Privacy Policy

Published: September 23, 2026

1. General Provisions

This Privacy Policy regarding the processing of personal data (the "Policy") applies to all information that Diba Group LLC (the "Operator", "Company", "we") may obtain about a user (the "User") while the User is using the website dibagroup.ru (the "Site"), its services and feedback forms.

The Company is a Russian legal entity registered and operating under the laws of the Russian Federation. Accordingly, this Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ "On Personal Data" dated 27 July 2006, Federal Law No. 149-FZ "On Information, Information Technologies and Information Protection" dated 27 July 2006, and other applicable regulatory acts of the Russian Federation in the field of personal data protection.

By using the Site, the User unconditionally agrees to this Policy and the terms of processing of his or her personal data set out herein. If the User does not agree with these terms, the User must refrain from using the Site.

2. Key Definitions

• Personal data — any information relating directly or indirectly to an identified or identifiable individual (data subject).
• Processing of personal data — any action (operation) or set of actions (operations) performed with personal data, whether or not using automation tools, including collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, de-identification, blocking, deletion and destruction of personal data.
• Operator — a person that, independently or jointly with others, organizes and/or carries out the processing of personal data, and determines the purposes of processing, the categories of data processed and the actions performed with them.
• User — any individual who visits the Site and/or sends the Operator personal data through the Site's forms, messengers, email, or by any other means.
• Cookie — a small piece of data sent by a web server and stored on the User's device.

3. Data Controller (Operator)

4. Personal Data Processed by the Operator

When using the Site (filling in feedback forms, requests to supply or purchase goods, contacting the Operator via WhatsApp/Telegram links shown on the Site, or sending an email), the Operator may process the following personal data of the User:

• last name, first name, patronymic (if applicable);
• company name and job title (if the User is contacting the Operator as a representative of a legal entity);
• phone number;
• email address;
• other data voluntarily provided by the User when contacting the Operator, including the content of a message or comments accompanying a request;
• anonymized data on Site visits collected automatically (IP address, cookie data, browser and device information, date and time of access, pages viewed) using web analytics services, including Yandex.Metrica and/or Google Analytics.

The Operator does not process special categories of personal data (race, nationality, political views, religious beliefs, health, intimate life) or biometric personal data.

5. Purposes of Processing

• processing requests and inquiries received through the Site's forms, email, or messengers, including requests to supply or purchase goods and services;
• concluding, performing and administering civil-law and foreign trade contracts with the User or the organization the User represents;
• providing the User with access to the Site's services and materials;
• communicating with the User, including responding to inquiries and providing status updates on requests;
• improving the Site's operation and usability, and developing new services;
• conducting statistical and analytical research based on anonymized data;
• complying with the requirements of the legislation of the Russian Federation.

6. Legal Basis for Processing

Personal data is processed on the following legal grounds: the consent of the data subject, expressed through implied actions (completing and submitting a form on the Site, sending a message to the Operator's email or messenger) in accordance with Articles 6 and 9 of the Law on Personal Data; the necessity of performing a contract to which the data subject is a party, beneficiary or guarantor; and other grounds provided for by the legislation of the Russian Federation.

7. Collection, Storage, Transfer and Other Processing of Personal Data

The security of personal data is ensured through legal, organizational and technical measures necessary to fully comply with the requirements of applicable personal data protection legislation. The Operator takes all reasonable measures to prevent unauthorized access to personal data.

The User's personal data is not disclosed to third parties, except in cases related to compliance with applicable law, or where the data subject has given consent to the transfer of data to a third party for the performance of obligations under a civil-law or foreign trade contract.

Personal data is processed for an unlimited period, by any lawful means, including in personal data information systems, with or without the use of automation tools.

8. Cross-Border Transfer of Personal Data

Given the specifics of the Operator's business, which involves foreign trade operations between the Russian Federation and the Islamic Republic of Iran, the personal data of a User who is a party to, or a representative of a party to, a foreign trade contract may be transferred to the territory of a foreign state solely to the extent and for the purposes necessary to perform such contract, in compliance with the requirements of Article 12 of the Law on Personal Data.

9. Cookies and Web Analytics

The Site uses cookies and web analytics services (in particular, Yandex.Metrica and/or Google Analytics) to analyze traffic, improve the Site's operation and personalize content. Cookies are not used to identify the User personally. The User may disable cookies in their browser settings, although this may limit the functionality of the Site.

10. Rights of the Data Subject

The User (data subject) has the right to:

• obtain information regarding the processing of his or her personal data, in the manner provided for by Article 14 of the Law on Personal Data;
• request that the Operator clarify, block, or destroy his or her personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data by sending a notice to the Operator's email specified in Section 3 of this Policy;
• appeal against the Operator's actions or omissions to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court.

11. Security Measures

The Operator takes the necessary legal, organizational and technical measures to protect personal data, including: appointing a person responsible for organizing the processing of personal data; identifying current threats to the security of personal data; applying organizational and technical protection measures; assessing the effectiveness of the measures taken; and timely detection of facts of unauthorized access to personal data.

12. Final Provisions

The Operator has the right to make changes to this Policy. The new version of the Policy takes effect from the moment it is posted on the Site, unless otherwise provided by the new version. The current version is always available at dibagroup.ru/privacy (Russian version of the Site) and dibagroup.ru/en/privacy (English version).

13. Contact Information