Operator’s Policy on Personal Data Processing

1. General Provisions
1.1. The Operator’s Policy on Personal Data Processing (hereinafter, the “Policy”) has been developed to ensure the protection of the rights and freedoms of the personal data subject in the processing of his personal data, including the protection of the right to privacy and personal and family secrets.
1.2. The basic terms used in this Policy:
1.2.1. Personal data - any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).
1.2.2. Personal data processing - any action (operation) or set of actions (operations) performed on personal data, with or without the use of automation tools. Personal data processing includes, among other things:
- collection;
- recording;
- systematization;
- accumulation;
- storage;
- updating (renewal, modification);
- retrieval;
- use;
- transfer (dissemination, provision, access);
- anonymization;
- blocking;
- deletion;
- destruction.
1.2.3. Automated processing of personal data - processing of personal data with the use of computer technology.
1.2.4. Dissemination of personal data - actions aimed at disclosing personal data to an indefinite circle of persons.
1.2.5. Provision of personal data - actions aimed at disclosing personal data to a specific person or a specific circle of persons.
1.2.6. Blocking of personal data - temporary suspension of personal data processing (except in cases when processing is necessary to clarify personal data).
1.2.7. Destruction of personal data - actions resulting in the impossibility of restoring the content of personal data in personal data information systems and/or which result in the destruction of the tangible media containing personal data.
1.2.8. Anonymization of personal data - actions after which it becomes impossible, without the use of additional information, to identify personal data as belonging to a specific personal data subject.
1.2.9. Personal data operator (Operator) - a state authority, municipal authority, legal entity or individual which, independently or jointly with other persons, organizes and/or carries out the processing of personal data, and also determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed on personal data.
1.3. The Operator, having obtained access to personal data, must maintain the confidentiality of such personal data - not disclosing them to third parties and not disseminating personal data without the consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation.
1.4. The personal data subject has the right to obtain information concerning the processing of his personal data, including the following:
1) confirmation of the fact of personal data processing by the Operator;
2) the legal grounds and purposes of personal data processing;
3) the purposes of personal data processing and the methods of personal data processing used by the Operator;
4) the name and location of the Operator, and information about persons (except for the Operator’s employees) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or in accordance with the legislation of the Russian Federation;
5) the personal data being processed that relate to the respective personal data subject, and the source of such data, unless a different procedure for providing such data is provided by the legislation of the Russian Federation;
6) the time periods for processing personal data, including the periods for which personal data will be stored;
7) the procedure for the personal data subject to exercise the rights provided by the legislation of the Russian Federation;
8) information on any performed or intended cross-border data transfer;
9) the name or surname, first name, patronymic, and address of the person processing personal data on behalf of the Operator, if the processing is or will be entrusted to such a person;
9.1) information on the methods of the Operator’s fulfillment of the obligations established by the legislation of the Russian Federation;
10) other information as specified by the Federal Law “On Personal Data” or other federal laws.
1.5. The personal data subject is entitled to demand that the Operator clarify (update) his personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, obtained unlawfully or are not necessary for the stated purpose of processing, as well as to take measures provided by law to protect his rights.
1.6. The personal data subject has the right to protect his rights and legitimate interests, including the right to compensation for damages and/or compensation for moral harm in court.
1.7. The personal data operator shall have the right to:
- defend its interests in court;
- provide personal data of subjects to third parties if this is provided by applicable legislation (tax authorities, law enforcement agencies, etc.);
- refuse to provide personal data in cases stipulated by law;
- use a subject’s personal data without his consent in cases provided for by law.
1.8. When collecting personal data, the Operator is obliged, at the request of the personal data subject, to provide information as specified in Part 7 of Article 14 of the Federal Law “On Personal Data”.
1.9. When collecting personal data, including via the Internet, the Operator must ensure that recording, systematization, accumulation, storage, updating (updating, changing), and retrieval of personal data of citizens of the Russian Federation is carried out using databases located on the territory of the Russian Federation, except for cases specified in clauses 2, 3, 4, and 8 of Part 1 of Article 6 of the Federal Law “On Personal Data”.

2. Purposes of Personal Data Collection
2.1. The processing of personal data is limited to the achievement of specific, predetermined, and lawful purposes. Processing of personal data that is incompatible with the purposes of personal data collection is not permitted.
2.2. The purposes of personal data processing derive, among other things, from an analysis of the legal acts regulating the Operator’s activities, the purposes of the activities actually carried out by the Operator, the activities provided for by the Operator’s constituent (founding) documents, and the Operator’s specific business processes in specific personal data information systems (segmented by the Operator’s structural subdivisions and their procedures with respect to certain categories of personal data subjects).
2.3. The purposes of the Operator’s processing of personal data include:
- concluding, executing, and terminating civil-law contracts;
- organizing the company’s human resources records, ensuring compliance with legal requirements, and concluding and fulfilling obligations under labor and civil-law contracts;
- maintaining HR documentation, assisting employees in employment, training, and promotion, and enabling employees to exercise benefits;
- fulfilling the requirements of tax legislation regarding the calculation and payment of personal income tax, contributions to extra-budgetary funds, and insurance contributions to extra-budgetary funds, as well as fulfilling the requirements of pension legislation when forming and submitting to the Pension Fund of the Russian Federation individualized data on each income recipient that are taken into account when calculating contributions for mandatory pension insurance;
- completing primary statistical documentation in accordance with labor and tax legislation and other federal laws.

3. Legal Grounds for Personal Data Processing
3.1. The legal grounds for processing personal data include:
- the aggregate of regulatory legal acts pursuant to which and in accordance with which the Operator carries out the processing of personal data;
- the Operator’s constituent documents;
- contracts concluded between the Operator and the personal data subject;
- the personal data subject’s consent to the processing of personal data (in cases not directly provided for by the legislation of the Russian Federation, but corresponding to the Operator’s authority).

4. Scope and Categories of Processed Personal Data, Categories of Personal Data Subjects
4.1. The content and scope of the personal data being processed correspond to the stated purposes of processing. The personal data being processed must not be excessive in relation to the stated purposes of their processing.
4.2. Processing of personal data is allowed in the following cases:
- the processing of personal data is carried out with the consent of the personal data subject to the processing of his personal data;
- the processing of personal data is necessary for the performance of a contract to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of a contract on the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;
- the processing of personal data is necessary to protect the life, health, or other vital interests of the personal data subject, if obtaining the personal data subject’s consent is impossible;
- the processing of personal data is necessary for the exercise of the rights and legitimate interests of the Operator or third parties (including in cases provided for by the Federal Law “On Protection of the Rights and Legal Interests of Individuals in the Conduct of Activities for the Recovery of Overdue Debts and on Amending the Federal Law ‘On Microfinance Activities and Microfinance Organizations’”), or for the achievement of socially significant purposes, provided that this does not violate the rights and freedoms of the personal data subject;
- the processing of personal data is necessary for the professional activities of a journalist and/or the lawful activities of a mass media outlet, or for scientific, literary or other creative activities, provided that the rights and legitimate interests of the personal data subject are not violated;
- the processing of personal data is carried out for statistical or other research purposes, except for the purposes specified in Article 15 of the Federal Law “On Personal Data”, provided that mandatory anonymization of personal data is performed;
- the processing of personal data is carried out for personal data made publicly available by the personal data subject (i.e. personal data to which an unlimited circle of persons has access as allowed by the personal data subject or at his request);
- the processing of personal data is carried out for personal data that must be published or are subject to mandatory disclosure in accordance with the legislation of the Russian Federation.
4.3. The categories of personal data subjects include:
4.3.1. Employees of the Operator, former employees, candidates for vacant positions, as well as relatives of employees.
In this category of subjects, the Operator processes personal data in connection with the administration of employment relations, which includes:
- last name, first name, patronymic;
- gender;
- citizenship;
- nationality;
- date (day, month, year) and place of birth (country, republic, krai, oblast, district, city, town, village, or other locality);
- residential address (postal code, country, republic, krai, oblast, district, city, town, village, street, house, building, apartment);
- information on registration at place of residence or place of stay (postal code, country, republic, krai, oblast, district, city, town, village, street, house, building, apartment);
- telephone numbers (home, mobile, work), email address;
- position held;
- information about employment history (names of organizations/agencies and positions held, duration of employment/service in those organizations/agencies);
- taxpayer identification number (date and place of tax registration, date of issuance of the certificate);
- data from the document confirming registration in the system of individual (personalized) record-keeping (including in electronic form);
- data from the compulsory health insurance policy;
- passport data or details of another identity document;
- data of the passport that certifies the identity of a citizen of the Russian Federation outside the territory of the Russian Federation;
- data from the work record book and any work record book insert;
- information on military service registration (series, number, date of issue, name of the authority that issued the military ID, military registration specialty, military rank, data on enlistment/discharge, on military service, on being in the reserve, on medical examinations and vaccinations);
- information on education (name of educational institution, date of graduation, specialty and qualification, academic degree, title, and details of the education and qualification document);
- information on additional professional education (date, location, program, and details of documents issued upon completion of the program);
- information on proficiency in foreign languages (foreign language and level of proficiency);
- information on criminal record (presence or absence of a criminal record, date (day, month, year) of being held criminally liable (or of removal or expungement of the criminal record), relevant legal article);
- information on legal capacity (details of the document establishing guardianship or custodianship, grounds for any limitation of legal capacity, details of the court decision);
- information on participation in the management of a business entity (except for housing, housing-construction, and garage cooperatives, horticultural, vegetable-gardening, and dacha consumer cooperatives, homeowners’ associations, and trade unions registered in the prescribed manner), and engagement in entrepreneurial activity;
- information contained in a medical certificate of the established form confirming the absence of any disease preventing entry into or service in the civil service (presence or absence of such disease, form of the disease);
- information on awards, other incentives, and distinctions (name of the award/incentive/distinction, date (day, month, year) awarded, details of the award or incentive document);
- information on disciplinary sanctions;
- information contained in materials of official investigations;
- information on marital status (marital state: single (never married), married, married again, divorced, widower/widow; date since when in current marriage; date since when divorced; number of marriages; family composition; details of marriage certificate);
- information on close relatives and in-laws (degree of relation, full name, date (day, month, year) and place of birth, place and address of work/service, address of residence, information on registration at place of residence or stay);
- information contained in income, expense, property and property obligations disclosure statements;
- bank account number;
- information on any security clearances for state secrets obtained;
- photographs.
4.3.2. Clients and counterparties of the Operator (individuals).
In this category of subjects, the Operator processes personal data obtained by the Operator in connection with the conclusion of a contract to which the personal data subject is a party, and which are used by the Operator solely for the performance of that contract and the conclusion of further contracts with the personal data subject:
- last name, first name, patronymic;
- gender;
- citizenship;
- date (day, month, year) and place of birth (country, republic, krai, oblast, district, city, town, village, or other locality);
- residential address (postal code, country, republic, krai, oblast, district, city, town, village, street, house, building, apartment);
- information on registration at place of residence or stay (postal code, country, republic, krai, oblast, district, city, town, village, street, house, building, apartment);
- telephone numbers (home, mobile, work), email address;
- position held;
- taxpayer identification number (date and place of tax registration, date of issuance of the certificate);
- passport data or details of another identity document;
- information on participation in the management of a business entity (except for housing, housing-construction, and garage cooperatives, horticultural, vegetable-gardening, and dacha consumer cooperatives, homeowners’ associations, and trade unions registered in the prescribed manner), and engagement in entrepreneurial activity;
- bank account number.
4.3.3. Representatives/employees of the Operator’s clients and counterparties (legal entities).
In this category of subjects, the Operator processes personal data obtained by the Operator in connection with the conclusion of a contract to which the client/counterparty (legal entity) is a party, and which are used by the Operator solely for the performance of that contract:
- last name, first name, patronymic;
- gender;
- telephone numbers (home, mobile, work), email address;
- position held;
- passport data or details of another identity document;
- information on participation in the management of a business entity (except for housing, housing-construction, and garage cooperatives, horticultural, vegetable-gardening, and dacha consumer cooperatives, homeowners’ associations, and trade unions registered in the prescribed manner), and engagement in entrepreneurial activity.
4.4. The processing of special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, or sex life is permitted in the following cases:
- if the personal data subject has given written consent to the processing of his personal data;
- in accordance with the legislation on state social assistance, labor legislation, and pension legislation of the Russian Federation.

5. Procedure and Conditions of Personal Data Processing
5.1. The Operator carries out the processing of personal data-operations performed with the use of automation tools (Google Analytics and Google Forms) or without the use of such tools on personal data - including collection, recording, systematization, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), anonymization, blocking, deletion, and destruction of personal data.
5.2. The processing of personal data is carried out in compliance with the principles and rules provided by Federal Law “On Personal Data”.
5.3. The processing of personal data by the Operator is limited to achieving specific, predetermined, and lawful purposes. Only personal data that meet the purposes of their processing shall be processed. The content and scope of the personal data processed must correspond to the stated purposes of processing.
5.4. Personal data must be stored in a form that allows identification of the personal data subject for no longer than the purposes of personal data processing require, unless a longer personal data storage period is established by the legislation of the Russian Federation or by a contract to which the personal data subject is a party, beneficiary, or guarantor. The personal data processed shall be destroyed or anonymized upon achievement of the purposes of processing or in the event that the need to achieve those purposes is no longer present, unless otherwise provided by federal law.
5.5. When storing personal data, the Operator must use databases located on the territory of the Russian Federation, in accordance with Part 5 of Article 18 of the Federal Law “On Personal Data”.
Personal data that is processed without the use of automation must be kept separate from other information, in particular by recording it on separate tangible media of personal data (hereinafter, “material media”), in special sections or fields of forms. When personal data is recorded on material media, it is not permitted to record on one material medium personal data whose processing purposes are clearly incompatible with each other. For the processing of different categories of personal data without the use of automation, a separate material medium must be used for each category of personal data.
5.6. The grounds for terminating the processing of personal data may include the achievement of the purposes of personal data processing, the expiration of the consent period or the withdrawal of the personal data subject’s consent to the processing of his personal data, as well as the discovery of unlawful processing of personal data.
5.7. The Operator has the right to entrust the processing of personal data to another person on the basis of a contract concluded with that person, including a state or municipal contract.
The person who processes personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided by Federal Law “On Personal Data”.
In addition, the Operator has the right to transfer personal data to inquiry and investigation authorities and other authorized bodies on the grounds provided by the legislation of the Russian Federation.
5.8. The Operator and other persons who have gained access to personal data are obliged not to disclose personal data to third parties and not to disseminate personal data without the consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation.
Consent to the processing of personal data permitted by the personal data subject for dissemination shall be executed separately from other consents of the personal data subject to the processing of his personal data. The Operator is obliged to provide the personal data subject with the ability to determine the list of personal data for each category of personal data that is specified in the consent to the processing of personal data which the personal data subject permits to be disseminated.
The transfer (dissemination, provision, access) of personal data permitted by the personal data subject for dissemination must be ceased at any time upon the demand of the personal data subject. Such a demand must include the last name, first name, patronymic (if any), contact information (telephone number, email address or postal address) of the personal data subject, as well as a list of the personal data whose processing is to be ceased. The personal data specified in that demand may only be processed by the Operator to whom it is addressed.
5.9. The Operator must take the measures necessary and sufficient to ensure the fulfillment of the obligations provided by the Federal Law “On Personal Data” and the regulatory legal acts adopted in accordance with it. The Operator independently determines the composition and list of such measures.
5.10. In processing personal data, the Operator takes or ensures the taking of the necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions with respect to personal data.

6. Procedure and Conditions for Processing Biometric Personal Data
6.1. Biometric personal data refers to information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established, and which is used by the Operator to establish the identity of the personal data subject.
6.2. Biometric personal data may be processed only with the written consent of the personal data subject, except for cases related to the implementation of international treaties of the Russian Federation on readmission, in connection with the administration of justice and the execution of judicial acts, in connection with the conduct of mandatory state dactyloscopic (fingerprint) registration, as well as in cases provided by the legislation of the Russian Federation on defense, on security, on countering terrorism, on transport security, on countering corruption, on operational-search activities, on public service, by the criminal-executive legislation of the Russian Federation, and by the legislation of the Russian Federation on the procedure for exit from and entry into the Russian Federation, and on the citizenship of the Russian Federation.
6.3. The processing of biometric personal data is carried out by the Operator in accordance with the requirements for the protection of biometric personal data established in accordance with Article 19 of the Federal Law “On Personal Data”.
6.4. The use and storage of biometric personal data outside personal data information systems may be carried out only on such material media and using such storage technologies that ensure the protection of these data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, or dissemination.
6.5. A “material medium” means a machine-readable information carrier (including magnetic and electronic media) on which information characterizing a person’s physiological features is recorded and stored, and on the basis of which the person’s identity can be established.
6.6. The Operator approves the procedure for transferring material media to authorized persons.
6.7. A material medium must be used for the period established by the Operator who recorded the biometric personal data on that material medium, but no longer than the service life of the material medium as set by its manufacturer.
6.8. The Operator is obliged to:
- keep a record of the number of copies of material media;
- assign a unique identification number to each material medium, allowing exact identification of the Operator who recorded the biometric personal data on that material medium.
6.9. Technologies for storing biometric personal data outside personal data information systems must ensure:
- access to the information contained on the material medium by authorized persons;
- the use of electronic signature tools or other information technologies that preserve the integrity and immutability of the biometric personal data recorded on the material medium;
- verification of the presence of the personal data subject’s written consent to the processing of his biometric personal data, or the presence of other grounds for personal data processing as established by the legislation of the Russian Federation in the sphere of relations connected with the processing of personal data.
6.10. When biometric personal data is stored outside personal data information systems, there must be a logging of any instances of unauthorized repeated or additional recording of information after its extraction from the personal data information system.

7. Updating, Correction, Deletion and Destruction of Personal Data, Responses to Personal Data Subjects’ Requests for Access to Personal Data
7.1. The Operator is obliged, in the manner prescribed by Article 14 of the Federal Law “On Personal Data”, to inform the personal data subject or his representative of the existence of personal data relating to that personal data subject, and to provide the opportunity to familiarize himself with those personal data upon the personal data subject’s or his representative’s request, or within thirty days from the date of receipt of a request from the personal data subject or his representative.
7.2. The Operator must provide the personal data subject or his representative with the opportunity to review, free of charge, the personal data relating to that personal data subject. Within a period not exceeding seven working days from the day the personal data subject or his representative provides information confirming that the personal data are incomplete, inaccurate or not up-to-date, the Operator shall make the necessary changes to those personal data. Within a period not exceeding seven working days from the day the personal data subject or his representative provides information confirming that such personal data were obtained unlawfully or are not necessary for the stated purpose of processing, the Operator shall destroy such personal data. The Operator is obliged to notify the personal data subject or his representative of the changes made and measures taken and to take reasonable measures to notify third parties to whom the personal data of the subject were disclosed.
7.3. In the event that the fact of inaccuracy of personal data is confirmed, the Operator, on the basis of information provided by the personal data subject or his representative or by an authorized body for the protection of the rights of personal data subjects, or on the basis of other necessary documents, must clarify (update) the personal data or ensure their clarification (if the processing of personal data is carried out by another person on behalf of the Operator) within seven working days from the day of submission of such information, and remove the blocking of the personal data.
7.4. The Operator is obliged to cease the processing of personal data, or ensure the cessation of personal data processing by a person acting on behalf of the Operator, in the following cases:
- if it is established that the processing of personal data by the Operator or by a person acting on behalf of the Operator is being carried out unlawfully, the processing must be stopped within a period not exceeding three working days from the date of the discovery of such unlawful processing;
- in the event the personal data subject withdraws his consent to the processing of his personal data;
- in the event the purpose of personal data processing has been achieved – the Operator must stop processing and destroy the personal data, or ensure their destruction (if the processing of personal data is carried out by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date of achievement of the purpose of processing. In the event that it is impossible to destroy the personal data within the specified period, the Operator shall block such personal data or ensure their blocking (if the processing of personal data is carried out by another person acting on behalf of the Operator) and ensure the destruction of the personal data within a period of no more than six months, unless a different period is established by federal laws.