1.1. The Policy of KL Engineer LLC (hereinafter, the "Operator") related to personal data processing (hereinafter, the "Policy") shall define the main goals, principles, conditions, and means of personal data processing, lists of subjects and personal data, processed by the Operator, rights of personal data subjects and functions of the Operator at the personal data processing, and requirements to personal data protection, implemented by the Operator.
1.2. The Policy is aimed to protect rights and freedoms if natural entities at the processing of their personal data by the Operator, including the protection of privacy right, personal and family secret.
1.3. The Policy was developed in accordance with the Law No. ZR-49-N "ON PERSONAL DATA PROTECTION" dated June 13, 2015 (hereinafter, the "Law"), the Law dated October 22, 2003 "ON FREEDOM OF INFORMATION" No. ZR-11-N and the requirements of the Constitution of the Republic of Armenia, and other regulatory legal acts of the Republic of Armenia in the field of personal data, and in accordance with the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108)
1.4. The provisions of this Policy shall form a basis for the development of in-house regulatory documents, regulating the Operator's issues and processes of processing personal data of its employees and other personal data subjects.
1.6 This Policy applies to all personal data of the subjects processed by the Operator with and without the use of automation devices.

2.1. In accordance with the Law, the following main terms are used in this Policy:

• personal data means any fact related to a natural entity, that allows or may allow identifying a person, directly or indirectly;
• Personal data processing Operator means a legal entity that, at its own account or jointly with the other entities, organizes and (or) performs processing of personal data, and determines the goals of personal data processing, the composition of personal data to be processed, actions (operations) performed with the personal data;
• personal data processing means any action or a set of actions that are related to collection or recording, or input, or systematization, or formation, or storage, or use, or transformation, or restoration, or transfer, or correction, or blocking, or destruction of personal data, or performing other actions with them, without regard of the type and way of performance (including, with or without the use of any automation and technical means);
• automated personal data processing means the personal data processing with computer equipment;
• personal data transfer to the third parties means an action, aimed at personal data transfer to any number of specified or unspecified persons, or at familiarization of any number of specified or unspecified persons with them, including personal data disclosure in mass media, publication in information and telecommunications network or provision of access to personal data to the other person otherwise;
• personal data use means an action, performed on the personal data, the direct or indirect goal of which may be making a decision or forming an opinion, or acquisition of rights, or provision of rights or benefits, or restriction or deprivation of rights, or implementation of other goals, that cause of may cause legal consequences for the data subject or the third parties, or otherwise relate to their rights and freedoms;
• personal data blocking means temporary suspension of a possibility of collection or recording, or systematization, or transfer, or use of personal data;
• personal data destruction means actions leading to an impossibility to restore the content of personal data in the information system and/or leading to destruction of personal data material media;
• personal data depersonalization means actions causing the impossibility to determine the belonging of data to the specific data subject;
• information system means the totality of information technologies or technical means, used for processing of personal data, included into the database, their processing by electronic or non-electronic means;
• third party means any entity, authority, institution or organization, that are not data subjects, a personal data operator, or an authorized person, and rights or legal interests of which are or might be affected due to the personal data processing;
• personal data trans-border transfer means personal data transfer to the foreign state territory, to the foreign state public authority, foreign natural entity or foreign legal entity.

2.2. For the purposes of this Policy, the following terms are used:

• administrative and economic activities mean in-house processes aimed at the current provision of the Operator's activities with material assets (procurement of stationery, office equipment, expendables, household supplies, communications services, etc.); work flow organization (maintenance of the archive, libraries, databases); buildings, premises, territories operation organization (maintenance, cleaning, design and renovation); work process organization;
• information means (messages, data) without regard of the form of their representation;
• user means a person who uses the current automated system or network to perform the specific function and to solve the tasks faced by them;
• personal data subjects mean a detemined or determinable natural entity, to which such personal data relate;
• Operator's employee means a natural entity that concluded a labor agreement with the Operator;
• close relatives mean persons who are ascendants and descendants (parents and children, grandparents, grandchildren), full- and half-blood (with one common parent) brothers and sisters;
• candidate means a natural entity, applying for a vacant position, personal data of which were received by the Operator;
• Operator's supplier is a term used at collective reference to a corporate counterparty, i.e., a legal entity, sole proprietor or natural entity, and a foreign legal entity, that concluded or 

intends to conclude an agreement for supply of services or products, performance of work or provision of services with the Operator;

• Operator's partners mean a legal entity, a sole entrepreneur, and a natural entity, carrying out business activities according to the procedure established by the laws of RA, who/that concluded or intends to conclude an agreement on provision of services or performance of works, provided of performed by the Operator, with the Operator;
• partner's/supplier's representative means a natural entity, personal data of which were transferred to the Operator, and:
  
  • acting on behalf of a partner, a supplier under the power of attorney or by virtue of labor duties;
  • being an owner, founder, shareholder of participant of a partner, a supplier;
  • included into the corporate bodies of a partner or a supplier;
• Operator's counterparty means a party to this agreement with the Operator;
• public personal data mean data that become known to any number of specified or unspecified persons at the data subject's consent or at performance of conscious actions, aimed at their accessibility, and data, stipulated by the law as public data;
• biometric personal data mean data that characterize the person's physiological and biological features;
• special categories of personal data mean data that relate to the person's racial and national affiliation, political views, religious or philosophical beliefs, health condition, private life;
• access to personal data – familiarization of the respective persons (including the employees) with the personal data of the subjects, processed by the Operator, provided that these data are kept confidential;
• personal data confidentiality means the obligation of persons who obtained access to personal data, not to disclose to the third parties and not to transfer the personal data without the personal data subject's consent, unless otherwise stipulated by the law.

3.1. The legal basis of personal data processing is the totality of regulatory legal acts, in pursuance of which and in accordance with which the Operator shall perform the personal data processing, including:

• Constitution of the Republic of Armenia;
• Labor Code of the Republic of Armenia;
• The Law No. ZR-49-N "ON PERSONAL DATA PROTECTION" dated June 13, 2015 and the Law No. ZR-11-N dated 20.10.2003 "ON FREEDOM OF INFORMATION";
• Convention for the protection of individuals with regard to automatic processing of personal data (ETS N 108, adopted in Strasbourg on 28.01.1981);
• Regulation (EU) 2016/679 of the European Parliament and of the Council "On the protection of natural persons with regard to the processing of personal data and on the free movement of such data", and repealing Directive 95/46/EC (General Data Protection Regulation) (adopted in Brussels on 27.04.2016).

3.2. With the purposes to implement the Policy provisions, the Operator shall develop the respective local regulatory acts and the other documents, including local regulatory acts and documents (orders, instructions, logs, notifications, etc.), governing and reflecting the Operator's issues of personal data processing and safety provision.

4.1. The Operator is entitled to:

• process the personal data of the personal data subject in accordance with the goal set;
• demand from the personal data subject to submit reliable personal data, required for the fulfillment of an agreement, service provision, identification of the personal data subject, and in other cases, stipulated by the laws оf personal data;
• limit the personal data subject's access to its personal data in case if the personal data subject's access to its personal data infringes rights and legal interests the third parties, and in other cases, provided for by the laws of the Republic of Armenia;
• process public personal data of natural entities;
• with the purposes of in-house information provision of the Operator, create in-house reference materials, that, at the personal data subject's written consent, unless otherwise stipulated by the laws of the Republic of Armenia, may include their surname, name, 

 patronymic, place of work, position, year and place of birth, address, line number, e-mail address and other personal data, communicated by the personal data subject;

• perform processing of personal data, subject to publication or obligatory disclosure in accordance with the laws of the Republic of Armenia;
• entrust the personal data processing to the other person at the personal data subject's consent based on the agreement concluded with this person.

4.2. The Operator is obliged to:

• process the personal data, obtained according to the procedure set by the current laws;
• review appeals from the personal data subject (the personal data subject's legal representative) concerning the processing of their personal data, and give motivated answers;
• perform operative and archive storage of the Operator's documents containing the personal data of the personal data subjects, in accordance with the requirements the laws of the Republic of Armenia.
• at collection of personal data, inter alia, via Internet, the Operator is obliged to provide recording, systematization, accumulation, storage, clarification (update, amendment), mining of personal data of the citizens of the Republic of Armenia with the use of databases, located on the territory of the Republic of Armenia, except for cases, specified in clauses 8, 9, 10 of the Law.

4.3. The Personal data subjects shall be entitled to:

• receive information, related to their personal data processing, according to the procedure, form and terms, established by the Personal data laws;
• demand clarification of their personal data, their blocking or destruction in case when they are incomplete, obsolete, inexact, unreliable, illegally obtained, or are not necessary for the set processing goal, and, when used with the purposes, not set earlier at the provision of consent to personal data processing;
• revoke their consent to personal data processing;
• takes measures on protection of their rights and legal interests, provided by law;
• with the purpose to implement their rights and legal interests, receive from the Operator information related to their personal data processing, at appealing to the Operator and 

sending the request in person or through the representative, with the obligatory specification of the necessary data, provided for by the laws of the Republic of Armenia.
4.4. The personal data subjects are obliged to:

• inform reliable information on themselves and submit documents, containing the personal data, the composition of which was determined by the laws of the Republic of Armenia and local regulatory documents of the Operator in the volume required for the processing goal;
• inform the Operator on clarification (update, amendment) of their personal data.

5.1. The Operator shall collect, process and store only the required personal data.
5.2. The Operator shall perform the personal data processing with the following purposes:

• provision of following the Constitution of the Republic of Armenia, laws and other regulatory legal acts of the Republic of Armenia, local regulatory acts of the Operator;
• performance of functions, powers and obligations imposed on the Operator, including those on personal data transfer to tax and other government authorities, which need such data to exercise their legal powers;
• regulation of labor relations with the Operator's employees (employment, training, control of quantity and quality of the work performed, property preservation provision, etc.);
• maintenance of staff record management and personal files of the Operator's employees;
• staff recruitment and selection;
• conclusion of any agreements with the personal data subject and their further fulfillment;
• preparation, conclusion, execution and termination of agreements with the counterparties;
• informing and conduct of polls and studies by the Operator;
• acceptance of partnership proposals and further negotiations;
• provision to the Personal data subject of information on the service provided by the Operator, informing on offers and development of new product and services;
• formation of statistical reporting, inter alia, for submission to tax and the other authorities;
• provision of access mode to the Operator's premises;
• preparation of reference materials for the in-house information provision of the Operator's activities; 
• performance of judicial acts, acts of other authorities or officials, subject to fulfillment in accordance with the by the execution proceeding laws of the Republic of Armenia;
• execution of rights and legal interests by the Operator in terms of conducting administrative and economic activities;
• regulation of labor relations and other relations directly connected with them;
• provision of customer support and service by the partner;
• with the purpose to achieve goals, provided for by the international agreement of the Republic of Armenia or the law, for execution and performance of functions, powers and duties, imposed by the laws of the Republic of Armenia on the Operator.

5.3. The Operator shall not check the authenticity of the personal information provided by the User and shall not perform the control of its relevance. The User shall bear all liability and potential consequences for submission of false or irrelevant personal information.

6.1. The Operator shall perform the personal data processing on the legal and fair basis with conformity to the following principles:

• conformity of personal data processing to achievement of the specific goals, set earlier;
• unacceptability of personal data processing, incompatible with personal data collection goals;
• unacceptability of uniting databases, containing the personal data, the processing of which is performed with the mutually incompatible purposes;
• performance of processing only of those personal data, that meet the processing goals;
• conformity of content, scope, nature and method of the personal data processed to the specified processing goals;
• unacceptability of redundancy of the personal data processed in relation to their processing goals, stated at the personal data collection;
• provision, at the personal data processing, of their precision, adequacy and relevance in relation to the personal data processing goals;
• provision and taking necessary measures on deletion or clarification of incomplete or inexact data;
• personal data storage in the form allowing to determine the Personal data subject not longer, then demanded by their processing goals, if the personal data storage term was not 

established by the laws of the RA, the agreement, the party, beneficiary party, or reference under it is the Personal data subject;

• destruction, or depersonalization of personal data processed upon achieving the processing goals or in case to lose the need in achieving these goals, unless otherwise stipulated by the law;
• provision of the personal data due safety, their confidentiality, and safety of the personal data processed.

6.2. Personal data processing is admitted in the following cases:

• the personal data subject's consent to processing of their personal data;
• transfer by the personal data subject (or at their request) of access to the personal data to the public;
• the present need with the purpose to achieve goals, provided for by the international agreement of the Republic of Armenia or the law, for execution and performance of functions, powers and duties, imposed by the laws of the Republic of Armenia on the Operator;
• the personal data subject's participation in constitutional, civil, administrative, criminal and arbitration proceedings, and for execution of judicial acts, subject to fulfillment in accordance with the laws of the Republic of Armenia;
• fulfillment of the agreement, the party, beneficiary party, or reference under it will be the personal data subject, and at conclusion of the agreement under the personal data subject's initiative;
• performance of processing of personal data, subject to publication or obligatory disclosure in accordance with the laws of the Republic of Armenia;
• for execution of rights and legal interests of the Operator or the third parties.

7.1 Content and scope of the personal data processed should meet the set processing goals, stipulated by section 5 of this Policy. The personal data processed should not be redundant in relation to the set goals of their processing.
7.2. The Operator shall process the following categories of the personal data subjects.
7.2.1. Candidates for employment by the Operator, who are office seekers for open positions replacement, at the consent of the personal data subjects, in composition and in terms required by the Operator to make a decision on employment or refusal to employ, and for the skill pool formation. 

• surname, first name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• contact information;
• information on education, experience, qualification;
• other personal data, communicated by candidates in CVs and covering letters.

7.2.2. The Operator's employees and former employees: for the purposes to meet labor laws of the Republic of Armenia in terms of labor relations and other relations directly related to them, and access mode execution. In composition and in terms required to achieve goals provided for by the laws of the Republic of Armenia, for performance of functions, powers and duties imposed on the Operator by the laws of the Republic of Armenia.

• surname, first name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• image (photo);
• passport information;
• address of registration at the place of residence;
• address of actual residence;
• contact information;
• social security number;
• information on education, training, professional training and further training;
• family status, presence of children, family ties;
• information on labor activities, including presence of motivations, rewards, and/or summary punishment;
• information on marriage registration;
• information on military registration;
• information on disability;
• information on maintenance deduction;
• other personal data, provided by the employee in accordance with the requirements of the labor laws. 

7.2.3. Family members of the Operator's employees - for the purposes to meet labor laws of the Republic of Armenia in terms of labor relations and other relations directly related to them:

• surname, first name, patronymic;
• relation degree;
• year of birth;
• other personal data, provided by the employee in accordance with the requirements of the labor laws.

7.2.4. Natural entities, performing works, rendering services, and/or performing supply of goods, that concluded a civil agreement with the Operator:

• surname, first name, patronymic;
• gender;
• passport information;
• contact information;
• social security number;
• other personal data, provided by natural entities in accordance with the requirements of the laws of the Republic of Armenia.

7.2.5. Natural entities, who are representatives of the existing and potential suppliers of the Operator, or who are representatives of the Operator's partners, at the consent of the personal data subjects, in composition and in terms required for interaction with the suppliers or partners.

• surname, first name, patronymic;
• passport information;
• contact information;
• position held;
• other personal data, submitted by representatives (employees) of suppliers or partners, required for conclusion and fulfillment of agreements.

7.2.6. Natural entities, whose personal data were made public by them, and their processing does not infringe their rights and meets the requirements set by the Personal data laws;
7.2.7. Natural entities, that gave consent to processing of their personal data by the Operator, or natural entities, whose personal data must be processed by the Operator with the purpose to achieve goals, provided for by the international agreement of the Republic of Armenia or the law, for execution and performance of powers and duties, imposed on the Operator by the laws of the Republic of Armenia.
7.3. Processing of biometrical personal data by the Operator shall be performed in accordance with the by the laws of the Republic of Armenia. 
7.4. The Operator shall not perform processing of personal data special categories concerning racial and national affiliation, political views, religious or philosophical beliefs, health condition, private life, except cases, provided for by the laws of the Republic of Armenia.

8.1. The Operator shall process the personal data in legal and fair grounds, for the purpose to perform functions, powers and duties imposed on it by the laws, execution of rights and legal interests of the Operator, its employees or the third parties.
8.2. The Operator shall receive the personal data directly from the personal data subjects, process the subjects' personal data on their consent that may be also expressed by performance of implied actions on the Operator's Website, including, but not limited to, order placement, account registration, opt-in e-mails, in accordance with this Policy.
8.3. The Operator shall transfer the personal data to the government authorities in terms of their powers in accordance with the laws of the Republic of Armenia.
8.4. The Operator shall provide access to the personal data processed only to those employees who need it in connection with performance of their job duties and with conformity to the personal responsibility principles. 
8.5. The Operator shall perform the personal data processing with the preservation of confidentiality that means the duty not to disclose to the third parties and not to transfer the personal data without the personal data subject's consent, unless otherwise stipulated by the laws of the Republic of Armenia.
8.6. The Operator shall provide the personal data confidentiality to the personal data subject from its side, from the side of its affiliated persons, from the side of its employees with an access to personal data of natural entities, and shall provide the use of personal data by the parties aforementioned solely for the purposes, conforming to the law, contract, or the other agreement concluded with the personal data subject.
8.7.  The Operator shall process the personal data as follows:

• non-automated personal data processing;
• automated personal data processing with or without the transfer of received information via information and telecommunication network;
• mixed personal data processing.

8.8.  Actions on personal data processing include collection, recording, systematization, accumulation, storage, clarification (update, amendment, mining, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction.
8.9. In case of detecting inexact personal data at the appeal of the personal data subject or their representative, or at their request, or at a request from the supervisory body, the Operator shall block personal data, related to this personal data subject, since the time of such appeal or receipt of the specified request for the check period, if the personal data blocking does not infringe rights and legal interests of the personal data subject or the third parties.
In case if the personal data are confirmed to be inexact, the Operator, based on the data submitted by the personal data subject or their representative, or a supervisory body, or other necessary documents, shall clarify the personal data within seven business days since such data were submitted, and remove the personal data blocking.
8.10. In the case of revealing false personal data processing at the appeal (request) of the personal data subject or their representative, or at a request from the supervisory body, the Operator shall perform blocking of falsely processed personal data, related to this personal data subject, since the moment of such appeal or request receipt.
8.11. The Operator shall protect the User's personal information in accordance with the requirements, set to protection of such information, and shall be liable for the use of safe methods of such information protection.
8.12.  The Operator shall be enabled to transfer the User's personal information (including to organizations that conduct recording, systematization, accumulation, clarification, storage, mining, directly conducting the transfer of special offers, information on new goods and sales promotions and processing of inquiries and appeals to the User, and conducting the personal information destruction) to the third parties.
8.13. With the purpose to protect the User's personal information, provide its due use and prevent unauthorized and/or accidental access to it, the Operator shall apply the required and sufficient technical and administrative measures. The personal information, provided by the User, shall be stored on servers with limited access, located in premises, the access of the third parties to which is also limited.
8.14. Safety measures, implemented by the Operator at personal data processing, shall include:

• obtaining consent from personal data subjects to processing of their personal data, except for cases, provided for by laws of the Republic of Armenia;
• appointment of officials in charge of organization of processing and personal data security provision in the Operator's subdivisions and information systems;
• approval and performance of local regulatory acts and other documents, establishing and regulating the Operator's issues of personal data processing and safety provision;
• provision of separated storage of the personal data and their material media, containing various categories of personal data and which are processed for different purposes;
• organization of accounting of personal data carriers and information systems, in which the personal data are processed;
• setting the restriction to the personal data transfer via public communications channels, data networks beyond the controlled zone and without the use of the Operator's measures for personal data safety provision (except for public and/or depersonalized personal data);
• storage of personal data material media with conformity to conditions ensuring the personal data safety and excluding unauthorized access to them;
• application of a set of legal, organizational and technical measures for provision of the personal data safety with the purpose to provide the personal data confidentiality and their protection from misconduct:
  
  • provision of unlimited access to the Policy, by placing it on the Operator's official Internet Website;
  • establishing the rules of access to the personal data, processed in the Operator's information system, and provision of their registration and recording of records with them;
  • performance of assessment of damage that may be inflicted to the personal data subjects in the case of breaking the Law;
  • determining threats to personal data security at their processing in the Operator's information system;
  • application of organization and technical measures, and the use of information protection measures, required fr achieving the set level of personal data protection;
  • provision of protection of documents, containing the personal data, in hard copy and on other material media, at their transfer to the third parties with the use of postage services;
  • revealing the facts of unauthorized access to the personal data and taking response measures, including restoration of the personal data, modified or destroyed due to unauthorized access to them;
  • performance of the internal control of conformity of the personal data processing to the requirements of the Personal data laws, including regulatory legal acts, adopted in accordance with it, to the requirements to the personal data protection, the Policy, the Regulation, and other local acts, including the control over the measures taken for provision of personal data safety and the level of their protection when processing in the Operator's information system;
  • performance of other measures, provided for by laws of the Republic of Armenia in the field of personal data.

8.15 Safety provision of the personal data processed shall be performed by the Operator in terms of a single complex system or organization and technical and legal measures for information protection, with regard of requirements of the personal data laws and regulatory legal acts adopted in accordance with it.
8.16 The Operator's information safety system is continuously evolving and improved on the basis of requirements of international and national information safety standards, and the best global practices.
8.17 The Security Specialist is designated as the person responsible for data protection. Responsibilities include:

• - Monitoring compliance with data protection laws
• Responding to requests from data subjects
• Cooperating with supervisory authorities
• Maintaining documentation of processing activities
• Reporting to top management on data protection status

Based on the size and nature of the Company's processing activities, the appointment of a dedicated Data Protection Officer is not mandatory under Art. 37 GDPR. The Security Specialist performs this function as part of their duties, with access to specialist literature and regular professional training.
When a processing activity meets the criteria for high-risk processing under Art. 35 GDPR, the Security Specialist shall conduct a DPIA. The DPIA shall include:

• Systematic description of the processing activities and purposes
• Assessment of necessity and proportionality
• Assessment of risks to the rights and freedoms of data subjects
• Proposed measures to mitigate identified risks
• Consultation with data subjects or their representatives where appropriate

The DPIA shall be documented and approved by the Director. For processing activities involving external service providers, the DPIA shall consider the provider's security measures and segregation controls.
Criteria for requiring a DPIA:

• Systematic and extensive evaluation of personal aspects based on automated processing (profiling)
• Processing on a large scale of special categories of personal data (Art. 9 GDPR)
• Systematic monitoring of publicly accessible areas on a large scale
• Processing that involves new technologies

The Security Specialist shall maintain a list of processing activities requiring DPIA and review it annually.
8.18 Transfers of personal data to third countries (outside the EEA and RA) shall only be conducted if:

• The European Commission has issued an adequacy decision for the country (Art. 45 GDPR); or
• Appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) adopted by the European Commission (Art. 46 GDPR); or
• Derogations apply, including explicit consent of the data subject (Art. 49 GDPR).

For transfers based on SCCs, a Transfer Impact Assessment (TIA) shall be conducted.
Where explicit consent of the data subject is required, the consent shall be:

• Obtained in writing or electronically with clear affirmative action
• Informing the data subject of the risks of transfers to countries without adequacy decisions
• Documented and revocable at any time

The Security Specialist shall maintain a list of all transfers to third countries in the Register of Processing Activities (ROPA) and review it annually.
8.19 Data subject requests.
Procedure:
1.  Any employee receiving a request from a data subject shall immediately forward it to the Security Specialist without responding directly.
2.  The Security Specialist shall verify the identity of the requester using appropriate means (e.g., confirmation of personal information, official identification documents).
3.  The request shall be processed within 30 days of receipt. This period may be extended by up to 60 days if necessary, considering the complexity and number of requests. The data subject shall be informed of any such extension within the initial 30-day period.
4.  If the request is denied (in whole or in part), the Security Specialist shall provide a written explanation of the reasons and inform the data subject of their right to lodge a complaint with the supervisory authority.
5.  All requests and responses shall be documented in a dedicated register (Annex 1), including: date of receipt, nature of request, identity verification method, response provided, date of response, and any refusal with reasons.
The register shall be retained for at least 3 years and be available for internal and external audits

9.1.  Terms and time of the personal data destruction by the Operator:

• achieving the personal data processing goal or loss of the need to achieve this goal: within 30 days;
• reaching the maximal terms of keeping the documents, containing the personal data: within 30 days;
• provision by the personal data subject (their representative) of a confirmation that the personal data were obtained illegally or are not necessary for the specified processing goal, - within seven business days;
• revocation by the personal data subject of the consent to their personal data processing, if no preservation of these data is needed for their processing: within 30 days

9.2. Upon achievement of the personal data processing goal, and in the case of revocation of the personal data subject's consent to their processing, the personal data shall be subject to destruction:

• unless otherwise stipulated by the agreement, the agreement, the party, beneficiary party, or reference under it will be the personal data subject;
• the Operator is entitled to perform processing without the personal data subjects consent on the grounds provided for by the Personal Data law or other laws of the RA;
• unless otherwise stipulated by the other agreement between the Operator and the personal data subject.

9.3. Personal data destruction shall be performed by a committee, formed by the order of the Operator's director.
9.4. The personal data destruction methods shall be established in the Operator's local regulatory acts.