Privacy policy

This Policy defines the procedure for processing personal data and measures to ensure the security of personal data in accordance with the order of the Director of Ural Les LLC (hereinafter referred to as the Operator) with the aim of protecting the rights and freedoms of individuals and citizens during the processing of their personal data, including the protection of rights to privacy, personal and family secrets.

The Personal Data Processing Policy (hereinafter referred to as the Policy) has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006 "On Personal Data".

The Policy applies to all personal data of subjects processed by the Operator with and without the use of automation tools.

Any personal data subject has access to this Policy. The Policy is published on the Operator's official website (https://uralwood.com/).

Legal bases for personal data processing:

• Labor Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Civil Procedure Code of the Russian Federation;
• Federal Law No. 402-FZ of December 06, 2011 "On Accounting";
• Federal Law No. 27 of April 01, 1996 "On Individual (Personalized) Accounting in the Compulsory Pension Insurance System";
• Federal Law No. 400-FZ of December 28, 2013 "On Insurance Pensions";
• Federal Law No. 173-FZ of December 17, 2001 "On Labor Pensions in the Russian Federation";
• Federal Law No. 223-FZ of July 18, 2011 "On Procurement of Goods, Works, Services by Certain Types of Legal Entities";
• Federal Law No. 326-FZ of November 29, 2010 "On Compulsory Medical Insurance in the Russian Federation";
• Federal Law No. 53-FZ of March 28, 1998 "On Military Duty and Military Service";
• Decree of the President of the Russian Federation No. 400 of July 02, 2021 "On the National Security Strategy of the Russian Federation";
• Decree of the Government of the Russian Federation No. 719 of November 27, 2006 "Regulations on Military Registration";
• Charter of Ural Les Limited Liability Company;
• Agreements concluded between the Operator and the personal data subject;
• Consents of personal data subjects to personal data processing.

Key Concepts Used in This Policy

The following key concepts are used in this Policy:

Automated personal data processing – personal data processing using computer technology;
Automated workstation (AWS) – a hardware and software complex of an automated system designed to automate a specific type of activity;
Blocking of personal data – temporary cessation of personal data processing (except in cases where processing is necessary for clarifying personal data);
Personal data information system – a collection of personal data contained in databases and the information technologies and technical means ensuring their processing;
Confidentiality of personal data – a requirement for the operator or any other person who has gained access to personal data not to disclose them without the consent of the subject or other legal basis;
Carrier – a material object, including a physical field, in which information is displayed in the form of symbols, images, signals, technical solutions and processes, quantitative characteristics of physical quantities.
Depersonalization of personal data – actions as a result of which it becomes impossible to determine the ownership of personal data to a specific personal data subject without using additional information;
Personal data processing – any action (operation) or set of actions performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data;
Operator – a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and/or carrying out personal data processing, and also determining the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;
Personal data – any information directly or indirectly related to an identified or identifiable natural person;
Personal data authorized by the personal data subject for dissemination – personal data to which an unlimited circle of persons has been granted access by the personal data subject by giving consent to the processing of personal data authorized by the personal data subject for dissemination in the established manner;
Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons;
Dissemination of personal data – actions aimed at disclosing personal data to an unlimited group of persons;
Personal data subject – a natural person who is directly or indirectly identified or identifiable through personal data;
Transborder transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign state authority, foreign individual or foreign legal entity;
Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which personal data carriers are destroyed.

Main Goals of Personal Data Processing

Purpose of personal data processing:

Registration and accounting of employees: creating necessary conditions for performing official duties, ensuring compliance with laws and other regulatory legal acts, assisting in training and professional development, career advancement, ensuring personal safety of employees, preservation of property, control of quantity and quality of work performed.

Categories of personal data processed for this purpose:

Surname, first name, patronymic; age; date and place of birth; citizenship; residential registration address and actual residence address; passport data (series, number, by whom and when issued); contact information (mobile phone, email address); data from education, qualification, professional training (retraining) documents; information on professional development; marital status; information on family composition; information on social benefits; TIN; SNILS; medical policy; military registration data (reserve category, military rank, fitness for military service category, information on removal from military registration); health status information (disability, pregnancy, etc.); medical certificates presented by employees during medical examinations; information on work experience, previous places of work, income from previous places of work; employment contract data (employment contract number, date of conclusion, start and end dates of the contract, type of work, duration of the contract, presence of probation period, work regime, duration of main leave, employee duties, additional social benefits and guarantees, number and date of changes to the employment contract, nature of work, form of payment, personnel category, working conditions, duration of working week); bank account details; academic degree, title, awards, incentives documents (if any); photographs; information on the reason for termination of employment contract, surname, first name, patronymic of close relatives; degree of kinship; date and year of birth of close relatives; marriage certificate details; birth certificate details; health information of children and other relatives (including disability certificates, chronic diseases) for calculating benefits.

Categories of subjects whose personal data are processed for this purpose:

Operator's employees; former Operator's employees; close relatives of Operator's employees and former Operator's employees.

Legal basis(es) for personal data processing carried out for this purpose:

Personal data processing is carried out with the consent of the personal data subject for processing his/her personal data, as well as with consent for processing personal data authorized for dissemination; personal data processing is necessary for the execution of an agreement to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor. An agreement concluded with the personal data subject cannot contain provisions limiting the rights and freedoms of the personal data subject; Labor Code of the Russian Federation; Tax Code of the Russian Federation; Federal Law No. 402-FZ of December 06, 2011 "On Accounting"; Federal Law No. 27 of April 01, 1996 "On Individual (Personalized) Accounting in the Compulsory Pension Insurance System"; Federal Law No. 400-FZ of December 28, 2013 "On Insurance Pensions"; Federal Law No. 173-FZ of December 17, 2001 "On Labor Pensions in the Russian Federation"; Federal Law No. 326-FZ of November 29, 2010 "On Compulsory Medical Insurance in the Russian Federation"; Federal Law No. 53-FZ of March 28, 1998 "On Military Duty and Military Service"; Decree of the Government of the Russian Federation No. 719 of November 27, 2006 "Regulations on Military Registration"; Charter of Ural Les Limited Liability Company.

List of actions with personal data carried out for this purpose:

Collection, systematization, storage, extraction, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, depersonalization, deletion, dissemination.

Methods of personal data processing used for this purpose:

Mixed, with transfer over the internal network of the legal entity, with transfer over the Internet.

Purpose of personal data processing:

Conducting interviews, recruiting personnel, assisting in employment, complying with the procedures and rules for employment established by the Labor Code of the Russian Federation.

Categories of personal data processed for this purpose:

Surname, first name, patronymic; date, month and year of birth; contact information (mobile phone, email address); data from education, qualification, professional training (retraining) documents; information on professional development; information on work experience, previous places of work.

Categories of subjects whose personal data are processed for this purpose:

Applicants for a vacant position.

Legal basis(es) for personal data processing carried out for this purpose:

Personal data processing is carried out with the consent of the personal data subject for processing his/her personal data, as well as with consent for processing personal data authorized for dissemination; personal data processing is necessary for the execution of an agreement to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor. An agreement concluded with the personal data subject cannot contain provisions limiting the rights and freedoms of the personal data subject; Labor Code of the Russian Federation; Tax Code of the Russian Federation; Federal Law No. 402-FZ of December 06, 2011 "On Accounting"; Federal Law No. 27 of April 01, 1996 "On Individual (Personalized) Accounting in the Compulsory Pension Insurance System"; Federal Law No. 400-FZ of December 28, 2013 "On Insurance Pensions"; Federal Law No. 173-FZ of December 17, 2001 "On Labor Pensions in the Russian Federation"; Federal Law No. 326-FZ of November 29, 2010 "On Compulsory Medical Insurance in the Russian Federation"; Federal Law No. 53-FZ of March 28, 1998 "On Military Duty and Military Service"; Decree of the Government of the Russian Federation No. 719 of November 27, 2006 "Regulations on Military Registration"; Charter of Ural Les Limited Liability Company.

List of actions with personal data carried out for this purpose:

Collection, systematization, storage, extraction, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, depersonalization, deletion.

Methods of personal data processing used for this purpose:

Mixed, with transfer over the internal network of the legal entity, with transfer over the Internet.

Purpose of personal data processing:

Registration and accounting of individuals with whom agreements are concluded, and their representatives.

Categories of personal data processed for this purpose:

Surname, first name, patronymic; date, month and year of birth; passport data (series, number, by whom and when issued); position; name of legal entity; place of study, information about education (field of study, course), address of residence; contact information (mobile phone, email address); bank account details; registration address and actual location; TIN; KPP; OGRN.

Categories of subjects whose personal data are processed for this purpose:

Representatives and employees of legal entities, individual entrepreneurs; individuals with whom agreements are concluded; interns.

Legal basis(es) for personal data processing carried out for this purpose:

Personal data processing is carried out with the consent of the personal data subject for processing his/her personal data, as well as with consent for processing personal data authorized for dissemination; personal data processing is necessary for the execution of an agreement to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor. An agreement concluded with the personal data subject cannot contain provisions limiting the rights and freedoms of the personal data subject. Labor Code of the Russian Federation; Tax Code of the Russian Federation; Federal Law No. 402-FZ of December 06, 2011 "On Accounting"; Federal Law No. 223-FZ of July 18, 2011 "On Procurement of Goods, Works, Services by Certain Types of Legal Entities"; Federal Law No. 152-FZ of July 27, 2006 "On Personal Data"; Charter of Ural Les Limited Liability Company.

List of actions with personal data carried out for this purpose:

Collection, systematization, storage, extraction, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, depersonalization, deletion.

Methods of personal data processing used for this purpose:

Mixed, with transfer over the internal network of the legal entity, with transfer over the Internet.

Purpose of personal data processing:

Considering citizens' appeals.

Categories of personal data processed for this purpose:

Surname, first name, patronymic; contact information (mobile phone, email address).

Categories of subjects whose personal data are processed for this purpose:

Persons who have submitted an appeal, website users.

Legal basis(es) for personal data processing carried out for this purpose:

Personal data processing is carried out with the consent of the personal data subject for processing his/her personal data; personal data processing is necessary for the execution of an agreement to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor. An agreement concluded with the personal data subject cannot contain provisions limiting the rights and freedoms of the personal data subject; Civil Procedure Code of the Russian Federation; Federal Law No. 59-FZ of May 02, 2006 "On the Procedure for Considering Appeals from Citizens of the Russian Federation"; Law of the Russian Federation No. 2300-1 of February 07, 1992 "On Protection of Consumer Rights"; Charter of Ural Les Limited Liability Company.

List of actions with personal data carried out for this purpose:

Collection, systematization, storage, extraction, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, depersonalization, deletion, dissemination.

Methods of personal data processing used for this purpose:

Mixed, with transfer over the internal network of the legal entity, with transfer over the Internet.

Purpose of personal data processing:

Participation in legal proceedings.

Categories of personal data processed for this purpose:

Surname, first name, patronymic; date, month and year of birth; contact information (mobile phone, email address); residential registration address and actual residence address; passport data (series, number, by whom and when issued); TIN; SNILS; health information, accident information, information about medical care provided, treatment and health-improving measures carried out.

Categories of subjects whose personal data are processed for this purpose:

Participants in legal proceedings.

Legal basis(es) for personal data processing carried out for this purpose:

Personal data processing is carried out with the consent of the personal data subject for processing his/her personal data; personal data processing is necessary for the execution of an agreement to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor. An agreement concluded with the personal data subject cannot contain provisions limiting the rights and freedoms of the personal data subject; Civil Procedure Code of the Russian Federation; Federal Law No. 59-FZ of May 02, 2006 "On the Procedure for Considering Appeals from Citizens of the Russian Federation"; Law of the Russian Federation No. 2300-1 of February 07, 1992 "On Protection of Consumer Rights"; Charter of Ural Les Limited Liability Company.

List of actions with personal data carried out for this purpose:

Collection, systematization, storage, extraction, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, depersonalization, deletion.

Methods of personal data processing used for this purpose:

Mixed, with transfer over the internal network of the legal entity, with transfer over the Internet.

Key Participants in the Personal Data Processing Management System

To ensure effective management of personal data processing, its key participants have been identified.

4.1.1. Human Resources Department:

• Ensuring recruitment, preparation and systematization of employee materials during interviews;
• Formalizing employee hiring, transfer, and dismissal in accordance with labor legislation, regulations, instructions, and Director's orders, issuing various certificates to the Operator's employees, maintaining established personnel documentation;
• Maintaining T-2 form cards;
• Controlling the creation and adherence to vacation schedules, as well as maintaining personalized and military registration by the Operator;
• Storing and filling out employment record books;
• Processing necessary documents for pension assignment for the Operator's employees, submitting them to the pension fund.

4.1.2. Accounting Department:

• Accrual of wages, temporary disability benefits, bonuses, child allowances, and other payments in the established manner;
• Settlements in the established manner with organizations and individuals regarding accruals and deductions from wages of workers, specialists, employees;
• Accrual of taxes on wages of workers, specialists, and employees;
• Issuing certificates to the Operator's employees on matters of wage accrual and other payments and deductions for them;
• Organizing standardization, payment, and incentives for labor;
• Forming consolidated reports on personnel headcount, wage fund, and social payments.

4.1.3. Legal Department:

• Current legal monitoring, adjustment, and development of internal organizational and administrative documentation of a legal nature;
• Preparation of opinions and clarifications on legal issues;
• Preparation of orders for bringing the Operator's employees to disciplinary and material liability;
• Maintenance of corporate documentation;
• Participation in labor disputes on the administration's side;
• Contract work (monitoring, adjustment, approval of commercial agreements);
• Legal support in the Operator's relations with state and municipal institutions and organizations;
• Formalizing agreements for legal actions;
• Maintaining a register of powers of attorney;
• Working with notaries;
• Representation in courts of general jurisdiction, arbitration courts, internal affairs bodies, customs, prosecutor's office, tax authorities, and other state supervisory bodies;
• Managing documents and data.

4.1.4. Financial Department:

• Transfer of wages to the Operator's employees;
• Payment of invoices to suppliers and contractors for shipped tangible assets, rendered services, and performed works in accordance with concluded agreements based on payment applications by order of the Director;
• Processing operations for debiting funds from the current account;
• Sending and receiving duly executed payment documents, bank statements, and taking measures for timely receipt of funds due from buyers.

4.1.5. Information Technology Department:

• Development of information systems;
• Providing methodological assistance to departments in preparing initial data for automated management systems;
• Implementation of information systems, software, and automation solutions developed by the department and acquired from third-party organizations;
• Adaptation of acquired information systems and software to the requirements of the enterprise;
• Ensuring information security of the enterprise (implementation of information security policy, development and application of necessary information security measures, control over compliance with information security measures).

4.1.6. Economic Security Department:

• Liaison with law enforcement and other state bodies on issues of protecting trade secrets and ensuring the economic security of the enterprise. Referring materials to law enforcement bodies for investigations into offenses and crimes committed against the Operator and its individual employees;
• Developing documents regulating the access control regime and their approval by the Director. Organizing the processing, accounting, issuance, and withdrawal of all types of passes to the Operator's territory. Controlling the correctness of document processing for the import (export), entry (exit) of material assets and documents;
• Implementing the access control regime: allowing access to the building for persons with permanent passes, issuing temporary and one-time passes with their registration in a journal of the established form.

Principles of Personal Data Processing

The Operator processes personal data on a lawful and fair basis.

Personal data processing is limited to achieving specific, predefined, and lawful purposes. Processing of personal data incompatible with the purposes of personal data collection is not permitted.

It is not permitted to combine databases containing personal data whose processing is carried out for incompatible purposes.

Only personal data that meet the purposes of their processing are subject to processing.

The content and volume of processed personal data correspond to the stated processing purposes. The processed personal data are not excessive in relation to the stated purposes of their processing.

When processing personal data, the accuracy of personal data, their sufficiency, and, if necessary, relevance to the purposes of personal data processing must be ensured. The Operator must take necessary measures or ensure their adoption to delete or clarify incomplete or inaccurate data.

Storage of personal data must be carried out in a form that allows identifying the personal data subject, no longer than required by the purposes of personal data processing, unless the personal data storage period is established by federal law, a contract to which the personal data subject is a party, beneficiary, or guarantor. Processed personal data are subject to destruction or depersonalization upon achievement of the processing purposes or in case of loss of necessity to achieve these purposes, unless otherwise provided by federal law.

The Operator and other persons who have gained access to personal data are obliged not to disclose personal data to third parties and not to disseminate them without the consent of the personal data subject, unless otherwise provided by federal law.

Conditions for Personal Data Processing

Personal data processing is carried out in compliance with the principles and rules stipulated by Federal Laws. Personal data processing is carried out in the following cases:

• Personal data processing is carried out with the consent of the personal data subject to the processing of his/her personal data;
• Personal data processing is necessary to achieve goals stipulated by an international treaty of the Russian Federation or law, for the exercise and performance of functions, powers, and duties assigned by the legislation of the Russian Federation to the Operator;
• Personal data processing is carried out in connection with the person's participation in constitutional, civil, administrative, criminal proceedings, proceedings in arbitration courts;
• Personal data processing is necessary for the execution of a judicial act, an act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings (hereinafter - execution of a judicial act);
• Personal data processing is necessary for the exercise of powers of federal executive authorities, state extra-budgetary funds bodies, executive authorities of the constituent entities of the Russian Federation, local self-government bodies, and functions of organizations participating in the provision of state and municipal services, respectively, provided for by Federal Law No. 210-FZ of July 27, 2010 "On the Organization of Provision of State and Municipal Services", including registration of the personal data subject on the unified portal of state and municipal services and (or) regional portals of state and municipal services;
• Personal data processing is necessary for the performance of a contract to which the personal data subject is a party or a beneficiary or guarantor, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor. A contract concluded with the personal data subject cannot contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing personal data of minors, unless otherwise provided by the legislation of the Russian Federation, as well as provisions allowing the inaction of the personal data subject as a condition for concluding the contract;
• Personal data processing is necessary to protect the life, health or other vital interests of the personal data subject, if obtaining the consent of the personal data subject is impossible;
• Personal data processing is necessary for the exercise of the rights and legitimate interests of the Operator or third parties, including in cases provided for by the Federal Law "On the Protection of Rights and Legitimate Interests of Individuals in the Course of Activities for the Collection of Overdue Debts and on Amendments to the Federal Law "On Microfinance Activities and Microfinance Organizations", or for the achievement of socially significant goals, provided that the rights and freedoms of the personal data subject are not violated;
• Personal data processing is necessary for the professional activity of a journalist and/or the lawful activity of a mass media outlet or scientific, literary or other creative activity, provided that the rights and legitimate interests of the personal data subject are not violated;
• Personal data processing is carried out for statistical or other research purposes, provided that personal data are mandatorily depersonalized;
• Processing of personal data obtained as a result of personal data depersonalization is carried out in order to increase the efficiency of state or municipal administration, as well as for other purposes provided for by Federal Law No. 123-FZ of April 24, 2020 "On Conducting an Experiment to Establish Special Regulation for the Purpose of Creating Necessary
• Conditions for the Development and Implementation of Artificial Intelligence Technologies in the Constituent Entity of the Russian Federation – the Federal City of Moscow and
• Amendments to Articles 6 and 10 of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" and Federal Law No. 258-FZ of July 31, 2020 "On Experimental Legal Regimes in the Sphere of Digital Innovations in the Russian Federation", in the manner and on the conditions provided for by these federal laws;
• Processing of personal data subject to publication or mandatory disclosure in accordance with federal law.

Processing of special categories of personal data concerning racial, national origin, political views, religious or philosophical beliefs, health status, intimate life is not allowed, except in cases where:

• The personal data subject has given written consent to the processing of their personal data;
• The personal data has been made publicly available by the personal data subject;
• Processing of personal data is necessary in connection with the implementation of international treaties of the Russian Federation on readmission;
• Personal data processing is carried out in accordance with Federal Law No. 8-FZ of January 25, 2002 "On the All-Russian Population Census";
• Personal data processing is carried out in accordance with legislation on state social assistance, labor legislation, pension legislation of the Russian Federation;
• Processing of personal data is necessary to protect the life, health, or other vital interests of the personal data subject or the life, health, or other vital interests of other persons, and obtaining the consent of the personal data subject is impossible;
• Personal data processing is carried out for medical and prophylactic purposes, for the purpose of establishing a medical diagnosis, providing medical and medico-social services, provided that the personal data processing is carried out by a person professionally engaged in medical activities and obliged to maintain medical secrecy in accordance with the legislation of the Russian Federation;
• Processing of personal data of members (participants) of a public association or religious organization is carried out by the respective public association or religious organization, acting in accordance with the legislation of the Russian Federation, to achieve lawful goals stipulated by their constituent documents, provided that personal data will not be disseminated without the written consent of the personal data subjects;
• Personal data processing is necessary for establishing or exercising the rights of the personal data subject or third parties, as well as in connection with the administration of justice;
• Personal data processing is carried out in accordance with the legislation of the Russian Federation on defense, security, countering terrorism, transport security, countering corruption, operational-search activities, enforcement proceedings, and criminal enforcement legislation of the Russian Federation;
• Processing of personal data obtained in cases established by the legislation of the Russian Federation is carried out by prosecutor's offices in connection with their exercise of prosecutorial supervision;
• Personal data processing is carried out in accordance with legislation on compulsory insurance types, with insurance legislation;
• Personal data processing is carried out in cases provided for by the legislation of the Russian Federation, by state bodies, municipal bodies or organizations for the purpose of placing children left without parental care for upbringing in citizens' families;
• Personal data processing is carried out in accordance with the legislation of the Russian Federation on citizenship of the Russian Federation.

Processing of personal data on criminal records may be carried out in cases and in the manner determined in accordance with federal laws.

Processing of special categories of personal data shall be immediately terminated if the reasons for which the processing was carried out have been eliminated, unless otherwise established by federal law.

Information that characterizes a person's physiological and biological characteristics, based on which their identity can be established (biometric personal data), is not processed. The processing of biometric personal data is not mandatory, except in cases provided for by Part 2 of Article 11 of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", and is carried out only with the written consent of the personal data subject.

The Operator has the right to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person, including a state or municipal contract, or by adopting a relevant act by a state or municipal body (hereinafter - Operator's instruction). A person carrying out personal data processing on behalf of the Operator is obliged to observe the principles and rules of personal data processing provided for by Federal Laws.

The Operator's instruction must define the list of personal data, the list of actions (operations) with personal data that will be performed by the person processing personal data, the purposes of their processing, establish the obligation of such person to maintain the confidentiality of personal data, the requirements provided for by Federal Law, the obligation to provide documents and other information at the request of the personal data Operator during the term of the Operator's instruction, including before processing personal data, confirming the adoption of measures and compliance with the requirements established in accordance with this article for the execution of the Operator's instruction, the obligation to ensure the security of personal data during their processing, and also specify the requirements for the protection of processed personal data in accordance with Federal Law, including the requirement to notify the Operator in cases of unlawful or accidental transfer (provision, dissemination, access) of personal data that led to a violation of the rights of personal data subjects.

A person carrying out personal data processing on behalf of the Operator is not obliged to obtain the consent of the personal data subject for processing his/her personal data.

If the Operator entrusts the processing of personal data to another person, the Operator is liable to the personal data subject for the actions of the specified person. The person carrying out personal data processing on behalf of the Operator is liable to the Operator.

If the Operator entrusts the processing of personal data to a foreign individual or a foreign legal entity, the Operator and the person carrying out personal data processing on behalf of the Operator are liable to the personal data subject for the actions of these persons.

Responsibility for sending personal data to the Operator via unsecured communication channels (email) lies with the sender.

General Description of Personal Data Processing

Personal data is processed by the Operator using automation tools and without using such tools. The Operator has defined a list of actions (operations) with personal data during their processing: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction.

Cross-border transfer of personal data to the territories of foreign states that do not provide adequate protection of personal data subjects' rights may be carried out in cases of:

• Written consent of the personal data subject for the cross-border transfer of their personal data;
• Provided for by international treaties of the Russian Federation;
• Provided for by federal laws, if it is necessary to protect the foundations of the constitutional order of the Russian Federation, ensure the country's defense and state security, as well as ensure the stable and safe functioning of the transport complex, protect the interests of individuals, society, and the state in the transport complex from unlawful interference;
• Performance of a contract to which the personal data subject is a party;
• Protection of the life, health, and other vital interests of the personal data subject or other persons when it is impossible to obtain the personal data subject's written consent.

The Operator is obliged to ensure that the foreign state, to whose territory personal data is transferred, provides adequate protection of personal data subjects' rights before commencing the cross-border transfer of personal data.

In cases of exclusively automated personal data processing, it is prohibited to make decisions that entail legal consequences for the personal data subject or otherwise affect their rights and legitimate interests, except where there is written consent from the personal data subject or in cases provided for by federal laws, which also establish measures to ensure compliance with the rights and legitimate interests of the personal data subject.

The Operator is obliged to explain to the personal data subject the procedure for making a decision based solely on automated processing of their personal data and the possible legal consequences of such a decision, provide an opportunity to object to such a decision, and explain the procedure for the personal data subject to protect their rights and legitimate interests.

The Operator is obliged to review the objection within thirty days from the date of its receipt and notify the personal data subject of the results of its review.

Processing of Personal Data Authorized by the Personal Data Subject for Dissemination

Processing of personal data, authorized by the personal data subject for dissemination, is carried out with the written consent of the personal data subject. Consent to the processing of personal data authorized by the personal data subject for dissemination is formalized separately from other consents of the personal data subject to the processing of their personal data.

The Operator is obliged to provide the personal data subject with the opportunity to define a list of personal data for each category of personal data specified in the consent to the processing of personal data authorized by the personal data subject for dissemination.

If the consent provided by the personal data subject for the processing of personal data authorized by the personal data subject for dissemination does not indicate that the personal data subject has agreed to the dissemination of personal data, such personal data are processed by the Operator to whom they were provided by the personal data subject, without the right to disseminate.

Silence or inaction of the personal data subject cannot under any circumstances be considered consent to the processing of personal data authorized by the personal data subject for dissemination.

In the consent to the processing of personal data authorized by the personal data subject for dissemination, the personal data subject has the right to establish prohibitions on the transfer (other than providing access) of these personal data by the Operator to an unlimited circle of persons, as well as prohibitions on the processing or conditions for the processing (other than obtaining access) of these personal data by an unlimited circle of persons. The Operator's refusal to establish prohibitions and conditions by the personal data subject, as provided for in this article, is not permitted.

The Operator is obliged, no later than three working days from the moment of receiving the relevant consent of the personal data subject, to publish information on the conditions of processing and on the existence of prohibitions and conditions for the processing by an unlimited circle of persons of personal data authorized by the personal data subject for dissemination.

Prohibitions established by the personal data subject on the transfer (other than providing access), as well as on the processing or conditions of processing (other than obtaining access) of personal data authorized by the personal data subject for dissemination, do not apply to cases of personal data processing in state, public, and other public interests defined by the legislation of the Russian Federation.

Transfer (dissemination, provision, access) of personal data authorized by the personal data subject for dissemination must be terminated at any time at the request of the personal data subject. This request must include the surname, first name, patronymic (if any), contact information (phone number, email address or postal address) of the personal data subject, as well as a list of personal data whose processing is subject to termination. The personal data specified in this request may only be processed by the Operator to whom it was sent. The validity of the personal data subject's consent to the processing of personal data authorized by the personal data subject for dissemination ceases from the moment the Operator receives the request.

Personal data authorized by the personal data subject for dissemination, posted on the Operator's website, are not subject to dissemination by third parties. In case of necessity to disseminate personal data by a third party, a written request must be sent to the Operator. The Operator, based on a written request and with the consent of the personal data subject whose personal data are required for transfer to a third party, provides an answer regarding the possibility of further transfer of personal data.

The Operator is obliged to stop the transfer (dissemination, provision, access) of personal data authorized by the personal data subject for dissemination within three working days from the moment of receiving the personal data subject's request to stop the transfer (dissemination, provision, access) or within the period specified in a court decision that has entered into force, and if such a period is not specified in the court decision, then within three working days from the moment the court decision enters into force.

The above requirements do not apply in the case of personal data processing for the purpose of fulfilling functions, powers, and duties assigned by the legislation of the Russian Federation to state bodies, municipal bodies, and organizations subordinate to such bodies.

Personal Data Processing Periods

In case of achievement of the personal data processing purpose, the Operator is obliged to cease personal data processing or ensure its cessation (if personal data processing is carried out by another person acting on behalf of the Operator) and destroy personal data or ensure their destruction (if personal data processing is carried out by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date of achievement of the personal data processing purpose, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, another agreement between the Operator and the personal data subject, or unless the Operator has the right to carry out personal data processing without the personal data subject's consent on grounds provided for by federal laws.

In case of detection of unlawful personal data processing carried out by the Operator or a person acting on behalf of the Operator, the Operator is obliged, within three working days from the date of such detection, to cease unlawful personal data processing or ensure its cessation by the person acting on behalf of the Operator. If it is impossible to ensure the lawfulness of personal data processing, the Operator is obliged, within ten working days from the date of detection of unlawful personal data processing, to destroy such personal data or ensure their destruction. The Operator is obliged to notify the personal data subject or their representative of the elimination of the committed violations or the destruction of personal data, and if the appeal of the personal data subject or their representative or the request of the authorized body for the protection of personal data subjects' rights was sent by the authorized body for the protection of personal data subjects' rights, also notify the specified body.

In the event of an unlawful or accidental transfer (provision, dissemination, access) of personal data that has resulted in a violation of the rights of personal data subjects, the Operator shall, from the moment such incident is detected by the Operator, the authorized body for the protection of personal data subjects' rights, or any other interested party, notify the authorized body for the protection of personal data subjects' rights:

• Within twenty-four hours of the incident, the alleged causes that led to the violation of the rights of personal data subjects, and the alleged harm caused to the rights of personal data subjects, the measures taken to eliminate the consequences of the incident, and also provide information about the person authorized by the Operator to interact with the authorized body for the protection of personal data subjects' rights on issues related to the detected incident;
  Within seventy-two hours of the results of the internal investigation of the detected incident, and also provide information about the persons whose actions caused the detected incident (if any).
• In the event that the personal data subject withdraws consent to the processing of their personal data, the Operator is obliged to cease their processing or ensure the cessation of such processing (if personal data processing is carried out by another person acting on behalf of the Operator) and, if the retention of personal data is no longer required for the purposes of personal data processing, destroy the personal data or ensure their destruction (if personal data processing is carried out by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date of receipt of the specified withdrawal, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary, or guarantor, another agreement between the Operator and the personal data subject, or unless the Operator has the right to process personal data without the personal data subject's consent on grounds provided for by federal laws.

9.3.1. In the event that a personal data subject requests the Operator to cease personal data processing, the Operator is obliged, within a period not exceeding ten working days from the date of receipt of the corresponding request by the Operator, to cease their processing or ensure the cessation of such processing (if such processing is carried out by the person processing personal data), except in cases provided for by the Federal Law. This period may be extended, but by no more than five working days, if the Operator sends a motivated notification to the personal data subject indicating the reasons for extending the period for providing the requested information.

If it is impossible to destroy personal data within the aforementioned periods, the Operator shall block such personal data or ensure their blocking (if personal data processing is carried out by another person acting on behalf of the Operator) and ensure the destruction of personal data within a period not exceeding six months, unless otherwise established by federal laws.

Measures in Personal Data Processing and Protection

10.1 The Operator is obliged to take necessary and sufficient measures to ensure compliance with the obligations stipulated by federal laws and regulatory legal acts adopted in accordance with them, regarding personal data processing. The Operator independently determines the composition and list of measures necessary and sufficient to ensure compliance with the obligations stipulated by this Federal Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by this Federal Law or other federal laws. Such measures, in particular, include:

• Appointment of a person, who is a legal entity, responsible for organizing personal data processing;
• Issuance by the Operator, being a legal entity, of documents defining the Operator's policy regarding personal data processing, local acts on personal data processing issues, defining for each personal data processing purpose the categories and list of processed personal data, categories of subjects whose personal data are processed, methods, terms of their processing and storage, procedure for destroying personal data upon achievement of their processing purposes or upon occurrence of other legal grounds, as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation, eliminating the consequences of such violations. Such documents and local acts cannot contain provisions restricting the rights of personal data subjects, or imposing on Operators powers and duties not provided for by the legislation of the Russian Federation;
  Identification of personal data security threats during their processing in personal data information systems;
• Establishment of personal data protection levels during their processing in personal data information systems depending on the security threats to these data;
• Fulfillment of requirements for personal data protection during their processing in personal data information systems, the execution of which ensures the established personal data protection levels;
• Application of information security tools in personal data information systems that have passed the conformity assessment procedure in the established manner;
• Assessment of the effectiveness of measures taken to ensure personal data security;
• Keeping records of personal data machine carriers;
• Ensuring the detection of unauthorized access to personal data and taking measures;
• Provision for the possibility of restoring personal data modified or destroyed due to unauthorized access;
• Establishment of rules for accessing personal data processed in the personal data information system, as well as ensuring the registration and accounting of all actions performed with personal data in the personal data information system;
• Monitoring of measures taken to ensure personal data security and the protection level of personal data information systems;
• Familiarization of the Operator's employees directly involved in personal data processing with the provisions of the legislation of the Russian Federation on personal data, including requirements for personal data protection, documents defining the Operator's policy regarding personal data processing, local acts on personal data processing issues, and training of the specified employees;
• Assessment of the harm that may be caused to personal data subjects in case of violation of this Federal Law, the correlation of the specified harm and the measures taken by the
• Operator aimed at ensuring compliance with the obligations stipulated by this Federal Law;
• Implementation of internal control and audit of personal data processing compliance with federal legislation and regulatory legal acts adopted in accordance with them, requirements for personal data protection, the Operator's policy regarding personal data processing, the Operator's local acts.

10.2 The Operator is obliged to publish or otherwise ensure unlimited access to the document defining its policy regarding personal data processing, to information on the implemented requirements for personal data protection. The Operator collecting personal data using information and telecommunication networks is obliged to publish in the relevant information and telecommunication network, including on the pages of the Operator's website in the "Internet" information and telecommunication network, through which personal data is collected, a document defining its policy regarding personal data processing, and information on the implemented requirements for personal data protection, and also ensure the possibility of access to the specified document using the means of the relevant information and telecommunication network.

Rights of the Personal Data Subject

The personal data subject has the right to receive information concerning the processing of their personal data, including information containing:

• Confirmation of the fact of personal data processing by the Operator;
• Legal grounds and purposes of personal data processing;
• Purposes and methods of personal data processing applied by the Operator;
• Name and location of the Operator, information about persons (excluding the Operator's employees) who have access to personal data or to whom personal data may be disclosed based on a contract with the Operator or based on federal law;
• Processed personal data relating to the respective personal data subject, their source, unless a different procedure for providing such data is stipulated by federal law;
• Periods of personal data processing, including their storage periods;
• Procedure for the personal data subject to exercise rights provided for by Federal Law;
• Information about performed or proposed cross-border data transfer;
• Name or surname, first name, patronymic, and address of the person processing personal data on behalf of the Operator, if processing is entrusted or will be entrusted to such person;
• Information on how the Operator takes measures necessary and sufficient to ensure compliance with the obligations provided for by Federal Law and regulatory legal acts adopted in accordance with it.
• Other information provided for by Federal Law or other federal laws.

The personal data subject has the right to demand from the Operator the clarification of their personal data, their blocking, recall or destruction if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing, and also to take measures provided by law to protect their rights.

The information specified in paragraph 10.1 is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data related to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.

The information specified in paragraph 10.1 is provided to the personal data subject or their representative by the Operator upon request or upon receipt of a request from the personal data subject or their representative. The request must contain the number of the main document identifying the personal data subject or their representative, information about the date of issue of the specified document and the issuing authority, information confirming the personal data subject's participation in relations with the Operator (contract number, contract conclusion date, conditional verbal designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator, the signature of the personal data subject or their representative. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation. The Operator provides the information specified in paragraph 10.1 to the personal data subject or their representative in the form in which the corresponding appeal or request was sent, unless otherwise specified in the appeal or request.

If the information specified in paragraph 10.1, as well as processed personal data, were provided for review to the personal data subject at their request, the personal data subject has the right to re-apply to the Operator or send a repeated request to obtain the information specified in paragraph 10.1 and to review such personal data no earlier than thirty days after the initial application or sending of the initial request, unless a shorter period is established by federal law, a regulatory legal act adopted in accordance with it, or a contract to which the personal data subject is a party, beneficiary, or guarantor.

The personal data subject has the right to re-apply to the Operator or send a repeated request to obtain the information specified in paragraph 10.1, as well as to review the processed personal data before the expiration of the term, if such information and processed personal data were not provided to them for review in full as a result of the consideration of the initial application. The repeated request must contain a justification for sending the repeated request.

The Operator has the right to refuse the personal data subject's request for a repeated request that does not comply with the conditions stipulated in paragraphs 10.5 and 10.6. Such refusal must be reasoned. The burden of proof for the validity of the refusal to comply with a repeated request lies with the Operator.

The right of the personal data subject to access their personal data may be limited in accordance with federal laws, including if:

• Personal data processing, including personal data obtained as a result of operational-search, counter-intelligence, and intelligence activities, is carried out for the purposes of national defense, state security, and law enforcement;
• Personal data processing is carried out by bodies that detained the personal data subject on suspicion of committing a crime, or charged the personal data subject in a criminal case, or applied a preventive measure to the personal data subject before charges were brought, except for cases provided for by the criminal procedural legislation of the Russian
• Federation when the suspect or accused is allowed to familiarize themselves with such personal data;
• Personal data processing is carried out in accordance with legislation on countering the legalization (laundering) of proceeds from crime and the financing of terrorism;
• The personal data subject's access to their personal data violates the rights and legitimate interests of third parties;
• Personal data processing is carried out in cases provided for by the legislation of the Russian Federation on transport security, to ensure the stable and safe functioning of the transport complex, protect the interests of individuals, society, and the state in the transport complex from unlawful interference.
• Processing of personal data for the purpose of promoting goods, works, services on the market by direct contact with potential consumers using communication means, as well as for the purpose of political agitation, is allowed only with the prior consent of the personal data subject. Such personal data processing is recognized as being carried out without the prior consent of the personal data subject if the Operator does not prove that such consent was obtained.

If the personal data subject believes that the Operator processes their personal data in violation of the requirements of this Federal Law or otherwise violates their rights and freedoms, the personal data subject has the right to appeal the Operator's actions or inactions to the authorized body for the protection of personal data subjects' rights or through judicial procedure.

The personal data subject has the right to protect their rights and legitimate interests, including compensation for damages and moral harm through judicial procedure.

Control and Supervision over Personal Data Processing

12.1 The authorized body for the protection of personal data subjects' rights, which is responsible for ensuring control and supervision over compliance of personal data processing with the requirements of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", is the federal executive body independently performing functions of control and supervision over compliance of personal data processing with the requirements of the legislation of the Russian Federation in the field of personal data (Roskomnadzor).

12.2 The authorized body for the protection of personal data subjects' rights considers appeals from personal data subjects regarding the compliance of the content of personal data and methods of their processing with the purposes of their processing and makes an appropriate decision.

12.3 Roskomnadzor Directorate for the Republic of Bashkortostan:

Address: 450005, Republic of Bashkortostan, Ufa, 50-letiya Oktyabrya street, 20/1
Phone: (347) 222–20–98
Fax: (347) 222–20–97
E-Mail: rsockanc02@rkn.gov.ru

Responsibility for Violating Data Processing Legislation

13.1 In accordance with Article 24 of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", persons guilty of violating the requirements of this Federal Law bear responsibility provided for by the legislation of the Russian Federation.

13.2 Moral damage caused to the personal data subject due to the violation of their rights, violation of personal data processing rules established by Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", as well as personal data protection requirements, is subject to compensation in accordance with the legislation of the Russian Federation. Compensation for moral damage is carried out regardless of compensation for property damage and losses incurred by the personal data subject.

13.3 Current legislation of the Russian Federation allows for claims regarding the secure handling of protected information and provides for the following types of responsibility for violating requirements when processing personal data and confidential information:

Administrative – Code of Administrative Offenses, Articles 5.39, 13.11, 13.12, 13.14, 19.7;
Criminal – Criminal Code of the Russian Federation, Articles 137, 140, 272, 273, 274;
Civil – Federal Law 152, Article 24, Civil Code of the Russian Federation, Article 15;
Disciplinary responsibility – Labor Code of the Russian Federation, Articles 81, 90, 192.