CHL LLC PROVISION on processing of personal data

General provisions

1.1. CHL LLC Provision on processing of personal data (hereinafter – «Provision») defined the policy of personal data processing in the CHL LLC, 31A Leningradsky Ave., building 1, floor 37, office I, room 1, 125284, Moscow, (hereinafter – «Company») in terms of personal data processing (hereinafter “PD”) of the contractors, supporters and visitors of the Company’s Websites.

1.2. The Provision is the local regulating statute of the CHL LLC. Requirements of the Provision are subject to implementation by all employees admitted to personal data processing, supporters and visitors of the Company’s websites.

1.3. Most recent revision of the Provision is stated at the Websites and mobile applications of the Company with no access restrictions, all changes become effective from the moment of publishing.

1.4. All Appendices shall be the integral part of the present Provision.

1.5. All employees of the Company having access to the PD processing shall familiarize themselves with the present Provision against signature.

2. Terms and Abbreviations

Supporter   The subject of the personal data having interest in hockey, having consented the processing of personal data by the Company, and having submitted its PD during the process of purchase, settling the User’s agreement or registering at the websites of the Company and/or Clubs, or in the Company’s and/or Clubs’ mobile applications

Unified Supporters Profile  IPDS, containing information on the Supporters

IIHF   International Ice Hockey Federation

IPDS  Informational Personal Data System

Clubs  Clubs admitted by the Company’s Board of Directors as the participants of competitions organized and held by the Company, list of which is published at khl.ru/official/documents/, mhl.khl.ru/about/documents/, whl.khl.ru/about/documents/

KHL  Limited Liability Company “Continental Hockey League”(CHL LLC)

3. Grounds for the processing of personal data The Company processes personal data by applying following documents: − The Constitution of the Russian Federation;

− The Civil Code of the Russian Federation;

− The Tax Code of the Russian Federation;

− Code of the Russian Federation on Administrative Violations;

− Federal Law as of December 06, 2011 № 402-FZ «On Accounting»;

− Federal Law as of July 27, 2006 № 149-FZ «On Information, Information

Technologies and the Protection of Information»;

− Russian Federation Presidential Decree as of March 06, 1997 г. № 188 «On approval of the list of information classified as confidential»;

− Decree of the Russian Government as of April 18, 2014 № 353 «On approval of the Regulations concerning safety provision during the official sporting competitions»;

− Decree of the Ministry of Culture of the Russian Federation as of 25 Aug 2010

№ 558 «On approval of «The list of standard regulatory archive documents generated during the activities of the government authorities, local self-governing authorities and organizations specifying their terms of retention»;

− Charter of the CHL LLC;

− Consents to the personal data processing;

− User’s Agreements;

− Agreements with the contractors of the Company;

− Local regulation acts of the Company, regulating the processing of personal data (CHL LLC Provision on processing the personal data, CHL LLC Websites Terms of Use).

4. Principles of PD processing

4.1. The Company processes the personal data only in case it is necessary. PD processing for any reasons different from the purposes of the PC collection.

4.2. While PD processing accuracy, sufficiency, and in cases needed - validity of the PD shall be provided.

5. Subjects of PD and purposes of processing

5.1. The Company processes PD of the following categories of the PD subjects: – contractors representatives - representatives of the legal entities (director of organization, attorney-in-fact), self-employed entrepreneurs and individuals, with which the Company settles civil law contracts; – Supporters;

– Company’s websites visitors – individuals continuing to the Company’s websites, whose website activity is processed by the Company according to the present Provision and CHL LLC websites Terms of Use. The abovementioned category shall also include the users of the Company’s mobile application.

5.2. Purposes for PD processing are:

5.2.1. Contractor’s representatives:

– settlement and performance of contracts;

– approval, formatting and signing of the agreements, acts, invoices and other similar documents;

– Tax counting and payment of the individual income tax (IIT) according to the applied tax legislation of the Russian Federation; – reporting to the taxing authorities.

5.2.2. Supporters:

- provision of services according to the User’s agreements;

- sale and delivery of goods;

- forming the Unified Supporters Profile;

- sending informational and advertising messages;

- sending request responses;

- money return;

- statistics and other research purposes; 

5.2.3. Website visitors:

–  review of the visitors website activity;

–   tatistics and other research purposes;

5.3. By submitting their PD to the Company, PD subjects allow the Company to perform cross-border PD transfer to the countries providing adequate personal data security, to wit members of the EU Convention on protection of individuals during automatized personal data processing (hereinafter - “EU Convention” and to the countries included in the list of foreign states, not being members of the EU Convention and providing adequate security for the rights of PD subjects, approved by the Decree of the Federal Service for Supervision of Communications, Information Technology and Mass Media as of March 15, 2013 № 274.

5.4. Personal data of the PD subjects may be transferred (including by means of granting access to the informational resource containing personal data) to the following third parties:

- individuals, members of the Company’s group, which need the transfer of PD to perform the economic activity of the Company;

- Clubs for forming the Unified Supporters Profile and its subsequent use for the commercial reasons of the Company and Clubs;

- contractors, providing services to the Company for its performance of the economic activity;

- KHL contractors within the scope of its economic activity;

- the Company's contractor - Inventos LLC, which provides support and maintains the functionality of mobile applications by uploading data from the Primary account to https://api.khl.webcaster.pro

5.5. While determining the volume and content of the PD processed the Company shall conform to the purposes of PD acquisition and processing, set by the legislation of the Russian Federation, present Provision, local regulating acts of the Company, agreements with the PD subjects, PD subjects consents.

5.6. PD subject guarantees to provide the truthful information on oneself, shall not use the personal data of the third parties and is liable for providing the Company with untruthful data and documents, for untimely PD update in case of its changes and for using the personal data of the third parties without obtaining their consent.

6. Measures for providing the execution of liabilities on PD security

6.1. The Company takes measures needed and sufficient for the provision of the execution of liabilities, related to the PD processing, as per the legislation of the Russian Federation. Such measures taken by the Company are:

- appointing the person within the Company responsible for the PD processing, (hereinafter – «Responsible for PD processing») whose responsibilities include:

• performing the internal control of the compliance of the Company and its employees to the Russian PD legislation, including requirements for PD security; • notification of the Company’s employees of the Russian PD legislation provisions, local regulatory acts for PD processing, PD security requirements;

• organization of collecting and processing claims and requests of the PD subjects or their representatives and/or controlling the collection and processing of such claims and requests.

The Responsible for PD processing, receives instructions from and reports directly to the Vice-president on marketing and public relations of the Company. The responsibilities of the abovementioned person are stated by the job description, approved by the Vice-president on marketing and public relations of the Company.

- completion and implementation of the documents determining the Company’s policy regarding PD and providing access to such document to the public;

- performing internal control and/or audit of the conformance of the PD processing to the applied legislation of the Russian Federation and related regulatory acts, requirements to the PD security, local Company’s regulations;

- the evaluation of the harm, which may be inflicted on the PD subjects in case of violation of the Russian legislation, correlation of the stated harm to the measures taken by the Company, aimed to the provision of execution of responsibilities as per the legislation of the Russian Federation;

- familiarization of the Company’s employees processing the PD, with the documents defining Company’s policy on the PD processing;

- taking measures to prevent the unauthorized access to the PD. Such measures are:

• The restriction of the number of people having access and processing rights on the tangible media an in Informational Personal Data System;

• registering the tangible media of the personal data ;

• other measures according to the Provision on organization and safety of the personal data with CHL LLC.

6.2. During the automated processing of the PD subject’s PD, the Company enables recording, systematization, storing, detailing (updating and changing), exclusion of the PD using databases situated within the territory of the Russian Federation.

6.3. The company has the right to delegate the PD processing to the third party conditional on the settlement of the contract with such party. The contract with such party shall define all substantial aspects of the transferred PD processing.

7. The rights of PD subject

PD subject shall have the right to:

1) Obtain information considering the processing of its PD. The request may be composed in compliance with the current legislation. Model form of the request on the processed PD is presented in Appendix № 1.

2) Claim for the change in wrongful, inaccurate, invalid PD. Model form of the claim for the change in wrongful Pd sent to the Company is presented in Appendix № 2 to the present Provision.

3) Withdraw consent for the PD processing. Model form of the consent withdrawal is presented in Appendix № 3 to the present Provision.

All written claims shall be sent to the address of the location of the Company according to the Unified State Register of Legal Entities, for the attention of the person responsible for personal data processing.

8. Processing procedures and content pf the processed PD

8.1. Unified procedure for processing the contractor’s PD:

8.1.1. To settle the contract the contractor as the individual submits its information on the proof of identity, Individual Taxpayer Number, Individual insurance account number, bank account details to the Company.

8.1.2. To settle the contract the contractor as the self-employed entrepreneur submits its information on the proof of identity, Individual Taxpayer Number, bank account details, certificate (extract) of the registration within the state authorities as selfemployed to the Company.

8.1.3. To settle the contract the representative of the legal entity submits its information on the documents reasserting its signing capacity.

8.1.4. The consent of the contractor for the PD processing shall not be necessary in case its PD shall be used solely for contractual purposes.

8.1.5. The storage of the contractor’s contracts shall be performed at the legal department of the Company. 8.2. Unified procedure for processing the Supporter’s PD:

8.2.1. The Supporters submit their personal data: e-mail, password, contacts and bank account details (in case of purchasing goods or services or replenishment of the personal account) by registering at the Company’s websites, settling the User’s agreement, making purchases at the Company’s stores and online-stores, taking part in marketing events of the Company. The Supporters shall also submit their passport data while formalizing the return of the previously paid money.

8.2.2. Upon the achievement of the purposes of the processing Supporter’s PD may be depersonalized and stored for the Company’s statistics.

8.3. General procedure for processing the personal data of the Company’s website visitors:

8.3.1. Processing of the personal data of the Company’s websites visitors is preformed according to the CHL LLC Websites Terms of Use for the purposes of forming the Unified Supporters Profile and collecting statistical data.

8.3.2. The Company’s website visitors by using websites and/or mobile applications consent to the processing of the purchasing and other activities at the website and/or mobile application with the use of cookies (detailed information thereon is stated in the CHL LLC Websites Terms of Use).

8.4. Access to the PD processing with or without using the automation technologies is granted to the Company’s employees according ti the List of departments and officials eligible for PD processing in the IPDS of the CHL LLC (hereinafter - “List”). Therewith the abovementioned individuals shall be granted access for processing of only those PD, which are necessary for their employment duties performance. The changes to the List are made by the person Responsible for the personal data processing.

8.5. For every official the access to the PD of the certain categories of the PD subjects (contractors, Supporters, website visitors) is set according to the List, as well as access to the IPDS and tangible PD media.

8.6. The Company’s employees having obtained the access to the PD shall be informed of the responsibilities on providing security to the confidentiality and PD protection.

8.7. In case the Company grants access to the processed PD to the contractors, contracts with such contractors shall include provisions on the procedures of PD processing, or the separate agreement on the transfer of PD between the contractor and the Company shall be settled.

8.8. Requests (claims) of the PD subjects and their representatives, legal entities and governing bodies in terms of processing and/or providing PD, with the marking of providing or denial to provide the information according to the request are registered by the person Responsible for the personal data processing in the electronic Record of public appeals.

8.9. The Company sets its own storage model of the tangible PD media:

8.9.1. The company provides for the separate storage of the tangible PD media, processing of which is performed according to the different purposes ass per the List of places for storing tangible PD media, processed without using the automation technologies.

8.9.2. All storage places shall conform to the following rules:

− personal data contained at the paper media shall be stored at the lockable filing cabinet or in the strongbox;

− keys to the lockable cabinets shall be handed solely to the authorized individuals. 8.9.3. The Company provides for the storage of the PD media within the period as per the agreement settled with the PD subject, PD subject’s consent, the Decree of the Ministry od Culture of the Russian Federation as of August 25, 2010 № 558 «On approval of «The list of standardregulatory archive documents generated during the activities of the government authorities, local self-governing authorities and organizations specifying their terms of retention», term of limitation, Federal law as of December 06, 2011 № 402-FZ «On accounting», as well as other regulations of the legislation of the Russian Federation and Company’s internal documents.

8.10. Personal data processed within the IPDS as well as tangible PD media shall be destroyed upon obtaining the purposes of their processing or in case of loss of necessity of obtaining the purpose of processing, as well as upon receiving the PD subject’s consent withdrawal claim, if the Company has no right to legitimately continue processing the PD without PD subject’s consent.

8.11. The procedure and technology of the PD destroying within the IPDS and on paper media are defined by the Regulations on the PD disposal performance.

9. The procedure of introducing changes

9.1. The present Provision may be subject to changes in case of the changes in the legislation of the Russian Federation in terms of PD processing and securing or in case of the changes in the purposes and conditions of the PD processing in the Company.

9.2. The revised Provision shall be approved by the decree of the KHL President and shall be published at the Company’s websites, in the Company’s mobile applications, as well as other places at the Company’s discretion.

10. Contacts

10.1. In case the PD subject has any claims or requests in terms of PD processing to the Company, the PD subject may contact the Company by sending the letter to the address of the Company’s location or via e-mail at: pdn@khl.ru.

Appendix No. 1

Request on the processed personal data

I (hereinafter – Subject), _____________________________________________,

(Full name)

identity document______ series __________ № _________,

(type of document)

issued ____________________________________________________________,

(by whom and when)

living at ________________________________________________, (residential address)

Note: in case of filling by a representative the following text shall be inserted: acting as a legal representative

___________________________________________________,

(Full name)

identity document______ series __________ № _________,

(type of document)

issued ____________________________________________________________,

(by whom and when)

living at ________________________________________________, (residential address)

request the CHL LLC (hereinafter - Operator), registered at the address: __________________, to provide the information on the processing of my personal data, including: __________________.

Please send your response to the address:

__________________________________________________________________

__________________________________________________________________

«____»______________ 20__ __________________ _________________   (Signature, Full name)

Appendix No. 2

Request on withdrawal or correction of the wrongful personal data

I (hereinafter – Subject), _____________________________________________,

(Full name)

identity document______ series __________ № _________,

(type of document)

issued ____________________________________________________________,

(by whom and when)

living at ________________________________________________, (residential address)

Note: in case of filling by a representative the following text shall be inserted: acting as a legal representative

___________________________________________________,

(Full name)

identity document______ series __________ № _________,

(type of document)

issued ____________________________________________________________,

(by whom and when)

issued ____________________________________________________________, (residential address)

request the CHL LLC (hereinafter - Operator), registered at the address: _________________, to withdraw/change the following wrongful personal data:

__________________________________________________________________ _______________________________________________________________,

in relation to

______________________________________________________________

(state the reason: personal data is incomplete, invalid, wrongful, obtained illegally, are not necessary for the stated reason for processing)

Please notify me on the changes made and measures taken by sending a letter/email at the following address:

__________________________________________________________________ ____________________________________________________________.

«____»______________ 20__ __________________ _________________ (Signature, Full name)

Appendix No. 3

Claim for consent to the personal data processing withdrawal

I (hereinafter – Subject),

_____________________________________________,

(Full name)

identity document______ series __________ № _________,

(type of document)

issued ____________________________________________________________,

(by whom and when)

living at ________________________________________________, (residential address)

ask to withdraw my consent on the processing of the personal data by CHL LLC (hereinafter - Operator), registered at the address:

__________________________________________________________________.

The reason for the claim for withdrawal of the consent to the personal data processing:

__________________________________________________________________

__________________________________________________________________

__________________________________________________________________.

I confirm that I have been familiarized with the provisions of the Federal law as of July 27, 2006 г. № 152-FZ «On the personal data», rights and liabilities in terms of personal data security have been made clear.

«____»______________ 20__ __________________ _________________

(Signature, Full name)