Regulation on the Processing and Protection of Personal Data at PSK OSNOVA LLC
1. General Provisions
1.1 This Regulation on the processing and protection of personal data (hereinafter, the “Regulation”) at PSK OSNOVA Limited Liability Company (hereinafter, the “Operator”) has been developed in accordance with the Labor Code of the Russian Federation, the Constitution of the Russian Federation Civil Code of the Russian Federation, the Federal Law “On Information, Information Technologies and Information Protection”, and the Federal Law “On Personal Data”.
1.2 This Regulation defines the procedure for processing personal data and establishes general requirements for ensuring the security of personal data processed by the Operator both with the use of automation tools and without the use of such tools.
1.3 The Operator considers compliance with human and civil rights and freedoms in the processing of personal data, including protection of the rights to privacy and personal and family secrets, to be its most important goal and a condition for carrying out its activities.
1.4 All issues related to the processing and protection of personal data that are not regulated by this Regulation shall be resolved in accordance with the current legislation of the Russian Federation in the field of personal data.
1.5 In accordance with this Regulation, the Operator may process personal data belonging to the following categories of Personal Data Subjects:
- employees of the Operator;
- applicants for vacant positions with the Operator;
- counterparties of the Operator (individuals);
- visitors to the Operator’s website.
2. Terms and Definitions
The following terms and definitions are used in this Regulation:
2.1 Automated Processing of Personal Data – processing of personal data using computer equipment.
2.2 Blocking of Personal Data – temporary suspension of the processing of personal data (except where processing is necessary to clarify personal data).
2.3 Personal Data Information System – a set of personal data contained in databases and the information technologies and technical means that ensure their processing.
2.4 Depersonalization of Personal Data – actions that make it impossible, without the use of additional information, to determine whether personal data belong to a specific Personal Data Subject.
2.5 Processing of Personal Data – any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
2.6 Personal Data Operator (Operator) – PSK OSNOVA LLC (Primary State Registration Number (OGRN) 1207800112156, TIN/KPP 7810902497/781001001, address: 196084, Saint Petersburg, intracity municipal district Moskovskaya Zastava, Kievskaya St., Building 5, Block 6, Structure 1, Office 218, Premises 12N), acting independently or jointly with other persons, organizing and/or carrying out the processing of personal data, as well as determining the purposes of personal data processing, the composition of personal data subject to processing, and the actions (operations) performed with personal data.
2.7 Personal Data – any information relating to a directly or indirectly identified or identifiable individual (Personal Data Subject).
2.8 Provision of Personal Data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.9 Dissemination of Personal Data – actions aimed at disclosing personal data to an indefinite group of persons.
2.10 Destruction of Personal Data – actions that make it impossible to restore the content of personal data in a personal data information system and/or as a result of which physical media containing personal data are destroyed.
2.11 Cross-Border Transfer of Data – transfer of personal data to the territory of a foreign state, to a governmental authority of a foreign state, to a foreign individual, or to a foreign legal entity.
The Operator has the right to:
- receive accurate information and/or documents containing personal data from the Personal Data Subject;
- if the Personal Data Subject withdraws consent to the processing of personal data, the Operator shall have the right to continue processing personal data without the consent of the Personal Data Subject if there are grounds specified in the Federal Law “On Personal Data”;
- independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Federal Law “On Personal Data” and regulatory legal acts adopted pursuant thereto, unless otherwise provided by the Federal Law “On Personal Data” or other federal laws.
The Operator shall:
- provide the Personal Data Subject, at his/her request, with information regarding the processing of his/her personal data;
- organize the processing of personal data in the manner established by the current legislation of the Russian Federation;
- respond to appeals and requests from Personal Data Subjects and their legal representatives in accordance with the requirements of the Federal Law “On Personal Data”;
- provide the authorized body for the protection of the rights of Personal Data Subjects, upon request, with the necessary information within 10 business days from the date of receipt of such request;
- publish or otherwise ensure unrestricted access to the Regulation regarding the processing of personal data;
- take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as from other unlawful actions with respect to personal data;
- cease the transfer (dissemination, provision, access) of personal data, cease processing, and destroy personal data in the manner and in the cases provided for by the Federal Law “On Personal Data”;
- perform other duties provided for by the Federal Law “On Personal Data”.
4. Purposes and Principles of Personal Data Processing
4.1 The processing of personal data shall be carried out on a lawful and fair basis.
4.2 The processing of personal data shall be limited to the achievement of specific, predetermined, and lawful purposes. Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted. Only personal data that meet the purposes of their processing shall be processed.
4.3 The content and scope of processed personal data shall correspond to the stated purposes of processing provided for in this section. The processed personal data must not be excessive in relation to the stated purposes of their processing.
4.4 Combining databases containing personal data, the processing of which is carried out for purposes incompatible with each other, is not permitted.
4.5 When processing personal data, the accuracy, sufficiency, and, where necessary, relevance of personal data in relation to the purposes of processing shall be ensured. The Operator shall take the necessary measures and/or ensure that they are taken to delete or clarify incomplete or inaccurate data.
4.6 Personal data shall be stored in a form that makes it possible to identify the Personal Data Subject for no longer than required by the purposes of personal data processing, unless the storage period for personal data is established by federal law or by a contract to which the Personal Data Subject is a party, beneficiary, or guarantor. Processed personal data shall be destroyed or depersonalized upon achievement of the purposes of processing or in the event that the need to achieve those purposes is lost, unless otherwise provided by federal law.
4.7 A condition for terminating the processing of personal data may be the achievement of the purposes of personal data processing, expiration of the consent of the Personal Data Subject, withdrawal of consent by the Personal Data Subject, as well as the detection of unlawful processing of personal data.
5. Main Rights and Obligations of Personal Data Subjects
5.1 Personal Data Subjects have the right to:
- receive information relating to the processing of their personal data, except in cases provided for by federal laws. The information shall be provided to the Personal Data Subject by the Operator in an accessible form and must not contain personal data relating to other Personal Data Subjects, except in cases where there are lawful grounds for disclosing such personal data;
- require the Operator to clarify, block, or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect their rights;
- impose a condition of prior consent when personal data are processed for the purposes of promoting goods, works, and services on the market;
- withdraw consent to the processing of personal data;
- appeal unlawful actions or omissions of the Operator in the processing of their personal data to the authorized body for the protection of the rights of Personal Data Subjects or in court;
- exercise other rights provided for by the legislation of the Russian Federation.
5.2 Personal Data Subjects shall:
- provide the Operator with accurate data about themselves;
- notify the Operator of the clarification (updating, modification) of their personal data.
5.3 Persons who have provided the Operator with inaccurate information about themselves or information about another Personal Data Subject without the latter’s consent shall bear liability in accordance with the legislation of the Russian Federation.
6. Processing of Employees’ Personal Data
6.1 The Operator processes employees’ personal data for the purposes of personnel administration and accounting.
6.2 Upon conclusion of an employment contract, employees give the Operator written consent to the processing of their personal data. The content of the employee’s consent must be specific and informed, i.e., contain information allowing an unambiguous conclusion as to the purposes and methods of processing, indicating the actions performed with personal data and the scope of personal data being processed.
6.3 Upon conclusion of an employment contract, employees provide the Operator with the following documents containing their personal data:
- a passport or other identity document;
- an employment record book and/or information on employment activity, except where the employment contract is concluded for the first time;
- a document confirming registration in the individual (personalized) accounting system, including in the form of an electronic document;
- military registration documents — for persons liable for military service and persons subject to conscription for military service;
- a document on education and/or qualifications or the availability of specialized knowledge — when applying for a position requiring specialized knowledge or special training;
- other documents in accordance with the requirements of the law.
6.4 In the case of initial conclusion of an employment contract with employees, the Operator shall arrange the employment record book and the state pension insurance certificate.
6.5 If other documents are required by law for the employment of an employee, the Operator shall request that the person applying for the job provide such documents containing personal data.
6.6 For the purposes specified above, the Operator processes the following categories of employees’ personal data:
- last name, first name, patronymic.
- year of birth.
- month of birth.
- date of birth.
- place of birth.
- citizenship.
- passport details.
- residential address.
- registered address.
- data from the document contained in the birth certificate.
- education.
- profession.
- information on employment activity (including work experience and data on current employment).
- contact phone number.
- email address.
- income.
- position.
- TIN.
- SNILS.
- marital status.
- bank details.
- military duty status and military registration information.
6.7 Processing by the Operator of special categories of employees’ personal data relating to health status shall be carried out in accordance with the requirements of the legislation of the Russian Federation.
6.8 The Operator carries out automated, non-automated, as well as mixed processing of employees’ personal data.
6.9 The list of actions for processing employees’ personal data includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), blocking, deletion, and destruction.
6.10 The Operator has the right to process the personal data of dismissed employees in cases and within the time limits provided for by federal law. Such cases include, among other things, the processing of personal data within the framework of accounting and tax records, including for the purpose of preserving documents necessary for the calculation, withholding, and remittance of tax.
6.11 The Operator is obliged to store accounting documentation for the periods established in accordance with the rules for the organization of state archival affairs, while the minimum retention period may not be less than 5 (five) years.
6.12 Upon expiration of the periods determined by the legislation of the Russian Federation, employees’ personal files and other documents shall be transferred for archival storage for a period of 75 years. Processing of the specified information does not require compliance with conditions related to obtaining consent for the processing of personal data. Employees’ consent to the processing of their personal data in the cases provided for in clauses 6.10–6.11 of this Regulation is not required.
6.13 Disclosure to third parties and dissemination of personal data without the employee’s consent is not permitted, unless otherwise provided by federal law.
6.14 When transferring an employee’s personal data, the Operator must comply with the following requirements:
- it is prohibited to communicate an employee’s personal data to a third party without the employee’s written consent, except where this is necessary to prevent a threat to the life and health of the employee, as well as in cases established by federal law;
- an employee transferring the personal data of an employee of the Operator is obliged to warn persons receiving the employee’s personal data that such data may be used only for the purposes for which they were communicated and to require confirmation from such persons that this rule is observed. Persons receiving the personal data of an employee of the Operator are obliged to maintain their confidentiality. This provision does not apply to the exchange of employees’ personal data in the manner established by federal laws;
- an employee transferring the personal data of an employee of the Operator has the right to transfer the employee’s personal data to employee representatives in the manner established by the Labor Code of the Russian Federation and to limit such information only to the employee’s personal data necessary for the performance of the functions of such representatives.
- transfer of employees’ personal data to the Federal Tax Service or the Social Fund of Russia in the manner established by federal laws, in particular the Federal Law “On Mandatory Pension Insurance in the Russian Federation”, the Federal Law “On the Fundamentals of Mandatory Social Insurance”, and the Federal Law “On Mandatory Medical Insurance in the Russian Federation”, is carried out without employees’ consent.
6.15 The Operator does not carry out cross-border transfer of employees’ personal data.
6.16 Employees shall mandatorily familiarize themselves, against signature, with the Operator’s local regulatory legal acts establishing the procedure for processing personal data, as well as with their rights and obligations in this area.
6.17 The following persons have the right of access to employees’ personal data:
- the General Director of the Operator;
- the Commercial Director of the Operator;
- the Chief Accountant of the Operator;
- the Secretary/Records Manager of the Operator.
6.18 An employee of the Operator has the right to:
6.18.1 To access and review his/her personal data, including the right to receive free of charge copies of any record containing the employee’s personal data.
6.18.2 To require the Operator to clarify, exclude, or correct incomplete, incorrect, outdated, unreliable, unlawfully obtained, or unnecessary personal data.
6.18.3 To receive from the Operator:
- information on the persons who have access to personal data or to whom such access may be granted;
- the list of processed personal data and the source of their receipt;
- the periods of personal data processing, including the periods of their storage;
- information on the legal consequences that the processing of personal data may entail for the Personal Data Subject.
6.18.4 To require the Operator to notify all persons to whom incorrect or incomplete personal data were previously communicated of all exclusions, corrections, or additions made to such data.
6.18.5 To appeal unlawful actions or omissions of the Operator in the processing and protection of his/her personal data to the authorized body for the protection of the rights of Personal Data Subjects or in court.
6.18.6 Copying and making extracts from an employee’s personal data is permitted exclusively for official purposes with the written permission of the General Director or the Chief Accountant of the Operator.
7. Processing of Applicants’ Personal Data
7.1 The Operator processes applicants’ personal data for the purpose of considering an applicant for a vacant position and making a decision on hiring or refusal to hire.
7.2 The list of applicants’ personal data:
- last name, first name, and patronymic;
- gender;
- date of birth;
- citizenship;
- address of registration and actual residence;
- information on education and advanced training;
- information on academic degrees and academic titles;
- information on employment and total work experience;
- information on driver’s license
- contact phone number;
other data specified by the applicant in his/her resume.
7.3 The following persons have access to applicants’ personal data:
- the General Director of the Operator;
- the Commercial Director of the Operator;
- the Chief Accountant of the Operator;
- the Chief Engineer of the Operator;
- the Secretary/Records Manager of the Operator.
7.4 Applicants for vacant positions send their personal data to the Operator directly to the email address or through specialized Internet resources (job aggregators).
7.5 The posting by applicants for vacant positions of resumes on electronic Internet resources (job aggregators) is carried out in accordance with the rules of such resources. By sending resumes to the Operator’s email address, applicants for vacant positions thereby give implied consent to the processing of their personal data.
7.6 Processing by the Operator of special categories of personal data of applicants for vacant positions is not carried out.
7.7 The Operator carries out automated, non-automated, as well as mixed processing of personal data of applicants for vacant positions.
7.8 The list of actions for processing personal data of applicants for vacant positions includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, depersonalization, blocking, deletion, and destruction.
7.9 Disclosure to third parties and dissemination of personal data without the consent of the applicant for a vacant position is not permitted, unless otherwise provided by federal law.
7.10 In cases where the Operator may obtain the applicant’s required personal data only from a third party, the Operator must notify the applicant of this and obtain written consent from him/her.
7.11 The Operator does not carry out cross-border transfer of applicants’ personal data.
7.12 According to clause 5 of Roskomnadzor Recommendations dated December 14, 2012, in the event of refusal to hire, the information provided by the applicant shall be destroyed within 30 days.
7.13 The retention period for documents (applications, certificates, etc.) of candidates for vacant positions in accordance with Order No. 558 of the Ministry of Culture does not exceed 3 years.
8. Processing of Counterparties’ Personal Data
8.1 The Operator processes the personal data of counterparties (individuals) for the purpose of concluding and performing contracts.
8.2 Processing of the personal data of counterparties (individuals) does not require obtaining additional consent if personal data are processed in accordance with paragraph 5, part 1, article 6 of the Federal Law “On Personal Data”.
8.3 For the purposes specified above, the Operator processes the following categories of personal data of counterparties (individuals):
- last name, first name, patronymic.
- residential address.
- education.
- profession.
- passport details.
- contact phone number.
- email address.
- position.
- TIN.
- SNILS.
- bank details.
8.4 Counterparties (individuals) provide personal data when concluding a contract. Personal data of counterparties (individuals) shall be stored for the duration of contractual obligations and/or for the periods established by law.
8.5 The Operator carries out automated, non-automated, as well as mixed processing of personal data of counterparties (individuals).
8.6 The list of actions for processing personal data of counterparties (individuals) includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, and destruction.
8.7 Disclosure to third parties and dissemination of personal data without the counterparty’s consent is not permitted, unless otherwise provided by federal law.
8.8 The Operator does not carry out cross-border transfer of personal data of counterparties (individuals).
9. Processing of Website Visitors’ Personal Data
9.1 The Operator processes website visitors’ personal data for the purpose of informing visitors by sending them emails and providing visitors with access to the services, information, and/or materials contained on the Operator’s website.
9.2 For the purposes specified above, the Operator processes the following categories of personal data of website visitors:
- last name, first name, and patronymic;
- contact phone number;
- other information specified by the website visitor.
9.3 The Operator processes website visitors’ personal data only if they are filled in and/or submitted by the visitor independently through a special form located on the website https://spbosnova.ru/ or sent to the Operator by email. By filling in the relevant form and/or sending his/her personal data to the Operator, the website visitor expresses consent to this Regulation.
9.4 Processing of special categories of personal data relating to racial or ethnic origin, political views, religious or philosophical beliefs, and intimate life is not carried out by the Operator.
9.5 The Operator carries out automated, non-automated, as well as mixed processing of website visitors’ personal data.
9.6 The list of actions for processing website visitors’ personal data includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, depersonalization, blocking, deletion, and destruction.
9.7 Disclosure to third parties and dissemination of personal data without the consent of the website visitor is not permitted, unless otherwise provided by federal law.
9.8 If inaccuracies in personal data are identified, the website visitor may update them independently by sending a notice to the Operator at the Operator’s email address info@spbosnova.ru with the note “Updating Personal Data”.
9.9 The website visitor may at any time withdraw consent to the processing of personal data by sending a notice to the Operator by email to the Operator’s email address info@spbosnova.ru with the note “Withdrawal of Consent to the Processing of Personal Data”.
9.10 The Operator has the right to send website visitors notifications about new products and services, special offers, and various events. The website visitor may always opt out of receiving informational messages by sending the Operator an email to the email address info@spbosnova.ru with the note “Opt-Out from Notifications about New Products, Services, and Special Offers”.
9.11 The Operator collects and processes depersonalized data of website visitors (including “cookie” files) if this is allowed in the website visitor’s browser settings (cookie storage and JavaScript technology are enabled). Depersonalized data of website visitors collected through Internet statistics services (Yandex Metrica and Google Analytics and others) are used to collect information about visitors’ actions on the website and improve the quality of the website and its content.
9.12 All information collected by third-party services, including payment systems, communication tools, and other service providers, is stored and processed by the said persons (Operators) in accordance with their user agreements and privacy policies. The Personal Data Subject and/or website visitor is obliged to familiarize himself/herself with these documents in a timely manner. The Operator is not responsible for the actions of third parties, including the service providers referred to in this clause.
9.13 The Operator does not carry out cross-border transfer of website visitors’ personal data.
9.14 The website visitor may receive any explanations on questions of interest concerning the processing of his/her personal data by contacting the Operator via email info@spbosnova.ru
10. Protection of Personal Data
10.1 The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, dissemination, and other unauthorized actions, including:
- identifying threats to the security of personal data during their processing;
- adopting local regulatory acts and other documents governing relations in the field of processing and protection of personal data;
- appointing persons responsible for ensuring the security of personal data;
- creating the necessary conditions for work with personal data;
- organizing records of documents containing personal data;
- organizing work with information systems in which personal data are processed;
- storing personal data under conditions ensuring their safekeeping and excluding unauthorized access to them;
- organizing training for the Operator’s employees who process personal data.
10.2 The Operator ensures the safekeeping of personal data and takes all possible measures to exclude access to personal data by unauthorized persons.
11. Confidentiality of Personal Data
11.1 When processing personal data, the Operator ensures the confidentiality of personal data.
11.2 The Operator and other persons who have gained access to personal data are obliged not to disclose personal data to third parties and not to disseminate them without the consent of the Personal Data Subject, unless otherwise provided by federal law.
12. Final Provisions
12.1 Other rights and obligations of employees whose functions include the processing of personal data shall also be determined by their job descriptions.
12.2 Liability for violation of the requirements of the legislation of the Russian Federation and the Operator’s local acts in the field of processing and protection of personal data shall be determined in accordance with the legislation of the Russian Federation.
12.3 Persons guilty of violating the rules governing the processing and protection of personal data shall bear material, disciplinary, administrative, civil, or criminal liability in the manner established by applicable law.
12.4 This Regulation enters into force from the moment of its approval and remains valid indefinitely until replaced by a new version of the Regulation.
12.5 Amendments may be made to this Regulation. The Operator has the right to make amendments at its own discretion, including, but not limited to, cases where such amendments are related to changes in applicable legislation.
12.6 The current version of the Regulation is freely available on the Internet at the address https://spbosnova.ru/privacy-policy/
