Оставьте Ваши контакты и мы свяжемся с Вами
Limited Liability Company
“REOCAT”
1. General Provisions
1.1. This Policy of REOCAT LLC regarding personal data processing (hereinafter referred to as the Policy) has been developed in fulfillment of the requirements of paragraph 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” (hereinafter referred to as the Personal Data Law) in order to ensure the protection of human and civil rights and freedoms when processing personal data, including the protection of rights to privacy, personal and family secrets.
1.2. The legal grounds for personal data processing are the Charter of the Operator, agreements concluded by the Operator with employees, customers, and other persons, as well as consents to personal data processing. The Policy applies to all personal data processed by REOCAT LLC (hereinafter referred to as the Operator).
1.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
1.4. In fulfillment of the requirements of part 2 of Article 18.1 of the Personal Data Law, this Policy is published in free access on the Operator’s website in the information and telecommunications network Internet.
1.5. Main terms used in the Policy:
personal data - any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
personal data operator (operator) - a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and/or carries out personal data processing, and also determines the purposes of personal data processing, the composition of personal data to be processed, and actions (operations) performed with personal data;
personal data processing - any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools. Personal data processing includes, among other things:
• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating, alteration);
• extraction;
• use;
• transfer (distribution, provision, access);
• depersonalization;
• blocking;
• deletion;
• destruction;
automated personal data processing - personal data processing using computer technology;
distribution of personal data - actions aimed at disclosing personal data to an indefinite range of persons;
provision of personal data - actions aimed at disclosing personal data to a specific person or a specific range of persons;
blocking of personal data - temporary termination of personal data processing (except in cases where processing is necessary to clarify personal data);
destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which tangible media containing personal data are destroyed;
depersonalization of personal data - actions as a result of which it becomes impossible, without the use of additional information, to determine whether personal data belongs to a specific personal data subject;
personal data information system - a set of personal data contained in databases and the information technologies and technical means ensuring their processing;
cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
1.6. Main rights and obligations of the Operator.
1.6.1. The Operator has the right:
1) to independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
2) to entrust personal data processing to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with such person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law;
3) in the event that the personal data subject withdraws consent to personal data processing, the Operator has the right to continue personal data processing without the consent of the personal data subject if there are grounds specified in the Personal Data Law.
1.6.2. The Operator is obliged:
1) to organize personal data processing in accordance with the requirements of the Personal Data Law;
2) to respond to appeals and requests of personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
3) to provide the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) with the necessary information at the request of this body within 30 days from the date of receipt of such request.
1.7. Main rights of the personal data subject. The personal data subject has the right:
1) to receive information concerning the processing of his/her personal data, except in cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
2) to demand that the operator clarify his/her personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained or is not necessary for the stated purpose of processing, and also to take measures provided by law to protect his/her rights;
3) to put forward a condition of prior consent when processing personal data for the purpose of promoting goods, works and services on the market;
4) to appeal to Roskomnadzor or in court against unlawful actions or inaction of the Operator when processing his/her personal data.
1.8. Control over compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing personal data processing at the Operator.
1.9. Liability for violation of the requirements of the legislation of the Russian Federation and regulatory acts of the Operator in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.
2. Purposes of personal data collection
2.1. Personal data processing is limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of personal data collection is not allowed.
2.2. Only personal data that meets the purposes of its processing is subject to processing.
2.3. The Operator processes personal data for the following purposes, including but not limited to:
• ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation;
• carrying out its activities in accordance with the Operator’s charter;
• maintaining personnel records management;
• assisting employees in employment, education and career advancement, ensuring the personal safety of employees, controlling the quantity and quality of work performed, ensuring the safety of property;
• attracting and selecting candidates for employment with the Operator;
• organizing the registration of employees for individual (personalized) accounting in the compulsory pension insurance system;
• filling out and submitting required reporting forms to executive authorities and other authorized organizations;
• carrying out civil-law relations;
• maintaining accounting records;
• carrying out access control.
2.4. Processing of employees’ personal data may be carried out exclusively for the purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal grounds for personal data processing
3.1. The legal ground for personal data processing is a set of regulatory legal acts in fulfillment of which and in accordance with which the Operator carries out personal data processing, including:
• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Labor Code of the Russian Federation;
• the Tax Code of the Russian Federation;
• Federal Law No. 14-FZ dated 08.02.1998 “On Limited Liability Companies”;
• Federal Law No. 402-FZ dated 06.12.2011 “On Accounting”;
• Federal Law No. 167-FZ dated 15.12.2001 “On Compulsory Pension Insurance in the Russian Federation”;
• Federal Law No. 326-FZ dated 29.11.2010 “On Compulsory Medical Insurance in the Russian Federation”;
• other regulatory legal acts regulating relations related to the Operator’s activities.
3.2. The legal grounds for personal data processing also include:
• the Operator’s charter;
• agreements concluded between the Operator and personal data subjects;
• consent of personal data subjects to the processing of their personal data.
4. Scope and categories of processed personal data,
categories of personal data subjects
4.1. The content and scope of processed personal data must correspond to the stated purposes of processing provided for in Section 2 of this Policy. The processed personal data must not be excessive in relation to the stated purposes of its processing.
4.2. The Operator may process personal data of the following categories of personal data subjects.
4.2.1. Candidates for employment with the Operator:
• surname, name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• contact details;
• information on education, work experience, qualifications;
• other personal data provided by candidates in resumes and cover letters.
4.2.2. Employees and former employees of the Operator:
• surname, name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• passport data;
• registered residential address;
• actual residential address;
• contact details;
• individual taxpayer number;
• individual personal account insurance number (SNILS);
• information on education, qualifications, professional training and advanced training;
• marital status, presence of children, family relations;
• information on employment activity, including the presence of incentives, awards and/or disciplinary sanctions;
• marriage registration data;
• military registration information;
• disability information;
• information on withholding of alimony;
• information on income from the previous place of work;
• other personal data provided by employees in accordance with the requirements of labor and other legislation of the Russian Federation.
4.2.3. Family members of the Operator’s employees:
• surname, name, patronymic;
• degree of kinship;
• year of birth;
• other personal data provided by employees in accordance with the requirements of the legislation of the Russian Federation.
4.2.4. Clients and counterparties of the Operator (individuals):
• surname, name, patronymic;
• date and place of birth;
• passport data;
• registered residential address;
• contact details;
• occupied position;
• individual taxpayer number;
• current account number;
• other personal data provided by clients and counterparties (individuals) necessary for the preparation, conclusion and performance of agreements.
4.2.5. Representatives (employees) of the Operator’s clients and counterparties (legal entities):
• surname, name, patronymic;
• contact details;
• occupied position;
• other personal data provided by representatives (employees) of clients and counterparties necessary for the preparation, conclusion and performance of agreements.
4.2.6. Visitors to the Operator’s website and social networks:
• surname, name, patronymic;
• contact details;
• other personal data provided by visitors to the Operator’s website and social networks necessary for the preparation, conclusion and performance of agreements.
4.3. The Operator does not process biometric personal data (information that characterizes the physiological and biological characteristics of a person on the basis of which his/her identity can be established), except in cases provided for by the legislation of the Russian Federation.
4.4. The Operator does not process special categories of personal data concerning racial or national affiliation, political views, religious or philosophical beliefs, health status, intimate life, except in cases provided for by the legislation of the Russian Federation.
5. Procedure and conditions for personal data processing
5.1. Personal data processing is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2. Personal data processing is carried out with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
5.3. The Operator carries out both automated and non-automated personal data processing.
5.4. Employees of the Operator whose job duties include personal data processing are allowed to process personal data.
5.5. Personal data processing is carried out by:
• obtaining personal data in oral and written form directly from personal data subjects;
• obtaining personal data from publicly available sources;
• entering personal data into journals, registers and information systems of the Operator;
• using other methods of personal data processing.
5.6. Disclosure to third parties and distribution of personal data without the consent of the personal data subject are not allowed, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the personal data subject for distribution is formalized separately from other consents of the personal data subject to the processing of his/her personal data.
5.7. Transfer of personal data to inquiry and investigation authorities, the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access to it, destruction, alteration, blocking, distribution and other unauthorized actions, including:
• identifying threats to the security of personal data during its processing;
• adopting local regulatory acts and other documents regulating relations in the field of personal data processing and protection;
• appointing persons responsible for ensuring the security of personal data in the structural subdivisions and information systems of the Operator;
• creating the necessary conditions for working with personal data;
• organizing the accounting of documents containing personal data;
• organizing work with information systems in which personal data is processed;
• storing personal data under conditions that ensure its preservation and exclude unlawful access to it;
• organizing training for employees of the Operator who process personal data.
5.9. The Operator stores personal data in a form that makes it possible to identify the personal data subject for no longer than required by the purposes of personal data processing, unless the personal data storage period is established by federal law or an agreement.
The Operator establishes the following periods for processing and storing personal data:
- personal data processed for the purposes of the main activity, during the term of the civil-law agreement and the limitation period after its completion;
- personal data processed in connection with employment relations - during the term of the employment agreement and 75 years after the termination of the employment agreement;
- personal data of candidates for vacant positions, including those who were not hired, - 1 year from the moment of making a negative decision.
5.10. When collecting personal data, including through the information and telecommunications network Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, alteration), and extraction of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, except in cases specified in the Personal Data Law.
6. Updating, correction, deletion and destruction
of personal data, responses to requests of subjects
for access to personal data
6.1. Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of personal data processing, as well as other information specified in part 7 of Article 14 of the Personal Data Law, are provided by the Operator to the personal data subject or his/her representative upon appeal or upon receipt of a request from the personal data subject or his/her representative.
The information provided does not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.
The request must contain:
• the number of the main document identifying the personal data subject or his/her representative, information on the date of issue of the specified document and the authority that issued it;
• information confirming the participation of the personal data subject in relations with the Operator (agreement number, date of conclusion of the agreement, conditional verbal designation and/or other information), or information otherwise confirming the fact of personal data processing by the Operator;
• signature of the personal data subject or his/her representative.
The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
If the appeal (request) of the personal data subject does not contain all necessary information in accordance with the requirements of the Personal Data Law, or the subject does not have rights of access to the requested information, a reasoned refusal is sent to him/her.
The right of the personal data subject to access his/her personal data may be restricted in accordance with part 8 of Article 14 of the Personal Data Law, including if the access of the personal data subject to his/her personal data violates the rights and lawful interests of third parties.
6.2. If inaccurate personal data is identified upon appeal of the personal data subject or his/her representative, or upon their request, or upon the request of Roskomnadzor, the Operator blocks personal data relating to this personal data subject from the moment of such appeal or receipt of the specified request for the verification period, if blocking personal data does not violate the rights and lawful interests of the personal data subject or third parties.
If the fact of inaccuracy of personal data is confirmed, the Operator, on the basis of information provided by the personal data subject or his/her representative, or by Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
6.3. If unlawful processing of personal data is identified upon appeal (request) of the personal data subject or his/her representative, or Roskomnadzor, the Operator blocks unlawfully processed personal data relating to this personal data subject from the moment of such appeal or receipt of the request.
6.4. Upon achievement of the purposes of personal data processing, and also in the event that the personal data subject withdraws consent to its processing, personal data shall be destroyed if:
• otherwise is not provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
• the operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
otherwise is not provided by another agreement between the Operator and the personal data subject.
“REOCAT”
PERSONAL DATA PROCESSING POLICY
1. General Provisions
1.1. This Policy of REOCAT LLC regarding personal data processing (hereinafter referred to as the Policy) has been developed in fulfillment of the requirements of paragraph 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” (hereinafter referred to as the Personal Data Law) in order to ensure the protection of human and civil rights and freedoms when processing personal data, including the protection of rights to privacy, personal and family secrets.
1.2. The legal grounds for personal data processing are the Charter of the Operator, agreements concluded by the Operator with employees, customers, and other persons, as well as consents to personal data processing. The Policy applies to all personal data processed by REOCAT LLC (hereinafter referred to as the Operator).
1.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
1.4. In fulfillment of the requirements of part 2 of Article 18.1 of the Personal Data Law, this Policy is published in free access on the Operator’s website in the information and telecommunications network Internet.
1.5. Main terms used in the Policy:
personal data - any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
personal data operator (operator) - a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and/or carries out personal data processing, and also determines the purposes of personal data processing, the composition of personal data to be processed, and actions (operations) performed with personal data;
personal data processing - any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools. Personal data processing includes, among other things:
• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating, alteration);
• extraction;
• use;
• transfer (distribution, provision, access);
• depersonalization;
• blocking;
• deletion;
• destruction;
automated personal data processing - personal data processing using computer technology;
distribution of personal data - actions aimed at disclosing personal data to an indefinite range of persons;
provision of personal data - actions aimed at disclosing personal data to a specific person or a specific range of persons;
blocking of personal data - temporary termination of personal data processing (except in cases where processing is necessary to clarify personal data);
destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which tangible media containing personal data are destroyed;
depersonalization of personal data - actions as a result of which it becomes impossible, without the use of additional information, to determine whether personal data belongs to a specific personal data subject;
personal data information system - a set of personal data contained in databases and the information technologies and technical means ensuring their processing;
cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
1.6. Main rights and obligations of the Operator.
1.6.1. The Operator has the right:
1) to independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
2) to entrust personal data processing to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with such person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law;
3) in the event that the personal data subject withdraws consent to personal data processing, the Operator has the right to continue personal data processing without the consent of the personal data subject if there are grounds specified in the Personal Data Law.
1.6.2. The Operator is obliged:
1) to organize personal data processing in accordance with the requirements of the Personal Data Law;
2) to respond to appeals and requests of personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
3) to provide the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) with the necessary information at the request of this body within 30 days from the date of receipt of such request.
1.7. Main rights of the personal data subject. The personal data subject has the right:
1) to receive information concerning the processing of his/her personal data, except in cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
2) to demand that the operator clarify his/her personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained or is not necessary for the stated purpose of processing, and also to take measures provided by law to protect his/her rights;
3) to put forward a condition of prior consent when processing personal data for the purpose of promoting goods, works and services on the market;
4) to appeal to Roskomnadzor or in court against unlawful actions or inaction of the Operator when processing his/her personal data.
1.8. Control over compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing personal data processing at the Operator.
1.9. Liability for violation of the requirements of the legislation of the Russian Federation and regulatory acts of the Operator in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.
2. Purposes of personal data collection
2.1. Personal data processing is limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of personal data collection is not allowed.
2.2. Only personal data that meets the purposes of its processing is subject to processing.
2.3. The Operator processes personal data for the following purposes, including but not limited to:
• ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation;
• carrying out its activities in accordance with the Operator’s charter;
• maintaining personnel records management;
• assisting employees in employment, education and career advancement, ensuring the personal safety of employees, controlling the quantity and quality of work performed, ensuring the safety of property;
• attracting and selecting candidates for employment with the Operator;
• organizing the registration of employees for individual (personalized) accounting in the compulsory pension insurance system;
• filling out and submitting required reporting forms to executive authorities and other authorized organizations;
• carrying out civil-law relations;
• maintaining accounting records;
• carrying out access control.
2.4. Processing of employees’ personal data may be carried out exclusively for the purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal grounds for personal data processing
3.1. The legal ground for personal data processing is a set of regulatory legal acts in fulfillment of which and in accordance with which the Operator carries out personal data processing, including:
• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Labor Code of the Russian Federation;
• the Tax Code of the Russian Federation;
• Federal Law No. 14-FZ dated 08.02.1998 “On Limited Liability Companies”;
• Federal Law No. 402-FZ dated 06.12.2011 “On Accounting”;
• Federal Law No. 167-FZ dated 15.12.2001 “On Compulsory Pension Insurance in the Russian Federation”;
• Federal Law No. 326-FZ dated 29.11.2010 “On Compulsory Medical Insurance in the Russian Federation”;
• other regulatory legal acts regulating relations related to the Operator’s activities.
3.2. The legal grounds for personal data processing also include:
• the Operator’s charter;
• agreements concluded between the Operator and personal data subjects;
• consent of personal data subjects to the processing of their personal data.
4. Scope and categories of processed personal data,
categories of personal data subjects
4.1. The content and scope of processed personal data must correspond to the stated purposes of processing provided for in Section 2 of this Policy. The processed personal data must not be excessive in relation to the stated purposes of its processing.
4.2. The Operator may process personal data of the following categories of personal data subjects.
4.2.1. Candidates for employment with the Operator:
• surname, name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• contact details;
• information on education, work experience, qualifications;
• other personal data provided by candidates in resumes and cover letters.
4.2.2. Employees and former employees of the Operator:
• surname, name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• passport data;
• registered residential address;
• actual residential address;
• contact details;
• individual taxpayer number;
• individual personal account insurance number (SNILS);
• information on education, qualifications, professional training and advanced training;
• marital status, presence of children, family relations;
• information on employment activity, including the presence of incentives, awards and/or disciplinary sanctions;
• marriage registration data;
• military registration information;
• disability information;
• information on withholding of alimony;
• information on income from the previous place of work;
• other personal data provided by employees in accordance with the requirements of labor and other legislation of the Russian Federation.
4.2.3. Family members of the Operator’s employees:
• surname, name, patronymic;
• degree of kinship;
• year of birth;
• other personal data provided by employees in accordance with the requirements of the legislation of the Russian Federation.
4.2.4. Clients and counterparties of the Operator (individuals):
• surname, name, patronymic;
• date and place of birth;
• passport data;
• registered residential address;
• contact details;
• occupied position;
• individual taxpayer number;
• current account number;
• other personal data provided by clients and counterparties (individuals) necessary for the preparation, conclusion and performance of agreements.
4.2.5. Representatives (employees) of the Operator’s clients and counterparties (legal entities):
• surname, name, patronymic;
• contact details;
• occupied position;
• other personal data provided by representatives (employees) of clients and counterparties necessary for the preparation, conclusion and performance of agreements.
4.2.6. Visitors to the Operator’s website and social networks:
• surname, name, patronymic;
• contact details;
• other personal data provided by visitors to the Operator’s website and social networks necessary for the preparation, conclusion and performance of agreements.
4.3. The Operator does not process biometric personal data (information that characterizes the physiological and biological characteristics of a person on the basis of which his/her identity can be established), except in cases provided for by the legislation of the Russian Federation.
4.4. The Operator does not process special categories of personal data concerning racial or national affiliation, political views, religious or philosophical beliefs, health status, intimate life, except in cases provided for by the legislation of the Russian Federation.
5. Procedure and conditions for personal data processing
5.1. Personal data processing is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2. Personal data processing is carried out with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
5.3. The Operator carries out both automated and non-automated personal data processing.
5.4. Employees of the Operator whose job duties include personal data processing are allowed to process personal data.
5.5. Personal data processing is carried out by:
• obtaining personal data in oral and written form directly from personal data subjects;
• obtaining personal data from publicly available sources;
• entering personal data into journals, registers and information systems of the Operator;
• using other methods of personal data processing.
5.6. Disclosure to third parties and distribution of personal data without the consent of the personal data subject are not allowed, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the personal data subject for distribution is formalized separately from other consents of the personal data subject to the processing of his/her personal data.
5.7. Transfer of personal data to inquiry and investigation authorities, the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access to it, destruction, alteration, blocking, distribution and other unauthorized actions, including:
• identifying threats to the security of personal data during its processing;
• adopting local regulatory acts and other documents regulating relations in the field of personal data processing and protection;
• appointing persons responsible for ensuring the security of personal data in the structural subdivisions and information systems of the Operator;
• creating the necessary conditions for working with personal data;
• organizing the accounting of documents containing personal data;
• organizing work with information systems in which personal data is processed;
• storing personal data under conditions that ensure its preservation and exclude unlawful access to it;
• organizing training for employees of the Operator who process personal data.
5.9. The Operator stores personal data in a form that makes it possible to identify the personal data subject for no longer than required by the purposes of personal data processing, unless the personal data storage period is established by federal law or an agreement.
The Operator establishes the following periods for processing and storing personal data:
- personal data processed for the purposes of the main activity, during the term of the civil-law agreement and the limitation period after its completion;
- personal data processed in connection with employment relations - during the term of the employment agreement and 75 years after the termination of the employment agreement;
- personal data of candidates for vacant positions, including those who were not hired, - 1 year from the moment of making a negative decision.
5.10. When collecting personal data, including through the information and telecommunications network Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, alteration), and extraction of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, except in cases specified in the Personal Data Law.
6. Updating, correction, deletion and destruction
of personal data, responses to requests of subjects
for access to personal data
6.1. Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of personal data processing, as well as other information specified in part 7 of Article 14 of the Personal Data Law, are provided by the Operator to the personal data subject or his/her representative upon appeal or upon receipt of a request from the personal data subject or his/her representative.
The information provided does not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.
The request must contain:
• the number of the main document identifying the personal data subject or his/her representative, information on the date of issue of the specified document and the authority that issued it;
• information confirming the participation of the personal data subject in relations with the Operator (agreement number, date of conclusion of the agreement, conditional verbal designation and/or other information), or information otherwise confirming the fact of personal data processing by the Operator;
• signature of the personal data subject or his/her representative.
The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
If the appeal (request) of the personal data subject does not contain all necessary information in accordance with the requirements of the Personal Data Law, or the subject does not have rights of access to the requested information, a reasoned refusal is sent to him/her.
The right of the personal data subject to access his/her personal data may be restricted in accordance with part 8 of Article 14 of the Personal Data Law, including if the access of the personal data subject to his/her personal data violates the rights and lawful interests of third parties.
6.2. If inaccurate personal data is identified upon appeal of the personal data subject or his/her representative, or upon their request, or upon the request of Roskomnadzor, the Operator blocks personal data relating to this personal data subject from the moment of such appeal or receipt of the specified request for the verification period, if blocking personal data does not violate the rights and lawful interests of the personal data subject or third parties.
If the fact of inaccuracy of personal data is confirmed, the Operator, on the basis of information provided by the personal data subject or his/her representative, or by Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
6.3. If unlawful processing of personal data is identified upon appeal (request) of the personal data subject or his/her representative, or Roskomnadzor, the Operator blocks unlawfully processed personal data relating to this personal data subject from the moment of such appeal or receipt of the request.
6.4. Upon achievement of the purposes of personal data processing, and also in the event that the personal data subject withdraws consent to its processing, personal data shall be destroyed if:
• otherwise is not provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
• the operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
otherwise is not provided by another agreement between the Operator and the personal data subject.