Privacy and Personal Data Processing Policy
1. General Provisions
1.1. This Policy has been developed to ensure the protection of human and civil rights and freedoms during the processing of personal data, including the protection of the rights to privacy, personal and family secrets.
Basic concepts used in the Policy:
personal data — any information relating to a directly or indirectly identified or identifiable individual (subject of personal data);
personal data operator (operator) — a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
processing of personal data — any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools.
Processing of personal data includes, among other things:
distribution of personal data — actions aimed at disclosing personal data to an indefinite circle of persons;
provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons;
blocking of personal data — temporary termination of personal data processing (except for cases where processing is necessary to clarify personal data);
destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed;
depersonalization of personal data — actions as a result of which it becomes impossible to determine the ownership of personal data to a specific subject of personal data without the use of additional information;
personal data information system — a set of personal data contained in databases and information technologies and technical means ensuring their processing.
1.3. Main rights and obligations of the Operator.
1.3.1. The Operator has the right to:
1.1. This Policy has been developed to ensure the protection of human and civil rights and freedoms during the processing of personal data, including the protection of the rights to privacy, personal and family secrets.
Basic concepts used in the Policy:
personal data — any information relating to a directly or indirectly identified or identifiable individual (subject of personal data);
personal data operator (operator) — a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
processing of personal data — any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools.
Processing of personal data includes, among other things:
- collection;
- recording;
- systematization;
- accumulation;
- storage;
- clarification (updating, changing);
- extraction;
- use;
- transfer (distribution, provision, access);
- depersonalization;
- blocking;
- deletion;
- destruction;
distribution of personal data — actions aimed at disclosing personal data to an indefinite circle of persons;
provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons;
blocking of personal data — temporary termination of personal data processing (except for cases where processing is necessary to clarify personal data);
destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed;
depersonalization of personal data — actions as a result of which it becomes impossible to determine the ownership of personal data to a specific subject of personal data without the use of additional information;
personal data information system — a set of personal data contained in databases and information technologies and technical means ensuring their processing.
1.3. Main rights and obligations of the Operator.
1.3.1. The Operator has the right to:
- independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
- entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data provided for by the Personal Data Law, maintain the confidentiality of personal data, and take the necessary measures aimed at ensuring the fulfillment of obligations provided for by the Personal Data Law;
- in the event that the personal data subject withdraws consent for the processing of personal data, the Operator is entitled to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Personal Data Law.
- organize the processing of personal data in accordance with the requirements of the Personal Data Law;
- respond to appeals and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
- report to the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)), upon request of this body, the necessary information within 10 working days from the date of receipt of such a request. This period may be extended, but by no more than five working days. To do this, the Operator must send a reasoned notification to Roskomnadzor indicating the reasons for extending the period for providing the requested information;
- in the manner determined by the federal executive body authorized in the field of security, ensure interaction with the state system for detection, prevention, and elimination of the consequences of computer attacks on the information resources of the Russian Federation, including informing it about computer incidents that resulted in the unlawful transfer (provision, distribution, access) of personal data.
- receive information regarding the processing of their personal data, except in cases provided for by federal laws. Information is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it is established by the Law on Personal Data;
- demand from the operator the clarification of their personal data, its blocking or destruction in the event that the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as to take measures provided by law to protect their rights;
- give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
- appeal to Roskomnadzor or in court against unlawful actions or omissions of the Operator during the processing of their personal data.
2. Purposes of personal data processing
2.1. Processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted.
2.2. Only personal data that meets the purposes of its processing is subject to processing.
2.3. Processing of personal data by the Operator is carried out for the following purposes:
2.1. Processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted.
2.2. Only personal data that meets the purposes of its processing is subject to processing.
2.3. Processing of personal data by the Operator is carried out for the following purposes:
- carrying out its activities in accordance with the charter of LLC "Bergauf Construction Technologies", including the conclusion and execution of contracts with counterparties;
- compliance with labor legislation within the framework of labor and other directly related relations, including: assisting employees in employment, obtaining education and promotion, attracting and selecting candidates for work with the Operator, ensuring the personal safety of employees, monitoring the quantity and quality of work performed, ensuring the safety of property, maintaining personnel and accounting records, filling out and submitting required reporting forms to authorized bodies, organizing the registration of employees for individual (personified) accounting in the systems of compulsory pension insurance and compulsory social insurance;
- advertising and marketing promotions;
- implementation of access control.
3. Legal grounds for processing personal data
3.1. The legal basis for the processing of personal data is a set of regulatory legal acts, in pursuance of which and in accordance with which the Operator processes personal data, including:
3.1. The legal basis for the processing of personal data is a set of regulatory legal acts, in pursuance of which and in accordance with which the Operator processes personal data, including:
- Constitution of the Russian Federation;
- Civil Code of the Russian Federation;
- Labor Code of the Russian Federation;
- Tax Code of the Russian Federation;
- Federal Law of 08.02.1998 N 14-FZ "On Limited Liability Companies";
- Federal Law of 06.12.2011 N 402-FZ "On Accounting";
- Federal Law of 15.12.2001 N 167-FZ "On Compulsory Pension Insurance in the Russian Federation";
- other regulatory legal acts regulating relations related to the activities of the Operator.
- the Articles of Association of Bergauf Construction Technologies LLC;
- contracts concluded between the Operator and the subjects of personal data;
- consent of the subjects of personal data to the processing of their personal data.
4. Scope and categories of processed personal data, categories of personal data subjects
4.1. The content and scope of the processed personal data must correspond to the stated purposes of processing provided for in Section 2 of this Policy. The processed personal data must not be excessive in relation to the stated purposes of their processing.
4.2. The Operator may process personal data of the following categories of personal data subjects.
4.2.1. Candidates for employment with the Operator — for the purposes of compliance with labor legislation within the framework of labor and other directly related relations, and the implementation of access control:
4.4. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health status, or intimate life, except in cases provided for by the legislation of the Russian Federation.
4.1. The content and scope of the processed personal data must correspond to the stated purposes of processing provided for in Section 2 of this Policy. The processed personal data must not be excessive in relation to the stated purposes of their processing.
4.2. The Operator may process personal data of the following categories of personal data subjects.
4.2.1. Candidates for employment with the Operator — for the purposes of compliance with labor legislation within the framework of labor and other directly related relations, and the implementation of access control:
- last name, first name, patronymic;
- gender;
- citizenship;
- date and place of birth;
- contact details;
- information on education, work experience, and qualifications;
- other personal data provided by candidates in resumes and cover letters.
- last name, first name, patronymic;
- gender;
- citizenship;
- date and place of birth;
- image (photograph);
- passport data;
- address of registration at the place of residence;
- actual residential address;
- contact details;
- individual taxpayer number;
- insurance number of the individual personal account (SNILS);
- information on education, qualifications, professional training, and advanced training;
- marital status, presence of children, family ties;
- information on labor activity, including rewards, awards, and (or) disciplinary sanctions;
- marriage registration data;
- military registration information;
- disability information;
- information on alimony deductions;
- information on income from the previous place of work;
- other personal data provided by employees in accordance with the requirements of labor legislation.
- last name, first name, patronymic;
- degree of relationship;
- year of birth;
- other personal data provided by employees in accordance with the requirements of labor legislation.
- last name, first name, patronymic;
- date and place of birth;
- passport data;
- address of registration at the place of residence;
- contact details (including phone number, email address, messenger data);
- position held;
- individual taxpayer number;
- settlement account number;
- other personal data provided by clients and counterparties (individuals) necessary for the conclusion and execution of contracts.
- last name, first name, patronymic;
- passport data;
- contact details;
- position held;
- other personal data provided by representatives (employees) of clients and contractors necessary for the conclusion and execution of contracts.
4.4. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health status, or intimate life, except in cases provided for by the legislation of the Russian Federation.
5. Procedure and conditions for processing personal data
5.1. Processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2. Processing of personal data is carried out with the consent of the personal data subjects to the processing of their personal data, as well as without it in cases provided for by the legislation of the Russian Federation.
5.3. The Operator processes personal data for each purpose of its processing in the following ways:
5.5. Processing of personal data for each processing purpose specified in clause 2.3 of the Policy is carried out by:
5.7. The transfer of personal data to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia, and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including:
5.10. The Operator shall cease processing personal data in the following cases:
5.13. When collecting personal data, including via the information and telecommunications network Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, changing), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.
5.1. Processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2. Processing of personal data is carried out with the consent of the personal data subjects to the processing of their personal data, as well as without it in cases provided for by the legislation of the Russian Federation.
5.3. The Operator processes personal data for each purpose of its processing in the following ways:
- non-automated processing of personal data;
- automated processing of personal data with or without the transmission of the information received via information and telecommunications networks;
- mixed processing of personal data.
5.5. Processing of personal data for each processing purpose specified in clause 2.3 of the Policy is carried out by:
- obtaining personal data in oral and written form directly from the personal data subjects;
- entering personal data into the Operator's logs, registers, and information systems;
- using other methods of processing personal data.
5.7. The transfer of personal data to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia, and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including:
- identifies threats to the security of personal data during their processing;
- adopts local regulatory acts and other documents governing relations in the field of processing and protection of personal data;
- appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;
- creates the necessary conditions for working with personal data;
- organizes the accounting of documents containing personal data;
- organizes work with information systems in which personal data are processed;
- stores personal data under conditions that ensure their safety and exclude unlawful access to them;
- organizes training for the Operator's employees who carry out the processing of personal data.
5.10. The Operator shall cease processing personal data in the following cases:
- the fact of their unlawful processing is identified. Period — within three working days from the date of identification;
- the purpose of their processing has been achieved;
- the validity period has expired or the personal data subject's consent to the processing of said data has been withdrawn, when under the Law on Personal Data the processing of such data is permitted only with consent.
- not otherwise provided for by a contract to which the personal data subject is a party, beneficiary, or guarantor;
- the Operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Law on Personal Data or other federal laws;
- otherwise is not provided for by another agreement between the Operator and the personal data subject.
5.13. When collecting personal data, including via the information and telecommunications network Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, changing), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.
6. Updating, correction, deletion, destruction of personal data, responses to subjects' requests for access to personal data
6.1. Confirmation of the fact of personal data processing by the Operator, legal grounds and purposes of personal data processing, as well as other information specified in Part 7 of Art. 14 of the Law on Personal Data, are provided by the Operator to the personal data subject or their representative within 10 working days from the moment of application or receipt of a request from the personal data subject or their representative. This period may be extended, but by no more than five working days. To do this, the Operator must send the personal data subject a reasoned notification indicating the reasons for extending the period for providing the requested information.
The information provided does not include personal data relating to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data.
The request must contain:
If the appeal (request) of the personal data subject does not reflect all necessary information in accordance with the requirements of the Personal Data Law, or if the subject does not possess access rights to the requested information, a reasoned refusal shall be sent to them.
The right of the personal data subject to access their personal data may be restricted in accordance with Part 8 of Article 14 of the Personal Data Law, including if the access of the personal data subject to their personal data violates the rights and legitimate interests of third parties.
6.2. In case of detection of inaccurate personal data upon the appeal of the personal data subject or their representative, or at their request or at the request of Roskomnadzor, the Operator shall block the personal data relating to this personal data subject from the moment of such appeal or receipt of the specified request for the period of verification, if blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
In case of confirmation of the fact of inaccuracy of personal data, the Operator, based on the information provided by the personal data subject or their representative or Roskomnadzor, or other necessary documents, shall clarify the personal data within seven working days from the date of submission of such information and lift the blocking of personal data.
6.3. In case of detection of unlawful processing of personal data upon application (request) of the personal data subject or their representative or Roskomnadzor, the Operator shall block the unlawfully processed personal data relating to this personal data subject from the moment of such application or receipt of the request.
6.4. Procedure for the destruction of personal data by the Operator.
6.4.1. Conditions and terms for the destruction of personal data by the Operator:
6.1. Confirmation of the fact of personal data processing by the Operator, legal grounds and purposes of personal data processing, as well as other information specified in Part 7 of Art. 14 of the Law on Personal Data, are provided by the Operator to the personal data subject or their representative within 10 working days from the moment of application or receipt of a request from the personal data subject or their representative. This period may be extended, but by no more than five working days. To do this, the Operator must send the personal data subject a reasoned notification indicating the reasons for extending the period for providing the requested information.
The information provided does not include personal data relating to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data.
The request must contain:
- the number of the main identity document of the personal data subject or their representative, information on the date of issue of the specified document and the issuing authority;
- information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator;
- signature of the personal data subject or their representative.
If the appeal (request) of the personal data subject does not reflect all necessary information in accordance with the requirements of the Personal Data Law, or if the subject does not possess access rights to the requested information, a reasoned refusal shall be sent to them.
The right of the personal data subject to access their personal data may be restricted in accordance with Part 8 of Article 14 of the Personal Data Law, including if the access of the personal data subject to their personal data violates the rights and legitimate interests of third parties.
6.2. In case of detection of inaccurate personal data upon the appeal of the personal data subject or their representative, or at their request or at the request of Roskomnadzor, the Operator shall block the personal data relating to this personal data subject from the moment of such appeal or receipt of the specified request for the period of verification, if blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
In case of confirmation of the fact of inaccuracy of personal data, the Operator, based on the information provided by the personal data subject or their representative or Roskomnadzor, or other necessary documents, shall clarify the personal data within seven working days from the date of submission of such information and lift the blocking of personal data.
6.3. In case of detection of unlawful processing of personal data upon application (request) of the personal data subject or their representative or Roskomnadzor, the Operator shall block the unlawfully processed personal data relating to this personal data subject from the moment of such application or receipt of the request.
6.4. Procedure for the destruction of personal data by the Operator.
6.4.1. Conditions and terms for the destruction of personal data by the Operator:
- achievement of the purpose of personal data processing or loss of the need to achieve this purpose — within 30 days;
- reaching the maximum storage periods for documents containing personal data — within 30 days;
- provision by the personal data subject (their representative) of confirmation that the personal data was obtained illegally or is not necessary for the stated purpose of processing — within seven working days;
- withdrawal by the personal data subject of consent to the processing of their personal data, if their preservation for the purpose of their processing is no longer required — within 30 days.
- otherwise is not provided for by the contract to which the personal data subject is a party, beneficiary, or guarantor;
- the operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Law on Personal Data or other federal laws;
- not otherwise provided for by another agreement between the Operator and the personal data subject.