Skip to content

Personal Data Processing Policy

This Personal Data Processing Policy (the "Policy") has been developed pursuant to clause 2 of Part 1 of Article 18.1 of Federal Law dated 27.07.2006 No. 152-FZ "On Personal Data" ("Law No. 152-FZ") and defines the personal data processing procedures and the data security measures adopted by OOO Oborona (ООО «Оборона») (the "Operator").

The Policy applies to all information about users of the website oboronhim.ru (the "Site") that the Operator may receive in the course of the Site's use, including through the forms placed on it. Using the Site signifies that the user has read this Policy. Consent to personal data processing is given separately and takes the form of a standalone document — the Consent to Personal Data Processing.

1. Operator Details

  • Full name: OOO Oborona, a limited liability company
  • OGRN: 1107746985202
  • INN / KPP: 7704770665 / 503201001
  • Address (registered office): 25/1 SNT Sadko, Islavskoye Village, Odintsovo, Moscow Region, 143032
  • Email address for personal data inquiries: privacy@oboronhim.ru

2. Key Terms

In this Policy, terms are used in the meanings defined by Article 3 of Law No. 152-FZ. In particular:

  • personal data — any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject);
  • personal data processing — any action or set of actions performed on personal data, including collection, recording, systematization, accumulation, storage, refinement (updating, amending), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction;
  • operator — a legal entity that organizes and (or) carries out personal data processing and determines the purposes of processing, the composition of the personal data processed, and the actions performed on it;
  • personal data subject — the natural person to whom the personal data relates.

3. Legal Grounds for Processing

The Operator processes personal data on the following legal grounds:

  • the personal data subject's consent to the processing of their personal data (clause 1 of Part 1 of Article 6 of Law No. 152-FZ);
  • the need to perform an agreement to which the personal data subject is a party, beneficiary, or guarantor, as well as the need to conclude an agreement at the personal data subject's initiative (clause 5 of Part 1 of Article 6 of Law No. 152-FZ);
  • the need to fulfill the obligations imposed on the Operator by the legislation of the Russian Federation (clause 2 of Part 1 of Article 6 of Law No. 152-FZ);
  • the exercise of the Operator's rights and legitimate interests, provided this does not violate the rights and freedoms of the personal data subject (clause 7 of Part 1 of Article 6 of Law No. 152-FZ);
  • the personal data subject's consent to the processing of their personal data for the purpose of promoting goods, works, and services in the market (Part 1 of Article 15 of Law No. 152-FZ) — for sending informational materials.

4. Categories of Personal Data Subjects

The Operator processes the personal data of the following categories of subjects:

  • Site users who have submitted an inquiry through the forms placed on the Site;
  • representatives of legal entities and individual entrepreneurs — current and prospective counterparties, distributors, wholesale buyers, and contract manufacturing partners;
  • persons who have subscribed to informational materials (newsletters);
  • candidates who have applied to open positions;
  • media representatives who have contacted the press office.

5. Categories of Personal Data Processed

The Operator processes the following personal data:

5.1. Data the user provides directly

  • name;
  • phone number;
  • email address;
  • the name of the organization the user represents, and their job title;
  • the content of the inquiry (message text);
  • details provided in a contract manufacturing request: product types of interest, planned volume, brand name, availability of finished packaging artwork;
  • any other information the user volunteers in the forms' free-text fields.

5.2. Data received automatically when the Site is accessed

  • the IP address of the device from which the inquiry was sent;
  • browser and operating system details (the User-Agent header and Sec-CH-UA client hints);
  • the address of the referring page (the Referer header);
  • the browser's language settings (the Accept-Language header) and the interface language selected on the Site;
  • the date and time the inquiry was submitted;
  • cookie data and similar technologies — to the extent described in the Cookie Policy.

Some of the information listed above is processed automatically by the Yandex Metrica web analytics service (LLC «YANDEX»), which is installed on the Website and loads when its pages are opened. The information the service processes, the purpose of the Webvisor feature and the procedure for opting out are described in the Cookie Policy.

The Operator does not process special categories of personal data (concerning race or ethnicity, political views, religious or philosophical beliefs, health, or intimate life), criminal record information, or biometric personal data. The Operator does not verify the accuracy of the information users provide and proceeds on the assumption that the user provides accurate data and holds the necessary authority when providing another person's data.

6. Purposes of Personal Data Processing

The Operator processes personal data for the following purposes:

  • reviewing inquiries and requests submitted through the Site's forms and responding to them;
  • maintaining contact with the user, including by phone and email;
  • preparing commercial proposals and concluding and performing supply and contract manufacturing agreements;
  • sending informational and promotional materials (newsletters) — subject to separate consent given when subscribing;
  • reviewing applications to open positions and communicating with candidates;
  • communicating with media representatives;
  • keeping the Site operational and secure and preventing fraudulent and automated submissions;
  • compiling depersonalized Site traffic statistics and improving the Site's operation;
  • fulfilling the obligations imposed on the Operator by the legislation of the Russian Federation;
  • protecting the Operator's rights and legitimate interests, including in the resolution of disputes.

The Operator may also process personal data for the purposes of providing access to the dealer portal and keeping it running, should such a service be launched. No processing is carried out for purposes incompatible with those stated above.

7. Principles, Procedures, and Methods of Processing

Personal data processing is carried out on a lawful and fair basis, is limited to the achievement of specific, predefined, and legitimate purposes, and is not excessive in relation to them.

The Operator processes personal data both without and with the use of automation tools, including collection, recording, systematization, accumulation, storage, refinement (updating, amending), retrieval, use, transfer (provision, access), blocking, deletion, and destruction.

The Operator makes no decisions that produce legal consequences for the personal data subject or otherwise affect their rights and legitimate interests solely on the basis of automated personal data processing.

8. Processing and Storage Periods; Destruction of Personal Data

  • Personal data received from inquiry and request forms (including contract manufacturing requests) is stored for three years from the date the inquiry is submitted. This period corresponds to the general limitation period established by Article 196 of the Civil Code of the Russian Federation and is needed by the Operator to address potential claims and disputes.
  • Personal data obtained when subscribing to the newsletter is processed until consent is withdrawn by the personal data subject.
  • The personal data of candidates for open positions is stored for six months from the date the application is received, unless the candidate has consented to longer storage.

Personal data is destroyed once the purposes of processing are achieved, when achieving them is no longer necessary, or upon withdrawal of consent — within the timeframes established by Article 21 of Law No. 152-FZ. If the Operator needs the personal data to fulfill obligations established by the legislation of the Russian Federation, it is stored for the legally established periods regardless of the withdrawal of consent.

9. Transfer of Personal Data to Third Parties

The Operator does not sell or disclose personal data to third parties, except in the cases provided for by this Policy and the legislation of the Russian Federation.

Personal data may be transferred (provided, or commissioned for processing) to the following categories of third parties:

  • the hosting provider that hosts and keeps the Site running within the Russian Federation;
  • LLC «YANDEX» — to the extent of the information collected by the Yandex Metrica web analytics service when the Website is visited, on the terms established by that entity for users of the service (see the Cookie Policy);
  • telecom operators and providers of email and mailing services located within the Russian Federation — to the extent needed to send responses and informational materials;
  • providers of customer relationship management (CRM) systems and other information systems located within the Russian Federation — should the Operator adopt such systems;
  • state authorities and organizations — in the cases, to the extent, and in the manner established by the legislation of the Russian Federation.

Personal data is transferred to a processor on the basis of an agreement obligating the processor to maintain confidentiality and ensure the security of personal data during processing, in accordance with Part 3 of Article 6 of Law No. 152-FZ.

10. Cross-Border Transfer of Personal Data

The Operator does not carry out cross-border transfers of personal data. Personal data is not transferred to the territory of foreign states and is not placed in information systems located outside the Russian Federation.

Should such a transfer become necessary in the future, it will be carried out no earlier than a separate notification of the intent to conduct cross-border personal data transfers is filed with Roskomnadzor in the manner set out in Part 3 of Article 12 of Law No. 152-FZ and the personal data subject's separate consent is obtained, and this Policy will be amended accordingly.

11. Database Localization

In accordance with Part 5 of Article 18 of Law No. 152-FZ, the recording, systematization, accumulation, storage, refinement, and retrieval of the personal data of citizens of the Russian Federation are carried out using databases located within the Russian Federation. The Site and its databases are hosted on the servers of a Russian hosting provider within the Russian Federation.

12. Personal Data Security Measures

The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, and dissemination, as well as from other unlawful actions, including:

  • appointing a person responsible for organizing personal data processing;
  • adopting internal regulations governing the processing and protection of personal data;
  • limiting the set of employees with access to personal data and differentiating access rights in information systems;
  • using a secure connection (the HTTPS protocol) for data transferred between the user's device and the Site;
  • using technical safeguards against automated and fraudulent submissions, as well as rate limiting;
  • backing up data and monitoring the actions performed on it;
  • familiarizing the employees directly involved in personal data processing with the requirements of the legislation of the Russian Federation and the Operator's internal regulations.

If an incident is identified that has resulted in the unlawful transfer (provision, dissemination, access) of personal data, the Operator notifies Roskomnadzor within the timeframes established by Part 3.1 of Article 21 of Law No. 152-FZ.

13. Rights of the Personal Data Subject

The personal data subject has the right to:

  • receive information about the processing of their personal data to the extent provided by Part 7 of Article 14 of Law No. 152-FZ, including the legal grounds and purposes of processing, the timeframes, and the parties to whom the personal data may be transferred;
  • demand that their personal data be refined, blocked, or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
  • withdraw consent to personal data processing;
  • object to the processing of personal data for the purpose of promoting goods, works, and services in the market;
  • appeal the Operator's actions or inaction to Roskomnadzor or in court;
  • defend their rights and legitimate interests, including claiming damages and compensation for moral harm in court.

14. Inquiries and Withdrawal of Consent

Inquiries, requests, and demands related to personal data processing are sent to the email address privacy@oboronhim.ru or in writing to the Operator's registered office address stated in Section 1 of this Policy.

A request must contain information that identifies the applicant and confirms their connection to the personal data being processed: last name, first name, patronymic (if any), details of the inquiry in connection with which the personal data is processed (for example, the date of the inquiry and the phone number or email address provided in it), as well as the substance of the request and the applicant's signature or another confirmation of their intent.

The Operator reviews the request and provides a response within ten business days of receiving it. This period may be extended, but by no more than five business days, with a reasoned notice of the extension sent to the applicant.

Consent to personal data processing may be withdrawn at any time by sending a message to that effect to the email address above. You can additionally unsubscribe from the newsletter using the unsubscribe link in each email. Upon receiving a withdrawal of consent, the Operator stops processing the personal data and ensures its destruction within the timeframes established by Law No. 152-FZ, except where processing may continue on another legal basis.

15. Cookies

The Website uses cookies and similar technologies, including the analytics cookies of the Yandex Metrica service. The cookies used, their purposes, their storage periods, the information transmitted and the procedure for refusing them are described in the Cookie Policy, which forms an integral part of this Policy.

When visiting the Website, the user is shown a notice about the use of cookies with a link to that Policy. By continuing to use the Website, the user agrees to the processing of cookies on the terms set out therein. The user may refuse cookies by means of their browser and may opt out of data collection by the web analytics service using Yandex's official opt-out mechanism; strictly necessary cookies nevertheless remain required for the Website's forms to work.

16. Changes to the Policy

The Operator may amend this Policy. The current version of the Policy is permanently available on the Site at /privacy. Amendments take effect from the moment the new version is published on the Site, unless the new version provides otherwise.

Version dated August 2, 2026.

This document is a translation provided for convenience. In case of any discrepancy, the Russian version prevails.