Version of 2 November 2026

Personal data processing policy of Limited Liability Company “ImbeonFarma”

English translation for convenience. In case of any discrepancies, the Russian version prevails.

1. General provisions

1.1. The policy of Limited Liability Company “ImbeonFarma” (the Company) on the processing of personal data (the Policy) has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the Law) and other acts of the Russian Federation.

1.2. The Policy sets out the procedure and conditions for processing personal data of users of the website https://www.imbeon.com/ and its language versions (the Website), as well as of persons who contact the Company by email, telephone or the Telegram messenger. The Policy describes the principles of processing, the rights of users, the obligations of the Company and the measures taken to protect personal data.

1.3. The Policy applies to all personal data that the Company receives from users of the Website and from persons who have contacted the Company (the Users, the User).

1.4. The Website has no registration, personal account, data collection forms, paid services or mailing lists. The Company receives personal data only when the User contacts the Company on their own initiative, and in the form of technical data that is transmitted automatically when the Website is visited.

1.5. If the User does not agree with the terms of the Policy, they must stop using the Website and must not send enquiries to the Company.

2. Terms and definitions

2.1. The following terms are used in the Policy.

Website: the website located at https://www.imbeon.com/ (including https://imbeon.com/ and the Russian-language version).
Personal data (PD): any information relating directly or indirectly to an identified or identifiable natural person (the PD subject).
Blocking of PD: temporary suspension of processing of PD, except where processing is necessary to clarify the PD.
Depersonalisation of PD: actions as a result of which it is impossible, without additional information, to determine whether the PD belongs to a specific PD subject.
Processing of PD: any action or set of actions performed with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, amendment), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction of PD.
Operator: Limited Liability Company “ImbeonFarma”. The Company independently organises and carries out the processing of PD and determines the purposes of processing, the composition of PD and the actions performed with it.
Provision of PD: actions aimed at disclosing PD to a specific person or a specific group of persons.
Dissemination of PD: actions aimed at disclosing PD to an indefinite group of persons.
User: a visitor to the Website or a person who has contacted the Company, who is a PD subject.
PDIS: a personal data information system.
Destruction of PD: actions as a result of which it becomes impossible to restore the content of PD in the PDIS and (or) as a result of which the physical media of PD are destroyed.
Cookies: small pieces of data that a website stores on the User’s device through the browser.

3. Legal grounds and purposes of personal data processing

3.1. The legal grounds for the Company’s processing of PD are:

the Civil Code of the Russian Federation;
Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;
Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and the Protection of Information”;
other applicable regulatory legal acts of the Russian Federation;
local acts of the Company;
the User’s consent to the processing of their personal data.

3.2. The Company processes the User’s PD solely for the following purposes:

3.2.1. establishing and maintaining communication between the User and the Company, replying to enquiries and advising on the Company’s services (development and market launch of health products);

3.2.2. preparing, concluding and performing contracts with the Company, including conducting negotiations;

3.2.3. ensuring the operation and security of the Website and identifying and fixing technical errors;

3.2.4. complying with the requirements of the legislation of the Russian Federation.

3.3. The specific scope of PD processed for these purposes is set out in section 5 of the Policy.

3.4. The Company does not send promotional messages to Users without their separate consent and does not make decisions that produce legal consequences for the User on the basis of solely automated processing of PD.

4. Conditions and procedure for giving consent to the processing of personal data

4.1. The Company does not verify the PD provided by the User. The Company therefore proceeds from the assumption that, when providing PD, the User:

4.1.1. has legal capacity; if a person lacks legal capacity, consent to the processing of PD is given by their legal representative, who has read and accepted the terms of the Policy;

4.1.2. provides accurate information about themselves to the extent necessary to achieve the purposes of processing and keeps it up to date.

4.2. The User accepts the terms of the Policy and gives the Company informed and conscious consent to the processing of their PD on the terms provided for by the Policy and the Law:

4.2.1. when contacting the Company by email, telephone or Telegram (including after pressing the buttons “Message on Telegram” and “Write an email” and following the contact links), consent is deemed given at the moment the enquiry is sent or the conversation begins;

4.2.2. when using the Website in any way, consent to the processing of technical data that is transmitted to the Company automatically is deemed given at the moment the User starts using the Website.

4.3. By performing the actions specified in clause 4.2 of the Policy, the User gives the Company consent to the processing of the relevant PD, the list of which is set out in section 5 of the Policy, including collection, recording, systematisation, accumulation, storage, clarification (updating, amendment), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction of PD, with and without the use of automation tools, in accordance with the purposes specified in section 3 of the Policy.

4.4. Consent is valid from the date it is given for the period necessary to achieve the purposes of processing PD, or until the User withdraws it. Consent may be withdrawn at any time in one of the following ways:

by sending a written application by post to: 108802, Russia, Moscow, intra-city territory “municipal okrug Kommunarka”, settlement Gazoprovod, ul. 1-ya Lesnye Polyany, 6, bldg 6, apt 2;
by sending an application in the form of an electronic document to the email address: info@imbeon.ru.

4.5. The Company does not disseminate Users’ PD and does not request consent to the dissemination of PD.

5. Personal data processed by the Company

5.1. Users’ PD is processed on the following terms.

Purpose of processing	Personal data processed
Establishing and maintaining communication, consulting (clause 3.2.1)	surname and first name (patronymic, if given); telephone number; email address; Telegram username and identifier; name of the organisation and job title (if given); the content of the enquiry and attached files.
Preparing, concluding and performing contracts (clause 3.2.2)	full name of the counterparty’s representative; job title and authority; telephone number and email address; details of the organisation; if the counterparty is an individual entrepreneur or a natural person and this is necessary to perform the contract: passport details, registration address, taxpayer identification number (INN), bank details.
Ensuring the operation and security of the Website (clause 3.2.3)	IP address; type and version of the browser and operating system; date and time of the request, address of the requested page; device information (type, screen size); server technical log data.
Compliance with legal requirements (clause 3.2.4)	PD to the extent directly required by the legislation of the Russian Federation.

5.2. The Company does not process special categories of PD or Users’ biometric PD.

5.3. The Website does not use cookies to identify Users, for analytics or for advertising, and does not connect third-party analytics systems, advertising pixels or external font services. To show the introductory screen, the User’s browser temporarily stores a technical flag (sessionStorage); it stays on the device, is not transmitted to the Company and is deleted when the tab is closed. The hosting provider and the content delivery network may use technical cookies and request logs that are necessary for the security and availability of the Website.

6. Processing of personal data

6.1. The Company processes PD on the basis of the following principles:

lawfulness and fairness;
limiting processing to the achievement of specific, predetermined and lawful purposes;
prohibiting the merging of databases containing PD that are processed for purposes incompatible with each other;
processing only the PD that corresponds to the purposes of processing;
ensuring that the content and scope of the PD processed correspond to the stated purposes of processing;
prohibiting the processing of PD that is excessive in relation to the stated purposes;
ensuring the accuracy, sufficiency and relevance of PD in relation to the purposes of processing;
destroying or depersonalising PD once the purposes of processing have been achieved or the need to achieve them is lost.

6.2. The Company records, systematises, accumulates, stores, clarifies (updates, amends) and retrieves the PD of citizens of the Russian Federation using databases located in the territory of the Russian Federation, in accordance with Part 5 of Article 18 of the Law.

6.3. PD is processed both with and without the use of automation tools.

6.4. The Company undertakes not to disclose PD to third parties and not to disseminate it without the consent of the PD subject, unless otherwise provided by federal law.

6.5. The processing of PD includes the following operations: collection, recording, systematisation, accumulation, storage, clarification (updating, amendment), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

6.6. PD is stored on electronic media (in the mail system, on the Company’s devices and systems) for the period necessary to achieve the purposes of processing or until the User withdraws consent to the processing of PD. Documents related to the conclusion and performance of contracts are kept for the periods established by the legislation of the Russian Federation on accounting and archiving.

6.7. The Company may transfer PD to third parties in accordance with the requirements of the legislation of the Russian Federation, namely:

6.7.1. to the Company’s partners and contractors (in particular, the hosting provider and email service providers) to achieve the purposes of processing specified in section 3, provided that they observe the confidentiality and security of PD;

6.7.2. at the request of authorised state bodies in cases established by law.

6.8. PD is transferred to the third parties specified in clause 6.7 of the Policy subject to the following conditions:

the third party ensures the confidentiality of PD when processing and using it, undertakes not to disclose it to others and not to disseminate it without the User’s consent;
the third party guarantees compliance with measures to ensure the security of PD;
the list of permitted methods of processing PD is determined by the contract or instruction;
the third party is prohibited from transferring and disseminating PD, except in cases expressly specified in the processing instruction.

6.9. If the User contacts the Company through Telegram, an email service of a third-party operator or another messenger, the data inside these services is processed by their operators under their own rules. By choosing such a means of communication, the User acts of their own free will.

7. Measures taken by the Company to protect personal data

7.1. The Company takes the necessary and sufficient legal, organisational and technical measures to protect the information provided by Users against unlawful or accidental access, destruction, alteration, blocking, copying and dissemination, as well as against other unlawful actions by third parties. Such measures include, in particular:

appointing a person responsible for organising the processing of PD;
issuing local acts on the processing and protection of PD and familiarising the Company’s employees with them;
limiting employees’ access to PD to those who need it to perform their duties;
applying organisational and technical measures to ensure the security of PD when it is processed in information systems;
protecting data transfer between the User’s browser and the Website with the HTTPS protocol;
monitoring cases of unauthorised access to PD and taking measures to prevent such incidents in the future.

7.2. The Company monitors the measures taken to ensure the security of PD and the level of protection of the PDIS.

8. Rights of the User

8.1. The User decides to provide their PD and gives consent to its processing freely, of their own will and in their own interest.

8.2. The User has the right to receive from the Company information concerning the processing of their PD, including confirmation of the fact of processing, the legal grounds and purposes of processing, the methods of processing, information about persons who have access to the PD, the periods of processing and storage, and the procedure for exercising the rights provided for by the Law.

8.3. The User has the right to demand clarification, blocking or destruction of their PD if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and to take the measures provided for by law to protect their rights.

8.4. The User may send the Company their requests and demands, including on the use of their PD and on the withdrawal of consent to the processing of PD, in the following ways:

8.4.1. in writing to the Company’s address given in section 12 of the Policy;

8.4.2. as an electronic document to the Company’s email address: info@imbeon.ru.

8.5. If the User believes that the Company is processing their PD in violation of the requirements of the Law or is otherwise violating their rights and freedoms, they have the right to appeal against the actions or inaction of the Company to the authorised body for the protection of the rights of PD subjects (Roskomnadzor) or in court.

9. Updating, correcting, deleting and destroying personal data

9.1. At the request of the User or their representative, in the manner provided for by Article 14 of the Law, the Company is obliged to provide information on whether it holds PD relating to that User. The reply is sent within 10 (ten) working days of receipt of the request; this period may be extended by no more than 5 (five) working days with a reasoned notice.

9.2. Within 7 (seven) working days of the User providing information confirming that the PD is incomplete, inaccurate or out of date, the Company is obliged to make the necessary changes to it.

9.3. Within 7 (seven) working days of the User providing information confirming that the PD has been unlawfully obtained or is not necessary for the stated purpose of processing, the Company is obliged to destroy such PD.

9.4. The Company is obliged to stop processing PD:

if unlawful processing of PD is identified, within 3 (three) working days of the date of such identification;
if the User withdraws consent to the processing of their PD;
if the purposes of processing PD have been achieved.

9.5. The Company is obliged to destroy the User’s PD within 30 (thirty) days of the date the purposes of processing PD are achieved or consent is withdrawn, unless otherwise provided by contract or law.

9.6. If PD cannot be destroyed within the period specified in clause 9.5 of the Policy, the Company blocks such PD and ensures its destruction within no more than 6 (six) months, unless another period is established by federal law.

10. Actions of the Company in the event of personal data incidents

10.1. If it is established that PD has been unlawfully or accidentally transferred (provided, disseminated, accessed), resulting in a violation of the rights of PD subjects, the Company is obliged to notify Roskomnadzor: within 24 hours of the incident, its presumed causes and the harm caused, and of the measures taken; and within 72 hours of the results of the internal investigation and of the persons whose actions caused the incident.

11. Amendments to the Policy

11.1. The Company reserves the right to amend the Policy. The User must read the text of the Policy each time they use the Website anew.

11.2. A new version of the Policy comes into force from the moment it is published on the Website. Continued use of the Website after a new version is published means that the User accepts the Policy and its terms. If the User does not agree with the terms of the Policy, they must stop using the Website.

11.3. Any questions about this Policy may be sent to the Company’s email address: info@imbeon.ru.

12. Information about the Company

Name: Limited Liability Company “ImbeonFarma” (LLC “ImbeonFarma”)
Registered address: 108802, Russia, Moscow, intra-city territory “municipal okrug Kommunarka”, settlement Gazoprovod, ul. 1-ya Lesnye Polyany, 6, bldg 6, apt 2
Actual address: same as the registered address
OGRN: 1267700190670
INN: 7751391784
KPP: 775101001
Telephone: +7 925 347 75 45
Email: info@imbeon.ru
General Director: Daria Aleksandrovna Buklesheva
Official website: https://www.imbeon.com/