1. General Provisions
1.1. This Personal Data Processing Policy (the “Policy”) establishes the rules governing the processing and protection of personal data in connection with the organisation and conduct of the MGIMO ITU Model (the “Model”), including the selection process, the Lecture School and the main sessions of the Model.
1.2. This Policy has been prepared in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, and other applicable laws and regulations of the Russian Federation governing the processing and protection of personal data.
1.3. The personal data operator is the Federal State Autonomous Educational Institution of Higher Education “Moscow State Institute of International Relations (University) of the Ministry of Foreign Affairs of the Russian Federation” (MGIMO University), located at 76 Vernadskogo Prospekt, Moscow 119454, Russian Federation (the “Operator”).
1.4. The MGIMO Centre for Artificial Intelligence is the structural unit responsible for the preparation and conduct of the Model and for coordinating the organisational processes associated with it.
1.5. This Policy applies to the personal data of:
1) applicants for participation in the Model;
2) participants in the Model and the Lecture School;
3) candidates for elective roles within the Model;
4) organisers and other persons involved in the organisational support of the Model;
5) experts, lecturers and invited guests;
6) users of the official information resource of the Model where such resource involves the processing of personal data.
1.6. This Policy shall be made publicly available through the official information resource of the Model.

2. Principles of Personal Data Processing
2.1. Personal data shall be processed lawfully and fairly.
2.2. Personal data shall be processed only for specific, predetermined and legitimate purposes.
2.3. Personal data shall not be processed in a manner incompatible with the purposes for which they were collected.
2.4. The nature and volume of the personal data processed shall correspond to the stated purposes of processing. Personal data excessive in relation to those purposes shall not be processed.
2.5. The Operator shall take appropriate measures to ensure the accuracy, sufficiency and, where necessary, the relevance of personal data.
2.6. Personal data shall be retained in a form permitting identification of the data subject for no longer than is required for the purposes of processing, unless a different retention period is established by the laws of the Russian Federation.
2.7. Upon achievement of the purposes of processing, personal data shall be destroyed or anonymised unless otherwise provided by applicable law or another lawful basis for processing.

3. Purposes of Personal Data Processing
3.1. The Operator may process personal data for the following purposes:
1) receiving and registering applications for participation in the Model;
2) conducting the competitive selection of participants;
3) assessing applicants’ knowledge, experience, motivation and other established selection criteria;
4) assigning participants to Member States, delegations and other roles;
5) maintaining a reserve list of participants;
6) organising and conducting the Lecture School;
7) informing applicants and participants of selection results, schedules, programmes and other organisational matters;
8) organising and conducting sessions, elections, expert events and other activities of the Model;
9) preparing participant lists, certificates, diplomas and award materials;
10) organising access control and ensuring security during in-person events;
11) communicating with participants, experts, lecturers, partners and invited guests;
12) handling enquiries and resolving organisational matters;
13) maintaining internal statistical, organisational and reporting documentation relating to the Model;
14) operating the official information resources of the Model;
15) complying with the Operator’s obligations under the laws of the Russian Federation.
3.2. Publication of a participant’s personal data in publicly accessible sources, including their full name, image, educational institution, represented Member State, participation results, awards or other information, shall take place only where an appropriate lawful basis exists.
3.3. Where required under the laws of the Russian Federation, dissemination of personal data shall take place on the basis of a separate consent provided by the data subject for the processing of personal data authorised by the data subject for dissemination.

4. Categories and Types of Personal Data Processed
4.1. The following personal data of applicants and participants may be processed:
1) full name;
2) citizenship;
3) educational or research institution;
4) field and level of study or position held;
5) email address;
6) telephone number;
7) account identifier in the messenger used by the organisers;
8) social media profile link, where requested in the application form or voluntarily provided by the data subject;
9) information on prior participation in models of international organisations, conferences, debates, educational, academic or research projects;
10) preferences concerning represented Member States and roles;
11) answers to selection questions;
12) statement of motivation;
13) information concerning the results of the competitive selection process;
14) assigned Member State and role;
15) attendance and participation information relating to the Lecture School and the Model;
16) documents, materials and statements prepared by the participant in connection with the Model;
17) information on participation results, nominations and awards;
18) photographs and video recordings made during the Model where an appropriate lawful basis exists.
4.2. The following personal data of experts, lecturers, invited guests and organisers may be processed:
1) full name;
2) employing organisation;
3) position;
4) academic degree and academic title;
5) contact details;
6) information concerning participation in the programme of the Model;
7) photographs and video recordings where an appropriate lawful basis exists.
4.3. When the official information resource of the Model is used, certain technical information necessary for its operation and security may be processed automatically, including IP address, browser and device information, date and time of access, and information relating to technical events.
4.4. The Operator does not intentionally collect special categories of personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health or intimate life.
4.5. The Operator does not process biometric personal data for the purpose of establishing the identity of a participant unless such processing is separately provided for by the laws of the Russian Federation and the relevant organisational procedure.

5. Legal Bases for Personal Data Processing
5.1. The legal bases for personal data processing may include:
1) the consent of the data subject;
2) applicable laws and regulations of the Russian Federation;
3) applicable internal regulations of the Operator;
4) other lawful grounds provided by Federal Law No. 152-FZ “On Personal Data”.
5.2. Where processing is based on the consent of the data subject, such consent shall be obtained separately from other documents and information signed or otherwise confirmed by the data subject.
5.3. Acknowledgement of this Policy does not in itself constitute consent to personal data processing where such consent is required by the laws of the Russian Federation.
5.4. Consent to the processing of personal data authorised by the data subject for dissemination shall, where required by law, be obtained separately from any other consent.

6. Personal Data Processing Operations and Methods
6.1. The Operator may perform the following operations in relation to personal data:
collection, recording, organisation, accumulation, storage, updating, alteration, retrieval, use, provision, access, anonymisation, blocking, deletion and destruction.
6.2. Personal data may be processed both by automated and non-automated means.
6.3. Access to personal data shall be granted only to employees of the Operator and other authorised persons who require such access in order to perform functions connected with the preparation and conduct of the Model.
6.4. Personal data shall not be transferred or disclosed to third parties except where:
1) such transfer or disclosure is necessary for the organisation and conduct of the Model and has a lawful basis;
2) personal data processing has been entrusted to another person or organisation under an agreement with the Operator;
3) the data subject has provided the relevant consent;
4) transfer or disclosure is required or otherwise permitted by the laws of the Russian Federation.
6.5. Persons processing personal data on behalf of the Operator shall be required to maintain the confidentiality and security of such data and to process them only within the scope of the Operator’s instructions.

7. Publication of Information, Photography and Video Recording
7.1. Photography and video recording may take place during open and public events held as part of the Model.
7.2. Photographs and video recordings may be used for internal organisational, archival and reporting purposes where an appropriate lawful basis exists.
7.3. Identifiable images of participants, their names or other personal data may be published on the official information resource of the Model, MGIMO University websites, social media, in the media or in other publicly accessible sources only where an appropriate lawful basis for such dissemination exists.
7.4. Where the laws of the Russian Federation require consent to dissemination, such consent shall be obtained separately and shall allow the data subject to specify the personal data authorised for dissemination and to impose any restrictions permitted by applicable law.

8. Personal Data Processing and Retention Periods
8.1. Personal data of applicants who are not selected and are not included in the reserve list shall be retained for no longer than 90 calendar days following publication of the selection results unless further processing is required for the handling of an enquiry, resolution of a dispute or another lawful purpose.
8.2. Personal data of persons included in the reserve list shall be processed until completion of the Model and for no longer than 90 calendar days thereafter unless longer processing is justified by another lawful basis.
8.3. Personal data of participants shall be processed throughout the preparation and conduct of the Model and, following its completion, for the period required to finalise results, issue documents, prepare reports and handle possible enquiries, but, as a general rule, for no longer than one year after completion of the Model unless a different period is required by the laws of the Russian Federation or applicable records-retention requirements.
8.4. Contact details of experts, lecturers and invited guests shall be processed during the preparation and conduct of the Model and, as a general rule, for no longer than one year following its completion unless further communication is based on another lawful ground.
8.5. The period during which personal data may be disseminated shall be determined by the relevant consent and shall terminate in the circumstances provided by the laws of the Russian Federation.
8.6. Documents and information evidencing the existence of a lawful basis for personal data processing may be retained for the period required for the Operator to comply with statutory obligations and protect its rights and legitimate interests.

9. Data Localisation and Cross-Border Transfers
9.1. When collecting personal data of citizens of the Russian Federation through the Internet, the Operator shall comply with the personal data localisation requirements established by the laws of the Russian Federation.
9.2. Recording, organisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation shall be carried out in compliance with the statutory requirements concerning the use of databases located within the territory of the Russian Federation.
9.3. Cross-border transfers of personal data may take place only where a lawful basis exists and after the Operator has complied with the requirements established by the laws of the Russian Federation.
9.4. The international nature of the Model does not, in itself, constitute a lawful basis for transferring participants’ personal data to the International Telecommunication Union, foreign organisations, foreign public authorities or foreign experts.

10. Personal Data Security
10.1. The Operator shall implement the legal, organisational and technical measures necessary to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination or other unlawful processing.
10.2. Measures for protecting personal data may include, in particular:
1) limiting the number of persons authorised to access personal data;
2) differentiating access rights to information systems;
3) using identification and authentication mechanisms;
4) creating backups and ensuring data integrity;
5) detecting, recording and reviewing information-security incidents;
6) informing personnel authorised to process personal data of the applicable statutory and internal requirements;
7) deleting, destroying or anonymising personal data once the purposes of processing have been achieved.

11. Rights of Data Subjects
11.1. A data subject has the right to:
1) obtain information concerning the processing of their personal data in accordance with applicable law;
2) request correction, blocking or destruction of personal data where such data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose;
3) withdraw consent to personal data processing;
4) request cessation of dissemination of personal data in the circumstances provided by law;
5) lodge a complaint concerning the actions or omissions of the Operator with the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or seek judicial protection;
6) exercise any other rights granted by the laws of the Russian Federation.
11.2. Withdrawal of consent shall not affect the lawfulness of personal data processing carried out before the withdrawal was received by the Operator.
11.3. Where permitted by applicable law, the Operator may continue processing personal data after withdrawal of consent where another lawful basis for such processing exists.

12. Requests and Contact Details
12.1. Requests concerning personal data processing, correction, cessation of processing, destruction of personal data or withdrawal of consent may be sent:
by post to: MGIMO University, 76 Vernadskogo Prospekt, Moscow 119454, Russian Federation;
by email to: [official email address for personal data-related requests].
12.2. For the purpose of identifying the person submitting a request, the Operator may request information reasonably necessary to confirm the applicant’s identity and their connection with the relevant personal data, to the extent permitted by the laws of the Russian Federation.

13. Final Provisions
13.1. This Policy shall take effect on the date of its approval.
13.2. The Operator may amend this Policy in response to changes in the laws of the Russian Federation, the organisation and conduct of the Model, or the information systems used.
13.3. The current version of this Policy shall be published through the official information resource of the Model.
13.4. This English-language version constitutes a translation of the Russian-language Policy and is provided for the convenience of international applicants and participants. In the event of any discrepancy between the Russian-language and English-language versions, the Russian-language version shall prevail to the extent permitted by applicable law.