Regulation on processing customers’ and counterparties’ personal data

Employer / organization​ Approved under No. Document number​ dated Document date.

This regulation governs internal handling of data concerning individual customers and counterparties’ representatives. A legal entity’s data are not in themselves personal data. Person responsible for organizing processing, their authority and deputizing arrangements: Responsible person and deputizing arrangements​. Employees shall comply with the requirements within their granted access rights.

The process register shall be maintained separately by purpose: entering into and performing contracts, mandatory recordkeeping and reporting, and handling requests; other purposes shall be included only after their basis has been checked. For each purpose, record the categories of data subjects, the specific data items, basis, actions, methods and retention period. A contract with a legal entity does not in itself authorize all processing of its employees’ data. Specific processes and organizational arrangements: Register of processes by purpose​. Before starting a new process, check data necessity, the legal basis, time limits and obligations to notify the authorized authority. Data shall not be collected “just in case”, nor may the purpose be changed without a lawful basis. Consent shall be used where it is the necessary basis, documented separately and supported by evidence. For processing required by law or for contract performance, the corresponding basis shall be used.

Data shall be received through the channels listed in the register, with the necessary information provided to the data subject; consent and other grounds shall be documented.

Only data necessary for the agreed purpose shall be collected: identifying, contact, contractual and payment information to the applicable extent. Identity documents shall not automatically be copied where the task can be accomplished by checking them or recording the necessary details. Special categories of data and biometric data shall not be collected by default and require a separate assessment of the basis and measures. When data are received from a third party, check the source and basis for transfer; provide the data subject with the information required by law unless a lawful exemption applies. Information from a publicly accessible source shall not be treated as freely usable for any purpose. Accuracy shall be checked when changes occur and when a data subject makes a request; data collected for different purposes shall not be combined contrary to the requirement of compatibility. Where consent is the basis, disclose the controller, purpose, data items and other necessary terms before obtaining it. Consent shall be documented separately from other documents being signed or confirmed; retain its version, date and evidence of the expression of will. Silence shall not be treated as consent in place of a refusal of optional processing.

Authorized roles: List of authorized persons/roles​. Access shall be limited by purpose and job necessity; reviews and termination of access shall be recorded. No cross-border transfers are made; connecting a new foreign service requires prior review.

Channels and identity verification: Request channels and identity verification​. Register each request with its receipt date, type, deadline and responsible person. Identity checks shall be proportionate and shall not result in excessive data collection. Responses shall be prepared in an accessible form without disclosing other persons’ data; refusals shall be justified by the applicable provision. Where accuracy is disputed, data shall be blocked during verification in the cases prescribed by law, provided this does not infringe the rights of data subjects or third parties. The request shall be forwarded to the responsible person. Information on processing shall be provided within 10 working days; any reasoned extension shall not exceed 5 working days. Inaccurate data shall be corrected within 7 working days in the cases prescribed by law. Unlawful processing shall cease within 3 working days; if it cannot be made lawful, the data shall be destroyed within 10 working days under the procedure prescribed by Article 21. Once the purpose is achieved, processing shall cease and the data shall be destroyed within 30 days of that date unless a statutory basis for continuation applies. Upon withdrawal of consent, processing shall cease, and data whose retention is no longer required for the processing purposes shall be destroyed within 30 days of receipt of the withdrawal, subject to the exceptions in parts 4 and 5 of Article 21. An independent request to stop processing shall be handled within 10 working days, with a possible reasoned extension of no more than 5 working days and the exceptions in part 5.1 of Article 21. If destruction within the prescribed periods is impossible, the data shall be blocked and destruction ensured within six months, unless federal law provides a different period. The reason for impossibility and monitoring of completion shall be documented. Prohibitions and restrictions on dissemination shall be observed separately.

Documents shall be organized by purpose and retention period, with restricted access; paper and electronic copies shall be tracked together. Once a purpose ends, the responsible person shall check mandatory retention periods, outstanding claims or requests, and other lawful grounds. Where such grounds exist, only the necessary data shall be retained, with ordinary use restricted. Withdrawal of consent shall be registered immediately; processing based solely on it shall cease under the statutory procedure. A duty to retain certain accounting documents does not permit continued advertising or other optional processing. Destruction shall be assigned to authorized persons; record the basis, data/media list, date, method and evidence of the result. Where processing is entrusted to a processor, the controller shall obtain confirmation of completion from the processor.

Periods by data and document type, termination, destruction and evidence: Document retention periods and responsible persons​. Upon detecting an incident, an employee shall immediately inform the responsible person. In the circumstances specified in part 3.1 of Article 21, the controller shall notify the authorized authority within 24 hours and provide information on the investigation within 72 hours. Logs, reviews and monitoring of deadlines: Registers and control review schedule​. Reviews shall cover consistency of the register with actual processes, lawfulness of grounds, and response, retention and deletion deadlines. Violations shall be recorded with a responsible person and deadline; a follow-up review shall confirm correction. Before receiving access to data, employees shall familiarize themselves with this regulation and their confidentiality duty; acknowledgment shall be repeated after changes. Persons responsible for acknowledgment, schedule and form of evidence: Employee acknowledgment and training​. Technical protection measures shall be defined in a separate internal regulation; the public policy shall be published separately. Signatory’s position​ __________ / Signatory’s full name​ /; authority Basis of authority​.