Joint-Stock Company "Far Eastern Fishing Management Company" (JSC "DRUK") · Electronic platform aodruk.ru · Revision of 17 September 2026
Operator: JSC "DRUK", 5, 1st Derbenevsky lane, Moscow, Russia. E-mail for requests concerning personal data: aodruk@aodruk.ru. Phone: +7 (499) 518 88 00.
1.1. This Policy on the processing of personal data (the "Policy") is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Personal Data Law") and defines the purposes, principles, conditions and methods of processing personal data by JSC "DRUK" (the "Operator"), and the measures taken to protect them.
1.2. The Policy applies to all personal data that the Operator processes in connection with the operation of the electronic platform aodruk.ru (the "Platform") and the conduct of request-for-offer procedures on it, as well as to personal data of counterparties and their representatives received in the course of the Operator's business.
1.3. The Policy is published on the Platform in unrestricted access and is available to any person.
1.4. Processing of personal data by the Operator is limited by the laws of the Russian Federation and the Operator's internal regulations.
2.1. Personal data — any information relating to a directly or indirectly identified or identifiable natural person (the data subject).
2.2. Operator — JSC "DRUK", which organises and carries out the processing of personal data and determines its purposes, the content of the data and the actions performed with them.
2.3. Processing — any action or set of actions with personal data, with or without automation, including collection, recording, systematisation, accumulation, storage, updating, extraction, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction.
2.4. Automated processing — processing by means of computer technology.
2.5. Provision — actions aimed at disclosing personal data to a specific person or group of persons.
2.6. Blocking — temporary suspension of processing (except where processing is needed to update the data).
2.7. Destruction — actions as a result of which it becomes impossible to restore the content of personal data in the information system and the material carriers are destroyed.
2.8. Depersonalisation — actions as a result of which it becomes impossible, without additional information, to attribute personal data to a specific subject.
2.9. Personal data information system — the set of personal data contained in databases together with the information technologies and technical means that process them.
2.10. Cross-border transfer — transfer of personal data to the territory of a foreign state to a foreign authority, foreign natural or legal person.
2.11. Platform — the set of computer programs and other information accessible via the Internet at https://aodruk.ru, on which the Operator conducts request-for-offer procedures for the sale of fish products.
2.12. Participant — a legal entity or individual entrepreneur registered on the Platform; contact person — the natural person whose details the Participant provides for communication with the Operator.
3.1. The Operator has the right to: independently determine the composition and list of measures necessary to fulfil its obligations under the Personal Data Law; entrust processing to another person on the basis of a contract that obliges that person to observe the principles and rules of processing and confidentiality; continue processing without consent where the Personal Data Law provides grounds for this.
3.2. The Operator is obliged to: organise processing in accordance with the Personal Data Law; respond to requests of data subjects and their representatives within 10 business days from receipt (the period may be extended by no more than 5 business days with a reasoned notice); provide the authorised body for the protection of data subjects' rights with the information it requests within 10 business days; publish this Policy; take legal, organisational and technical measures to protect personal data; notify the authorised body of incidents involving personal data within the periods established by law.
3.3. The Operator has appointed a person responsible for organising the processing of personal data. Requests are sent to the e-mail address aodruk@aodruk.ru marked "Personal data".
4.1. The data subject has the right to: receive information concerning the processing of their personal data, except in cases provided for by federal laws; demand that the Operator update, block or destroy the data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose; withdraw consent to processing; appeal against the Operator's actions or omissions to the authorised body for the protection of data subjects' rights or in court; exercise other rights provided for by the Personal Data Law.
4.2. Information is provided to the data subject in an accessible form and must not contain personal data of other subjects, unless there are legal grounds for disclosing them.
4.3. A Participant may independently update the contact details in the personal account on the Platform and delete the account there.
5.1. Processing is carried out on the basis of: the Constitution of the Russian Federation; the Civil Code of the Russian Federation; Federal Law No. 152-FZ "On Personal Data"; Federal Law No. 149-FZ of 27 July 2006 "On Information, Information Technologies and Protection of Information"; Federal Law No. 402-FZ of 6 December 2011 "On Accounting"; Federal Law No. 38-FZ of 13 March 2006 "On Advertising"; other regulations governing the Operator's activities.
5.2. The grounds also include: the Operator's rules; contracts concluded with Participants; the Rules of the Platform; the consent of the data subject to the processing of personal data given at registration or on the consent page of the Platform.
6.1. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is not permitted.
6.2. The Operator processes personal data for the following purposes: registration and identification of Participants and their contact persons, granting access to the Platform; conducting request-for-offer procedures, drawing up protocols of their results; concluding and performing contracts with winners of procedures; sending notifications on the course of procedures and, with the subject's consent, information mailings; considering requests and claims; ensuring the reliability of procedures, resolving disputes, preventing abuse; ensuring the operation and security of the Platform, keeping statistics of visits; fulfilling obligations imposed on the Operator by law.
7.1. Processing is carried out on a lawful and fair basis.
7.2. Processing is limited to the achievement of specific, predetermined and lawful purposes.
7.3. Databases containing personal data processed for incompatible purposes are not combined.
7.4. Only personal data that meet the purposes of processing are processed.
7.5. The content and scope of the data correspond to the stated purposes and are not excessive in relation to them.
7.6. The accuracy, sufficiency and, where necessary, relevance of the data are ensured; incomplete or inaccurate data are deleted or updated.
7.7. Personal data are stored in a form that makes it possible to identify the subject no longer than the purposes of processing require, unless a retention period is established by federal law or a contract to which the subject is a party. Upon achievement of the purposes the data are destroyed or depersonalised, unless federal law provides otherwise.
8.1. Categories of data subjects: contact persons and representatives of Participants (legal entities and individual entrepreneurs, including foreign ones); users of the Platform; representatives and employees of the Operator's counterparties; employees of the Operator working with the Platform.
8.2. Personal data of contact persons of Participants: surname, name, patronymic; position; work phone number; work e-mail address; language of communication.
8.3. Data of Platform users obtained automatically: IP address; information on the browser and device; date and time of visits and actions on the Platform (event log); technical cookies necessary for authorisation and language selection; the text, date, time and IP address of the consents given.
8.4. Data generated in the course of procedures: applications and price offers submitted through the Platform, their date and time, and protocols of procedure results, in which the contact person of the winner is indicated.
8.5. Details of organisations (name, tax number, country, address) relate to legal entities and are not personal data, but are stored together with the account.
8.6. The Operator does not process special categories of personal data or biometric personal data on the Platform.
8.7. The Operator does not create publicly available sources of personal data.
9.1. Processing includes collection, recording, systematisation, accumulation, storage, updating (renewal, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction of personal data.
9.2. Processing is carried out by automated means (the Platform's information system) and without automation (paper protocols and contracts), including transfer via information and telecommunication networks.
9.3. Personal data are recorded, systematised, accumulated, stored, updated and extracted using databases located in the Russian Federation.
9.4. The Operator does not carry out cross-border transfer of personal data. Notifications sent to contact persons located abroad contain only the data of the addressee themselves.
9.5. Processing of personal data of Platform users is carried out with the consent of the data subject, confirmed by ticking the box on the registration form or on the consent page. The text of the consent, the date, time and IP address are recorded by the Platform.
9.6. Personal data may be provided to persons processing them on the Operator's instructions — the hosting provider and the e-mail delivery service — on the basis of contracts obliging them to maintain confidentiality, and to state bodies in cases provided for by law. The Operator does not sell or otherwise disclose personal data to third parties.
9.7. Personal data are stored while the Participant's account is active and for three years after its deletion (the limitation period for claims under contracts). Personal data included in protocols of completed procedures, contracts and accounting documents are stored for the periods established by legislation on accounting and archiving.
9.8. Conditions for termination of processing: achievement of the purposes of processing; expiry of the retention period; withdrawal of consent by the data subject, unless the Operator has other legal grounds for processing; the Operator's liquidation; other cases provided for by law.
9.9. Protection measures. The Operator takes the necessary and sufficient legal, organisational and technical measures, including: appointment of a person responsible for organising the processing of personal data; adoption of internal documents on the processing and protection of personal data; determination of threats to security and the level of protection of the information system; restriction of employees' access to personal data and keeping an event log of the Platform; use of an encrypted connection (HTTPS) and protection of accounts from password guessing; backup of the database; familiarisation of employees with the legislation and the Operator's internal documents; internal control over compliance with the requirements of the law and this Policy.
9.10. Cookies. The Platform uses only technical cookies necessary for authorisation, protection of forms and storing the selected language. Analytics or advertising cookies are not used. Cookies can be disabled in the browser settings; in that case signing in to the Platform will be impossible.
10.1. Where the inaccuracy of personal data is confirmed, the Operator updates them within 7 business days from the submission of the relevant information by the data subject, their representative or the authorised body, and lifts the blocking.
10.2. Where processing is found to be unlawful, the Operator terminates the unlawful processing within 3 business days from the discovery.
10.3. Upon achievement of the purpose of processing or withdrawal of consent, the Operator terminates processing and destroys the personal data within 30 days, unless other grounds for processing are provided for by a contract with the subject or by federal law.
10.4. Where destruction within the established period is impossible, the Operator blocks the personal data and ensures their destruction within no more than 6 months.
10.5. Destruction is documented by an act on the destruction of personal data and, for the information system, by an extract from the event log.
11.1. Control over compliance with this Policy is exercised by the person responsible for organising the processing of personal data at the Operator.
11.2. Where violations of the procedure for processing personal data are identified, the Operator takes measures to establish their causes and eliminate them.
11.3. Persons guilty of violating the rules governing the processing and protection of personal data are liable in accordance with the laws of the Russian Federation.
11.4. The Operator has the right to amend this Policy. The current revision is published on this page with the date of the revision; the previous revisions cease to apply from the date of publication of the new one.
11.5. In the event of discrepancies between the Russian and English texts of the Policy, the Russian text prevails.
