1. General provisions

This Personal Data Processing Policy is created in compliance with the requirements of the Personal Data Law and outlines the procedures for handling personal data and the security measures taken by CBGA as the Operator.

1.1. The Operator prioritizes the protection of individual rights and freedoms in the processing of personal data, including privacy, personal, and family secrets.

1.2. This Policy applies to all information received by the Operator from visitors of the website investor-visa-canada.com.

2. Basic concepts used in the Policy

2.1. Automated processing of personal data refers to the use of computer technology to handle personal data.

2.2. Blocking of personal data is the temporary cessation of processing personal data, except when processing is required for data clarification purposes.

2.3. The Website refers to a collection of graphics, information materials, computer programs, and databases that are accessible on the Internet at the network address investor-visa-canada.com.

2.4. Personal data information system includes personal data stored in databases, as well as the information technologies and technical means used to process them.

2.5. Depersonalization of personal data is the process that removes the ability to identify the ownership of personal data to a specific User or subject without additional information.

2.6. Personal data processing encompasses any actions performed with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, depersonalization, blocking, deletion, and destruction of personal data.

2.7. The Operator refers to a government body, municipal body, legal entity, or individual who independently or jointly with others organizes and/or processes personal data, and determines the purposes, composition, and actions performed with personal data.

2.8. Personal data includes any information directly or indirectly related to a specific or identifiable User of the Website investor-visa-canada.com.

2.9. Personal data authorized by the subject for distribution refers to personal data to which an unlimited number of individuals have access, with consent given by the subject of the data in accordance with the procedures outlined in the Personal Data Law.

2.10. A User is any visitor of the website investor-visa-canada.com/.

2.11. Provision of personal data involves actions aimed at disclosing personal data to specific individuals or groups.

2.12. Dissemination of personal data includes actions aimed at disclosing personal data to an indefinite number of individuals, including transferring personal data, making personal data available to an unlimited number of individuals, publishing personal data in the media, or placing personal data in information and telecommunications networks.

2.13. Cross-border transfer of personal data refers to the transfer of personal data to the territory of a foreign state, to the authority of a foreign state, or to a foreign individual or legal entity.

2.14. Personal data destruction refers to actions that permanently destroy personal data, making it impossible to restore the content of the data in the personal data information system and/or the physical carriers of the data.

3. Basic rights and obligations of the Operator

3.1. The Operator has the following rights:

— Receive accurate information and/or documents containing personal data from the data subject.

— Continue processing personal data without the consent of the data subject if there are legal grounds specified in the Personal Data Law, even if the data subject withdraws their consent to processing.

— Independently determine the necessary measures to fulfill obligations outlined in the Personal Data Law and accompanying regulatory acts, unless otherwise stipulated by the law.

3.2. The Operator is obligated to:

— Provide the data subject with information concerning the processing of their personal data upon request.

— Conduct personal data processing in accordance with the relevant legislation of the Canada.

— Respond to requests and inquiries from data subjects and their legal representatives in compliance with the requirements of the Personal Data Law.

— Supply the necessary information to the authorized body responsible for protecting the rights of data subjects within 30 days of receiving a request from that body.

— Publish or ensure unrestricted access to this Personal Data Processing Policy.

— Take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other illegal actions.

— Cease the transfer, processing, and destroy personal data as specified by the Personal Data Law.

— Fulfill other duties stipulated by the Personal Data Law.

4. Basic rights and obligations of data subjects

4.1. Data subjects have the right to:

— Obtain information regarding the processing of their personal data, except in cases provided for by federal laws. The Operator should provide this information to the data subject in an accessible format, avoiding disclosure of personal data related to other individuals, unless there are legal grounds for such disclosure. The list and procedure for obtaining this information are established by the Personal Data Law.

— Request the Operator to clarify, block, or destroy their personal data if the data is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purpose of processing. Data subjects can also take legal measures to protect their rights.

— Require prior consent for the processing of personal data for marketing purposes.

— Revoke consent for the processing of personal data.

— File complaints with the authorized body responsible for protecting the rights of data subjects or seek legal action against the Operator for illegal actions or inaction regarding the processing of their personal data.

— Exercise other rights as provided by the legislation of the Canada.

4.2. Data subjects are obligated to:

— Provide the Operator with accurate personal data.

— Inform the Operator of any changes or updates to their personal data.

4.3. Individuals who provide the Operator with false information about themselves or information about another individual’s personal data without the latter’s consent are subject to legal liability under the legislation of the Canada.

5. The Operator may process the following personal data of the User:

5.1. Last name, first name, patronymic.

5.2. Email address.

5.3. Phone numbers.

5.4. Additionally, the collection and processing of anonymous data about visitors (including cookies) using Internet statistics tools (such as Yandex Metric, Google Analytics, and others) are done on the site.

5.5. The aforementioned data shall hereinafter be referred to as General Personal Data under this Policy.

5.6. The Operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, or intimate life.

5.7. The processing of personal data allowed for dissemination among the special categories of personal data specified in Part 1 of Article 10 of the Law on Personal Data is permitted only if the prohibitions and conditions provided in Article 10.1 of the Law on Personal Data are observed.

5.8. The User’s consent to the processing of personal data allowed for dissemination shall be obtained separately from other consents for processing their personal data. Moreover, the requirements stipulated, particularly, in Article 10.1 of the Law on Personal Data, must be observed. The authorized body for the protection of the rights of personal data subjects establishes the requirements for the content of such consent.

5.8.1 The User provides the Operator with consent for the processing of personal data allowed for dissemination directly.

5.8.2 The Operator is obliged to publish information about the processing conditions, the existence of prohibitions and conditions for processing personal data allowed for dissemination by an unlimited number of persons no later than three working days from the date of receiving the User’s consent.

5.8.3 The transfer (distribution, provision, access) of personal data authorized by the personal data subject for dissemination must be terminated upon request of the personal data subject at any time. This request must include the personal data subject’s last name, first name, patronymic (if applicable), contact information (phone number, email address, or postal address), as well as a list of personal data whose processing should be terminated. The Operator may only process the personal data specified in this request.

5.8.4 Consent for the processing of personal data allowed for dissemination terminates upon receipt by the Operator of the request specified in clause 5.8.3 of this Policy regarding the processing of personal data.

6. Principles of personal data processing:

6.1. Personal data processing is conducted on a legal and fair basis.

6.2. Personal data processing is limited to achieving specific, predefined, and legitimate goals. Processing personal data that is inconsistent with the purposes of personal data collection is not permitted.

6.3. Combining databases containing personal data that are processed for incompatible purposes is prohibited.

6.4. Only personal data that aligns with the purposes of its processing can be processed.

6.5. The content and volume of processed personal data corresponds to the stated purposes of processing. Having excessive personal data in relation to the stated purposes of their processing is not allowed.

6.6. When processing personal data, accuracy, sufficiency, and, if necessary, relevance to the purposes of personal data processing are ensured. The Operator takes necessary measures and/or ensures that they are taken to delete or rectify incomplete or inaccurate data.

6.7. Personal data is stored in a manner that allows for identification of the data subject no longer than necessary for the purposes of data processing, unless a longer storage period is established by federal law, an agreement to which the data subject is a party, beneficiary, or guarantor. Processed personal data is destroyed or anonymized when the processing purposes are achieved or when there is no longer a need to achieve these purposes, unless otherwise specified by federal law.

7. Purposes of personal data processing:

7.1. The purpose of processing the User’s personal data includes:

— Informing the User through email;

— Conclusion, execution, and termination of civil law contracts;

— Providing the User with access to the services, information, and/or materials available on the website investor-visa-canada.com.

7.2. The Operator also has the right to send notifications to the User regarding new products and services, special offers, and various events. The User can opt out of receiving informational messages by emailing the Operator at office@cbg-a.com with the subject line "Refusal of notifications about new products and services and special offers".

7.3. Depersonalized User data collected through internet statistics services are used to gather information about User actions on the site, improve the quality of the site and its content.

8. Legal grounds for processing personal data:

8.1. The legal grounds for processing personal data by the Operator include:

— Regulatory legal acts that govern activities related to the Operator, such as the Federal Law;

— Operator's internal documents;

— Contracts between the Operator and the data subject;

— Federal laws and other regulatory legal acts related to personal data protection;

— Consent of Users for the processing of their personal data and the processing of personal data allowed for distribution.

8.2. The Operator processes the User’s personal data only when it is voluntarily provided by the User through specific forms on the website investor-visa-canada.com or sent to the Operator via email. By filling out the forms and/or sending personal data to the Operator, the User agrees to this Policy.

8.3. The Operator processes depersonalized data about the User if it is permitted by the User’s browser settings (enabling the saving of cookies and the use of JavaScript technology).

8.4. The data subject independently decides whether to provide their personal data and gives consent freely, voluntarily, and in their own interest.

9. Terms of personal data processing:

9.1. Personal data processing is carried out with the consent of the data subject.

9.2. Personal data processing is necessary to achieve the goals specified in an international agreement of the Canada or a law, and to fulfill the functions, powers, and obligations assigned to the Operator by the legislation of the Canada.

9.3. Personal data processing is necessary for the administration of justice, the execution of a court decision, or the execution of an act by another body or official in accordance with the legislation of the Canada on enforcement proceedings.

9.4. Personal data processing is necessary for the execution of a contract in which the data subject is a party, beneficiary, or guarantor, as well as for the conclusion of a contract initiated by the data subject or a contract in which the data subject will be a beneficiary or guarantor.

9.5. The operator or third parties may process personal data when it is necessary to exercise their rights and legitimate interests or to achieve socially significant goals, as long as the rights and freedoms of the data subject are not violated.

9.6. Personal data that is publicly available may be processed, provided that the data subject has provided access or has requested it.

9.7. Personal data may be processed if it is required to be published or disclosed in accordance with federal law.

10. Procedure for collecting, storing, transferring, and other types of personal data processing

The Operator ensures the security of the personal data they process by implementing legal, organizational, and technical measures to comply fully with the requirements of current legislation on personal data protection.

10.1. The Operator takes all possible measures to ensure the security of personal data and prevent unauthorized access.

10.2. The User’s personal data will never be transferred to third parties under any circumstances, except when it is required by current legislation or if the data subject has given consent for the transfer to fulfill obligations under a civil contract.

10.3. If there are any inaccuracies in personal data, the User can update them independently by sending a notification to the Operator’s email address office@cbg-a.com with the subject "Updating of personal data".

10.4. The duration of personal data processing is determined by the achievement of the purposes for which the data was collected, unless another period is specified in the contract or by current legislation.

The User can withdraw their consent to the processing of personal data at any time by sending a notification to the Operator’s email address office@cbg-a.com with the subject "Withdrawal of consent to the processing of personal data".

10.5. Third-party services, such as payment systems, communication tools, and other service providers, store and process all information collected in accordance with their User Agreement and Privacy Policy. The data subject and/or the User are responsible for familiarizing themselves with these documents in a timely manner. The Operator is not responsible for the actions of third parties, including the specified service providers.

10.6. The prohibitions imposed by the data subject on the transfer or processing conditions of personal data permitted for distribution do not apply in cases of processing personal data in the state’s, public’s, or other public interests defined by Canada legislation.

10.7. The Operator ensures the confidentiality of personal data during its processing.

10.8. The Operator stores personal data in a format that allows identifying the data subject for no longer than necessary to achieve the purposes of processing, unless federal law, an agreement, or the subject’s status determines a specific storage period.

10.9. The termination of personal data processing may occur when the purposes of processing have been achieved, the consent of the data subject has expired or been withdrawn, or when unlawful processing of personal data has been identified.

11. List of actions performed by the Operator with the personal data received:

11.1. The Operator collects, records, systematizes, stores, updates, extracts, uses, transfers, depersonalizes, blocks, deletes and destroys personal data.

11.2. The Operator engages in the automated handling of personal data, either with or without receiving and/or transmitting the information through information and telecommunication networks.

12. Cross-border transfer of personal data

12.1. Prior to initiating the transfer of personal data across borders, the Operator must ensure that the foreign country where the transfer is intended to take place provides reliable protection of the rights of personal data subjects.

12.2. Transfers of personal data to foreign countries that do not meet the aforementioned requirements may only be conducted with the written consent of the personal data subject, allowing for the cross-border transfer of their personal data and/or the execution of a contract in which the personal data subject is a party.

13. Confidentiality of personal data

The Operator, along with any other individuals who have access to personal data, are obligated to not disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise specified by federal law.

14. Final provisions

14.1. The User can obtain any clarifications on matters related to the processing of their personal data by reaching out to the Operator via e-mail at office@cbg-a.com.

14.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. This policy remains valid indefinitely until it is replaced by a new version.

14.3. The current version of the Policy is freely accessible on the internet at https://investor-visa-canada.com.