NON-DISCLOSURE AGREEMENT

Annex
to Non-Disclosure Agreement No. ___________ dated __________________, 20__
(Agreement)

ASSIGNMENT FOR PERSONAL DATA PROCESSING (hereinafter, the Assignment)

Unless otherwise stipulated by a separate agreement of the Parties or (in cases determined in accordance with the Assignment) by the instruction of the Disclosing Party, CI containing Personal Data (PD) and known to the Receiving Party shall be processed by the Receiving Party under the conditions set out below in accordance with the requirements of the Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006 (hereinafter, FL on PD).

1.           PD LIST AND METHODS OF PD PROCESSING

Unless otherwise expressly specified by the Disclosing Party, the Disclosing Party (PD Operator) instructs the Receiving Party (the person/entity processing PD on behalf of the PD Operator) to process the following PD categories: last name, first name, patronymic (if any), contact phone numbers, email addresses. The PD list may be specified in the agreement concluded by and between the Parties. PD may be processed using automation means or without using such means, by making the following actions (transactions): collection, recording, systematization, accumulation, storage, specification (updating, change), extraction, use, transfer (provision, access), blocking, deletion, destruction of PD.

2.           PD PROCESSING PURPOSE

Unless otherwise expressly stated by the Disclosing Party, the PD processing purpose in all cases is to ensure cooperation under the Project. The PD processing purposes may be specified in the agreement concluded by and between the Parties.

3.           PD SECURITY ARRANGEMENTS

The Receiving Party shall:

(a)         comply with the principles and rules for PD processing provided for by the FL on PD;

(b)         comply with PD confidentiality and take the necessary legal, organizational and technical measures to protect the PD from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of PD, as well as from other illegal actions against PD. The security of PD during their processing in the personal data information systems of the Receiving Party (hereinafter, PDIS) shall be arranged, inter alia:

·         by determining threats to the PD security during their processing in PDIS;

·         by applying organizational and technical measures to arrange the security of PD during their processing in PDIS that correspond to the security level 3 (or a higher security level, if this is based on the categories of the PD processed, their amount and type of actual threats);

·         by applying means of information protection, compliance of which was properly assessed;

by assessing the efficiency of measures to arrange PD security,

accepted by the Receiving Party prior to the PDIS commissioning;

·         by detecting the facts of unauthorized access to PD and taking measures, including the measures to detect, prevent and eliminate the consequences of computer attacks on PDIS and to respond to computer incidents in them;

·         by restoring modified PD or PD destroyed due to unauthorized access to them;

·         by setting rules for access to PD processed in PDIS, ensuring registration and accounting of all actions performed with PD in PDIS;

·         by ensuring control over the measures taken to arrange the PD security and the level of PDIS security;

(c)         take the measures stipulated by Article 18.1 of the FL on PD;

(d)         provide the Disclosing Party with the documents and other information confirming the acceptance by the Receiving Party of measures and compliance with the obligation to arrange the PD security, as well as the documents confirming the adoption by the Receiving Party of the measures provided for in Article 18.1 of the FL on PD, within five (5) business days upon receipt of the request of the Disclosing Party;

(e)         process PD only using databases located in the territory of the Russian Federation, unless otherwise stipulated by an agreement between the Parties;

(f)           in case of revealing the fact of unauthorized or accidental PD transfer (provision, distribution, access), notify the Disclosing Party about the incident, the alleged reasons that led to violating the rights of the PD subjects, the alleged harm caused to the rights of the PD subjects, the measures taken to eliminate the consequences of the incident no later than twelve (12) hours upon its detection, as well as notify the Disclosing Party of the results of the internal investigation conducted by the Receiving Party in regard of the incident detected and provide information about the persons whose actions caused the incident detected (if such information is available) within forty-eight (48) hours upon its detection.

4.           PD PROCESSING PROCEDURE

4.1.      Upon receipt from the authority for the protection of rights of PD subjects, another public authority or court of a request for information on processing the PD of a particular PD subject or upon receipt from the PD subject (his/her representative) of a request for information on PD processing, withdrawal of consent to PD processing, demand to stop PD processing, the Receiving Party shall send a copy of the received request (review, demand) to the Disclosing Party within two (2) business days upon receipt of the request (review, demand).

4.2.      Upon receipt of a request (communication) from a PD subject (his/her representative) or the authority for the protection of rights of PD subjects containing information about unauthorized PD processing or the PD incompleteness, inaccuracy or obsolete state, the Receiving Party shall:

(a)         block the PD specified in the request (communication) once such a request (communication) is submitted until further instructions from the Disclosing Party;

(b)         send a copy of the received request (appeal) to the Disclosing Party within two (2) business days upon receipt of the request (appeal).

4.3.      The Receiving Party shall ensure blocking, update or destruction of PD based on the relevant request (instruction) made by the Disclosing Party within the time frames established in such instruction, as well as in other cases in accordance with the legislation of the Russian Federation.

4.4.      The Receiving Party agrees to immediately discontinue processing PD and/or ensure the processing cessation (if the PD processing is carried out by a third party acting on behalf of the Receiving Party) upon the occurrence of either event specified in cl. 4.5 of the Assignment.

4.5.      The Receiving Party undertakes to process PD until the Agreement is expired and/or until one of the following events, whichever comes earlier, unless it contradicts the legislation of the Russian Federation:

(a)     receipt by the Receiving Party from the Disclosing Party of a notice of the need to discontinue processing PD;

(b)     achievement by the Receiving Party of the PD processing objective or loss of the necessity in achieving such an objective;

(c)         termination of the Agreement.

4.6.      The Receiving Party undertakes to destroy PD and/or ensure the destruction thereof (if the PD processing is carried out by a third party acting on behalf of the Receiving Party) within the following time frames:

(a)         within the time frames specified in the notice of the need to discontinue processing the PD belonging to PD subjects sent by the Disclosing Party to the Receiving Party;

(b)         within thirty (30) days upon achieving by the Disclosing Party of the personal data processing objective, upon termination of the Agreement on any grounds or upon termination of the respective instructions of the Disclosing Party.

4.7.      The Disclosing Party guarantees to the Receiving Party the presence of the corresponding legal grounds for transferring PD and/or entrusting the PD processing to the Receiving Party. The Disclosing Party undertakes to ensure that the Receiving Party has no claims (demands) related to unauthorized PD processing. In case of violation of the said guarantee, the Disclosing Party shall indemnify the Receiving Party for the losses incurred.

4.8.      The Receiving Party is entitled to engage third parties in executing the Assignment provisions only with the consent of the Disclosing Party.

4.9.      If a third party is engaged in the fulfillment of the Assignment by the Receiving Party, the Receiving Party shall include into contracts with such a third party the terms and requirements for processing PD similar to those specified herein. In this case, the Receiving Party shall be liable for any actions committed by such third parties due to non-fulfillment of the terms and requirements for PD processing, regardless of the availability of such terms and requirements in the contract between the Receiving Party and the third party.

4.10.  The Disclosing Party shall be entitled to give the Receiving Party binding instructions to execute the provisions of the Assignment, while the Receiving Party undertakes to execute them in full.

4.11.  Any actions beyond the Assignment and/or beyond the allowed in accordance with the legislation of the Russian Federation on PD shall be considered to be carried out by the Receiving Party independently and at its own risk.

SIGNATURES OF REPRESENTATIVES OF THE PARTIES:

On behalf of the Partner                                           On behalf of Company Bronevik LLC

Annex
to Non-Disclosure Agreement No. ___________ dated __________________, 20__
(Agreement)

GENERAL TERMS

1.           These General Terms are an integral part of the Agreement and are to be read in conjunction with it.

2.           DEFINITIONS AND INTERPRETATION

2.1.      Capitalized terms and abbreviations used in the Agreement, including these General Terms and all other Annexes thereto, shall have the meanings below, unless the context clearly indicates otherwise.

Subsidiary shall mean any legal entity in which an individual or legal entity (or its subsidiary) directly or indirectly owns shares (stakes) in the authorized capital.

Insider Information or II shall mean information that, in relation to the Disclosing Party, is insider information as this term is defined in Article 3 of Federal Law dated 27.07.2010 No. 224-FZ “On Countering the Misuse of Insider Information and Market Manipulation and on Amending Certain Legislative Acts of the Russian Federation”.

Confidential Information or CI shall mean information, documents or materials in any form and on any media that relate to the Disclosing Party or the Project and that are marked as CI by the Disclosing Party (by marking “Confidential” or “Trade Secret”) while:

(b)         the information independently generated by the Receiving Party (including with its participation) on the basis of the received CI shall be considered as CI of the Disclosing Party;

(c)         the term “CI” shall not include information that:

                                  (i)            was or became publicly available other than as a result of its disclosure by the Receiving Party;

                                 (ii)            was already held by the Receiving Party, provided that the Receiving Party is not aware that this information was or could have been the subject matter of a non-disclosure agreement between the Disclosing Party and a third party;

                                (iii)            became available to the Receiving Party from publicly available sources, provided that the Receiving Party was not aware that this source had non-disclosure obligations to the Disclosing Party; or

                               (iv)            is classified as information, access to which cannot be restricted, in accordance with the legislation of the Russian Federation;

(d)         regardless of other provisions of these General Terms, the CI of Company Bronevik LLC shall be deemed:

(i)     the information about the persons/entities who have entered into contracts, agreements with Company Bronevik LLC, as well as other information about transactions and services rendered by Company Bronevik LLC, which became known to Company Bronevik LLC as a party to the service agreement by virtue of the service agreement and subject to protection in accordance with the legislation of the Russian Federation on Personal Data.

Personal Data (PD) shall mean any information directly or indirectly related to a defined or determined individual (PD subject).

Transfer of CI shall mean the transfer or otherwise provision of the Disclosing Party’s CI to the Receiving Party or any third parties.

Disclosing Party shall mean the Party to the Agreement that transfers or otherwise provides CI to the other Party.

Receiving Party shall mean the Party to the Agreement that receives CI from the other Party.

Representatives, in relation to the Disclosing Party, the Receiving Party and any other individuals/entities, shall mean their subsidiaries, contractors, subcontractors, agents, representatives, counterparties or consultants and/or affiliates, as well as directors, officers, employees, agents, consultants, lawyers, accountants and auditors of all of the above individuals/entities.

Disclosure shall mean the placement of information in publicly available sources and/or the provision of public access to information as required by the applicable law.

2.2.      In these General Terms:

(a)         references to each of the Parties include a reference to its Representatives, unless the context clearly implies otherwise;

(b)         the term “individual/entity” shall be interpreted broadly, including the mass media, any entity or individual.

3.           CONFIDENTIALITY MODE

3.1.      Purpose of Using and Obligations to Maintain the Confidentiality of CI

(a)         The Receiving Party undertakes and guarantees that the Disclosing Party’s CI will be used by it only for the purpose of cooperation under the Project.

(b)         The Receiving Party undertakes not to transfer or disclose the Disclosing Party’s CI, as well as information on the fact of cooperation under the Project, to any individuals/entities without the prior written consent of the Disclosing Party, except for the permitted transfer and disclosure of CI in accordance with this Agreement.

(c)         The Receiving Party undertakes to maintain the confidentiality of CI, regardless of whether the Parties decide on the implementation of the Project.

3.2.      Transfer of CI

(a)         The Disclosing Party shall transfer CI to the Receiving Party in any of the following ways:

                                  (i)            CI transfer as hard copy;

                                 (ii)            file sharing using the MTS PJSC resource “Nextcloud Secure Cloud Storage of MTS PJSC” https://nextcloud.mts.ru via HTTPS protocol;

                                 (iii)           transfer by e-mail to the addresses of authorized persons of the Parties specified in Clause 5 of the Agreement or to the addresses located in corporate domains of the Parties while using at least v1.2 TLS protocol on such corporate mail servers. The Parties acknowledge the use of at least v1.2 TLS protocol on corporate mail servers by default to exchange CI by e-mail;

                               (iv)            CI transfer by additional electronic channels specified in the Annex “Additional Electronic Channels for CI Transfer” (if such an Annex exists, otherwise this sub-clause is not applicable).

(b)         Party 2 is entitled to offer to use other methods of transferring its CI, if Party 1 has the technical ability for CI receipt.

(c)         The Receiving Party shall to sign the CI Transfer and Acceptance Certificate(s) between the Parties in the form of an Annex to the Agreement, as requested by the Disclosing Party. The Disclosing Party is entitled to refuse to transfer the CI if the Receiving Party refuses to sign the Transfer and Acceptance Certificate.

(d)         For the avoidance of doubt, the Receiving Party undertakes to comply with these General Terms in terms of the received CI, even if the Transfer and Acceptance Certificate regarding such CI has not been signed by the Parties.

3.3.      Non-Transfer of Rights to CI

The conclusion of the Agreement and/or the transfer of CI to the Receiving Party shall not be treated as transferring or granting to it of any rights related to a trade secret, production secret (know-how), copyright or other rights to CI.

3.4.      Return of CI

(a)         Within ten (10) business days from the date of receipt of the written request from the Disclosing Party (depending on its content), the Receiving Party shall:

                                  (i)            return to the Disclosing Party the received media with CI in the same form (including all copies on any media) in which the relevant CI was provided by the Disclosing Party; and/or

                                 (ii)            completely destroy documents and files, as well as their copies on any media and any other records held by it and/or created (copied) by the Receiving Party using or based on the Disclosing Party’s CI, to the point of being unrecoverable and notify the Disclosing Party thereof.

(b)         Notwithstanding any other provisions hereof, the Receiving Party and the individuals/entities that were provided by the Receiving Party with the Disclosing Party’s CI in accordance herewith shall be entitled to keep backup or automatically created archive electronic copies of CI which extraction and destruction will require disproportionate costs to be incurred by the Receiving Party, unless otherwise provided by the applicable law.

3.5.      Information Security Measures

(a)         To ensure the safety of the Disclosing Party’s CI, the Receiving Party undertakes to take all measures that comply with the requirements of the RF legislation, the Agreement and the procedures provided for by the Disclosing Party to ensure the safety of CI. Such measures shall exclude the possibility of access by any third parties and unauthorized persons of the Receiving Party to the Disclosing Party’s CI.

(b)         The Disclosing Party has the right to request information from the Receiving Party about the measures taken by the Receiving Party to ensure the confidentiality of the Disclosing Party’s CI.

(c)         If the Receiving Party fails to provide comprehensive information (certified by an authorized employee of the Receiving Party) on the measures taken to protect the CI, the Disclosing Party shall be entitled to:

                                  (i)            demand the immediate return and/or destruction of all CI previously transferred to the Receiving Party;

                                 (ii)            refuse further CI transfer; and/or

                                (iii)            immediately terminate the Agreement, and the Receiving Party shall immediately ensure proper implementation of any of the requirements above.

4.           NOTIFYING ON VIOLATIONS

4.1.      The Receiving Party undertakes to notify the Disclosing Party on receipt of information of a violation of the Agreement terms committed by the Receiving Party and/or its Representatives and to provide assistance in mitigating damage from such a violation.

4.2.      Notifying in accordance with this clause 4 shall be made by the Receiving Party in writing to the electronic address of the Disclosing Party specified in clause 5 of the Agreement and within a period not exceeding three (3) business days from the moment when the Receiving Party learned about the fact of violation and/or alleged violation of the Agreement, unless otherwise provided for in the Agreement.

4.3.      Any notice of the Receiving Party shall contain detailed information about the violation of obligations for keeping CI safe, as well as a list of measures taken by the Receiving Party in order to mitigate the damage from such a violation.

5.           INSIDER INFORMATION

5.1.      In the event that either Party gains access to II of the other Party, the Party that has gained such access undertakes to comply with the requirements of the RF legislation on countering the misuse of II, as well as not to use II:

(a)         to execute transactions with financial instruments, foreign currency and/or goods, works, services of concern of the II, at their own expense or at the expense of a third party, except for such transactions, in regard of which the execution obligation arose before the person/entity learned about the II;

(b)         by transferring II to a third party, except for the cases when such information was transferred to a person/entity, included in the list of insiders due to the execution of obligations set forth by the federal laws or due to the execution of labor obligations or execution of an agreement; and

(c)         by providing recommendations to third parties, i.e. obligating or otherwise making them acquire or sell financial instruments, foreign currency and/or goods, works, services.

5.2.      The Parties acknowledge that non-listing of either Party as an insider of the other Party shall not be deemed to be a circumstance that allows the misuse of the other Party’s II or a justification for the misuse of the other Party’s II.

6.           PERSONAL DATA

The Parties acknowledge that CI may contain PD and undertake to comply with all requirements of the RF legislation on PD regarding the processing of any PD contained in CI, including not to transfer and/or disclose, without the prior written consent of the Disclosing Party, PD of employees and officers of the Disclosing Party, as well as other individuals, which became known to the Receiving Party from CI, except for the provision of such PD to its employees in a confidential manner and only for them to perform their official duties in connection with the fulfillment of obligations of the Receiving Party under the Agreement or in connection with it.

7.           NOTICES

7.1.      Any notice or other official communication submitted under the Agreement shall be:

(a)         drawn up in writing and signed by the sending Party;

(b)         addressed to the corresponding Party;

(c)         served or delivered against receipt, with the postage prepaid, delivered by express courier service, registered mail to the appropriate addresses, by e-mail or through one of the communication channels specified in the Agreement.

7.2.      Any notice pursuant to the Agreement shall be deemed to have been duly communicated:

(a)         if delivered by hand or by registered mail, once delivered;

(b)         if sent by e-mail, once the earlier of the following occurs:

                                  (i)            when the recipient’s mail server creates an automatic delivery confirmation message;

                                 (ii)            at the time of confirmation of receipt by the addressee; or

                                (iii)            24 hours after sending the message, if the sender does not receive a notification about any errors in e-mail delivery, besides, if the expected receipt takes place before 09:00 on a business day, it shall be considered to have occurred at 09:00 on that day and if the expected receipt takes place after 17:00 on a business day or on a non-business day, it shall be considered to have occurred at 17:00 on the next business day.

7.3.      Any notices of the Parties shall be addressed to the contact details of the authorized persons of the Parties specified in Clause 5 of the Agreement or to such other persons whose contact details will be communicated by the authorized persons of the Parties to each other in writing (including by e-mail).

7.4.      Either Party shall be entitled to notify the other Party of a change in its name, details, other data or address for the purposes hereof, and such notice shall be valid:

(a)         on the date specified in the notice, but not earlier than ten (10) calendar days upon sending of the corresponding notice; or

(b)         if no date is specified, on the date coming arriving ten (10) calendar days upon sending of the corresponding notice.

8.           CONTACT PERSONS

Each of the Parties undertakes not to contact the employees of the other Party in relation to CI without prior notice to the other Party, except for the duly authorized Representatives who are directly involved in cooperation under the Project.

9.           TRANSFER OF RIGHTS

Neither Party shall be entitled to transfer its rights and obligations hereunder to any third parties without the prior written consent of the other Party.

10.        AMENDMENTS

Any amendments and supplements hereto shall be valid only if made in writing and duly signed by both Parties.

11.        RELEASE FROM LIABILITY AND WARRANTIES

The Receiving Party shall agree that the Disclosing Party hereby does not guarantee that the transferred CI is complete and reliable.

12.        INVALIDITY OF CERTAIN PROVISIONS AND PREVALENCE OF THE TERMS AND CONDITIONS OF THE AGREEMENT

12.1.  If any provision of the Agreement is found by a court of competent jurisdiction to be invalid and legally unenforceable, this shall not affect or terminate the validity and enforceability of the remaining provisions hereof in any way.

If the provisions hereof conflict with the provisions of other agreements between the Parties, the relevant provisions hereof shall prevail over other agreements between the Parties with regard to the relations, rights and obligations of the Parties under the Project, unless such other agreements expressly provide for amendments to be made hereto.

************************************************ End of the Document ***********************************************