POLICY

on processing of personal data of individual investors of Limited Liability Microfinance Company “Kreditech Rus”

This Policy has been developed on the basis of the Constitution of the Russian Federation, the Convention for the protection of individuals with regard to automatic processing of personal data ETS No 108 dated January 28, 1981, Federal Law No. 218-FZ “On Credit Histories” dated December 30, 2004, Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and Data Protection" and Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", Federal Law No. 151-FZ “On Microfinancial activity and Microfinancial organizations” dated July 02, 2010, Federal Law No. 353-FZ “On Consumer Credit (Loan)” dated December 21.12.2013 and other regulations, including but not limited to regulations of the Central Bank of the Russian Federation.

1. General

1.1. Main terms and definitions:
Operator means Limited Liability Company Microfinance Organization “Kreditech Rus”, OGRN 1135543003793, INN 5501246928, registered at: 127055, Moscow, Novoslobodskaya str., h.14/19, bld.1, office 29, room 5.
Operator’s Group means Operator, Kreditech Holding SSL GmbH, a company, organized under law of Germany and located at Ludwig-Erhard-Straße 1, 20459 Hamburg and their affiliates.
Loanmeans loan provided in favor of the Operator by the Investor in accordance with terms and conditions of the Loan Agreement.
Loan Agreement means the loan agreement entered into between Operator and Investor.
Investor (or Personal Data Subject) means an individual, being a citizen of the Russian Federation, foreign national and stateless person, who is willing to, is in the process of granting or who has granted a Loan as well as who is willing to, is in the process of entering into or has entered into Loan Agreement with Operator.
Personal Data means Investor details required by Operator including in connection with the making and performance of a Loan Agreement and includes the Investor's full name or assumed name, date of birth, address, telephone number, email address, location, passport number, INN (Tax identification number), bank account details and other related financial information.
Personal Data processing means any action (operation) or a set of actions (operations), whether using means of automation or not, involving, including collection, entry, compilation, accumulation, storage, refinement (update, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of Personal Data.
Dissemination of Personal Data means actions aimed at disclosing Personal Data to general public.
Provision of Personal Data means actions aimed at disclosing Personal Data to a certain person or to a certain group of persons.
Blocking of Personal Data means a temporary suspension of collection, compilation, accumulation, use and dissemination of Investor Personal Data, including its transfer.
Destruction of Personal Data means actions making it impossible to restore the contents of Investor Personal Data in the Personal Data information system or resulting in destruction of physical media with Investor Personal Data.
Cross-border transfer of Personal Data means transfer of Investor Personal Data by Operator across the state border of the Russian Federation to any authority, individual or legal entity of a foreign state.
Personal Data Information System (PDIS) means the information system that combines the aggregate of Personal Data contained in the data base, information technologies and hardware, which provide the capability of processing such Personal Data with or without the use of means of automation.
1.2. The purpose of this Policy is to protect the rights of Investors in connection with the processing of their Personal Data related to the making and performance of a Loan Agreement between Investor and Operator.

2. What is the purpose of collection

2.1. Personal Data may be processed solely for the purposes directly related to the Operator’s activities. Operator shall collect the data only to the extent required to achieve said purposes. Notwithstanding the foregoing Personal Data of Investors is also processed with the purpose to enable Operator to lawfully carry out his functions and activities necessary for the provisions of services, for internal management purposes and assisting Investors (the “Primary Purpose”). Personal Data is also processed for the following list of additional purposes:
2.1.1. providing Investors with further information and support at their request;
2.1.2. carrying out statistical analysis that allows Operator to improve its technology;
2.1.3. personalizing and customizing Investor’s experiences with Operator;
2.1.4. helping Operator to review, manage and enhance its services;
2.1.5. developing insights used in reports or other content developed by Operator;
2.1.6. managing and enhancing products or Investors’ experience on Operator’s platform and domains and those of our Operator’s Group;
2.1.7. contacting the Investor to manage the contractual relationship or to discuss the prospect of entering into the Loan Agreement;
2.1.8. in order to generate the Loan Agreement and other ancillary contractual documents;
2.1.9. for the performance of obligations under Loan Agreement;
2.1.10. paying the necessary taxes if applicable;
2.1.11. promoting and marketing services which Operator considers of interest to Investors;
2.1.12. providing news and updates about any services rendered to Investors;
2.1.13. sending marketing and promotional material to Investors, if the Investor so chooses by giving express consent during sign-up or at a further stage;
2.1.14. communicating with Investors including via email, telephone and mail or any other means provided by the Investor;
2.1.15. conducting surveys or promotions;
2.1.16. investigating any complaints about or made by Investors, or if Operator has reason to suspect that Investor may have breached any relevant terms; or
2.1.17. as may be required or permitted by law.
2.2. The Personal Data may not be used for the purposes of inflicting property or moral damage to Investors to impede the exercise of rights and freedoms by Investors.
2.3. This Policy and amendments thereto shall be approved by the order of the Operator's General Director.

3. Confidentiality of Investor Personal Data

3.1. Investor Personal Data constitutes confidential information.
3.2. Operator shall protect confidentiality of Personal Data and shall have a duty not to permit the same to be disseminated without the Investor's consent or otherwise without a legally valid ground.
3.3. All confidentiality precautions in connection with the collection, processing and storage of Investor Personal Data shall apply to both paper and electronic (automated) media.
3.4. Confidentiality, integrity and protection of Personal Data from unauthorized or incidental access to the same, destruction, modification, blocking, copying or dissemination of Personal Data as well as from other unauthorized actions shall be ensured by putting in place appropriate administrative and technical measures for the protection from unauthorized or incidental access to the same.
3.5. The confidential treatment of Personal Data shall no longer apply where the same have been depersonalized or included into publicly available sources of Personal Data, unless the law provides otherwise.

4. Rights and obligations of Operator

4.1. Operator shall be authorized to process Investor Personal Data subject to their written consent to the processing of Personal Data and in other cases provided for by the legislation of the Russian Federation, where such consent is not required.
4.2. Operator may not obtain and process Investor Personal Data relating to his/her criminal conviction, political, religious or other beliefs and private life, his membership in public associations or his trade union activities or the Investor's state of health.
4.3. Operator shall ensure the protection of Investor Personal Data from their unauthorized use or loss at its own cost pursuant to the procedure, provided for by the federal legislation.

5. Rights and obligations of Investor

5.1. Investor shall be required to provide to Operator true details and documents, containing Personal Data, necessary for the purposes of making a Loan Agreement.
5.2. Investor shall be required to notify Operator on any changes in Personal Data (last name, address of residence (stay)) within 60 days from the date such changes occurred.
5.3. Investor shall have the right to receive information on Operator, its place of business, on whether Operator holds any Personal Data, relating to Investor, and also to review such Personal Data.
5.4. Investor shall be entitled to request Operator to update his/her Personal Data, to block or destroy the same, where the Personal Data is incomplete, obsolete, incorrect, have been improperly obtained or is not required for the declared purpose of processing, as well as to pursue any remedies available under the law. Such a request should be sent by e-mail or by mail to the following addresses:
5.4.1. privacy@kredito24.ru;
5.4.2. 127055, Moscow, Novoslobodskaya str., h.14/19, bld.1, office 29, room 5
5.5. Information on any Personal Data held shall be provided to Investor in easily-accessible form and should not contain any Personal Data relating to other Investors.
5.6. Access to his/her Personal Data shall be provided to Investor or his/her attorney-in-fact upon request or upon receipt of inquiry from Investor or his/her attorney-in-fact. An inquiry should contain the number of the primary identification document of Investor (or his/her attorney-in-fact), details as to the date of issuance of such document and the issuing authority together with authentic signature of Investor (or his/her attorney-in-fact, a power of attorney for the same). An inquiry may be submitted in electronic form and signed by a digital signature in accordance with the law of the Russian Federation.
5.7. Investor shall be entitled to receive information relating to the processing of his/her Personal Data, including that containing:
5.7.1. a confirmation of the fact of processing of Personal Data by Operator;
5.7.2. legal basis and purpose of the Personal Data processing;
5.7.3. methods of Personal Data processing employed by Operator;
5.7.4. the Operator's name and place of business, details of parties (other than the Operator's employees), who have access to Personal Data or to whom Personal Data may be disclosed pursuant to a contract with Operator or the law of the Russian Federation as in effect from time to time;
5.7.5. Personal Data being processed that relates to a relevant Investor and the source, from which the same have been obtained;
5.7.6. a period of Personal Data processing, including a period of its retention;
5.7.7. procedure for the exercise by Investor of these rights available under the law of the Russian Federation;
5.7.8. information on complete or anticipated cross-border transfer of data;
5.7.9. corporate or family name, first/middle name and address of a person processing Personal Data on the Operator's instructions to the extent the processing has been or will be assigned to such person;
5.7.10. other details provided for under the legislation as in effect from time to time.
5.8. Investor shall be entitled to revoke his/her consent to Personal Data processing, to limit the methods and forms of Personal Data processing, to disallow the dissemination of Personal Data without his/her consent.

6. Procedure for obtaining Personal Data

6.1. Investor’s Personal Data may be contained in the following documents generated as a consequence of the Operator's activities:

• Loan Agreements;
• application form for entering into Loan Agreements;
• complaints and other communications from Investors;
• other documents, including written and electronic (which are completed by the Personal Data Subjects on-line on the Operator's web site (https://www.kredito24.ru/invest)through the Internet).

6.2. Operator shall obtain Investor’s Personal Data directly from Investor or otherwise:

• from entities of the Operator’s Group;
• from Russian banks, law enforcement agencies and other government entities;
• from publicly available sources of information;
• in course of communication of the Investor with Operator through Internet, via telephone or otherwise; and
• by other means of which Operator will reasonably inform Investor.

6.3. Prior to the commencement of the Personal Data processing Operator shall be required to provide to Investor information on the legal basis for and purposes of the processing by Operator of Investor Personal Data, on the proposed users of Personal Data and the rights of Investor established under the law.

7. Personal Data processing

7.1. Processing of the Investor’s Personal Data shall be performed by Operator solely for achieving purposes set forth in clause 2.1 including for purpose related to the Primary Purpose herein and it will not be used for any purpose not reasonably expected.
7.2. Personal Data processing of the Investor’s Personal Data shall be carried out by using the method of combined (including automated) processing.
7.3. In case of revocation by Investor of his/her consent to his/her Personal Data processing Operator shall be required to discontinue the processing of and destroy (cause to be destroyed) Investor Personal Data within the period not exceeding 30 days from the date of receipt of the said request for revocation.
7.4. Notwithstanding the revocation of the consent to Personal Data processing Operator shall be required to continue the processing of Investor Personal Data in accordance with archive and tax law and in other cases, when such processing is necessary for the performance by Operator of duties imposed on it.

8. Personal Data transfer

8.1. Transfer of Investor Personal Data to third parties upon the Operator's instruction shall be possible subject to the existence of the Investor's written consent, solely for the achievement of purposes set forth in clause 2.1 above and pursuant to a relevant contract between Operator and a third party, which has as its essential condition the third party's obligation to maintain the confidentiality of Investor’s Personal Data and security of Personal Data in the course of processing. Such third party may include third parties engaged by Operator to perform services on his behalf, customer referees and former employers, CRB, Operator’s professional advisors including accountants, auditors and lawyers and Operator’s Group
Thus the Investor hereby gives his consent to

• Operator;
• Operator’s Group;

8.2. This Policy shall not apply in the event of depersonalization of Personal Data and in respect of publicly available Personal Data.
8.3. Upon transfer of Investor Personal Data to a third party Operator shall comply with the following requirements:
8.3.1. not to disclose Investor Personal Data to third parties without the Investor's written consent except in cases established by the federal law;
8.3.2. not to disclose Investor Personal Data for commercial purposes without his/her consent;
8.3.3. to ensure parties receiving Investor Personal Data only use the Personal Data for the purpose for which it was disclosed;
8.3.4. to permit access to Investor Personal Data only to specially authorized persons, with such persons being authorized to receive only such Investor Personal Data as required for the performance of specific functions.
8.4. The Investor's consent to the transfer of his/her Personal Data to third parties shall not be required in cases where the same is necessary for preventing the threat to life and health of Investor and when third parties render services to Operator pursuant to executed contracts containing relevant provisions on non-disclosure of Personal Data and in cases provided by the federal law.
8.5. Cross-border transfers of Investor Personal Data upon his/her written consent may be made to Operator’s Group or within separate business units of the Operator and its affiliates as well as to other overseas recipients located in Germany, the USA and Ireland. If Personal Data is transferred to overseas recipients, reasonable measures will be taken to protect Personal Data in particular de-identification of all data where appropriate before transferring.

9. Personal Data storage

9.1. Investor Personal Data may be stored both on paper and electronically.
9.2. Investor Personal Data on paper shall be stored in specially designated separate premises with restricted access of third parties.
9.3. Investor Personal Data in electronic form shall be stored on the PDIS of Operator or parties, to whom it has assigned the processing of Investor Personal Data with restricted access of third parties.
9.4. Investor Personal Data shall be stored no longer than is necessary for the purposes of its processing, and it should be destroyed upon achievement of the purposes of processing or if there is no more need for achieving the same.
9.5. Documents containing Investor Personal Data are to be maintained and destroyed as provided by archival legislation of the Russian Federation.

10. Protection of Investor Personal Data

10.1. When processing Investor Personal Data Operator shall adopt adequate administrative and technical measures for protecting Personal Data from unauthorized or incidental access to the same, data destruction, loss, modification, blocking, copying or dissemination, as well as from other improper actions.
10.2. The security of access to electronic media, on which Investor Personal Data is stored, shall be ensured through:
10.2.1. Use of licensed anti-virus software.
10.2.2. Restricted access rights.
10.2.3. Logins and passwords.
10.2.4. Use of secure file folders.
10.2.5. Use of Secure Socket Layer and/or additional encryption security.
10.2.6. Use of firewall and other means and procedures to protect Personal Data from unauthorized access, destruction, use, modification and disclosure.
10.3. Whenever Personal Data needs to be processes with aid of actual human interaction, it will be subject to segmentation in order to avoid unnecessary exposure thereof.
10.4. All agents with systematic privilege to view Personal Data are under special non-disclosure obligations and will only access and process personal info were strictly necessary.
10.5. Operator’s data protection officer is responsible for ensuring that Personal Data is securely processed and stored.

11. Liability of Operator

11.1. Operator shall bear liability in accordance with the laws of the Russian Federation.
11.2. Operator hereby asserts that security of communication sent by Investors to Operator via electronic means or post cannot be guaranteed and Operator will not accept responsibility for misuse, loss or unauthorized access to Personal Data as long as security measures were not within reasonable control of Operator.

12. 12. Cookies

12.1. Operator uses Google Analytics and other tools to assist in examining how users use the site. These tools make use of the so-called cookies (“Cookies”), which are text files stored on Investor’s computer to collect standard information such as data logging and user behaviour. Cookies cannot be used to obtain data from Investor’s drive, Investor’s e-mail address or any personal information.
12.2. The information that Cookies generate based on Investor’s activity on Operator’s website (including IP address) is transmitted to Google, Yandex, Hotjar and Criteo. These are then used to assess the use and creation of statistical reports on website activity. Neither Operator and Operator’s Group nor Google will not try to connect to the IP address of the user data and any other data. Operator and Operator’s Group will not combine information collected on their website with any personally identifiable information from other sources, provided that the above information is not explicitly published by Investor. Investor can set his Web browser to alert him when it writes Cookies or completely block their transmission. Investor must remember, however, that blocking Cookies deprives Investor of some features that Operator and Operator’s Group offer on their website.
12.3. Operator may collect information about Investor when Investor visits the page and keep the ones that are associated with Investor’s user profile. This information may include data on the web, viewing content, frequency and length of visits, type of transaction, downloaded documents and other activities related to the Operator’s and Operator’s Group site, Investor’s IP address, domain name, browser type, operating system, device type, device brand.

13. Other Provisions

13.1. Everything not covered by this Policy shall be subject to the laws of the Russian Federation as in effect from time to time.

14. Compliance

14.1. Investor may complain on Operator's actions or failures to act to the relevant authority overseeing Personal Data compliance or to the court.
14.2. Investor shall be entitled to the protection of his rights and legally recognizable interests, including to the compensation of damages and moral harm through legal action.

Consent and acknowledgement

Investor hereby acknowledges that his consent is given for processing of Personal Data in the volume and in the manner as described above to the Operator and to other persons as described above.
This consent shall be effective throughout the term of Loan Agreement entered into between Investor and Operator and may be revoked by him at any time in writing by notifying Operator at: 127055, Moscow, Novoslobodskaya str., h.14/19, bld.1, office 29, room 5, subject to 30 (thirty) days’ notice prior to date of revocation subject to limitations provided by the legislation of the Russian Federation.
Investor acknowledges that he has read and understood the provisions of this Policy and consent, and by signing below he voluntarily and explicitly provides consent to Operator to process his Personal Data as described above.
Investor also acknowledges that his rights under Federal Law No, 152-FZ “On personal data” dated 27.07.2006 have been duly explained to him.