Personal Data Processing Policy of "Scan-City" LLC (BRAVO Telecom) (edition of 06.10.2026)

1. 1. General provisions
2. 2. Terms
3. 3. Legal grounds for processing
4. 4. Purposes of processing, categories of subjects and data
5. 5. Procedure and conditions of processing
6. 6. Website, Customer Account and cookies
7. 7. Retention periods and destruction
8. 8. Rights of personal data subjects
9. 9. Personal data protection measures
10. 10. Final provisions and contacts

1. General provisions

1.1. This Policy determines how "Scan-City" LLC (ООО "Скан-Сити") (commercial designation "BRAVO Telecom", hereinafter the Operator) processes and protects personal data. The Policy is issued in pursuance of Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter Law No. 152-FZ).

1.2. Personal data operator:

1.3. The Policy applies to all personal data that the Operator receives from subscribers, their representatives, users of services, visitors to the website bravotele.com and the Customer Account abonent.bravotele.com (additional addresses (mirrors) - yotele.com and abonent.yotele.com), counterparties, employees and job candidates, with or without the use of automation tools.

1.4. The Policy is published in free access on the Operator's website at https://bravotele.com/dokumenty/ and is valid indefinitely until replaced by a new edition.

1.5. The Operator processes personal data lawfully and fairly, only for predetermined purposes, to the extent necessary for these purposes, and no longer than the purposes or the law require (Article 5 of Law No. 152-FZ). The Operator observes the secrecy of communications (Article 63 of the Federal Law "On Communications").

2. Terms

2.1. In the Policy, terms are used in the meanings established by Article 3 of Law No. 152-FZ, with the clarifications below.

• Personal data - any information relating directly or indirectly to an identified or identifiable individual (personal data subject).
• Processing - any action with personal data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, destruction.
• Subscriber - an individual or legal entity, or a sole proprietor, who has concluded a contract for the provision of communication services with the Operator.
• User - an individual who uses communication services from the equipment of a subscriber that is a legal entity or sole proprietor (clause 35(z) of the Rules for Rendering Telematic Communication Services, approved by Resolution of the Government of the Russian Federation No. 2607 of 31.12.2021).
• Website - https://bravotele.com. Customer Account - https://abonent.bravotele.com, the section for subscribers: balance, payment, plan, services.
• Cookies - small files that the website stores in the visitor's browser.

3. Legal grounds for processing

3.1. The Operator processes personal data on the basis of:

• Federal Law No. 126-FZ of 07.07.2003 "On Communications", including Articles 44, 53, 63, 64;
• the Rules for Rendering Telematic Communication Services and the Rules for Rendering Data Transmission Communication Services (approved by Resolutions of the Government of the Russian Federation No. 2607 and No. 2606 of 31.12.2021);
• Law No. 152-FZ;
• the Civil, Tax and Labor Codes of the Russian Federation, Federal Law No. 402-FZ of 06.12.2011 "On Accounting";
• the Operator's licenses and the Charter of "Scan-City" LLC;
• contracts for the provision of communication services, including those concluded by joining the Rules for Communication Services of BRAVO Telecom, and other contracts to which the subject is a party;
• the subject's consent to personal data processing - in cases where it is required. Consent is executed as a separate document (Part 1 of Article 9 of Law No. 152-FZ); the form is posted on the page https://bravotele.com/dokumenty/soglasie/.

3.2. The subject's consent is not required for the performance of a contract to which the subject is a party or for the fulfillment of the Operator's obligations under the law (paragraphs 2, 5 of Part 1 of Article 6 of Law No. 152-FZ). The Operator processes the personal data of a subscriber who is an individual, to the extent of Article 53 of the Federal Law "On Communications", without the subscriber's consent for settlements for services and consideration of claims; for other purposes - with written consent.

4. Purposes of processing, categories of subjects and data

4.1. The Operator processes personal data only for the purposes listed in the table. The Operator does not process special categories of personal data (beliefs, nationality, etc.) or biometric personal data. Health information is processed only in relation to employees and only to the extent expressly provided for by labor legislation (sick leave certificates, medical examinations), on the basis of paragraph 2.3 of Part 2 of Article 10 of Law No. 152-FZ; health information of job applicants is not requested.

5. Procedure and conditions of processing

5.1. The Operator processes personal data with the use of automation tools (automated settlement system, Customer Account, accounting systems) and without them (paper contracts and applications). The Operator does not make decisions that give rise to legal consequences based solely on automated processing (Article 16 of Law No. 152-FZ).

5.2. Localization. Recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of Russia are carried out in databases located in the territory of the Russian Federation (Part 5 of Article 18 of Law No. 152-FZ). The Operator's servers are located in Khabarovsk.

5.3. Cross-border transfer of personal data is not carried out. If it becomes necessary, the Operator will notify Roskomnadzor in advance, fulfill the other requirements of Article 12 of Law No. 152-FZ and amend the Policy.

5.4. Transfer to third parties. The Operator does not sell personal data and does not transfer it for advertising. Data is transferred only to the extent necessary for the purpose:

5.5. If the Operator entrusts processing to another person, a contract (instruction) is concluded with that person containing the conditions of Part 3 of Article 6 of Law No. 152-FZ: the list of actions and purposes, the obligation to maintain confidentiality and protection measures. The Operator bears responsibility to the subject.

5.6. The Operator does not disseminate personal data to an unlimited number of persons (Article 10.1 of Law No. 152-FZ).

6. Website, Customer Account and cookies

6.1. The website bravotele.com uses the web analytics service Yandex Metrica ("YANDEX" LLC) and its cookies only with the visitor's consent. The counter is loaded after clicking "Accept" in the cookie notice. If the visitor clicked "Decline" or made no choice, the counter is not loaded and its cookies are not set; the website remains fully functional.

6.1.1. Yandex Metrica is used only for aggregated visit statistics: how many visitors come to the website, from which sources, which pages they view, from which devices. Recording of visitor actions (Webvisor) and the click map are not used. No advertising systems or advertising cookies are installed on the website.

6.1.2. Consent can be withdrawn at any time via the link "Withdraw cookie consent" at the bottom of any page of the website. After withdrawal, the counter is disabled, and Yandex Metrica cookies and data are deleted from the visitor's browser. The choice can also be changed via the link "Cookie settings". The visitor's choice is stored only in their browser and is not transferred to the Operator.

6.1.3. Speed test. The "Speed test" page runs a test to the Operator's server in Khabarovsk (st.bravotele.com). When the test is run, the Operator's server receives the visitor's IP address and browser information and saves them together with the test result and test time in a log accessible only to the Operator's employees, for checking the quality of communications and considering requests. Records are kept for 90 days and deleted automatically. No third-party services are used during the test, and no cookies are set. The history of their own tests, which the visitor sees under the test, is stored only in their browser.

6.2. The Customer Account abonent.bravotele.com uses only strictly necessary cookies - for logging in with a login and password and maintaining the session. The account cannot work without them; analytics and advertising cookies are not used. The visitor can block or delete cookies in the browser settings; in this case, logging in to the Customer Account is impossible, but services can be paid for without logging in - through the payment system using the personal account number.

6.3. When the website and the Customer Account are accessed, the web server automatically records in a log the IP address, date and time, the requested page and browser information. The logs are used only to ensure operability and protection against attacks and are kept for no more than 30 days.

6.4. The "Write to us" form. The website has a feedback form. It requests only a name, phone and (or) e-mail, connection address (optional) and the message text. The message is sent only when the consent box is checked, which is not checked by default (the consent form is on the page https://bravotele.com/dokumenty/soglasie/#forma). The message is received by the server of the Operator's website in Khabarovsk and within a few minutes forwarded to the Operator's mailbox khabnet@mail.ru (servers in Russia); it is not stored on the website server after forwarding. Messages are kept for 3 years (section 4). The form does not use cookies or third-party services (including foreign "captchas"); protection against automated submissions is performed by the website server.

6.5. Connections to the website and the Customer Account are protected by encryption (HTTPS). The rules for using the Customer Account are established by the User Agreement (https://bravotele.com/dokumenty/soglashenie-lk/).

7. Retention periods and destruction

7.1. Personal data is stored in a form that allows the subject to be identified no longer than required by the purposes of processing, unless another period is established by federal law or contract (Part 7 of Article 5 of Law No. 152-FZ). The periods for each purpose are specified in section 4.

7.2. Information about subscribers and the communication services rendered to them is stored within the periods established by Article 64 of the Federal Law "On Communications" and acts of the Government of the Russian Federation adopted in accordance with it. Primary accounting documents - 5 years (Federal Law No. 402-FZ "On Accounting").

7.3. Personal data is destroyed or depersonalized:

• upon achievement of the purpose of processing or loss of the need for it - within 30 days (Part 4 of Article 21);
• upon withdrawal of consent, if there is no other lawful ground for processing - within 30 days (Part 5 of Article 21);
• upon detection of unlawful processing that cannot be remedied - within 10 working days (Part 3 of Article 21);
• at the subject's request to stop processing - within 10 working days; the period may be extended by no more than 5 working days with a reasoned notice (Part 5.1 of Article 21).

7.4. If it is impossible to destroy the data within the specified period, the Operator blocks it and destroys it within a period of no more than 6 months (Part 6 of Article 21).

7.5. Paper media are destroyed by shredding, electronic data - by deletion without the possibility of recovery; in backup copies, data is deleted during their scheduled rotation. Destruction is confirmed by an act and an extract from the event log in accordance with the requirements of Roskomnadzor Order No. 179 of 28.10.2022.

8. Rights of personal data subjects

8.1. The subject has the right to:

• receive information about the processing of their personal data to the extent of Part 7 of Article 14 of Law No. 152-FZ;
• demand clarification, blocking or destruction of data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to processing;
• appeal against the Operator's actions to Roskomnadzor (rkn.gov.ru) or in court;
• demand compensation for losses and compensation for moral damage in court.

8.2. A request is sent in writing to the Operator's address or in the form of an electronic document signed with an electronic signature. The request must contain the number of the main identity document of the subject or their representative, information confirming the relationship with the Operator (contract or personal account number), and a signature (Part 3 of Article 14). The response is given free of charge within 10 working days from the date of receipt of the request; the period may be extended by no more than 5 working days with a reasoned notice (Part 1 of Article 20).

8.3. After consent is withdrawn, the Operator may continue processing if there are other grounds for it under paragraphs 2-11 of Part 1 of Article 6 of Law No. 152-FZ, for example performance of a contract for the provision of communication services or of obligations established by communications legislation.

8.4. The right of access to personal data may be restricted in the cases provided for by Part 8 of Article 14 of Law No. 152-FZ.

9. Personal data protection measures

9.1. The Operator takes legal, organizational and technical measures under Articles 18.1 and 19 of Law No. 152-FZ:

• the person responsible for organizing personal data processing is appointed by order of the General Director; until another person is appointed, the duties are performed by the General Director;
• local acts on personal data processing have been approved, and employees have been familiarized with them against signature;
• a harm assessment has been carried out in accordance with Roskomnadzor Order No. 178 of 27.10.2022, and threats and the security level of information systems have been determined in accordance with Resolution of the Government of the Russian Federation No. 1119 of 01.11.2012;
• only employees who need access to perform their duties have access to the data; actions in the billing system and the customer account are logged;
• firewalling, anti-virus protection, backup, and encryption of communication channels (HTTPS/TLS) are used;
• servers are located in a guarded room with restricted access;
• records of machine media are kept and periodic internal control is carried out.

9.2. In the event of unlawful or accidental transfer of personal data that has resulted in a violation of the rights of subjects, the Operator notifies Roskomnadzor within 24 hours of the incident and within 72 hours of the results of the internal investigation (Part 3.1 of Article 21). The Operator interacts with GosSOPKA (the State System for Detection, Prevention and Elimination of Consequences of Computer Attacks) in the manner set out in Part 12 of Article 19.

9.3. Recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation (Part 5 of Article 18).

10. Final provisions and contacts

10.1. The Policy is approved by the General Director of "Scan-City" LLC, enters into force on the date of publication and is valid until replaced by a new edition.

10.2. The Policy is published in free access on the Operator's website: https://bravotele.com/dokumenty/ (Part 2 of Article 18.1). The Operator reviews the Policy when legislation and the procedure for processing personal data change. A new edition enters into force on the date of publication, unless otherwise specified in it.

10.3. Contacts for personal data matters:

10.4. Liability for violation of the requirements of legislation in the field of personal data is established in accordance with the legislation of the Russian Federation, including the Code of Administrative Offenses of the Russian Federation as amended by Federal Law No. 420-FZ of 30.11.2024.

Edition of 06.10.2026.