Personal Data Processing Policy

Approved on Approval date.

Data controller: Data controller​, taxpayer identification number (ИНН) Controller's taxpayer identification number (ИНН)​, address: Controller's address​. Contact for personal data matters: Contact details for requests​. This policy describes processing under Federal Law No. 152-FZ (152-ФЗ) and is publicly available without restriction. Arrangements for public access: Where the policy is available outside the website​. Notification to the authorized authority or applicable statutory exemption: Notification particulars / grounds for exemption​. A person responsible for organizing processing has been appointed; contact details: Contact of the person responsible for organizing processing​.

Processing is limited to predetermined lawful purposes. Combining databases for incompatible purposes and collecting excessive data are prohibited. Purposes: Processing is organized separately for each purpose; the table below is completed only for processes actually carried out. An entry in the policy does not create an independent legal ground.

Additions reflecting actual circumstances: Processing purposes​. Legal grounds for each purpose: Legal grounds for each purpose​. Where processing is necessary to comply with the law or perform a contract and has the corresponding legal ground, consent is not used as a formal substitute for that ground. Categories of data subjects by purpose: Categories of data subjects by purpose​. Data lists by purpose: Data lists for each purpose​. Processing operations and methods by purpose: Within the stated purpose, operations may include collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer where a legal ground exists, blocking, deletion and destruction. An automated, non-automated or combined method is specified for each purpose; operations are limited to what is necessary. Additions reflecting actual circumstances: Processing operations and methods by purpose​.

Storage and processing periods for each purpose, termination conditions and destruction procedure: The period is determined separately for each purpose, taking account of mandatory document retention, contract performance and other lawful grounds. Achievement of the purpose or termination of the ground triggers a review of the need for further storage; where no ground exists, data are destroyed under the prescribed procedure with confirmation. Withdrawal of consent does not override mandatory retention, but precludes continued processing based solely on the withdrawn consent. Additions reflecting actual circumstances: Processing/retention periods and destruction by purpose​. Data are updated as necessary and kept no longer than required for the purpose, unless another period is established on a lawful ground. Withdrawal of consent ends processing based on it, except where processing may lawfully continue on another ground.

When collecting personal data of Russian citizens, requirements to use databases located in the Russian Federation are observed in the cases provided by law. No cross-border transfers are made.

Measures applied: The controller appoints responsible persons, restricts access on a need-to-know basis, records storage media and requests, trains authorized employees and monitors compliance. Organizational and technical safeguards appropriate to the risks protect against accidental or unlawful access, alteration, loss and disclosure. Details whose disclosure would reduce security are not included in the public policy. Additions reflecting actual circumstances: Public description of safeguards​. A data subject may obtain information about processing, request updating, blocking or destruction where grounds exist, withdraw consent, and challenge the controller's actions before the authorized authority or a court. A request is sent to the specified address or contact with information enabling identity and the connection to the processing to be verified. Information requested is provided within 10 working days; a reasoned extension of no more than 5 working days is permitted in the cases provided by law. The controller considers requests, remedies violations and responds to incidents within statutory time limits. The current policy version is made available in the same manner; amending the text does not automatically expand consent previously given.

A request includes information identifying the requester and the relevant processing, the substance of the request and a convenient reply method. A representative provides evidence of authority. Do not send third-party information or additional document copies unless they are necessary to verify the request. The controller verifies the request and provides information about the grounds, purposes, methods, periods and recipients, or sends a reasoned refusal in the cases provided by law. Confirmed inaccuracies are corrected; unlawful processing is stopped. If data have been sent to a processor, the controller ensures that the processor also implements the decision. A complaint may be submitted to the authorized authority for the protection of personal data subjects' rights or to a court. Contacting the controller does not remove the right to such protection.

Before starting a new process, the controller checks the lawfulness of the purposes, the data involved and the need for notifications and information to data subjects. Entrusting processing to another person does not release the controller from responsibility to the data subject. Data are provided to an authorized state authority only upon a lawful request and only to the extent necessary. The controller keeps information current, considers requests and takes steps to remedy violations. A new policy version is published with its approval date; it does not retrospectively expand the purposes or scope of consent previously obtained.