Policy of the joint-stock company "Development Corporation of the WYaroslavl Region" regarding the processing of personal data
1. General provisions 1.1. This Policy of the joint-stock company "Development Corporation of the Yaroslavl Region" (hereinafter - the Operator, the Company) regarding the processing of personal data (hereinafter - the Policy) is developed in pursuance of the requirements of paragraph 2 of part 1 of Article 18.1 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" (hereinafter - the Law on Personal Data) in order to ensure the protection of human rights and freedoms and citizens when processing their personal data, including the protection of the rights to privacy, personal and family secrets. 1.2. The Policy applies to all personal data processed by the Company. 1.3. The Policy applies to relations in the field of personal data processing that arose at the Operator both before and after the approval of this Policy. 1.4. Pursuant to the requirements of Part 2 of Art. 18.1 of the Law on Personal Data, this Policy is published in free access in the information and telecommunication network Internet on the website of the Operator. 1.5. The main concepts used in the Policy:
personal data any information relating directly or indirectly to a specific or identifiable natural person (personal data subject);
personal data operator (operator) - a state body, municipal body, legal or natural person, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;
personal data processing - any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools. The processing of personal data includes including:
automated processing of personal data - processing of personal data using computer equipment;
dissemination of personal data actions aimed at disclosing personal data to an indefinite circle of persons;
personal data actions aimed at disclosing personal data to a certain person or a certain circle of persons;
blocking of personal data temporary termination of the processing of personal data (unless the processing is necessary to clarify personal data);
personalization actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed;
depersonalization actions as a result of which it becomes impossible without the use of additional information to determine the ownership of personal data to a specific subject of personal data;
personal data information system - a set of personal data contained in databases and information technologies and technical means providing their processing. 1.6. Basic rights and obligations of the Operator. 1.6.1. The operator has the right to: 1) independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for in By law. on personal data and regulatory legal acts adopted in accordance with it, unless otherwise provided By law. Personal data or other federal laws; 2) to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Law on Personal Data, to observe the confidentiality of personal data, to take the necessary measures aimed at ensuring the fulfillment of the obligations provided for by the Law on Personal Data; 3) in the event that the subject of personal data withdraws consent to the processing of personal data, the Operator has the right to continue the processing of personal data without the consent of the personal data subject if there are grounds specified in The law Personal data. 1.6.2. The operator shall: 1) organize the processing of personal data in accordance with the requirements Law about personal data; 2) respond to requests and requests of personal data subjects and their legal representatives in accordance with the requirements Law about personal data; (3) report to authorized body for protection of the rights of personal data subjects (Federal Service for Supervision of Communications, Information Technologies and Mass Communications (Roskomnadzor)) at the request of this body, the necessary information within 10 working days from the date of receipt of such a request. This period may be extended, but not more than five working days. To do this, the Operator should send a reasoned notice to Roskomnadzor indicating the reasons for extending the period for providing the requested information; 4 in the manner determined by the federal executive body authorized in the field of security, to ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it about computer incidents that led to the illegal transfer (provision, distribution, access) of personal data. 1.7. Basic rights of the personal data subject. The subject of personal data has the right to: 1) to receive information concerning the processing of his personal data, except as provided for federally. The information is provided to the personal data subject by the Operator in an accessible form, and it should not contain personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. List information routine receipt is established By law. about personal data; 2) require the operator to clarify, block or destroy his personal data if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing, as well as take measures provided for by law to protect his rights; 3) give prior consent to the processing of personal data in order to promote goods, works and services on the market; (4) appeal in Roskomnadzor or in court unlawful actions or inaction of the Operator in the processing of his personal data. 1.8. Control over the fulfillment of the requirements of this Policy is carried out by the authorized person responsible for the organization of personal data processing with the Operator. 1.9. Responsibility for violation of the requirements of the legislation of the Russian Federation and regulatory acts of the Company in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.
2. Purpose of collecting personal data 2.1. The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. The processing of personal data incompatible with the purposes of collecting personal data is not allowed. 2.2. Only personal data that meet the purposes of their processing are subject to processing. 2.3. The processing of personal data by the Operator is carried out for the following purposes: carrying out its activities in accordance with the Charter of the Company, including the conclusion and execution of contracts with counterparties; execution of labor legislation within the framework of labor and other directly related relations, including: assistance to employees in employment, education and promotion, attraction and selection of candidates for work from the Operator, ensuring the personal safety of employees, control of the quantity and quality of work performed, ensuring the safety of property, maintaining personnel and accounting, filling out and transferring to the authorized bodies the required reporting forms, organizing individual (personalized) registration of employees in compulsory pension insurance and compulsory social insurance systems; receiving feedback on the website on the Internet invest76.ru; implementation of the pass regime; registration in the personal account on the website invest76.ru
2.4. The processing of personal data of employees can be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal grounds for processing personal data 3.1. The legal basis for the processing of personal data is a set of regulatory legal acts in pursuance of which and in accordance with which the Operator processes personal data, including: Constitution of the Russian Federation; Civil Code of the Russian Federation; Labor Code of the Russian Federation; Tax Code of the Russian Federation; Federal Law of 08.02.1998 N 14-FZ "On Limited Liability Companies"; Federal Law of 06.12.2011 N 402-FZ "On Accounting"; Federal Law No. 167-FZ of 15.12.2001 "On Compulsory Pension Insurance in the Russian Federation"; other regulatory legal acts regulating relations related to the activities of the Operator. 3.2. The legal basis for processing personal data is also: the charter of the Society; contracts concluded between the Operator and personal data subjects; consent of personal data subjects to the processing of their personal data.
4. Volume and categories of personal data processed, categories of personal data subjects 4.1. The content and scope of the personal data processed must comply with the stated purposes of the processing provided for in the section. 2 of this Policy. The personal data processed should not be excessive in relation to the stated purposes of their processing. 4.2. The operator may process personal data of the following categories of personal data subjects. 4.2.1. Candidates for employment with the Operator - for the purposes of implementing labor legislation within the framework of labor and other directly related relations, implementing the permit regime: surname, first name, patronymic; floor; nationality; date and place of birth; contact details; information about education, work experience, qualifications; other personal data provided by candidates in resumes and cover letters. 4.2.2. Employees and former employees of the Operator - for the purposes of implementing labor legislation within the framework of labor and other directly related relations, implementing the permit regime: surname, first name, patronymic; floor; nationality; date and place of birth; Image (photo); passport data; address of registration at the place of residence; address of actual residence; contact details; individual number of the taxpayer; insurance number of individual personal account (SNILS); information on education, qualifications, vocational training and advanced training; marital status, the presence of children, family ties; information on labor activity, including the presence of incentives, awards and (or) disciplinary penalties; data on registration of marriage; information on military accounting; information on disability; information on the retention of alimony; information on income from the previous place of work; other personal data provided by employees in accordance with the requirements of labor legislation. 4.2.3. Family members of the Operator's employees - for the purposes of implementing labor legislation within the framework of labor and other directly related relations: surname, first name, patronymic; degree of kinship; year of birth; other personal data provided by employees in accordance with the requirements of labor legislation. 4.2.4. Clients and contractors of the Operator (individuals) - for the purposes of carrying out their activities in accordance with the Charter of the Company, implementing the access regime: surname, first name, patronymic; date and place of birth; passport data; address of registration at the place of residence; contact details; the post to be replaced; individual number of the taxpayer; account number; other personal data provided by customers and contractors (individuals) necessary for the conclusion and execution of contracts. 4.2.5. Representatives (employees) of clients and contractors of the Operator (legal entities) - for the purposes of carrying out their activities in accordance with the Charter of the Company, implementing the access regime: surname, first name, patronymic; passport data; contact details; the post to be replaced; other personal data provided by representatives (employees) of clients and contractors necessary for the conclusion and execution of contracts. 4.2.6. Applicants whose personal data are processed for the purpose of filling out the feedback and registration form on the invest76.ru website: surname, first name, patronymic; Post; Organization; E-mail; Phone number; Password. 4.3. Processing by the Operator of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity) is carried out in accordance with the legislation of the Russian Federation. 4.4. The operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, except in cases provided for by the legislation of the Russian Federation. 4.5. Use of Yandex.Metrics The website invest76.ru uses Yandex web analytics service. Metrics provided by LLC "Yandex" (119021, Russia, Moscow, L. Tolstoy str., 16). This service automatically collects anonymous information about user visits, including: • IP address (depersonalized); • Location data (city); • information about the browser, device and operating system; • data on the behavior of users on the site (pages viewed, clicks, stay time, etc.). Data is collected using cookies and other tracking technologies. This information is used solely to analyze site traffic and improve the user experience. The site uses the Yandex web analytics service. Metric to collect anonymous information about user behavior. The data is processed in accordance with the Yandex Privacy Policy. You can disable data collection in the browser settings or through Yandex tools.
5. Procedure and conditions of personal data processing 5.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation. 5.2. The processing of personal data is carried out with the consent of personal data subjects to the processing of their personal data, as well as without it in cases provided for by the legislation of the Russian Federation. 5.3. The operator processes personal data for each purpose of their processing in the following ways: non-automated processing of personal data; automated processing of personal data with or without the transfer of information received via information and telecommunication networks; mixed processing of personal data. 5.4. The processing of personal data is allowed to employees of the Operator, whose duties include the processing of personal data. 5.5. The processing of personal data for each purpose of processing specified in clause 2.3 of the Policy is carried out by: obtaining personal data in oral and written form directly from personal data subjects; entering personal data into the journals, registers and information systems of the Operator; use of other methods of processing personal data. 5.6. Disclosure to third parties and dissemination of personal data without the consent of the subject of personal data is not allowed, unless otherwise provided by federal law. Consent to the processing of personal data allowed by the subject of personal data for distribution is issued separately from other consents of the subject of personal data to the processing of his personal data. Requirements for the content of consent to the processing of personal data allowed by the subject of personal data for distribution are approved by the Order of Roskomnadzor of 24.02. 2021 N 18. 5.7. The transfer of personal data to the bodies of inquiry and investigation, the Federal Tax Service, the Social Fund of Russia and other authorized bodies of executive power and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation. 5.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data from illegal or accidental access to them, destruction, modification, blocking, distribution and other unauthorized actions, including: identifies threats to the security of personal data during their processing; adopts local regulations and other documents regulating relations in the field of processing and protection of personal data; appoint persons responsible for ensuring the security of personal data in the structural units and information systems of the Operator; creates the necessary conditions for working with personal data; organizes records of documents containing personal data; organizes work with information systems in which personal data are processed; stores personal data in conditions under which their safety is ensured and illegal access to them is excluded; organizes training of the Operator’s employees who process personal data. 5.9. The operator stores personal data in a form that allows determining the subject of personal data, no longer than it is required by each purpose of processing personal data, unless the period of storage of personal data is established by federal law, contract. 5.9.1. Personal data on paper are stored in the Company during the storage periods of documents for which these periods are provided for by the legislation on archival affairs in the Russian Federation (Federal Law No. 125-FZ of 22.10.2004 "On Archival Affairs in the Russian Federation", List of standard management archival documents formed in the course of the activities of state bodies, local governments and organizations, indicating the terms of their storage (Order of Rosarchiv of 20.12.2019 No. 236). 5.9.2. The period of storage of personal data processed in personal data information systems corresponds to the period of storage of personal data on paper. 5.10. The operator stops processing personal data in the following cases: The fact of their unlawful processing was revealed. Term - within three working days from the date of detection; the purpose of their processing has been achieved; The period of validity has expired or the consent of the subject of personal data to the processing of said data has been withdrawn, when, according to the Law on Personal Data, the processing of this data is allowed only with consent. 5.11. Upon achievement of the purposes of personal data processing, as well as in case of withdrawal by the subject of personal data of consent to their processing, the Operator terminates the processing of this data if: other is not provided by the contract, the party of which, the beneficiary or guarantor for which is the subject of personal data; The operator is not entitled to process without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws; other is not provided by another agreement between the Operator and the subject of personal data. 5.12. When the subject of personal data appeals to the Operator with a request to stop processing personal data within a period not exceeding 10 working days from the date of receipt by the Operator of the relevant request, the processing of personal data is terminated, except for the cases provided for by the Law on Personal Data. This period may be extended, but not more than five working days. To do this, the Operator must send a reasoned notice to the subject of personal data indicating the reasons for extending the period. 5.13. When collecting personal data, including through the information and telecommunication network Internet, the Operator provides recording, systematization, accumulation, storage, clarification (update, change), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for the cases specified in the Law on Personal Data. 6. Updating, correcting, deleting, destroying personal data, responding to requests from subjects for access to personal data 6.1. Confirmation of the fact of processing personal data by the Operator, the legal grounds and purposes of processing personal data, as well as other information specified in part 7 of Art. 14 of the Law on Personal Data, provided by the Operator to the subject of personal data or his representative within 10 working days from the date of application or receipt of the request of the subject of personal data or his representative. This period may be extended, but not more than five working days. To do this, the Operator should Qa reasoned notice to the subject of personal data indicating the reasons for extending the period for providing the requested information. The information provided does not include personal data relating to other personal data subjects, unless there are legal grounds for disclosing such personal data. The request shall contain: the number of the main document certifying the identity of the personal data subject or his representative, information about the date of issue of the specified document and the body that issued it; information confirming the participation of the subject of personal data in relations with the Operator (contract number, date of conclusion of the contract, conditional verbal designation and (or) other information), or information otherwise confirming the fact of processing personal data by the Operator; signature of the personal data subject or his representative. The request can be sent in the form of an electronic document and signed by electronic signature in accordance with the legislation of the Russian Federation. The operator provides the information specified in part 7 of Art. 14 of the Law on Personal Data, the subject of personal data or his representative in the form in which the relevant appeal or request is sent, unless otherwise specified in the appeal or request. If the request (request) of the subject of personal data does not reflect in accordance with the requirements of the Law on Personal Data all the necessary information or the subject does not have the rights of access to the requested information, then a reasoned refusal is sent to him. The right of the subject of personal data to access his personal data may be limited in accordance with Part 8 of Art. 14 of the Law on Personal Data, including if the access of the subject of personal data to his personal data violates the rights and legitimate interests of third parties. 6.2. In case of detection of inaccurate personal data at the request of the personal data subject or his representative or at their request or at the request of Roskomnadzor, the Operator blocks personal data relating to this personal data subject from the moment of such request or receipt of the specified request for the verification period, if the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties. In case of confirmation of the fact of inaccuracy of personal data, the Operator on the basis of information provided by the personal data subject or his representative or Roskomnadzor, or other necessary documents, clarifies personal data within seven working days from the date of submission of such information and removes the blocking of personal data. 6.3. In case of detection of illegal processing of personal data when applying (request) of the personal data subject or his representative or Roskomnadzor, the Operator shall block unlawfully processed personal data relating to this personal data subject from the moment of such request or receipt of the request. 6.4. If the Operator, Roskomnadzor or other interested party reveals the fact of illegal or accidental transfer (provision, distribution) of personal data (access to personal data), which entailed a violation of the rights of personal data subjects, the Operator: within 24 hours - notifies Roskomnadzor about the incident, the alleged reasons for the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident; within 72 hours - notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information about the persons whose actions caused it (if any). 6.5. Procedure for destruction of personal data by the Operator. 6.5.1. Conditions and terms of destruction of personal data by the Operator: achievement of the purpose of processing personal data or loss of the need to achieve this goal - within 30 days; achieving the maximum retention period of documents containing personal data - within 30 days; provision by the subject of personal data (his representative) of confirmation that personal data is obtained illegally or is not necessary for the stated purpose of processing - within seven working days; withdrawal by the subject of personal data of consent to the processing of his personal data, if their preservation for the purpose of their processing is no longer required - within 30 days. 6.5.2. When achieving the purpose of processing personal data, as well as in the case of withdrawal of consent by the subject of personal data to their processing, personal data are subject to destruction if: other is not provided by the contract, the party of which, the beneficiary or guarantor for which is the subject of personal data; The operator is not entitled to process without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws; other is not provided by another agreement between the Operator and the subject of personal data. 6.5.3. Destruction of personal data is carried out by a commission established by order of the General Director of the Company. 6.6. The subject of personal data has the right to withdraw his consent to the processing of personal data at any time. To do this, you must send a written application to the address of the operator or an electronic appeal through the form on the site. In case of withdrawal of consent, the processing is terminated, except for cases provided for by the legislation of the Russian Federation. The withdrawal of consent shall not affect the lawfulness of the processing carried out before its receipt.”
