Продолжая пользоваться сайтом, вы даете согласие на обработку ваших данных.
Policy on the Processing and Protection of Personal Data of Evgeny Olegovich Bogutsky
Policy on the Processing and Protection of Personal Data of Evgeny Olegovich Bogutsky
1. General Provisions
1.1. This Policy of the individual Evgeny Olegovich Bogutsky (hereinafter referred to as the Operator) regarding the processing of personal data (hereinafter referred to as the Policy) has been developed pursuant to Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter referred to as Law No. 152-FZ) in order to ensure the protection of the rights and freedoms of individuals in the processing of their personal data, including the protection of the right to privacy and personal and family confidentiality, and defines the purposes and procedures for the processing of personal data as well as the measures taken by the Operator to ensure the security of personal data.
1.2.
This Policy applies to all personal data (hereinafter referred to as Personal Data) processed by the Operator.
1.3.
This Policy applies to relations concerning the processing of Personal Data that arose both before and after the approval of this Policy.
1.4.
This Policy contains information on the legal grounds, purposes, principles, and conditions for the processing of Personal Data, the rights of Personal Data subjects, the obligations of the Operator in general and of the person responsible for organizing the processing of Personal Data in particular, as well as liability for violations of the requirements of Law No. 152-FZ.
1.5.
The provisions of this Policy apply to all employees of the Operator (permanent, temporary, contract-based, etc.). Compliance with the requirements of this Policy is also mandatory for other persons when their participation in the processing of Personal Data is necessary, as well as when Personal Data is transferred to them in accordance with established procedures on the basis of contracts or other agreements for data processing.
1.6.
This Policy shall be reviewed and, if necessary, updated in the event of changes in the legislation of the Russian Federation in the field of Personal Data and/or the Operator’s internal regulations concerning the processing of Personal Data.
1.7.
In accordance with Part 2 of Article 18.1 of Law No. 152-FZ, this Policy is published in open access on the official website of the Operator on the Internet.
2. Terms and Definitions2.1.
The following basic terms and definitions are used in this Policy:
2.1.1. Personal Data
Any information relating directly or indirectly to an identified or identifiable individual (Personal Data subject).
2.1.2. Processing of Personal Data
Any action (operation) or set of actions (operations) performed with Personal Data using automation tools or without the use of such tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of Personal Data.
2.1.3. Automated Processing of Personal Data
Processing of Personal Data using computer technology.
2.1.4. Distribution of Personal Data
Actions aimed at disclosing Personal Data to an indefinite number of persons.
2.1.5. Provision of Personal Data
Actions aimed at disclosing Personal Data to a specific person or a specific group of persons.
2.1.6. Blocking of Personal Data
Temporary cessation of the processing of Personal Data, except where processing is necessary for clarification of the Personal Data.
2.1.7. Destruction of Personal Data
Actions resulting in the impossibility of restoring the content of Personal Data in a Personal Data information system and/or resulting in the destruction of physical media containing Personal Data.
2.1.8. Anonymization of Personal Data
Actions resulting in the impossibility of determining, without the use of additional information, whether Personal Data belongs to a specific Personal Data subject.
2.1.9. Personal Data Information System
A set of Personal Data contained in databases and the information technologies and technical means that ensure their processing.
3. Rights and Obligations of the Operator 3.1. The Operator shall have the right to: 3.1.1.Independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations established by Law No. 152-FZ and the regulations adopted pursuant thereto, unless otherwise provided by Law No. 152-FZ or other federal laws.
3.1.2.Entrust the processing of Personal Data to another person with the consent of the Personal Data subject, unless otherwise provided by federal law, on the basis of a contract concluded with such person. A person processing Personal Data on behalf of the Operator shall comply with the principles and rules for Personal Data processing established by Law No. 152-FZ, this Policy, and/or other internal regulations of the Operator concerning Personal Data processing.
3.1.3.Continue processing Personal Data without the consent of the Personal Data subject if such consent has been withdrawn, provided that the legal grounds specified in Law No. 152-FZ exist.
3.2. The Operator shall: 3.2.1.Organize the processing of Personal Data in accordance with the requirements of Law No. 152-FZ.
3.2.2.Respond to requests and inquiries from Personal Data subjects and their legal representatives in accordance with the requirements of Law No. 152-FZ.
3.2.3.Provide the Personal Data subject, upon request, with the information stipulated by Part 7 of Article 14 of Law No. 152-FZ.
3.2.4.Where Personal Data has not been obtained directly from the Personal Data subject, the Operator shall, except in the cases provided for in Part 4 of Article 18 of Law No. 152-FZ, provide the Personal Data subject with the following information prior to commencing processing:
4. Rights and Obligations of the Personal Data Subject 4.1. The Personal Data subject shall have the right to: 4.1.1.Require the Operator to clarify, block, or destroy their Personal Data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the declared purpose of processing, as well as to take other measures provided by law to protect their rights.
4.1.2.Receive information concerning the processing of their Personal Data, including:
4.2. The Personal Data subject shall: 4.2.1.Provide complete, accurate, and reliable information concerning their Personal Data and/or documents containing such Personal Data.
5. Purposes of Personal Data Processing 5.1.The processing of Personal Data by the Operator shall be limited to the achievement of specific, predetermined, and lawful purposes. Processing of Personal Data that is incompatible with the purposes for which the Personal Data was collected is prohibited.
5.2.The Operator processes Personal Data in the course of its activities for the following purposes:
5.2.1.To achieve the purposes established by an international treaty of the Russian Federation or by law, and to perform the functions, powers, and obligations imposed on the Operator by the legislation of the Russian Federation.
5.2.2.To ensure the participation of the Personal Data subject and/or the Operator in constitutional, civil, administrative, criminal, and commercial (arbitrazh) court proceedings.
5.2.3.To execute court judgments, acts of other authorities, or decisions of officials subject to enforcement under the legislation of the Russian Federation on enforcement proceedings.
5.2.4.To conclude, perform, and terminate civil law contracts with individuals, legal entities, sole proprietors, and other persons in cases provided for by law.
5.2.5.To prepare reference materials for the internal information support of the Operator's activities.
5.2.6.To fulfill obligations imposed on the Operator by the legislation of the Russian Federation, including obligations related to submitting employees' Personal Data to tax authorities, the Pension Fund of the Russian Federation, the Social Insurance Fund of the Russian Federation, the Federal Mandatory Medical Insurance Fund, and other governmental authorities as required by applicable law.
5.2.7.To provide employees with additional guarantees and benefits, including voluntary health insurance.
5.2.8.To review job applicants' resumes.
5.2.9.To maintain a talent pool (personnel reserve).
5.2.10.To maintain personnel records and facilitate employee support.
5.2.11.To maintain accounting and bookkeeping records.
5.2.12.To administer access control procedures.
5.2.13.To provide employees with electronic signature facilities.
5.2.14.To carry out activities related to mobilization preparedness, civil defense, and emergency prevention.
5.2.15.To interact with secondary school graduates applying to higher or vocational educational institutions for the purpose of concluding targeted education agreements.
5.2.16.To interact with students of higher or vocational educational institutions for the purpose of concluding practical training agreements and maintaining up-to-date information on students enrolled under targeted education programs.
5.2.17.To protect the life, health, or other vital interests of the Personal Data subject where obtaining the subject's consent is impossible.
5.2.18.To conduct statistical or other research activities, except as prohibited under Article 15 of Law No. 152-FZ, provided that the Personal Data is anonymized.
5.2.19.To publish or otherwise disclose Personal Data where such publication or disclosure is required by Law No. 152-FZ.
5.2.20.To review requests and inquiries submitted by Personal Data subjects and their legal representatives.
5.2.21.For other purposes specified in the Personal Data subject's consent to the processing of their Personal Data.
6. Legal Grounds for the Processing of Personal DataThe Operator processes Personal Data on the following legal grounds:
7. Scope and Categories of Personal Data Processed; Categories of Personal Data Subjects 7.1. Scope of Personal Data Processed 7.1.1.The content and scope of the Personal Data processed by the Operator shall correspond to the declared purposes of processing. The processing of Personal Data that is excessive in relation to the stated purposes is not permitted. Where necessary, the Operator shall clarify and update the stated purposes of processing.
7.1.2.The list of Personal Data processed by the Operator shall be determined in accordance with the legislation of the Russian Federation, taking into account the purposes of processing specified in Section 5 of this Policy.
7.2. Categories of Personal Data Processed 7.2.1. Publicly Available Personal DataInformation obtained exclusively from publicly available sources of Personal Data, including public directories, address books, recruitment services, and publicly available resumes (prior to their storage or printing by the Operator).
7.2.2. Special Categories of Personal DataPersonal Data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, or the intimate life of a Personal Data subject.
7.2.3. Biometric Personal DataPersonal Data characterizing the physiological or biological characteristics of an individual that can be used to establish that individual's identity, including but not limited to:
7.3. Categories of Personal Data SubjectsThe Operator processes Personal Data relating to the following categories of individuals:
EmployeesPersonal Data relating to the Operator's employees.
Third PartiesPersonal Data relating to:
7.5.The Operator does not process Special Categories of Personal Data relating to:
8. Procedure and Conditions for the Processing of Personal Data 8.1. Procedure for Processing Personal Data 8.1.1.The Operator shall process Personal Data in accordance with the legislation of the Russian Federation and the Operator's internal regulations. Such processing may be carried out by the Operator's employees and/or by third-party organizations engaged by the Operator under agreements for the provision of relevant services.
8.1.2.Personal Data shall be processed with the consent of the Personal Data subject, as well as without such consent where permitted by the legislation of the Russian Federation.
8.1.3.Only those employees whose job responsibilities include the processing of Personal Data shall be authorized to process such data.
8.1.4.The Operator's processing of Personal Data includes the following operations:
8.1.7.The Operator and any other persons who have gained access to Personal Data shall not disclose or distribute such Personal Data to third parties without the consent of the Personal Data subject unless otherwise provided by federal law.
8.1.8.Consent to the processing of Personal Data that the Personal Data subject has authorized for public dissemination shall be obtained separately from any other consent to the processing of Personal Data.
8.1.9.The Operator may transfer Personal Data to inquiry bodies, investigative authorities, and other authorized governmental bodies on the grounds provided for by the legislation of the Russian Federation.
8.1.10.The Operator shall develop and approve:
8.1.14.When storing Personal Data, the Operator shall use databases located within the territory of the Russian Federation in accordance with Part 5 of Article 18 of Federal Law No. 152-FZ.
8.1.15.Where Personal Data is processed without the use of automated means, such Personal Data shall be kept separate from other information, including by recording it on separate physical media containing Personal Data.
8.1.16.Where different categories of Personal Data recorded on the same physical medium are processed for incompatible purposes, and the medium does not permit separate processing of such data, the Operator shall take measures to ensure separate processing, including:
8.2. Conditions for the Processing of Personal Data 8.2.1.Personal Data shall be processed on a lawful and fair basis.
8.2.2.The processing of Personal Data shall be limited to specific, predetermined, and lawful purposes. Processing that is incompatible with the purposes for which the Personal Data was collected shall not be permitted.
8.2.3.Databases containing Personal Data that are processed for purposes incompatible with one another shall not be merged.
8.2.4.Only Personal Data that is relevant and necessary for the purposes of processing shall be processed.
8.2.5.When processing Personal Data, the Operator shall ensure that such Personal Data is accurate, adequate, and, where necessary, kept up to date with regard to the purposes for which it is processed.
9. Updating, Rectification, Deletion, and Destruction of Personal Data; Responses to Requests for Access to Personal Data 9.1.In accordance with Article 14 of Federal Law No. 152-FZ, the Operator shall provide the Personal Data subject or the subject's representative with information regarding the existence of Personal Data relating to that Personal Data subject and shall provide access to such Personal Data upon request by the Personal Data subject or the subject's representative, or within ten (10) days from the date of receipt of such request.
9.2.The Operator shall provide the Personal Data subject or the subject's representative with access to the Personal Data relating to that subject free of charge.
Within no more than seven (7) business days from the date on which the Personal Data subject or the subject's representative provides evidence confirming that the Personal Data is incomplete, inaccurate, or outdated, the Operator shall make the necessary amendments.
Within no more than seven (7) business days from the date on which the Personal Data subject or the subject's representative provides evidence confirming that the Personal Data was obtained unlawfully or is not necessary for the stated purpose of processing, the Operator shall destroy such Personal Data.
The Operator shall notify the Personal Data subject or the subject's representative of the amendments made and the measures taken and shall take reasonable steps to notify any third parties to whom such Personal Data has previously been disclosed.
9.3.Where the inaccuracy of Personal Data has been confirmed on the basis of information provided by the Personal Data subject, the subject's representative, the authorized authority responsible for protecting the rights of Personal Data subjects, or other necessary documents, the Operator shall update the Personal Data, or ensure that it is updated where processing is carried out by a processor acting on behalf of the Operator, within seven (7) business days from the date such information is received, and shall remove any blocking previously imposed on the Personal Data.
9.4.The Operator shall cease processing Personal Data, or ensure that processing is ceased by a processor acting on behalf of the Operator, in the following cases:
Where it is impossible to destroy the Personal Data within the specified period, the Operator shall block such Personal Data, or ensure that it is blocked by the processor acting on behalf of the Operator, and shall ensure its destruction within a period not exceeding six (6) months, unless a different period is established by federal law.
1.1. This Policy of the individual Evgeny Olegovich Bogutsky (hereinafter referred to as the Operator) regarding the processing of personal data (hereinafter referred to as the Policy) has been developed pursuant to Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter referred to as Law No. 152-FZ) in order to ensure the protection of the rights and freedoms of individuals in the processing of their personal data, including the protection of the right to privacy and personal and family confidentiality, and defines the purposes and procedures for the processing of personal data as well as the measures taken by the Operator to ensure the security of personal data.
1.2.
This Policy applies to all personal data (hereinafter referred to as Personal Data) processed by the Operator.
1.3.
This Policy applies to relations concerning the processing of Personal Data that arose both before and after the approval of this Policy.
1.4.
This Policy contains information on the legal grounds, purposes, principles, and conditions for the processing of Personal Data, the rights of Personal Data subjects, the obligations of the Operator in general and of the person responsible for organizing the processing of Personal Data in particular, as well as liability for violations of the requirements of Law No. 152-FZ.
1.5.
The provisions of this Policy apply to all employees of the Operator (permanent, temporary, contract-based, etc.). Compliance with the requirements of this Policy is also mandatory for other persons when their participation in the processing of Personal Data is necessary, as well as when Personal Data is transferred to them in accordance with established procedures on the basis of contracts or other agreements for data processing.
1.6.
This Policy shall be reviewed and, if necessary, updated in the event of changes in the legislation of the Russian Federation in the field of Personal Data and/or the Operator’s internal regulations concerning the processing of Personal Data.
1.7.
In accordance with Part 2 of Article 18.1 of Law No. 152-FZ, this Policy is published in open access on the official website of the Operator on the Internet.
2. Terms and Definitions2.1.
The following basic terms and definitions are used in this Policy:
2.1.1. Personal Data
Any information relating directly or indirectly to an identified or identifiable individual (Personal Data subject).
2.1.2. Processing of Personal Data
Any action (operation) or set of actions (operations) performed with Personal Data using automation tools or without the use of such tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of Personal Data.
2.1.3. Automated Processing of Personal Data
Processing of Personal Data using computer technology.
2.1.4. Distribution of Personal Data
Actions aimed at disclosing Personal Data to an indefinite number of persons.
2.1.5. Provision of Personal Data
Actions aimed at disclosing Personal Data to a specific person or a specific group of persons.
2.1.6. Blocking of Personal Data
Temporary cessation of the processing of Personal Data, except where processing is necessary for clarification of the Personal Data.
2.1.7. Destruction of Personal Data
Actions resulting in the impossibility of restoring the content of Personal Data in a Personal Data information system and/or resulting in the destruction of physical media containing Personal Data.
2.1.8. Anonymization of Personal Data
Actions resulting in the impossibility of determining, without the use of additional information, whether Personal Data belongs to a specific Personal Data subject.
2.1.9. Personal Data Information System
A set of Personal Data contained in databases and the information technologies and technical means that ensure their processing.
3. Rights and Obligations of the Operator 3.1. The Operator shall have the right to: 3.1.1.Independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations established by Law No. 152-FZ and the regulations adopted pursuant thereto, unless otherwise provided by Law No. 152-FZ or other federal laws.
3.1.2.Entrust the processing of Personal Data to another person with the consent of the Personal Data subject, unless otherwise provided by federal law, on the basis of a contract concluded with such person. A person processing Personal Data on behalf of the Operator shall comply with the principles and rules for Personal Data processing established by Law No. 152-FZ, this Policy, and/or other internal regulations of the Operator concerning Personal Data processing.
3.1.3.Continue processing Personal Data without the consent of the Personal Data subject if such consent has been withdrawn, provided that the legal grounds specified in Law No. 152-FZ exist.
3.2. The Operator shall: 3.2.1.Organize the processing of Personal Data in accordance with the requirements of Law No. 152-FZ.
3.2.2.Respond to requests and inquiries from Personal Data subjects and their legal representatives in accordance with the requirements of Law No. 152-FZ.
3.2.3.Provide the Personal Data subject, upon request, with the information stipulated by Part 7 of Article 14 of Law No. 152-FZ.
3.2.4.Where Personal Data has not been obtained directly from the Personal Data subject, the Operator shall, except in the cases provided for in Part 4 of Article 18 of Law No. 152-FZ, provide the Personal Data subject with the following information prior to commencing processing:
- The name or full name and address of the Operator or its representative;
- The purpose and legal basis for processing Personal Data;
- The intended users of the Personal Data;
- The rights of the Personal Data subject established by Law No. 152-FZ;
- The source from which the Personal Data was obtained.
- Appointing a person responsible for organizing the processing of Personal Data;
- Adopting documents defining the Operator's policy regarding Personal Data processing, internal regulations governing Personal Data processing, and procedures aimed at preventing and detecting violations of the legislation of the Russian Federation in the field of Personal Data and eliminating the consequences of such violations;
- Applying legal, organizational, and technical measures to ensure the security of Personal Data in accordance with Article 19 of Law No. 152-FZ;
- Conducting internal monitoring and/or audits to verify compliance of Personal Data processing with Law No. 152-FZ, applicable regulations, Personal Data protection requirements, this Policy, and the Operator's internal regulations;
- Assessing the potential harm that may be caused to Personal Data subjects in the event of violations of Law No. 152-FZ and evaluating such harm against the measures implemented by the Operator to comply with legal requirements;
- Familiarizing employees directly involved in the processing of Personal Data with the provisions of the legislation of the Russian Federation on Personal Data, including Personal Data protection requirements, this Policy, and the Operator's internal regulations, and/or providing appropriate training.
4. Rights and Obligations of the Personal Data Subject 4.1. The Personal Data subject shall have the right to: 4.1.1.Require the Operator to clarify, block, or destroy their Personal Data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the declared purpose of processing, as well as to take other measures provided by law to protect their rights.
4.1.2.Receive information concerning the processing of their Personal Data, including:
- Confirmation that the Operator processes their Personal Data;
- The legal grounds and purposes of the processing;
- The Personal Data being processed, relating to the relevant Personal Data subject, and the source from which such data was obtained, unless another procedure is established by Law No. 152-FZ;
- The period during which the Personal Data will be processed, including the retention period;
- The procedure for exercising the rights granted to the Personal Data subject under Law No. 152-FZ;
- Other information provided for by Law No. 152-FZ or other federal laws.
4.2. The Personal Data subject shall: 4.2.1.Provide complete, accurate, and reliable information concerning their Personal Data and/or documents containing such Personal Data.
5. Purposes of Personal Data Processing 5.1.The processing of Personal Data by the Operator shall be limited to the achievement of specific, predetermined, and lawful purposes. Processing of Personal Data that is incompatible with the purposes for which the Personal Data was collected is prohibited.
5.2.The Operator processes Personal Data in the course of its activities for the following purposes:
5.2.1.To achieve the purposes established by an international treaty of the Russian Federation or by law, and to perform the functions, powers, and obligations imposed on the Operator by the legislation of the Russian Federation.
5.2.2.To ensure the participation of the Personal Data subject and/or the Operator in constitutional, civil, administrative, criminal, and commercial (arbitrazh) court proceedings.
5.2.3.To execute court judgments, acts of other authorities, or decisions of officials subject to enforcement under the legislation of the Russian Federation on enforcement proceedings.
5.2.4.To conclude, perform, and terminate civil law contracts with individuals, legal entities, sole proprietors, and other persons in cases provided for by law.
5.2.5.To prepare reference materials for the internal information support of the Operator's activities.
5.2.6.To fulfill obligations imposed on the Operator by the legislation of the Russian Federation, including obligations related to submitting employees' Personal Data to tax authorities, the Pension Fund of the Russian Federation, the Social Insurance Fund of the Russian Federation, the Federal Mandatory Medical Insurance Fund, and other governmental authorities as required by applicable law.
5.2.7.To provide employees with additional guarantees and benefits, including voluntary health insurance.
5.2.8.To review job applicants' resumes.
5.2.9.To maintain a talent pool (personnel reserve).
5.2.10.To maintain personnel records and facilitate employee support.
5.2.11.To maintain accounting and bookkeeping records.
5.2.12.To administer access control procedures.
5.2.13.To provide employees with electronic signature facilities.
5.2.14.To carry out activities related to mobilization preparedness, civil defense, and emergency prevention.
5.2.15.To interact with secondary school graduates applying to higher or vocational educational institutions for the purpose of concluding targeted education agreements.
5.2.16.To interact with students of higher or vocational educational institutions for the purpose of concluding practical training agreements and maintaining up-to-date information on students enrolled under targeted education programs.
5.2.17.To protect the life, health, or other vital interests of the Personal Data subject where obtaining the subject's consent is impossible.
5.2.18.To conduct statistical or other research activities, except as prohibited under Article 15 of Law No. 152-FZ, provided that the Personal Data is anonymized.
5.2.19.To publish or otherwise disclose Personal Data where such publication or disclosure is required by Law No. 152-FZ.
5.2.20.To review requests and inquiries submitted by Personal Data subjects and their legal representatives.
5.2.21.For other purposes specified in the Personal Data subject's consent to the processing of their Personal Data.
6. Legal Grounds for the Processing of Personal DataThe Operator processes Personal Data on the following legal grounds:
- contracts and agreements concluded between the Operator (or the Operator's representative) and the Personal Data subject;
- federal laws and other regulatory legal acts governing the protection and processing of Personal Data;
- the consent of Personal Data subjects to the processing of their Personal Data;
- other applicable regulatory legal acts and authorizing documents governing, among other things, the activities of the Operator.
7. Scope and Categories of Personal Data Processed; Categories of Personal Data Subjects 7.1. Scope of Personal Data Processed 7.1.1.The content and scope of the Personal Data processed by the Operator shall correspond to the declared purposes of processing. The processing of Personal Data that is excessive in relation to the stated purposes is not permitted. Where necessary, the Operator shall clarify and update the stated purposes of processing.
7.1.2.The list of Personal Data processed by the Operator shall be determined in accordance with the legislation of the Russian Federation, taking into account the purposes of processing specified in Section 5 of this Policy.
7.2. Categories of Personal Data Processed 7.2.1. Publicly Available Personal DataInformation obtained exclusively from publicly available sources of Personal Data, including public directories, address books, recruitment services, and publicly available resumes (prior to their storage or printing by the Operator).
7.2.2. Special Categories of Personal DataPersonal Data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, or the intimate life of a Personal Data subject.
7.2.3. Biometric Personal DataPersonal Data characterizing the physiological or biological characteristics of an individual that can be used to establish that individual's identity, including but not limited to:
- fingerprint data;
- iris scans;
- DNA analysis;
- height;
- weight;
- other physiological or biological characteristics;
- photographs;
- video recordings,
7.3. Categories of Personal Data SubjectsThe Operator processes Personal Data relating to the following categories of individuals:
EmployeesPersonal Data relating to the Operator's employees.
Third PartiesPersonal Data relating to:
- spouses;
- parents;
- children;
- former employees;
- relatives of former employees;
- applicants for vacant positions;
- landlords;
- citizens;
- counterparties;
- and other individuals whose Personal Data is processed in connection with the Operator's activities.
7.5.The Operator does not process Special Categories of Personal Data relating to:
- racial or ethnic origin;
- political opinions;
- religious beliefs;
- philosophical beliefs;
- intimate life.
8. Procedure and Conditions for the Processing of Personal Data 8.1. Procedure for Processing Personal Data 8.1.1.The Operator shall process Personal Data in accordance with the legislation of the Russian Federation and the Operator's internal regulations. Such processing may be carried out by the Operator's employees and/or by third-party organizations engaged by the Operator under agreements for the provision of relevant services.
8.1.2.Personal Data shall be processed with the consent of the Personal Data subject, as well as without such consent where permitted by the legislation of the Russian Federation.
8.1.3.Only those employees whose job responsibilities include the processing of Personal Data shall be authorized to process such data.
8.1.4.The Operator's processing of Personal Data includes the following operations:
- collection;
- recording;
- systematization;
- accumulation;
- storage;
- updating and amendment;
- retrieval;
- use;
- transfer (including disclosure, provision, and granting access);
- anonymization;
- blocking;
- deletion;
- destruction.
- obtaining Personal Data directly from the Personal Data subject in oral or written form;
- obtaining Personal Data from publicly available sources;
- receiving original documents containing Personal Data;
- making copies of documents containing Personal Data;
- entering Personal Data into paper-based or electronic records;
- generating Personal Data during personnel administration;
- entering, storing, and maintaining Personal Data in the Operator's information systems and databases;
- other lawful methods of processing Personal Data.
8.1.7.The Operator and any other persons who have gained access to Personal Data shall not disclose or distribute such Personal Data to third parties without the consent of the Personal Data subject unless otherwise provided by federal law.
8.1.8.Consent to the processing of Personal Data that the Personal Data subject has authorized for public dissemination shall be obtained separately from any other consent to the processing of Personal Data.
8.1.9.The Operator may transfer Personal Data to inquiry bodies, investigative authorities, and other authorized governmental bodies on the grounds provided for by the legislation of the Russian Federation.
8.1.10.The Operator shall develop and approve:
- this Policy governing the processing of Personal Data;
- internal regulations concerning the processing of Personal Data;
- internal procedures aimed at preventing and detecting violations of the legislation of the Russian Federation relating to Personal Data and eliminating the consequences of such violations.
- identifying threats to the security of Personal Data during processing;
- adopting internal regulations governing the processing and protection of Personal Data;
- appointing persons responsible for ensuring the security of Personal Data within the Operator's organizational units and information systems;
- creating appropriate conditions for working with Personal Data;
- maintaining records of documents containing Personal Data;
- organizing the operation of information systems processing Personal Data;
- storing Personal Data under conditions ensuring its integrity and preventing unauthorized access;
- providing training for employees engaged in the processing of Personal Data.
- achievement of the purposes for which the Personal Data was processed;
- expiration of the applicable consent period;
- withdrawal of consent by the Personal Data subject;
- detection of unlawful processing of Personal Data.
8.1.14.When storing Personal Data, the Operator shall use databases located within the territory of the Russian Federation in accordance with Part 5 of Article 18 of Federal Law No. 152-FZ.
8.1.15.Where Personal Data is processed without the use of automated means, such Personal Data shall be kept separate from other information, including by recording it on separate physical media containing Personal Data.
8.1.16.Where different categories of Personal Data recorded on the same physical medium are processed for incompatible purposes, and the medium does not permit separate processing of such data, the Operator shall take measures to ensure separate processing, including:
- where it is necessary to use or disclose only certain Personal Data recorded on the same physical medium, the Personal Data intended for use or disclosure shall be copied in a manner that prevents the simultaneous copying of Personal Data that is not intended for use or disclosure, and only the copied data shall be used or disclosed;
- where it is necessary to destroy or block only part of the Personal Data recorded on a physical medium, the medium shall be destroyed or blocked only after the information that is not subject to destruction or blocking has been copied in a manner that prevents the simultaneous copying of the Personal Data subject to destruction or blocking.
8.2. Conditions for the Processing of Personal Data 8.2.1.Personal Data shall be processed on a lawful and fair basis.
8.2.2.The processing of Personal Data shall be limited to specific, predetermined, and lawful purposes. Processing that is incompatible with the purposes for which the Personal Data was collected shall not be permitted.
8.2.3.Databases containing Personal Data that are processed for purposes incompatible with one another shall not be merged.
8.2.4.Only Personal Data that is relevant and necessary for the purposes of processing shall be processed.
8.2.5.When processing Personal Data, the Operator shall ensure that such Personal Data is accurate, adequate, and, where necessary, kept up to date with regard to the purposes for which it is processed.
9. Updating, Rectification, Deletion, and Destruction of Personal Data; Responses to Requests for Access to Personal Data 9.1.In accordance with Article 14 of Federal Law No. 152-FZ, the Operator shall provide the Personal Data subject or the subject's representative with information regarding the existence of Personal Data relating to that Personal Data subject and shall provide access to such Personal Data upon request by the Personal Data subject or the subject's representative, or within ten (10) days from the date of receipt of such request.
9.2.The Operator shall provide the Personal Data subject or the subject's representative with access to the Personal Data relating to that subject free of charge.
Within no more than seven (7) business days from the date on which the Personal Data subject or the subject's representative provides evidence confirming that the Personal Data is incomplete, inaccurate, or outdated, the Operator shall make the necessary amendments.
Within no more than seven (7) business days from the date on which the Personal Data subject or the subject's representative provides evidence confirming that the Personal Data was obtained unlawfully or is not necessary for the stated purpose of processing, the Operator shall destroy such Personal Data.
The Operator shall notify the Personal Data subject or the subject's representative of the amendments made and the measures taken and shall take reasonable steps to notify any third parties to whom such Personal Data has previously been disclosed.
9.3.Where the inaccuracy of Personal Data has been confirmed on the basis of information provided by the Personal Data subject, the subject's representative, the authorized authority responsible for protecting the rights of Personal Data subjects, or other necessary documents, the Operator shall update the Personal Data, or ensure that it is updated where processing is carried out by a processor acting on behalf of the Operator, within seven (7) business days from the date such information is received, and shall remove any blocking previously imposed on the Personal Data.
9.4.The Operator shall cease processing Personal Data, or ensure that processing is ceased by a processor acting on behalf of the Operator, in the following cases:
- where unlawful processing of Personal Data by the Operator or by a processor acting on behalf of the Operator has been identified, within no more than three (3) business days from the date such unlawful processing is detected;
- where the Personal Data subject withdraws consent to the processing of their Personal Data, unless another legal basis for processing exists under applicable law;
- where the purpose of processing has been achieved.
Where it is impossible to destroy the Personal Data within the specified period, the Operator shall block such Personal Data, or ensure that it is blocked by the processor acting on behalf of the Operator, and shall ensure its destruction within a period not exceeding six (6) months, unless a different period is established by federal law.
