Annex No. 1 to Order No. 1/pd-X64 dated 10 December 2025.
This Regulation is a normative act of Limited Liability Company "X64" (LLC "X64"), INN 7720910084, KPP 772001001, OGRN 1237700714888, location: 111141, Russian Federation, Moscow, Perovskaya St., 21, room 6 (legal address: 111141, Russian Federation, Moscow, Perovskaya St., 21, room 6), adopted taking into account the requirements of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (hereinafter, the Personal Data Law).
The Regulation enters into force upon approval and remains in effect until cancelled by a corresponding order or until a new Regulation is introduced.
Amendments to the Regulation are made by a corresponding order. Amendments enter into force upon signing of such order.
The administrator of the website https://images.x64.ru/ is LLC "X64", INN 7720910084, KPP 772001001, OGRN 1237700714888, location: 111141, Russian Federation, Moscow, Perovskaya St., 21, room 6 (legal address: 111141, Russian Federation, Moscow, Perovskaya St., 21, room 6).
Key definitions:
Personal data — any information relating to a directly or indirectly identified or identifiable natural person (Personal Data Subject).
Personal Data Subject (subject) — a citizen who discloses their personal data to the Operator; a user of the Website who independently posts a set of data about themselves on the Website.
Operator (Personal Data Operator) — LLC "X64", INN 7720910084, KPP 772001001, OGRN 1237700714888, and organizations engaged under contract for automated processing in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data", that process personal data.
Website — the Internet site at https://images.x64.ru/.
Other terms and definitions have the meanings set out in the Personal Data Law.
1. General provisions
1.1. The Operator processes personal data of Personal Data Subjects in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data", the requirements for personal data protection when processing personal data in personal data information systems approved by Decree of the Government of the Russian Federation No. 1119 of 1 November 2012, other legislative and regulatory legal acts on personal data processing and protection, and contracts between the Personal Data Operator and the Personal Data Subject.
1.2. By disclosing personal data, the Personal Data Subject gives Consent to personal data processing.
1.3. Upon registration on the Website, the Personal Data Subject gives Consent to personal data processing (in the form of Annex No. 3 to this Regulation). Consent is a mandatory condition for registration and use of Website functionality. The Operator does not process personal data of Website users who have not completed registration and have not given consent, except for anonymized technical information about a user's device connection when using the Website.
1.4. The Regulation establishes: the purpose, procedure, and conditions of personal data processing; categories of Subjects whose personal data are processed, categories (lists) of processed personal data, methods and periods of processing and storage, and the procedure for destroying such data when processing purposes are achieved or other lawful grounds arise; the list of actions to protect personal data and procedures aimed at detecting and preventing violations of Russian Federation personal data law and eliminating the consequences of such violations.
1.5. This Regulation governs relations between the Operator and the Personal Data Subject arising in the performance of the Operator's duties and in other cases provided by Russian Federation law. Matters not resolved by this Regulation are governed by applicable Russian Federation law. This Regulation, or any part of it, may be changed by the Operator without special notice to the Personal Data Subject and without any compensation in that regard.
1.6. Documents containing Subjects' personal data are confidential. The confidentiality regime ceases if personal data are anonymized.
1.7. Personal Data Subjects may send the Operator requests, suggestions, or questions concerning this Policy by email to director@x64.ru, by post to LLC "X64", location: 111141, Russian Federation, Moscow, Perovskaya St., 21, room 6, or by phone +7 (999) 202-25-69.
2. Processing purposes, categories of personal data, and categories of Subjects
2.1. Under this Regulation, personal data are processed for the application and performance of labour legislation and contracts for the provision of services, including: collection, analysis, storage, and other actions, including transfer of personal data for potential employment; HR and accounting records; assisting employees in obtaining education; providing statutory working conditions, guarantees, and compensation; completing and submitting required reporting forms to authorized bodies; ensuring employee safety and protection of the Operator's property; monitoring the quantity and quality of work performed; registration, identification, and access to Website information resources; promotion of goods, works, and services on the market, including sending information about goods and services; direct contacts with potential consumers via communications means; research related to the Operator's activities for new product development and quality control, and statistical and other studies; optimization, including advertising targeting; detecting and preventing fraud and unlawful use of the Website; preparing responses to claims and requests; and performing obligations under service contracts, warranty obligations, and other obligations provided by Russian Federation law.
2.2. In accordance with the purposes in clause 2.1, the Operator processes the following personal data:
2.2.1. Contact data: last name, first name, patronymic (if any); telephone number (home and/or mobile); email address.
2.2.2. CV / HR data: last name, first name, patronymic (if any), and previous names, date and place of change (if changed); sex; date and place of birth; photographic image; citizenship; identity document type, series, number, issuing authority, and issue date; SNILS; INN; address and date of registration at place of residence (stay) and actual residence address; contact phone, email, and/or other contact methods; civil status act registration certificate details; family status and family composition; education and/or qualifications or special knowledge; foreign language skills; military duty and military registration details; employment history and previous workplaces; documents authorizing stay and work in the Russian Federation (for foreign nationals); temporary residence / permanent residence details; income and enforcement-document obligations; bank account and bank card numbers; health information (for certain categories).
2.2.3. Technical information automatically transmitted by the Website during use (including via contextual advertising services under clause 3.4): referral source; search or advertising query information; user device data (resolution, version, and other attributes); user clicks, page views, field completions, banner and video impressions/views; audience segment data; session parameters; visit time data; Website user identifier; cookie data.
2.2.4. The composition of processed personal data may be clarified in separate Consents to personal data processing posted on the Website.
2.3. The Operator does not verify the accuracy of personal data provided by the Subject. Where agreements so provide, the Subject must provide confirmation of authenticity of the information submitted.
2.4. The Operator does not process biometric personal data or other special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life, except where provided by Russian Federation law.
2.5. The Operator does not carry out cross-border transfer of personal data.
2.6. Categories of Subjects whose personal data are processed: candidates for employment with the Operator; the Operator's employees; former employees; family members of employees where the law requires the employee to provide such information; counterparties and their representatives; other persons whose personal data the Operator is obliged to process under Russian Federation law (including clients, customers, users of the Operator's services, and Website users).
3. Rights and obligations of the Operator
3.1. The Operator may perform actions to process Subjects' personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymization, blocking, deletion, and any other actions with personal data provided by applicable Russian Federation law.
3.2. The Operator stores Subjects' personal data in accordance with applicable Russian Federation law.
3.3. The Operator may transfer Subjects' personal data to inquiry and investigation bodies and other authorized bodies on grounds provided by applicable Russian Federation law.
3.4. To improve the Website, the Operator may use contextual advertising and statistics services that obtain access to information about a Subject's visits to and actions on the Website. Contextual advertising service: Yandex.Metrica, YANDEX LLC (Russia), address: 119021, Russia, Moscow, Leo Tolstoy St., 16 (Yandex Services User Agreement: https://yandex.ru/legal/rules; Privacy Policy: https://yandex.ru/legal/confidential).
3.5. All of a Subject's personal data must be obtained by the Operator from the Subject. If personal data can be obtained only from a third party, the Subject must be notified in advance and written consent (power of attorney) obtained. The Operator must inform the Subject of the purposes, intended sources and methods of obtaining personal data, the nature of the data to be obtained, and the consequences of refusing written consent.
3.6. The Operator may not obtain or process information about a Subject that, under Russian Federation personal data law, belongs to special categories of personal data, except in cases provided by law.
4. Rights and obligations of the Personal Data Subject
4.1. The Subject has the right to receive information regarding the processing of their personal data, including confirmation of processing, legal grounds and purposes, methods, the Operator's name and location, persons who have access or to whom data may be disclosed under a contract or federal law, the processed personal data relating to the Subject and their source, processing and storage periods, the procedure for exercising Subject rights, and information on completed or intended cross-border transfer.
4.2. The Subject may require the Operator to clarify, block, or destroy personal data if they are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose, and may take statutory measures to protect their rights.
4.3. The Subject may withdraw consent to processing by sending a corresponding notice to the Operator.
4.4. The Subject may appeal the Operator's acts or omissions to Roskomnadzor or to a court.
4.5. The Subject shall provide reliable personal data and timely notify the Operator of changes.
5. Procedure and conditions of personal data processing
5.1. Processing is carried out with and without automation tools.
5.2. Processing is based on the Subject's consent, necessity to perform a contract, necessity to comply with Russian Federation law, and other grounds under Article 6 of the Personal Data Law.
5.3. The Operator takes legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful acts.
5.4. Access to personal data is granted only to persons who need it to perform employment or contractual duties, subject to confidentiality.
5.5. Transfer of personal data to third parties is allowed with the Subject's consent or where required by law, under contracts obliging recipients to ensure confidentiality and security.
6. Processing and storage periods
6.1. Personal data are processed and stored no longer than required by the processing purposes, unless a longer period is established by federal law or a contract.
6.2. If processing purposes are achieved, consent is withdrawn, or other lawful grounds arise, personal data are destroyed or anonymized unless otherwise provided by law.
6.3. Storage periods for HR and accounting documents containing personal data follow archive legislation and internal retention schedules.
7. Blocking and destruction of personal data
7.1. The Operator blocks personal data upon detecting unlawful processing, at the Subject's request, or as required by the authorized body, for the period needed to clarify or cease unlawful processing.
7.2. Destruction is performed when processing purposes are achieved, consent is withdrawn (if no other legal grounds remain), retention periods expire, or a lawful order of an authorized body is received.
7.3. Destruction is documented. Methods ensure that recovery of destroyed data is impossible.
8. Personal data protection; procedures to prevent and detect violations
8.1. The Operator applies organizational and technical protection measures commensurate with threats to personal data security, including access control, accounting of storage media, antivirus protection, backup, and employee training.
8.2. A person responsible for organizing personal data processing is appointed.
8.3. The Operator regularly reviews compliance of processing with law and this Regulation and eliminates identified violations.
8.4. Employees admitted to processing are familiarized with Russian Federation personal data law requirements and local Operator acts against signature.
9. Investigation of unlawful or accidental transfer (provision, distribution, access)
9.1. Upon discovering a fact of unlawful or accidental transfer (provision, distribution, access) of personal data resulting in violation of Subject rights, the Operator takes measures to establish the circumstances, localize consequences, notify authorized bodies and Subjects where required by law, and prevent recurrence.
9.2. Internal investigations are conducted by authorized persons of the Operator with documentation of results.
10. Specifics for Operators engaging third parties
10.1. The Operator may entrust processing to another person under a contract (or state/municipal act) with the Subject's consent, unless otherwise provided by federal law.
10.2. The contract must define the list of actions (operations) with personal data, processing purposes, confidentiality and security obligations, and requirements under Article 19 of the Personal Data Law.
10.3. The person processing personal data on the Operator's behalf is not obliged to obtain the Subject's consent.
10.4. The Operator remains liable to the Subject for the actions of the person processing data on the Operator's behalf.
11. Liability for violation of personal data rules
11.1. Persons guilty of violating Russian Federation personal data law rules bear liability under Russian Federation legislation.
11.2. Moral harm caused to a Personal Data Subject due to violation of their rights, violation of personal data processing rules, or non-compliance with protection requirements established by the Personal Data Law is subject to compensation under Russian Federation law. Compensation for moral harm is independent of compensation for property damage and losses incurred by the Personal Data Subject.