Personal data processing policy

Last updated: August 7, 2025 .

1. GENERAL PROVISIONS

1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") of Space Tourism Agency LLC (hereinafter referred to as the "Operator") defines the basic principles, purposes, conditions, and methods of personal data processing by Space Tourism Agency LLC, INN 5717003903, OGRN 1155749011593.

1.2. This Policy has been developed in compliance with Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data" (hereinafter referred to as the "Personal Data Law"), taking into account the requirements of the Personal Data Law and other regulatory legal acts of the Russian Federation in the field of personal data, to protect the rights and freedoms of individuals during the processing of their personal data, including the right to privacy, personal, and family secrets.

1.3. This Policy applies to all operations performed by the Operator with personal data, whether automated or non-automated. The Operator processes personal data only if the data subject fills out and/or submits such data independently through forms on the website http://www.spacetour-agency.ru (hereinafter referred to as the "Website"). By filling out the relevant forms and/or submitting their personal data to the Operator, the data subject consents to this Policy.

1.4. The Policy applies to all personal data processed by the Operator.

1.5. The Operator is registered with Roskomnadzor as a personal data operator in accordance with Article 22 of the Personal Data Law.

1.6. The data subject independently decides to provide their personal data and gives consent freely, voluntarily, and in their own interest.

1.7. This Policy may be updated at the Operator's initiative or in case of changes to the Russian Federation's personal data legislation.

1.8. The Policy applies to personal data processing relationships that arose before or after the approval of this Policy.

1.9. In compliance with Part 2, Article 18.1 of the Personal Data Law, this Policy is publicly available on the Operator's website.

1.10. Compliance with this Policy is monitored by an authorized person responsible for organizing personal data processing at the Operator.

1.11. Liability for violations of Russian Federation legislation and the Operator's internal regulations in the field of personal data processing and protection is determined in accordance with Russian law.

2. KEY DEFINITIONS

2.1. For the purposes of this Policy, the following terms are used with the meanings below:

Personal Data: Any information relating directly or indirectly to an identified or identifiable individual (data subject).
Personal Data Operator (Operator): A state or municipal body, legal entity, or individual organizing and/or processing personal data independently or jointly with others, as well as determining the purposes and composition of personal data processing.
Processing of Personal Data: Any action (operation) or set of actions performed with personal data, including collection, recording, systematization, storage, updating, retrieval, use, transfer, anonymization, blocking, deletion, or destruction.
Automated Processing: Processing of personal data using computer technology.
Dissemination of Personal Data: Actions aimed at disclosing personal data to an indefinite circle of persons.
Provision of Personal Data: Actions aimed at disclosing personal data to a specific person or group.
Blocking of Personal Data: Temporary suspension of processing (except where necessary for clarification).
Destruction of Personal Data: Actions making it impossible to restore the content of personal data in the information system or destroying physical media.
Anonymization of Personal Data: Actions making it impossible to determine the data subject without additional information.
Personal Data Information System: A combination of personal data databases and the technologies and tools used to process them.
Data Subject: An individual identifiable directly or indirectly through personal data.
Consent to Processing: A written or digital document confirming the data subject's voluntary decision to provide their personal data to the Operator under the terms of this Policy.

3. RIGHTS AND OBLIGATIONS OF THE PARTIES

3.1. The Operator has the right to:

Determine the measures necessary to comply with the Personal Data Law.
Engage third parties for processing, subject to the data subject's consent and contractual obligations.
Continue processing personal data after consent withdrawal if permitted by law.

3.2. The Operator is obligated to:

Organize processing in compliance with the Personal Data Law.
Respond to data subject requests.
Provide Roskomnadzor with requested information within 10 business days (extendable by 5 days with justification).
Cooperate with authorities on cybersecurity incidents involving personal data breaches.

4. RIGHTS OF DATA SUBJECTS

4.1. Data subjects have the right to:

Access their personal data (unless restricted by law).
Request correction, blocking, or deletion of inaccurate or unlawfully processed data.
Consent to processing for marketing purposes.
Appeal unlawful processing actions to Roskomnadzor or court.

5. PRINCIPLES AND PURPOSES OF PROCESSING

5.1. Processing is based on legality, purpose limitation, data minimization, accuracy, storage limitation, and confidentiality.

5.2. Purposes include:

Identifying subjects for contracts.
Conducting surveys, promotions, or research.
Communication (e.g., emails, notifications).
Verifying data accuracy.
Invitations to events.
Background checks for security.
Compliance with labor laws.
Statistical or analytical research (with anonymization).

6. SCOPE AND CATEGORIES OF PROCESSED DATA

6.1. Processed data may include:

Full name, citizenship, birth details.
Passport data, address, INN.
Phone number, email, social media accounts.
Website activity (cookies, location, session data).

6.2. For employees/candidates:

Additional details like education, work history, marital status, etc.

6.3. The Operator does not process sensitive data (e.g., race, religion, health) unless required by law.

7. PROCESSING PROCEDURES AND CONDITIONS

7.1. Processing methods:

Non-automated, automated, or mixed.

7.2. Actions: Collection, storage, use, transfer, anonymization, deletion, etc.

7.3. Consent is voluntary; processing without consent is allowed only as per law.

7.4. No biometric or cross-border data transfers.

7.5. Processing stops upon:

Achieving the purpose.
Consent withdrawal (within 5 business days).
Detection of unlawful processing (within 3 days).

8. UPDATING, CORRECTING, DELETING DATA

8.1. Data subjects may request access, corrections, or deletion. Responses are provided within 10 business days (extendable by 5 days).

8.2. Inaccurate data is blocked during verification.

8.3. Unlawful processing incidents are reported to Roskomnadzor within 24 hours, with investigation results within 72 hours.

9. DISPUTE RESOLUTION

9.1. Disputes are resolved through negotiations.

9.2. A 30-day pre-trial claim process is required before court action.

9.3. Russian law governs the Policy and disputes.

10. FINAL PROVISIONS

10.1. The Operator may update the Policy, with changes effective upon website publication.

10.2. Questions or requests can be sent to: info@spacetour-agency.ru

10. 3. The Consent Form is available at www.spacetour-agency.ru

11. OPERATOR DETAILS

Space Tourism Agency LLC

INN 5717003903

OGRN 1155749011593

Legal address: 302028, Orel, Lenina St., 16/20, Apt. 8

Contacts: +7 (965) 160-38-83