1. General provisions

1.1. This Personal Data Processing Policy (the “Policy”) sets out the purposes, procedure, and conditions for processing personal data, as well as the measures taken to protect such data. It has been prepared to comply with Part 2 of Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (the “Personal Data Law”).

1.2. The personal data operator is Individual Entrepreneur Stanislav Leonidovich Natapov (the “Operator”), who conducts business under the project name Grand Mission.

1.3. This Policy applies to all personal data the Operator receives from individuals through grand-mission.com (the “Website”), in connection with entering into and performing contracts, and when interacting with counterparties, engaged specialists, and candidates.

1.4. The current version of this Policy is publicly available online at grand-mission.com/privacy.

1.5. Terms used in this Policy have the meanings assigned to them in Article 3 of the Personal Data Law.

2. Operator information

3. Categories of personal data subjects

3.1. The Operator processes the personal data of the following categories of Personal Data Subjects:

• Website visitors who submit an application or other inquiry;

• parents and other legal representatives of participants in the Operator’s programs;

• participants in the Operator’s programs, including minors ages 13 through 17, based on the consent of their legal representatives;

• representatives of the Operator’s counterparties and partners;

• specialists engaged by the Operator to provide services, and candidates for such engagement.

3.2. The Operator does not process the personal data of individuals who do not fall within the categories listed above.

4. Personal data processed

4.1. When forms are completed on the Website, the Operator processes the following data: surname, given name, and patronymic; telephone number; email address; messenger identifier; city; age and school grade or year of study of the program participant; and the content of the inquiry.

4.2. When the Website is used, the following data are automatically recorded in server logs: IP address, browser and device information, and the date and time of access. These data are used solely to maintain the functionality and security of the Website.

4.3. The Website uses only technically necessary cookies that support the operation of forms and retain the selected interface language. The Website does not use web analytics systems, advertising pixels, or other tools that track user behavior. Website visitors are not profiled.

4.4. When entering into and performing a paid services agreement, the Operator processes: the surname, given name, patronymic, and passport details of the customer or legal representative; registered address; banking details to the extent required to execute and perform the agreement; the program participant’s surname, given name, and age; information about the participant’s educational path, interests, and professional preferences; and the results of questionnaires and diagnostic methodologies used.

4.5. The Operator does not process biometric personal data. If meetings are audio- or video-recorded, such recording is carried out on the basis of separate consent from the participant and their legal representative and is not used to establish the identity of the Personal Data Subject.

4.6. Special categories of personal data concerning health are processed solely to the extent contained in the results of diagnostic methodologies used in providing services, and only on the basis of written consent from the Personal Data Subject or legal representative in accordance with Part 2 of Article 10 of the Personal Data Law. Special categories of personal data are not collected through the Website.

4.7. The Operator does not process personal data concerning race or ethnicity, political opinions, religious or philosophical beliefs, or criminal convictions.

5. Purposes and legal bases for processing personal data

5.1. The Operator processes personal data for the following purposes:

Consent of the Personal Data Subject — Point 1, Part 1, Article 6 of the Personal Data Law

Performance of an agreement — Point 5, Part 1, Article 6; consent of the legal representative for a minor’s data

Written consent — Point 1, Part 2, Article 10 of the Personal Data Law

Separate consent — Point 1, Part 1, Article 6 of the Personal Data Law and Part 1, Article 18 of the Federal Law “On Advertising”

Compliance with a legal obligation — Point 2, Part 1, Article 6 of the Personal Data Law

Exercise of the Operator’s rights and legitimate interests — Point 7, Part 1, Article 6 of the Personal Data Law

Consent of the Personal Data Subject — Point 1, Part 1, Article 6 of the Personal Data Law

5.2. The Operator does not process personal data for purposes incompatible with those specified in Clause 5.1 and does not process data in an amount excessive in relation to the stated purposes.

5.3. The Operator does not make decisions that produce legal consequences for a Personal Data Subject or otherwise affect the Subject’s rights and legitimate interests solely on the basis of automated personal data processing.

6. Procedure and conditions for processing personal data

6.1. Personal data are processed using a combination of automated and non-automated means.

6.2. Processing includes the following actions: collection, recording, organization, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (provision or access), anonymization, blocking, deletion, and destruction of personal data.

6.3. The recording, organization, accumulation, storage, clarification, and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation, in accordance with Part 5 of Article 18 of the Personal Data Law.

6.4. The Operator may entrust personal data processing to third parties under agreements that require confidentiality and compliance with data protection requirements. Processing may be entrusted to providers that create, operate, host, and publish the Website; maintain the Operator’s inquiry records and client database; send email and messenger communications; and provide accounting and tax support. All engaged parties are registered in the Russian Federation and process data using databases located in the Russian Federation.

6.5. Personal data of a program participant and their legal representative are provided to specialists engaged by the Operator to deliver services—including a psychodiagnostic specialist, coach, specialist in psychological barriers, body analyst, neuropsychologist, career advisor, and integration methodologist—only to the extent necessary for them to perform their functions and subject to confidentiality obligations.

6.6. The Operator does not sell personal data, transfer such data to third parties for their own purposes, or publish such data in publicly available sources, except where the Personal Data Subject has provided consent to the processing of personal data permitted for dissemination in accordance with Article 10.1 of the Personal Data Law.

6.7. Access to personal data is limited to persons who require such access to perform their assigned duties.

7. Personal data processing and retention periods

7.1. Personal data are processed for the following periods:
Processing period
1 year from the date of the inquiry

For the term of the agreement and 3 years after its performance

3 years after performance of the agreement, unless the Personal Data Subject requests a shorter period

5 years, as required by law

Until the relevant consent is withdrawn

1 year from the date received

No more than 12 months5 years, as required by law

7.2. Once the purposes of processing have been achieved, or if consent is withdrawn or unlawful processing is identified, the personal data must be destroyed within 30 days of the relevant event, unless another period is required by law or contract.

7.3. The destruction of personal data is documented in a destruction report prepared by the Operator in accordance with the requirements established by the competent authority for the protection of Personal Data Subjects’ rights.

8. Processing personal data of minors

8.1. Forms on the Website are intended to be completed by adults. The Operator does not intentionally collect minors’ personal data through the Website.

8.2. The personal data of a program participant under 18 are processed on the basis of consent from the participant’s parent or other legal representative. By submitting an application and entering into an agreement, the legal representative confirms that they have authority to provide such consent for the minor.

8.3. The Operator informs a minor program participant about the purposes and scope of processing their personal data in a manner appropriate to the participant’s age.

8.4. If the Operator learns that a minor’s personal data were obtained without the consent of the minor’s legal representative, processing will cease and the data will be destroyed within 30 days.

9. Cross-border transfers of personal data

9.1. The Operator does not transfer personal data across national borders.

10. Personal data security measures

10.1. The Operator implements the legal, organizational, and technical measures provided for in Articles 18.1 and 19 of the Personal Data Law, including:

• appointing a person responsible for organizing personal data processing;

• issuing documents that establish the Operator’s personal data processing policy;

• familiarizing engaged specialists with personal data laws and the Operator’s internal documents;

• limiting the persons who have access to personal data and defining their authority;

• using a secure HTTPS connection when transmitting data through the Website;

• backing up data and maintaining records of machine-readable personal data storage media;

• conducting internal reviews to confirm that processing complies with applicable law.

10.2. The Operator notifies the competent authority for the protection of Personal Data Subjects’ rights of incidents that result in a violation of such rights within the periods specified in Part 3.1 of Article 21 of the Personal Data Law.

10.3. Persons who obtain access to personal data remain bound by confidentiality obligations after their engagement with the Operator ends.

11. Rights of the personal data subject

11.1. A Personal Data Subject has the right to:

• obtain information concerning the processing of their personal data to the extent provided for in Part 7 of Article 14 of the Personal Data Law;

• request clarification, blocking, or destruction of personal data if the data are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing;

• withdraw consent to the processing of personal data;

• object to the processing of personal data for the purpose of promoting services in the market;

• appeal the Operator’s actions or omissions to the competent authority for the protection of Personal Data Subjects’ rights or in court.

11.2. Requests from a Personal Data Subject may be sent by email to sn@grand-mission.com or in writing to the address specified in Section 2 of this Policy. A request must contain information sufficient to identify the Personal Data Subject, as well as information confirming the Subject’s relationship with the Operator or other information confirming that the Operator processes the Subject’s personal data.

11.3. The Operator reviews a request and responds within 10 business days of receipt. This period may be extended by no more than 5 business days if the Personal Data Subject receives a reasoned notice explaining the extension.

11.4. Consent to personal data processing may be withdrawn by sending the Operator a notice using the methods specified in Clause 11.2. A request to stop receiving informational and promotional messages may also be submitted through a link in the message or by replying to the message.

11.5. Withdrawal of consent does not require the Operator to stop processing personal data where such processing is based on other lawful grounds, including performance of an agreement and compliance with the Operator’s legal obligations.

12. Final provisions

12.1. The Operator may amend this Policy. A new version takes effect when published on the Website unless the new version provides otherwise.

12.2. Previous versions of this Policy are available upon request submitted in accordance with Clause 11.2.

12.3. Matters not addressed by this Policy are governed by the laws of the Russian Federation.