytics and other cookie services, if used, is disclosed in the Cookie Policy and/or the cookie management interface on the website.

7. Cross-Border Transfer and Localisation

7.1. When collecting personal data of citizens of the Russian Federation, including via the Internet, the recording, systematisation, accumulation, storage, updating and retrieval of such personal data are carried out using databases located in the territory of the Russian Federation, except in cases expressly provided for by law.

7.2. Cross-border transfer of personal data, if required, is carried out only in compliance with the requirements of Article 12 of Federal Law No. 152-FZ and after the Operator has performed the necessary notification and other duties.

8. Cookies and Website Visit Data

Cookies and similar technologies may be used on the website. The procedure for their use, categories, purposes, retention periods and management methods are determined by a separate Cookie Policy. Optional analytics, functional and advertising cookies for which consent is required must not be activated until the corresponding user choice is obtained.

9. Retention Periods and Termination of Processing

9.1. The retention period is determined by the purpose of processing, the terms of consent, the contract and legal requirements. The Operator does not store data longer than necessary.

• data from enquiries and prospective clients — during the period of processing the enquiry and thereafter for a period objectively necessary for continued business communication and protection of the parties’ rights, unless the subject has requested termination of processing and there is no other lawful ground;
• data under contracts — during the term of the contract and the document retention periods established by law;
• data for advertising communications — until withdrawal of the relevant consent or until termination of the relevant purpose;
• candidate data — until completion of the relevant recruitment process, unless another period is agreed separately or established by law;
• cookies and technical identifiers — for the periods established by the Cookie Policy and the settings of the relevant technologies.

9.2. Upon achievement of the purpose of processing or withdrawal of consent, if there is no other lawful ground, the Operator ceases processing and destroys the personal data within the periods provided for by Federal Law No. 152-FZ, as a general rule — no later than 30 days in the cases established by Article 21 of the said law.

10. Rights of the Personal Data Subject

• to obtain information about the processing of their personal data to the extent provided for by law;
• to require updating, blocking or destruction of data if they are incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
• to withdraw previously granted consent;
• to require termination of processing in cases provided for by law;
• to opt out of advertising messages;
• to appeal against the Operator’s actions or inaction to Roskomnadzor or to a court.

Enquiries regarding personal data may be sent to the address: 123112, Moscow, Presnenskaya Embankment, 12, floor 23, premises 2, or by e-mail to sales@octoglass.ru with the subject/mark “Personal Data”. To fulfil a request, the Operator is entitled to request information necessary to confirm the identity of the applicant and their connection with the Operator.

11. Protection Measures and Incident Response

The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful acts. In the event of incidents resulting in unlawful or accidental transfer (provision, dissemination, access) of personal data, the Operator performs its duties to notify Roskomnadzor and to conduct an internal investigation within the periods established by law.

12. Final Provisions

12.1. The Operator is entitled to update this Policy upon changes in legislation, processing processes or website functionality. The new version takes effect from the moment of its publication on the website, unless otherwise stated therein.

12.2. Separate consents to the processing of personal data, to receiving advertising messages and to the use of optional cookies do not replace one another and must be executed/recorded separately.

12.3. If a particular provision of the Policy conflicts with a mandatory provision of law, the corresponding provision of law shall apply.

Approved by: General Director of JSC “Octoglass” V.V. Kravchenko. Version dated 16 August 2026.