June 28, 2024

1. General Provisions
1.1. In order to fully comply with the provisions of the current legislation, BM technical service considers its most important tasks to be compliance with the principles of personal data processing provided for by law, confidentiality in the processing of personal data, as well as ensuring the security of their processing processes.
1.2. This policy for organizing the processing and ensuring the security of personal data of consumers, users of the website is https://bmtechnicalservices.com characterized by the following features:
developed in accordance with the current legislation in the field of processing and protection of personal data in order to implement the requirements of the current legislation in the field of processing and protection of personal data;
discloses the methods and principles of personal data processing by the operator, the rights and obligations of the operator in the processing of personal data, the rights of personal data subjects, and also includes a list of measures applied by the operator in order to ensure the security of personal data during their processing;
is a publicly available document declaring the conceptual foundations of the operator's activities in the processing and protection of personal data.
1.3. Prior to the processing of personal data, the Operator notified the authorized body for the protection of the rights of personal data subjects of its intention to process personal data. The Operator shall update the information specified in the notification in good faith and within the appropriate time.

2. List of abbreviations and abbreviations
The following abbreviations and abbreviations are used in this document:
Company or Operator — BM technical service
Policy – the Policy "On the organization of processing and ensuring the security of personal data of consumers, users of the website https://bmtechnicalservices.com

3. Basic Concepts Used in the Policy
Automated processing of personal data is the processing of personal data using computer technology.
Blocking of personal data is a temporary suspension of the processing of personal data (except for cases where processing is necessary for the clarification of personal data).
Personal data information system is a set of personal data contained in databases and information technologies and technical means that ensure their processing.
Depersonalization of personal data is actions as a result of which it becomes impossible to determine the ownership of personal data by a specific personal data subject without the use of additional information.
Personal data processing is any action (operation) or a set of actions (operations) with personal data performed with or without the use of automation tools. The processing of personal data includes, but is not limited to: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.
Personal data operator (operator) shall mean a state body, municipal body, legal entity or individual who, independently or jointly with other persons, organizes and (or) carries out the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data.
Responsible for the organization of personal data processing shall mean an individual or legal entity appointed by the Operator to be responsible for the organization of personal data processing.
Personal data is any information relating to a directly or indirectly identified or identifiable individual (personal data subject).
Personal data permitted by the personal data subject for distribution shall mean personal data, access to which is granted to an unlimited number of persons by the personal data subject by giving consent to the processing of personal data permitted by the personal data subject for distribution in the manner prescribed by this Federal Law.
Provision of personal data is actions aimed at disclosing personal data to a certain person or a certain group of persons.
Dissemination of personal data is actions aimed at disclosing personal data to an indefinite number of persons.
Personal data subject is an individual to whom personal data directly or indirectly relates.
Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which tangible media of personal data are destroyed.

4. Basic rights and obligations of the Data Controller
4.1. The Operator has the right to:
receive reliable information and/or documents containing personal data from the personal data subject;
require the personal data subject to timely clarify the personal data provided;
entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by law, on the basis of an agreement concluded with this person;
create publicly available sources of personal data for the purpose of information support with the written consent of the personal data subject.
4.2. The Operator shall:
to process personal data in accordance with the procedure established by the current legislation;
not to disclose to third parties and not to distribute personal data without the consent of the personal data subject, unless otherwise provided by law;
when collecting personal data, provide the personal data subject with information on the processing of personal data at his request;
explain to the personal data subject the legal consequences of refusing to provide his/her personal data and (or) give consent to their processing, if in accordance with the legislation the provision of such data and (or) obtaining consent by the operator are mandatory;
provide the personal data subject with information about the processing of his personal data before the start of their processing, if the personal data were received by the operator not from the personal data subject, except as provided for by law;
inform the personal data subject (his/her legal representative) about the availability of personal data related to the relevant personal data subject, if such personal data were received by the operator not from the personal data subject;
consider appeals from the personal data subject (his/her legal representative) regarding the processing of personal data and give reasoned answers;
provide the personal data subject (his/her legal representative) with the opportunity to access his/her personal data free of charge, except as provided for by law;
take measures to clarify, destroy the personal data of the personal data subject in connection with his (his legal representative) handling of legal and justified claims;
organize the protection of personal data in accordance with the requirements of the law;
when collecting personal data, including through the Internet, to ensure the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens using databases;
exclude information about the personal data subject from publicly available sources of personal data at the request of the personal data subject or by decision of the court or other authorized state bodies.

5. Basic rights and obligations of personal data subjects
5.1. The personal data subject has the right to:
obtaining information about the processing of his personal data by the Operator to the extent determined by law;
access his/her personal data and receive a copy of any record containing his/her personal data, except as provided by law;
clarification of their personal data, their blocking or destruction if they are incomplete, outdated, inaccurate, illegally obtained or cannot be recognized as necessary for the stated purpose of processing;
termination of the processing of his/her personal data, including by withdrawing consent to the processing of personal data, except as provided for by law;
contacting the Operator to exercise and protect their rights and legitimate interests;
appealing against the actions or inaction of the Operator by contacting the authorized body for the protection of the rights of personal data subjects and other competent authorities;
protection of their rights and legitimate interests, including compensation for losses and/or compensation for moral damage in court or other manner established by law, as well as the exercise of other rights provided for by legislation in the field of personal data;
establishment of prohibitions on the transfer (except for the provision of access) of personal data by the operator to an unlimited number of persons, as well as prohibitions on the processing or conditions of processing (except for obtaining access) of personal data by an unlimited number of persons in consent to the processing of personal data allowed by the personal data subject for distribution;
termination of the transfer (distribution, provision, access) of his/her personal data, previously allowed by the personal data subject for distribution, to any person processing his/her personal data, in case of non-compliance with the provisions of the law, or to apply to the court with such a request.
5.2. The personal data subject is obliged to:
provide the Operator with only reliable data about himself/herself, as well as provide documents containing personal data to the extent necessary for the purpose of processing;
inform the Operator about the clarification (update, change) of their personal data.
5.3. The right of the personal data subject to access his/her personal data may be limited in accordance with federal laws, including if the personal data subject's access to his/her personal data violates the rights and legitimate interests of third parties.
5.4. Processing of personal data for the purpose of promoting goods, works, services on the market by making direct contacts with a potential consumer using means of communication is carried out only with the prior consent of the personal data subject.
5.5. The agreement with the personal data subject, on the basis of which the processing of his personal data will be carried out, may not contain the following provisions:
restricting the rights and freedoms of the personal data subject;
establishing cases of processing of personal data of minors, unless otherwise provided by law;
allowing the inaction of the personal data subject as a condition for concluding a contract.
5.6. It is prohibited to make decisions on the basis of exclusively automated processing of personal data that give rise to legal consequences in relation to the personal data subject or otherwise affect his rights and legitimate interests, except in cases provided for by law or with the written consent of the personal data subject.

6. Legal grounds for processing personal data
6.1. The processing of personal data is carried out by the Operator in compliance with the principles and rules provided for by the legislation in the field of processing and protection of personal data with the consent of the personal data subject to the processing of his personal data, as well as in cases where the processing of personal data is necessary:
to achieve the goals provided for by an international treaty or law, to exercise and fulfill the powers and obligations imposed by law;
in connection with the participation of a person in civil, administrative, legal proceedings in arbitration courts;
for the execution of a judicial act, an act of another body or official subject to execution in accordance with the legislation on enforcement proceedings;
for the performance of an agreement to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor;
to protect the life, health or other vital interests of the personal data subject, if it is impossible to obtain the consent of the personal data subject;
to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant goals, provided that the rights and freedoms of the personal data subject are not violated;
to carry out scientific, literary or other creative activities, provided that the rights and legitimate interests of the personal data subject are not violated;
personal data processing is carried out for statistical or other research purposes, subject to mandatory depersonalization of personal data;
personal data subject to publication or mandatory disclosure in accordance with the federal law is processed.
6.2. The Operator processes personal data in accordance with the legislation in the field of personal data, guided by the following legal grounds:
federal laws and regulations adopted on their basis governing relations related to the Operator's activities
agreements concluded between the Company and personal data subjects, as well as beneficiaries or guarantors, under which personal data subjects are;
consent of personal data subjects to the processing of personal data.

7. Principles of personal data processing by the Operator
7.1. In its activities, the Operator ensures compliance with the principles of personal data processing provided for by law.
7.2. The processing of personal data in the Company is carried out on a legal and fair basis, and is limited to the achievement of specific, predetermined and legitimate purposes.
7.3. Only personal data that meet the purposes of their processing are subject to processing.
7.4. When processing personal data in the Company, it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other.
7.5. The Operator shall ensure that the content and volume of the processed personal data comply with the stated purposes of processing and, if necessary, shall take measures to eliminate their redundancy in relation to the stated purposes of processing.
7.6. When processing personal data, the accuracy of personal data, their sufficiency, and, if necessary, relevance in relation to the purposes of personal data processing must be ensured. The Operator shall take the necessary measures or ensure that they are taken to delete or clarify incomplete or inaccurate data.
7.7. Personal data shall be stored in a form that makes it possible to identify the personal data subject for a period no longer than required by the purposes of personal data processing, except for cases where the personal data storage period is established by a federal law, an agreement to which the personal data subject is a party, beneficiary or guarantor.
7.8. Processed personal data are subject to destruction or depersonalization upon achievement of the processing goals or in case of loss of the need to achieve these goals, unless otherwise provided by law.

8. Purposes of collecting personal data:
8.1. The processing of personal data in the Company is limited to the achievement of specific, predetermined and legitimate purposes.
8.2. The Company processes general personal data for the following purposes:
compliance with and fulfillment of the requirements of the legislation applicable to the Operator, as well as ensuring the legitimate interests of the Operator, namely:
1. Implementation and performance of functions, powers and obligations by the Operator, which are provided for by law, including, but not limited to: tax, civil, including legislation in the field of consumer protection;
2. carrying out business activities, including sending and receiving correspondence and other postal items, as well as providing access to the Operator's IT resources, providing technical support in their use, monitoring and controlling the use of the Operator's IT resources and ensuring information security;
3. Storage of personal data and their media in accordance with the local regulations of the Operator;
promotion and provision of products/services, including:
1. conclusion of any contracts under which the personal data subjects are a party or beneficiaries, and further performance of obligations under the concluded contracts;
2. Study of the degree of satisfaction of the personal data subject with the quality of the Operator's products/services;
3. organization and conduct of events to increase awareness and loyalty to the Operator's brand, including promotions, loyalty programs, marketing research, newsletters about the Operator's products/services, with the participation of personal data subjects;
4. communication, including the receipt and processing of requests and requests from personal data subjects, and quality control of information interaction;
5. analytics of the actions of subjects, personal data on the Operator's websites (including the determination of location) and the functioning of the Operator's websites;
6. promotion of the brand of the Operator and (or) companies belonging to the same group of persons with the Operator, by posting personal data of subjects on websites, official pages in social networks of the Operator and other resources available to an unlimited number of persons.

9. Categories of personal data subjects and categories of processed personal data
9.1. The Operator collects and further processes personal data of the following categories of personal data subjects:
Consumers of products/services and their legal representatives are individuals and their representatives who are buyers, end users, customers of the Company's products/services.
Users/visitors of the website are individuals who visit and (or) use the Company's websites.

10. Procedure and conditions for processing personal data
10.1. The processing of personal data is carried out by the Operator subject to the consent of the personal data subject, except for cases established by law when the processing of personal data can be carried out without such consent.
10.2. The personal data subject decides to provide his/her personal data and gives his/her consent freely, of his/her own free will and in his/her own interest.
10.3. The consent is given in any form that allows confirming the fact of its receipt. In cases provided for by law, the consent is drawn up in writing.
10.4. Consent may be withdrawn by written notice sent to the Operator by mail.
10.5. The personal data subject, giving consent to the processing of his personal data, must be informed about the purposes of their processing.
10.6. The purposes of processing must be included in the consent form of the personal data subject.
10.7. The processing of personal data by the Operator is carried out in the following ways:
non-automated processing of personal data;
automated processing of personal data with or without the transfer of information received via information and telecommunication networks;
mixed processing of personal data.
10.8. The Operator does not make decisions that give rise to legal consequences in relation to personal data subjects or otherwise affect their rights and legitimate interests, based solely on the automated processing of their personal data.
10.9. Processing of personal data by the Operator includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), cross-border transfer, blocking, deletion, destruction of personal data.
10.10. The Operator has the right to transfer personal data to the bodies of inquiry and investigation, other authorized bodies on the grounds provided for by the current legislation.
10.11. In cases where it is necessary to interact with third parties within the framework of achieving the purposes of personal data processing, the Operator has the right to transfer personal data to authorized third parties to achieve the purposes of processing.
10.12. The Operator shall process the personal data of personal data subjects permitted for distribution on the basis of a separate consent of the personal data subject to the processing of such personal data. The Operator shall provide the personal data subject with the opportunity to determine the list of personal data for each category of personal data specified in the consent to the processing of personal data permitted by the personal data subject for distribution.
10.13. The Operator has established the following conditions for the termination of personal data processing:
achievement of the purposes of personal data processing and the maximum retention periods for personal data;
loss of the need to achieve the purposes of personal data processing;
provision by the personal data subject or his/her legal representative of information confirming that personal data are illegally obtained or are not necessary for the stated purpose of processing;
the impossibility of ensuring the lawfulness of the processing of personal data;
withdrawal of consent to the processing of personal data by the personal data subject, if the storage of personal data is no longer required for the purposes of personal data processing;
expiration of the statute of limitations for legal relations within the framework of which the processing of personal data is or was carried out.
liquidation of the Operator.
10.14. The terms of storage of personal data by the Operator are determined at the discretion of the Operator.
10.15. In the event that the documents containing personal data generated in the course of the Operator's activities will be archival documents, then the period of their storage may be determined by local governments and organizations, indicating the terms of their storage.
10.16. The period of storage of personal data processed in personal data information systems shall correspond to the period of storage of personal data on paper.
10.17. When storing personal data, the Operator uses personal databases located on the computer of BM technical service.

11. Measures for the proper organization of processing and ensuring the security of personal data
11.1. When processing personal data, the Operator takes all necessary legal, organizational and technical measures to protect them from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other illegal actions in relation to them.
11.2. In accordance with the procedure established by the federal executive body authorized in the field of security, the Operator shall ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources, including informing it about computer incidents that resulted in the illegal transfer (provision, distribution, access) of personal data.

12. Person responsible for organizing the processing of personal data
12.1. The rights, obligations and legal responsibility of the person responsible for organizing the processing of personal data are established by law.
12.2. The person responsible for organizing the processing of personal data:
organizes the implementation of internal control over the compliance of the Operator and its employees with the legislation on personal data, including the requirements for the protection of personal data;
bring to the attention of the Operator's employees the provisions of the legislation on personal data, local acts on the processing of personal data, requirements for the protection of personal data or ensure that they are informed;
exercises control over the receipt and processing of appeals and requests from personal data subjects or their representatives.
12.4. Contact details of the person responsible for organizing the processing of personal data: BM technical service Dubai business bay metropolis tower, Office 2101.
Updating, correcting, deleting and destroying personal data, responding to requests from subjects for access to personal data

13. In case of confirmation of the fact of inaccuracy of personal data or the illegality of their processing, personal data shall be updated by the Operator, or their processing shall be terminated accordingly.
13.1. The fact of inaccuracy of personal data or the illegality of their processing may be established either by the personal data subject or by the competent state authorities.
13.2. At the written request of the personal data subject or his representative, the Operator is obliged to provide information about the processing of personal data of the specified subject.
13.3. The request shall contain:
number of the main identity document of the personal data subject and his/her representative;
information on the date of issue of the said document and the issuing authority;
information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator;
13.4. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the law.
13.5. If the request of the personal data subject does not reflect all the necessary information or the subject does not have the right to access the requested information, then a reasoned refusal shall be sent to him/her.
13.6. In accordance with the procedure provided for in clause 13.2, the personal data subject has the right to demand from the Operator to clarify his/her personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect his/her rights.
13.7. Upon achievement of the purposes of personal data processing, as well as in the event of withdrawal of consent by the subject of personal data, personal data shall be destroyed if:
otherwise is not provided for by the agreement to which the personal data subject is a party, beneficiary or guarantor;
the operator is not entitled to process without the consent of the personal data subject on the grounds provided for by the Federal Law "On Personal Data" or other federal laws;
otherwise provided by another agreement between the Operator and the personal data subject.

14. Liability
14.1. Persons guilty of violating the rules governing the processing and protection of personal data are liable under the law.
14.2. A person who has provided the Operator with inaccurate information about himself/herself, or information about another personal data subject without the consent of the latter, shall be liable in accordance with the law.

15. Access to the Policy
15.1. The current version of the Policy in hard copy is stored at: Dubai business bay metropolis tower, Office 2101
15.2. The electronic version of the current version of the Policy is publicly available on the Operator's website on the Internet at: https://bmtechnicalservices.com

16. Changes
16.1. The Operator has the right to make changes to the Policy. When making changes, the date of approval of the current version of the Policy shall be indicated in the title of the Policy.
16.4. The Policy may be revised again as changes are made:
regulatory legal acts in the field of personal data;
in the local regulatory and individual acts of the Operator governing the organization of processing and ensuring the security of personal data.
16.5. All relations relating to the processing of personal data that are not reflected in this Policy are regulated in accordance with the provisions of the law.