Personal Data Processing Policy

Edition: 27 October 2026

1. General provisions

This Policy sets out how JSC "SUDOEXPERT TECHNOLOGY" (the “Operator”) processes personal data in connection with the use of sudoexpert.pro, enquiries and requests, and dealings with the Operator concerning equipment supply, shipbuilding, repairs, financing and other services.

This Policy has been prepared with regard to Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable laws and regulations of the Russian Federation.

Personal data operator: JSC "SUDOEXPERT TECHNOLOGY".

Registered address: 101000, Moscow, Ogorodnaya Sloboda, bld 12, office 3-P.

Personal data enquiries: office@sudoexpert.pro.

2. Core processing principles

Processing must be lawful and fair; limited to specific, predetermined and lawful purposes; and compatible with the purposes for which the data was collected. The categories and amount of data must be proportionate to the stated purposes. Data must be accurate and up to date, retained no longer than required by the processing purposes or the law, and protected by organisational and technical measures.

3. Individuals and data covered

The Operator may process personal data relating to website visitors, representatives of customers and prospective customers, counterparties and other individuals who contact it. Individuals may provide the following information in emails they send themselves; the website does not collect this information automatically:

• first and/or last name, if supplied;

• company name and company information, if supplied;

• email address;

• telephone number;

• enquiry content, technical parameters and project information;

• other information voluntarily included in the email;

• files attached by the individual and the information they contain.

If analytics tools are enabled, technical information about website visits is processed in accordance with the user's choice and cookie settings. Form and email content is not sent to analytics services.

The Operator does not request special categories of personal data or biometric personal data through the forms. Users should not send such information unless necessary and supported by a separate lawful basis.

3.1. Enquiries using website forms

Website forms generate email text locally in the user's browser. Information entered in form fields is not transmitted to the website server or stored in the website database.

“Open email” offers to open a draft addressed to office@sudoexpert.pro in the user's email application. “Copy text” lets the user copy the prepared text and paste it into an email. Neither action sends an email to the Operator.

The user reviews the email and decides whether to send it using their email application. Personal data reaches the Operator after the user actually sends the email.

Once an enquiry is received at office@sudoexpert.pro, the email is retained in the company’s mailbox. Under the configured forwarding rules, copies of the enquiry are forwarded to authorised company employees for review and preparation of a response.

Users wishing to submit technical requirements, specifications, drawings or other documents must attach them themselves in their email application. The website does not upload or store these files.

Once the fields have been validated and the separate consent checkbox selected, confirmation of consent and its version, SUDOEXPERT-PD-2026-09-24, are included in the email text. Without this checkbox, the email text cannot be generated or copied. Confirmation is contained in the email sent by the user; the forms do not create a separate server-side consent record.

4. Processing purposes

Handling enquiries and requests: contacting the user, clarifying the request, preparing a proposal, selecting equipment or services and arranging further business dealings.

Reviewing technical files: reviewing technical requirements, specifications, drawings and other documents attached by the user to an email.

Security: protecting information systems and received correspondence against misuse and unauthorised access.

Evidence of consent: retaining consent confirmation and its version within the email received from the user.

Web analytics, only with consent and if enabled: assessing website use and improving its operation without sending form content, contact details or files to analytics services.

5. Lawful bases

Depending on the circumstances, processing is based on the individual's consent; the need to enter into a contract at that individual's initiative or perform a contract to which the individual is a party, beneficiary or guarantor (Article 6(1)(5) of Federal Law No. 152-FZ); the Operator's statutory obligations; or another basis provided by law. The form's consent checkbox is not the sole basis for all personal data processing by the Operator.

The consent document is published on a separate website page. Consent confirmation is included when the email is generated locally and reaches the Operator with the email sent by the user. Consent may be withdrawn by contacting office@sudoexpert.pro. Withdrawal does not affect processing that may continue on another lawful basis.

6. Processing methods and operations

Processing may include collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer to authorised processors on a lawful basis and subject to appropriate conditions, restriction of processing, erasure and destruction. Processing is automated and, where necessary, non-automated.

7. Data localisation and infrastructure

The Operator takes measures to comply with Russian requirements for personal data localisation and protection. Website forms prepare email text locally; the user then sends it using their chosen email application. This Policy does not assert unverified locations for backups or technical logs of email or other operational infrastructure.

8. Disclosure to third parties

The Operator does not sell personal data. Access may be given only to persons who need it to perform their duties and to engaged processors where there is a lawful basis, an agreement and the necessary safeguards. Data is disclosed to public authorities in the cases and manner provided for by Russian law.

Users choose their own email application and provider; processing by those services is governed by their respective terms. If the Operator needs to make a cross-border transfer, it complies with Article 12 of Federal Law No. 152-FZ before the transfer begins.

9. Retention and destruction

Enquiries received by email and related technical documents are retained for three years after the end of the interaction or the last substantive communication, unless a longer period is required by law, a contract or the protection of the Operator's legitimate interests.

The established retention period for enquiries also applies to working copies received through automatic forwarding. The procedure for deleting these copies from the mailboxes and other storage locations used is governed by the company’s internal documents.

Consent confirmation is retained within the received email. This period does not automatically apply to personnel, accounting or other documents subject to specific retention periods.

Once the purpose has been fulfilled or another ground for ending processing arises, data is erased or destroyed unless continued retention is required by law or contract.

10. Security

The Operator takes organisational and technical measures to protect received personal data, taking into account the nature of processing and applicable legal requirements.

The website uses HTTPS. Forms do not transmit entered values to the website server or upload attachments. Users check the recipient address and email content before sending.

11. Cookies and analytics

The website may use necessary technical cookies for security and operation. Form data is not stored in cookies, localStorage or other client-side website storage. Only the analytics preference and related technical information are stored separately in localStorage. Yandex Metrica is disabled in the current website version. If analytics tools are enabled, their use follows the user's choice and cookie settings. Further details are set out in the Cookie Policy.

12. Individual rights

Individuals may obtain information about the processing of their data; request correction, restriction of processing or erasure where grounds exist; withdraw consent; challenge the Operator's acts or omissions before the competent authority or a court; and exercise other rights under Russian law.

To exercise these rights, contact office@sudoexpert.pro. The Operator may request information needed to verify the applicant's identity and the scope of the requested data.

13. Incidents

If an incident involving unlawful or accidental transfer, provision, dissemination of, or access to personal data infringes individuals' rights, the Operator follows the procedures and deadlines established by Russian law, including notifying Roskomnadzor where required.

14. Policy updates

The Operator may update this Policy. The current edition is published on the website with its update date. Material changes are reflected in the consent version where the nature of processing requires this.

Legal references: Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, including Articles 5, 6, 9, 12, 18, 18.1, 19, 21 and 22; Federal Law No. 38-FZ of 13 March 2006 “On Advertising”, if advertising mailings are introduced in future.