PERSONAL DATA PROCESSING POLICY

1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy defines the principles, procedures, and conditions for processing personal data of employees, customers, contractors, and other individuals of OOO "AEROHOTEL" (hereinafter referred to as the Operator), as well as other persons whose personal data is processed by the Operator or by persons acting on behalf of the Operator.

1.2. This Personal Data Processing Policy is developed and applied in accordance with:
  • Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data";
  • the Constitution of the Russian Federation;
  • the Civil Code of the Russian Federation;
  • the Labour Code of the Russian Federation;
  • the Tax Code of the Russian Federation;
  • Federal Law No. 402-FZ dated December 6, 2011 "On Accounting";
  • Federal Law No. 167-FZ dated December 15, 2001 "On Compulsory Pension Insurance in the Russian Federation";
  • agreements concluded between the Operator and data subjects;
  • consents provided by data subjects for the processing of their personal data;
  • other applicable legal acts regulating personal data processing and internal documents of the Operator.
1.3. The terms and definitions used in this Policy shall have the meanings established by Federal Law No. 152-FZ "On Personal Data".

1.4. The purpose of the Operator is to ensure the protection of the rights and freedoms of personal data subjects during the processing of their personal data, including the protection of privacy and personal and family life.

1.5. This Policy applies to all personal data processed by the Operator and serves as the basis for organizing personal data processing activities at OOO "AEROHOTEL".

This Policy is mandatory for employees and other authorized persons of the Operator who process personal data within the scope of their professional duties.
2. CONCEPT, COMPOSITION AND CATEGORIES OF PERSONAL DATA
2.1. Personal data means any information relating directly or indirectly to an identified or identifiable individual (personal data subject).

2.2. Personal data processing means any action or set of actions performed with personal data, whether using automated systems or without their use, including:
  • collection;
  • recording;
  • systematization;
  • accumulation;
  • storage;
  • updating and modification;
  • extraction;
  • use;
  • transfer (disclosure, provision, access);
  • anonymization;
  • blocking;
  • deletion;
  • destruction.
2.3. Personal data may be processed independently or together with other confidential information, where the procedure for such processing is established by applicable legislation.

2.4. The Operator may process personal data made available for public distribution by the personal data subject in accordance with Article 10.1 of Federal Law No. 152-FZ, taking into account restrictions and prohibitions established by the personal data subject.

Categories of Personal Data Subjects
The Operator processes personal data of the following categories of individuals:
  • guests staying at the Hotel;
  • visitors to the 6·12·24 café-bar;
  • current and former employees of the Company and their close relatives;
  • candidates applying for vacant positions;
  • individuals who are contractors or representatives of contractors having contractual or other legal relations with the Company;
  • representatives of counterparties;
  • visitors and users of the Operator’s website;
  • persons submitting requests through feedback forms;
  • persons who create or do not complete a reservation through the Me Hotel online booking module or the Operator’s website;
  • persons contacting the Operator by telephone, email, messengers, or other communication channels;
  • recommenders;
  • other categories of personal data subjects.
3. SOURCES OF PERSONAL DATA COLLECTION
3.1. Personal data may be obtained directly from the personal data subject or from third parties that are contractors or counterparties of OOO "AEROHOTEL".

3.2. When collecting personal data directly from the personal data subject, the Operator ensures that there are legal grounds for processing such data.
Where processing is based on consent, such consent must be specific, informed, explicit, and conscious.

3.3. In cases established by law, personal data processing is carried out only with the written consent of the personal data subject.

3.4. If the personal data subject is legally incapable, consent to the processing of personal data shall be provided by their legal representative.

3.5. The Operator may collect personal data through:
  • the official website;
  • mobile applications;
  • telephone communication;
  • social media platforms;
  • customer service channels of OOO "AEROHOTEL".
3.6. In certain cases, the Operator may obtain personal data from third-party sources, including booking platforms and travel agencies.

Such sources may include publicly available information.

The Operator may also receive information from social media platforms when users interact with the Operator’s content or pages, including when they leave reviews about their stay or services provided by OOO "AEROHOTEL" (for example, Tripadvisor, Booking.com, Google Maps, Yandex Maps).
4. PURPOSES OF PERSONAL DATA PROCESSING
4.1. The Operator independently determines the purposes, composition, and methods of personal data processing and performs personal data processing activities in accordance with applicable legislation.

4.2. Processing of special categories of personal data, including information relating to:
  • race;
  • nationality;
  • political views;
  • religious or philosophical beliefs;
  • health information;
  • private life;
is permitted in cases established by Federal Law No. 152-FZ, including:
  • when the personal data subject provides written consent;
  • when processing is required under legislation on social assistance, labour relations, or pension provision.
Processing Methods
Processing method:
Automated, non-automated, or mixed processing depending on the category of personal data and the purpose of processing.

Retention Period
Personal data is stored for the period required to achieve the purposes of processing unless another storage period is established by legislation, agreements, or consent of the personal data subject.
4.3. PURPOSES OF PERSONAL DATA PROCESSING BY OOO "AEROHOTEL"
4.3.1. Processing of Personal Data of Employees and CandidatesPurpose of processing
Processing of personal data is carried out for the purpose of ensuring employees' labour rights and guarantees provided by OOO "AEROHOTEL", organizing labour and operational processes, and complying with the requirements of labour legislation of the Russian Federation and other regulatory legal acts containing labour law provisions.
The purposes of processing also include:
  • assistance with employment, professional training, and career development;
  • ensuring employee safety;
  • organizing access to the Company’s premises;
  • monitoring the quantity and quality of work performed;
  • ensuring the protection of the Company’s property;
  • providing information support, including payroll processing, personnel records management, organization and participation in training events, and business trips;
  • administration of access to information systems;
  • arranging voluntary health insurance;
  • issuing business cards;
  • conducting pre-trial and court proceedings.
Categories of Personal Data Subjects
  • current employees of the Company;
  • former employees;
  • dismissed employees;
  • close relatives of employees;
  • candidates applying for vacant positions.
Categories of Personal Data
The Operator may process the following categories of personal data:
  • full name;
  • gender;
  • citizenship;
  • nationality;
  • date and place of birth;
  • residential address;
  • registration address;
  • contact details, including telephone numbers and email address;
  • position held;
  • employment history;
  • information about previous employers and positions held;
  • taxpayer identification number (TIN);
  • information contained in individual personal account registration documents;
  • compulsory medical insurance policy details;
  • passport details or details of another identity document;
  • foreign passport details;
  • employment record information;
  • military registration information;
  • education details;
  • information about additional professional education;
  • foreign language proficiency;
  • criminal record information;
  • legal capacity information;
  • information about participation in management of legal entities and entrepreneurial activity;
  • medical information where required by law;
  • information about awards, incentives, and distinctions;
  • disciplinary records;
  • information contained in internal investigations;
  • marital status;
  • information about close relatives;
  • income, expenses, property, and property obligations;
  • bank account details;
  • information regarding access to state secrets;
  • photographs.
Processing Method
Mixed processing of personal data.

Retention Period
For the period established by applicable legislation, agreements, consent of the personal data subject, or other legal grounds.
4.3.2. Processing of Personal Data of Clients, Guests, and ContractorsPurpose of processing
Processing of personal data is carried out for:
  • conclusion, execution, and termination of agreements with clients and contractors;
  • provision of hotel and other services;
  • processing reservations;
  • communication with guests and contractors;
  • processing payments;
  • fulfillment of contractual obligations;
  • maintaining accounting and document records;
  • reviewing claims and resolving disputes;
  • conducting pre-trial and court proceedings.
Categories of Personal Data Subjects
  • guests staying at the Hotel;
  • clients of OOO "AEROHOTEL";
  • visitors to the 6·12·24 café-bar;
  • representatives of contractors and counterparties;
  • individuals entering into contractual relations with the Company.
Categories of Personal Data
The Operator may process:
  • full name;
  • date and place of birth;
  • citizenship;
  • passport details or details of another identity document;
  • residential and registration address;
  • telephone number;
  • email address;
  • information about reservations and provided services;
  • information about payments;
  • bank account details;
  • information contained in contracts, applications, requests, and other documents;
  • other information provided by the personal data subject necessary for the purposes of processing.
Processing Method
Mixed processing of personal data.
Retention Period
For the period established by applicable legislation, agreements, consent of the personal data subject, or other legal grounds.
4.3.3. Processing of Personal Data of Website UsersPurpose of processing
Processing of personal data of users of the Operator’s website https://6-12-24.ru-eng/ is carried out for:
  • providing access to website functionality;
  • processing requests submitted through website forms;
  • providing information about the Hotel and services;
  • managing reservations;
  • communicating with website users;
  • improving the quality of services.
Categories of Personal Data Subjects
  • website visitors;
  • users submitting requests through feedback forms;
  • users creating reservations through the website;
  • users interacting with online services provided by the Operator.
Categories of Personal Data
The Operator may process:
  • full name;
  • telephone number;
  • email address;
  • information provided in request forms;
  • reservation information;
  • information necessary for communication with the user.
Processing Method
Automated, non-automated, or mixed processing depending on the method of obtaining and processing personal data.
Retention Period
Until the purposes of processing are achieved, unless another storage period is established by applicable legislation, agreements, or consent of the personal data subject.
4.3.4. Processing of Personal Data of Persons Who Contact the OperatorPurpose of processing
Processing of personal data of persons who contact OOO "AEROHOTEL" by telephone, email, messengers, feedback forms, or other communication channels is carried out for:
  • reviewing and responding to requests;
  • providing information about Hotel services;
  • maintaining communication with customers and other persons;
  • processing requests, comments, and complaints;
  • improving the quality of customer service.
Categories of Personal Data Subjects
  • customers;
  • potential customers;
  • persons contacting the Operator;
  • representatives of organizations contacting the Operator.
Categories of Personal Data
The Operator may process:
  • full name;
  • telephone number;
  • email address;
  • information contained in requests and messages;
  • other information voluntarily provided by the person.
Processing Method
Automated, non-automated, or mixed processing of personal data.
Retention Period
Until the purpose of processing is achieved and within the period established by applicable legislation or internal documents of the Operator.
4.3.5. Processing of Personal Data of Persons Who Create or Do Not Complete a ReservationPurpose of processing
Processing of personal data of persons who create or do not complete a reservation through the Me Hotel online booking module or the Operator’s website is carried out for:
  • creating and managing reservations;
  • contacting the customer regarding the reservation;
  • providing information about reservation status;
  • assisting with completion of the reservation process;
  • analyzing customer requests and improving reservation services.
Categories of Personal Data Subjects
  • persons who create reservations through the Me Hotel online booking module;
  • persons who create reservations through the Operator’s website;
  • persons who begin but do not complete the reservation process.
Categories of Personal Data
The Operator may process:
  • full name;
  • telephone number;
  • email address;
  • reservation details;
  • selected services;
  • dates of stay;
  • number of guests;
  • other information provided during the reservation process.
Processing Method
Automated, non-automated, or mixed processing of personal data.
Retention Period
Until the purpose of processing is achieved, unless another storage period is established by applicable legislation, agreements, consent of the personal data subject, or other legal grounds.
4.3.6. Processing of Personal Data of Persons Leaving Reviews and Interacting with Online PlatformsPurpose of processing
Processing of personal data of persons who leave reviews about their stay at the Hotel or services provided by OOO "AEROHOTEL" is carried out for:
  • monitoring customer feedback;
  • improving the quality of services;
  • responding to reviews and requests;
  • analyzing customer experience;
  • maintaining the reputation of the Hotel and the Company.
Categories of Personal Data Subjects
  • users of online platforms;
  • persons leaving reviews about the Hotel or services of the Operator;
  • users interacting with the Operator’s pages and profiles on external platforms.
Categories of Personal Data
The Operator may process:
  • name or username used on the platform;
  • publicly available profile information;
  • review content;
  • photographs and other materials voluntarily published by the user;
  • information contained in communication with the user.
Processing Method
Automated, non-automated, or mixed processing of personal data.
Retention Period
Until the purposes of processing are achieved or for the period established by applicable legislation and internal documents of the Operator.
4.3.7. Processing of Personal Data of Website Visitors and Users of Digital ServicesPurpose of processing
Processing of personal data of website visitors and users of digital services provided by the Operator is carried out for:
  • ensuring operation of the website and digital services;
  • improving website performance and usability;
  • analyzing user requests and interactions;
  • providing information about the Hotel and services;
  • ensuring information security.
Categories of Personal Data Subjects
  • visitors of the Operator’s website;
  • users of digital services provided by the Operator.
Categories of Personal Data
The Operator may process:
  • technical information provided during website use;
  • information necessary for operation of digital services;
  • information about interactions with online services.
Processing Method
Automated processing of personal data.
Retention Period
For the period necessary to achieve the purposes of processing or for the period established by applicable legislation.
5. LEGAL BASIS FOR PERSONAL DATA PROCESSING
5.1. The Operator processes personal data based on:
  • the Constitution of the Russian Federation;
  • the Civil Code of the Russian Federation;
  • the Labour Code of the Russian Federation;
  • the Tax Code of the Russian Federation;
  • Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data";
  • other regulatory legal acts of the Russian Federation;
  • agreements concluded between the Operator and personal data subjects;
  • consent provided by personal data subjects for the processing of their personal data.
5.2. The Operator processes personal data for the following purposes:
  • compliance with obligations established by the legislation of the Russian Federation;
  • execution of agreements concluded with personal data subjects;
  • provision of hotel and other services;
  • protection of the legitimate interests and rights of the Operator;
  • maintaining communication with customers, guests, employees, and other persons whose personal data is processed.
6. PRINCIPLES OF PERSONAL DATA PROCESSING
The Operator processes personal data based on the following principles:

6.1. Lawfulness and fairness of processing
Personal data processing is carried out on a lawful basis and in accordance with the rights and freedoms of personal data subjects.

6.2. Limitation of processing purposes
Personal data is processed only for specific, predetermined, and legitimate purposes.
Processing of personal data that is incompatible with the purposes of collection is not permitted.

6.3. Data accuracy and relevance
The Operator ensures that processed personal data is accurate, sufficient, and relevant for the stated purposes of processing.
The Operator takes measures to update, correct, or delete inaccurate or unnecessary personal data.

6.4. Storage limitation
Personal data is stored only for the period necessary to achieve the purposes of processing, unless a longer storage period is required by applicable legislation, agreements, or other legal grounds.

6.5. Confidentiality and security
The Operator ensures confidentiality and security of personal data and takes appropriate legal, organizational, and technical measures to protect personal data from unlawful access, modification, disclosure, destruction, or other unauthorized actions.
7. RIGHTS AND OBLIGATIONS OF PERSONAL DATA SUBJECTS AND THE OPERATOR
7.1. Rights of Personal Data Subjects
Personal data subjects have the right to:
  • receive information regarding the processing of their personal data, including information about the purposes, legal grounds, and methods of processing, except where otherwise provided by law;
  • request correction, updating, or completion of their personal data if such data is inaccurate, incomplete, outdated, or unnecessary for the stated purposes of processing;
  • request deletion or blocking of personal data if processing is unlawful or the purposes of processing have been achieved;
  • withdraw consent to the processing of personal data, unless there are other legal grounds for processing;
  • receive information about measures taken by the Operator in response to their requests;
  • protect their rights and legitimate interests through administrative or judicial procedures established by law.
7.2. Obligations of Personal Data Subjects
Personal data subjects shall:
  • provide accurate and complete personal data necessary for the purposes of processing;
  • promptly notify the Operator of any changes to their personal data;
  • provide consent to processing where such consent is required by law;
  • comply with the terms of agreements concluded with the Operator.
7.3. Rights of the Operator
The Operator has the right to:
  • process personal data in accordance with the purposes established by this Policy and applicable legislation;
  • determine the composition of personal data required for achieving processing purposes;
  • request confirmation of the accuracy of personal data provided by personal data subjects;
  • involve third parties in personal data processing where permitted by law and based on appropriate agreements;
  • refuse requests for modification or deletion of personal data where there are legal grounds preventing such actions.
7.4. Obligations of the Operator
The Operator shall:
  • process personal data in accordance with the requirements of applicable legislation of the Russian Federation;
  • use personal data only for the purposes for which it was collected;
  • ensure confidentiality of personal data;
  • prevent unauthorized access, disclosure, modification, blocking, copying, distribution, or destruction of personal data;
  • take necessary legal, organizational, and technical measures to protect personal data;
  • respond to requests from personal data subjects within the time limits established by law.
8. MEASURES TO ENSURE PERSONAL DATA SECURITY
8.1. When processing personal data, the Operator takes all necessary legal, organizational, and technical measures to ensure the security of personal data and prevent:
  • unauthorized access to personal data;
  • destruction, modification, blocking, copying, or distribution of personal data;
  • other unlawful actions involving personal data.
8.2. The Operator ensures personal data protection through the following measures:
  • identifying threats to the security of personal data during processing;
  • assessing the effectiveness of measures taken to protect personal data;
  • implementing organizational and technical measures to ensure personal data security;
  • restricting access to personal data only to employees and authorized persons who require such access for their duties;
  • maintaining records of actions performed with personal data;
  • detecting and preventing unauthorized access to personal data;
  • restoring personal data that has been modified or destroyed due to unauthorized access;
  • establishing internal procedures and rules for employees involved in personal data processing.
8.3. Employees and other persons authorized by the Operator who have access to personal data must maintain confidentiality and must not disclose personal data to third parties without legal grounds.
9. PROCESSING OF PERSONAL DATA THROUGH THE WEBSITE
9.1. When users visit the Operator’s website https://6-12-24.ru-eng/, personal data may be processed for the purposes of:
  • providing website functionality;
  • processing requests submitted through online forms;
  • managing reservations;
  • providing information about Hotel services;
  • maintaining communication with users.
9.2. The Operator may process information provided by users through:
  • reservation forms;
  • feedback forms;
  • requests sent through communication channels;
  • other website services.
Such information may include:
  • full name;
  • telephone number;
  • email address;
  • reservation details;
  • information provided in the user’s request.
9.3. The Operator uses received personal data only for the purposes specified in this Policy and does not process personal data in ways incompatible with the purposes of its collection.
10. TRANSFER OF PERSONAL DATA TO THIRD PARTIES
10.1. The Operator may transfer personal data to third parties only when there are legal grounds for such transfer.
Such grounds may include:
  • consent of the personal data subject;
  • requirements established by the legislation of the Russian Federation;
  • execution of agreements concluded with personal data subjects;
  • protection of legitimate interests and rights of the Operator.
10.2. Personal data may be transferred to:
  • organizations providing services to the Operator under contractual arrangements;
  • payment service providers and banks;
  • contractors and counterparties involved in providing services;
  • information systems and software providers used by the Operator;
  • government authorities and other organizations where required by law.
10.3. When transferring personal data, the Operator ensures that recipients of personal data comply with confidentiality requirements and implement appropriate measures to protect personal data.

10.4. The Operator does not transfer personal data to third parties without the consent of the personal data subject, except where such transfer is permitted or required by applicable legislation.
11. CROSS-BORDER TRANSFER OF PERSONAL DATA
11.1. Before carrying out cross-border transfer of personal data, the Operator ensures that the foreign state to which personal data is transferred provides adequate protection of the rights of personal data subjects.
11.2. Cross-border transfer of personal data may be carried out:
  • with the consent of the personal data subject;
  • for the purpose of execution of agreements concluded with the personal data subject;
  • in other cases established by the legislation of the Russian Federation.
11.3. The Operator takes necessary measures to ensure confidentiality and security of personal data transferred outside the Russian Federation.
12. PROCESSING OF PERSONAL DATA IN INFORMATION SYSTEMS
12.1. The Operator processes personal data using information systems designed for the collection, storage, updating, use, and protection of personal data.

12.2. Access to personal data stored in information systems is granted only to employees and authorized persons of the Operator who require such access to perform their professional duties.

12.3. The Operator ensures:
  • identification and authentication of users who access information systems containing personal data;
  • protection of information systems from unauthorized access;
  • control and recording of actions performed with personal data;
  • backup and recovery of personal data where necessary;
  • implementation and maintenance of up-to-date security measures.
13. STORAGE AND DESTRUCTION OF PERSONAL DATA
13.1. The Operator stores personal data for the period necessary to achieve the purposes of processing, unless another storage period is established by:
  • applicable legislation of the Russian Federation;
  • agreements concluded with personal data subjects;
  • consent of personal data subjects;
  • other legal grounds.
13.2. Personal data shall be deleted or anonymized when:
  • the purposes of processing have been achieved;
  • the retention period has expired;
  • the personal data subject withdraws consent and there are no other legal grounds for processing.
13.3. Destruction of personal data is carried out in a manner that prevents further restoration or unauthorized use of such data, unless otherwise provided by applicable legislation.
14. FINAL PROVISIONS
14.1. The Operator may amend or supplement this Personal Data Processing Policy.
The updated version of the Policy becomes effective from the moment it is published on the Operator’s website unless another effective date is specified in the updated version.

14.2. The current version of this Personal Data Processing Policy is available on the website: https://6-12-24.ru-eng/

14.3. If any provision of this Policy is recognized as invalid or unenforceable, this shall not affect the validity of other provisions of the Policy.

14.4. For matters not regulated by this Policy, the Operator and personal data subjects shall be guided by the applicable legislation of the Russian Federation.
15. OPERATOR DETAILS
OOO "AEROHOTEL"
Legal address:
101 Mozzherina Avenue, Building 1,
Ob, Novosibirsk Region,
633 102, Russian Federation
TIN: 5 410 092 685
PSRN: 1 225 400 005 687