CURRENT EDITION / EN

Personal Data Processing Policy

OOO Mezhdunarodny Dom Chaya (International Tea House LLC) — cafex-expo.ru

Version of 05.09.2026. Effective from 05.09.2026.

This English text is provided for information only. The legally binding version is the Russian one, available at https://cafex-expo.ru/ru/legal/privacy. In case of any discrepancy the Russian version prevails.

1. General provisions

1.1. This Personal Data Processing Policy (the Policy) sets out the procedure and conditions for the processing of personal data by International Tea House LLC (the Operator), as well as information on the personal data protection requirements implemented by the Operator.

1.2. The Policy is adopted pursuant to Article 18.1(2) of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (Law No. 152-FZ) and is published for unrestricted access.

1.3. The Policy applies to all personal data received from data subjects through the website https://cafex-expo.ru and its subdomains (the Website), upon registration for and attendance at the CAFEX exhibition, upon participation as an exhibitor, partner, speaker or media representative, and in the course of any other interaction with the Operator.

1.4. Operator details:


Full name	Limited Liability Company "Mezhdunarodny Dom Chaya"
INN / KPP	7729467886 / 772901001
OGRN	1157746645660
Registered address	119526, Moscow, ul. 26-ti Bakinskikh Komissarov 4, bldg 3, apt. 48
Postal address	123060, Moscow, ul. Berzarina 36, bldg 2, office 415
Telephone	+7 (495) 935-87-07
E-mail	info@cafex-expo.ru

1.5. The Operator is entered in the register of personal data operators maintained by Roskomnadzor.

1.6. Terms used in the Policy have the meanings given in Article 3 of Law No. 152-FZ.

1.7. The current version of the Policy is permanently available at https://cafex-expo.ru/ru/legal/privacy.

2. Principles and legal grounds

2.1. Processing is based on the principles set out in Article 5 of Law No. 152-FZ: lawfulness and fairness; limitation to specific, pre-defined and lawful purposes; no combining of databases processed for incompatible purposes; processing only of data relevant to the purposes; adequacy and relevance of the data; accuracy and currency; and storage in a form permitting identification of the subject no longer than required by the purposes.

2.2. The legal grounds for processing are:

(a) the Constitution of the Russian Federation, the Civil Code, Law No. 152-FZ, Federal Law No. 149-FZ of 27 July 2006 "On Information, Information Technologies and Information Protection", Law No. 2300-I of 7 February 1992 "On Protection of Consumer Rights", Federal Law No. 38-FZ of 13 March 2006 "On Advertising", the Tax Code and Federal Law No. 402-FZ of 6 December 2011 "On Accounting";

(b) the Operator's constitutive documents and internal personal data regulations;

(c) contracts between the Operator and the data subject, including contracts concluded by acceptance of the public offer published on the Website (Article 6(1)(5) of Law No. 152-FZ);

(d) consents of data subjects (Article 6(1)(1)), including separate consents to receive advertising messages;

(e) the legitimate interests of the Operator or third parties, provided the rights and freedoms of the data subject are not infringed (Article 6(1)(7)).

2.3. Processing is carried out with the subject's consent, except where Article 6(1) of Law No. 152-FZ permits processing without consent.

3. Categories of subjects and data processed

3.1. Website visitors, persons submitting enquiries, subscribers. Surname, first name, patronymic (if provided); e-mail address; telephone number; company name and position (where the field is completed); contents of the enquiry and correspondence; subscription details and status.

3.2. Exhibition visitors who have registered and/or purchased a ticket. Full name; e-mail address; telephone number; company name, position, field of activity; order, ticket and admission details (order number, ticket number, status, date and time of entry); payment details required for issuing a fiscal receipt and for accounting (excluding payment card data — see clause 3.8).

3.3. Representatives of exhibitors, partners, sponsors, contractors and other counterparties. Full name; position; e-mail address; telephone number; data required for passes, accreditation and admission to build-up and dismantling; data contained in powers of attorney and other documents confirming authority.

3.3.1. Users of the exhibitor personal account. Account credentials (login, e-mail address, password hash, one-time confirmation codes); details of the organisation represented and of the user's authority; the personal account activity log (date and time of logins and operations, IP address, device data); information entered by the user about the company and its products; data of accredited employees (full name, position, contact details); history of applications and services ordered; uploaded materials.

3.3.2. Personal data of the organisation's employees and representatives are entered into the personal account by the Exhibitor itself. The Exhibitor confirms that it has legal grounds to transfer such data to the Operator and must inform those persons that their data will be processed by the Operator in accordance with this Policy. The Operator processes such data for the purposes set out in Section 4 as an independent operator.

3.4. Speakers of the business programme and participants of competition programmes. Full name; position and place of work; biography, photograph and other materials submitted for publication in the programme; contact details; data required for payment of remuneration (if applicable).

3.5. Media representatives. Full name; name of the media outlet; position; contact details; editorial assignment and accreditation details.

3.6. Images of visitors and participants obtained through photography and filming at the exhibition. Photographs, video and audio recordings made during filming carried out by the Organiser and persons authorised by it on the exhibition premises and at its business and competition programme events; associated details (date, time and place of filming); and the surname, first name and position of the person where the image carries a caption or is used in programme materials. The filming, opt-out and use procedure is set out in the Visitor Rules.

3.7. Website technical data. IP address; date and time of the request; browser and operating system data; language and regional settings; referring page; actions performed on the Website; cookie and similar technology identifiers (Section 6).

3.8. The Operator does not collect or store payment card details. Payment is processed by the acquiring bank / payment service; the Operator receives only the outcome of the transaction, its identifier, the amount and the masked card number (last four digits), to the extent necessary to confirm payment and process refunds.

3.9. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life), biometric personal data, or personal data authorised by the subject for dissemination, except where the subject provides such data on their own initiative subject to a separate consent under Articles 10, 10.1 and 11 of Law No. 152-FZ.

3.10. The subject is not required to provide personal data beyond the scope necessary for the stated purpose. Leaving optional fields blank does not result in refusal of service.

4. Purposes, grounds and retention periods

Purpose	Data	Legal ground	Retention
Handling enquiries submitted via Website forms and e-mail, providing responses	3.1	Consent; Art. 6(1)(7)	1 year from last interaction
Visitor registration, processing and performance of ticket orders, admission to the exhibition, order support	3.2	Contract (Art. 6(1)(5)); Consumer Protection Law	3 years after the exhibition (general limitation period); accounting and tax records — 5 years
Conclusion and performance of contracts with exhibitors, partners and contractors; accreditation of their representatives	3.3	Contract; Art. 6(1)(7)	5 years from performance of the contract
Providing access to the exhibitor personal account, receiving applications and company information, preparing contractual documents, publishing catalogue entries	3.3.1	Contract (Art. 6(1)(5)); consent; Art. 6(1)(7)	Account — until deleted or 3 years after last login; activity log — 1 year; data transferred into contractual documents — 5 years
Compiling and publishing the business programme, organising presentations and competitions	3.4	Consent; contract	3 years after the exhibition; published programme materials — archived indefinitely to the extent authorised by the subject
Accreditation of media representatives	3.5	Consent; contract	1 year after the exhibition
Photography and filming of the exhibition, coverage and promotion of the event, preparation of reporting and advertising materials	3.6	Art. 6(1)(7); consent where a particular person's image is the principal subject; Art. 152.1 of the Civil Code	Raw materials — 3 years; published materials — indefinitely or until a justified removal request
Sending organisational (service) messages required for attendance or participation	3.1–3.5	Contract; consent to informational messages	Until completion of the relevant interaction
Sending news and advertising e-mail	E-mail address, name, subscription data	Separate consent; Art. 18(1) of the Advertising Law	Until consent is withdrawn; record of unsubscribe — 3 years
Ensuring safety and order at the exhibition, recording breaches of the Visitor Rules, restricting access to future events	Full name, contact details, ticket number, date and substance of the breach, statement reference	Art. 6(1)(7) (legitimate interests of the Operator, exhibitors and other visitors)	3 years from the date of the breach
Ensuring operation and security of the Website, preventing fraud and abuse	3.7	Art. 6(1)(7)	Event logs — 6 months
Website traffic and service quality analysis	3.7, anonymised or aggregated	Cookie consent; Art. 6(1)(7)	12 months
Compliance with statutory obligations (accounting, tax, responses to authorities)	As required by law	Statutory obligation (Art. 6(1)(2))	Statutory periods

4.1. Processing ceases upon achievement of the purposes, expiry of the retention period, withdrawal of consent, or identification of unlawful processing — in the manner and within the periods set out in Article 21 of Law No. 152-FZ.

4.2. Personal data whose retention period has expired are destroyed or anonymised. Destruction is evidenced by a record and/or an extract from the event log of the information system in accordance with Roskomnadzor requirements.

5. Methods of processing. Data localisation

5.1. Processing is carried out with and without the use of automation and includes collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

5.2. The Operator does not take decisions producing legal effects concerning the subject, or otherwise affecting their rights and legitimate interests, solely on the basis of automated processing (Article 16 of Law No. 152-FZ).

5.3. When collecting personal data, including via the Website, the recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation (Article 18(5) of Law No. 152-FZ).

5.4. The Operator does not collect personal data through the Website using foreign services that store data outside the Russian Federation without prior recording in databases located in the Russian Federation.

6. Cookies and similar technologies

6.1. The Website uses cookies — small text files stored in the user's browser — and similar technologies (local storage, pixels, counters).

6.2. Categories used:

(a) strictly necessary — enable the Website to function, maintain the user session, ensure security and the correct operation of forms and the order basket; based on Article 6(1)(7) of Law No. 152-FZ and not subject to consent, as the Website cannot operate without them;

(b) functional — store the selected language, region and other interface settings;

(c) analytical — allow assessment of traffic and user behaviour in anonymised or aggregated form (including via Yandex Metrica);

(d) advertising — used to measure the effectiveness of advertising campaigns and to display relevant materials, where such technologies are applied.

6.3. Functional, analytical and advertising cookies are set after the user's consent has been obtained through the cookie banner displayed on first visit. Consent may be withdrawn at any time by changing the cookie settings on the Website or by deleting cookies and disabling them in the browser.

6.4. Disabling strictly necessary cookies in the browser may render the Website partially or fully inoperable, including making it impossible to place an order.

6.5. Cookie identifiers alone do not enable the Operator to identify the user; where such data are combined with information entered by the user in Website forms, they are processed as personal data under this Policy.

7. Transfer of personal data to third parties

7.1. The Operator does not sell personal data and does not transfer them to third parties except as set out in this Section.

7.2. The Operator may entrust processing to another party under a contract in accordance with Article 6(3) and 6(5) of Law No. 152-FZ. Such instruction defines the list of actions, the purposes of processing, the duty of confidentiality and security, and data protection requirements. The Operator remains liable to the subject for the acts of such party.

7.3. Categories of recipients / processors:

(a) hosting and information system providers located in the Russian Federation;

(b) e-mail and notification distribution service providers;

(d) the acquiring bank and payment service handling payments and refunds;

(e) the fiscal data operator and receipt issuing service under Federal Law No. 54-FZ of 22 May 2003;

(f) telecommunications operators and messaging services;

(g) organisations providing access control, accreditation, registration and technical organisation of the exhibition at the venue;

(h) the owner of the exhibition venue — to the extent necessary for admission and security;

(i) the electronic document management operator through which the Operator sends contracts, invoices and closing documents to counterparties;

(j) providers of accounting, audit and legal services to the Operator;

(k) state authorities, local self-government bodies, courts and other competent authorities — in the cases and to the extent prescribed by Russian law.

7.4. The Operator discloses information about visitors and participants to counterparties solely in anonymised or aggregated form (statistics by industry, region, category), unless the subject has given separate consent to the transfer of their contact details to a specific party.

7.5. Exchange of contacts at the exhibition. Contact details are transferred to an exhibitor only after a separate express action by the visitor in the digital business-card interface or by presenting a separate code intended for contact exchange. Before confirmation, the recipient and the data to be transferred must be displayed to the visitor. A Ticket code used for access control is not consent to data transfer and must not disclose personal data to an exhibitor. The exhibitor becomes an independent operator in respect of subsequent processing.

8. Cross-border transfer

8.1. The Operator does not plan cross-border transfers within the processes described in this Policy and selects contractors with regard to Russian data-localisation requirements.

8.2. The actual set of services used is reviewed periodically. If a service would involve a cross-border transfer, before the transfer begins the Operator complies with Article 12 of Law No. 152-FZ, including assessment of the transfer conditions, notification of Roskomnadzor where applicable and an update of this Policy.

9. Security measures

9.1. The Operator implements the legal, organisational and technical measures required by Articles 18.1 and 19 of Law No. 152-FZ, including:

(a) appointing a person responsible for organising the processing of personal data;

(b) adopting internal regulations on processing and protection and familiarising employees with them;

(d) identifying threats to the security of personal data in information systems and applying measures required to achieve the level of protection prescribed by Decree of the Government of the Russian Federation No. 1119 of 1 November 2012;

(e) restricting and segregating access, keeping records of persons with access and logging actions with the data;

(f) using information protection tools, encryption of the data transmission channel (HTTPS), backup and anti-virus protection;

(g) detecting unauthorised access and taking measures to restore data;

(h) assessing the harm that may be caused to subjects in the event of a breach of Law No. 152-FZ.

9.2. Where an unlawful or accidental transfer of personal data resulting in a breach of the subjects' rights is established, the Operator notifies Roskomnadzor within 24 hours of the incident and within 72 hours of the results of the internal investigation (Article 21(3.1) of Law No. 152-FZ).

10. Rights of the data subject

10.1. The data subject has the right to:

(a) obtain the information about the processing of their personal data listed in Article 14(7) of Law No. 152-FZ;

(b) require the updating, blocking or destruction of personal data that are incomplete, out of date, inaccurate, unlawfully obtained or unnecessary for the stated purpose;

(d) object to processing for the purposes of promoting goods, works and services and for political campaigning (Article 15(1)); upon such demand the Operator must cease such processing immediately;

(e) appeal against the Operator's acts or omissions to Roskomnadzor or in court;

(f) protection of their rights and legitimate interests, including compensation for losses and moral harm.

10.2. Requests are sent to info@cafex-expo.ru or by post to: 123060, Moscow, ul. Berzarina 36, bldg 2, office 415.

10.3. The request must contain the information required by Article 14(3) of Law No. 152-FZ: the number of the main identity document of the subject or their representative, the date of issue and issuing authority; information confirming the subject's involvement in relations with the Operator (order number, e-mail address used at registration or similar) or otherwise confirming the fact of processing; and the signature of the subject or their representative. The request may be submitted as an electronic document signed with an electronic signature.

10.4. Time limits:

(a) information about processing is provided within 10 working days of receipt of the request; this may be extended by no more than 5 working days with a reasoned notice to the subject (Article 20(1)–(2));

(b) where inaccuracy is confirmed, the Operator updates the data within 7 working days and lifts the blocking (Article 21(2));

(c) where unlawful processing is identified, the Operator ceases it within 3 working days, and if lawfulness cannot be ensured, destroys the data within 10 working days (Article 21(3));

(d) upon withdrawal of consent, processing ceases and the data are destroyed within 30 days of receipt of the withdrawal, unless otherwise provided by a contract with the subject or unless the Operator is entitled to continue processing on another ground under Law No. 152-FZ (Article 21(5)).

10.5. Withdrawal of consent does not affect the lawfulness of processing carried out before its receipt and does not terminate processing carried out on grounds not requiring consent (performance of a contract, statutory obligation, protection of the Operator's rights and legitimate interests).

10.6. Unsubscribing from advertising mailings is done via the "Unsubscribe" link in each advertising e-mail or by contacting info@cafex-expo.ru, and does not stop service (organisational) messages required to perform an order or registration.

11. Personal data of minors

11.1. The Website and the Operator's services are addressed to persons aged 18 and over and are not intended for independent use by minors.

11.2. The Operator does not deliberately collect personal data of minors. Where a minor's personal data are provided in connection with their attendance at the exhibition, consent is given by a parent or other legal representative.

11.3. Upon becoming aware that a minor's personal data have been provided without the legal representative's consent, the Operator takes steps to delete them.

12. Person responsible for organising processing

12.1. The person responsible for organising the processing of personal data is appointed by order of the Operator's chief executive. Enquiries on personal data matters should be sent to info@cafex-expo.ru marked "For the person responsible for organising the processing of personal data".

13. Final provisions

13.1. The Operator may amend the Policy. A new version takes effect upon publication on the Website unless the version itself provides otherwise. The date of the latest version is shown at the top of the document. Previous versions are available on request.

13.2. Amendments materially affecting subjects' rights are additionally communicated by notice on the Website and/or by e-mail.

13.3. Continued use of the Website after a new version takes effect constitutes agreement with it, save where separate consent of the data subject is required.

13.4. Matters not covered by this Policy are governed by the legislation of the Russian Federation.

13.5. Related documents: