Personal Data Processing Policy
Personal Data Processing Policy
1. GENERAL PROVISIONS
1.1. This Policy regarding the processing of personal data of PANELAO FM LLC (hereinafter – the "Policy") is drawn up in accordance with the requirements of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (hereinafter – the "Personal Data Law") and defines the procedure for processing personal data and measures to ensure the security of personal data taken by PANELAO FM LLC (hereinafter – the "Operator", INN 7706285417, OGRN 1027706022431) and its affiliated and controlled persons.
1.2. The Policy is the fundamental local act of the Operator regulating the processing of personal data and serves as the basis for the development of documents governing the processing and protection of personal data.
1.3. The provisions of the Policy apply to all companies under the direct or indirect control of the Operator. The Policy is binding on all employees, representatives, affiliated and controlled persons of the Operator.
1.4. The Operator sets as its most important goal and condition for carrying out its activities the observance of human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy, personal and family secrets.
1.5. The Policy applies to all personal data processed by the Operator, both with the use of computer equipment, including information and telecommunication networks, and without the use of such means.
1.6. Pursuant to the requirements of Part 2 of Article 18.1 of the Personal Data Law, this Policy is published in free access on the Internet information and telecommunication network on the Operator's website.
2. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING
2.1. The legal grounds for processing personal data are the totality of regulatory legal acts, in execution of and in accordance with which the Operator processes personal data, including:
- The Constitution of the Russian Federation;
- The Civil Code of the Russian Federation;
- The Labor Code of the Russian Federation;
- The Tax Code of the Russian Federation;
- Federal Law No. 152-FZ of 27 July 2006 "On Personal Data";
- Federal Law No. 14-FZ of 8 February 1998 "On Limited Liability Companies";
- Federal Law No. 402-FZ of 6 December 2011 "On Accounting";
- Federal Law No. 167-FZ of 15 December 2001 "On Compulsory Pension Insurance in the Russian Federation";
- Other regulatory legal acts governing relations related to the Operator's activities.
2.2. The legal grounds for processing personal data also include:
- The charter of PANELAO FM LLC;
- Contracts concluded between the Operator and personal data subjects;
- Contracts concluded by the Operator with counterparties (individuals and legal entities, individual entrepreneurs);
- Consent of personal data subjects to the processing of their personal data.
3. TERMS AND DEFINITIONS
The following terms and definitions are used in the Policy:
Personal data – any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).
Processing of personal data – any action (operation) or set of actions (operations) with personal data performed using automation tools or without their use. Processing of personal data includes, among others:
- collection
- recording
- systematization
- accumulation
- storage
- clarification (updating, modification)
- extraction
- use
- transfer (dissemination, provision, access)
- depersonalization
- blocking
- deletion
- destruction
Dissemination of personal data – actions aimed at disclosing personal data to an indefinite circle of persons.
Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific circle of persons.
Blocking of personal data – temporary cessation of processing of personal data (except where processing is necessary to clarify personal data).
Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.
Depersonalization of personal data – actions as a result of which it becomes impossible to determine, without the use of additional information, the belonging of personal data to a specific personal data subject.
Personal data information system – a set of personal data contained in databases and information technologies and technical means ensuring their processing.
Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state, to a foreign state authority, a foreign natural person or a foreign legal entity.
4. PURPOSES OF PERSONAL DATA PROCESSING
4.1. The processing of personal data is limited to achieving specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of personal data collection is not permitted.
4.2. The purposes of personal data processing derive, among other things, from an analysis of the legal acts regulating the Operator's activities, the purposes of the activities actually carried out by the Operator, as well as activities provided for by the Operator's constituent documents, and specific business processes of the Operator in specific personal data information systems (by structural subdivisions of the operator and their procedures in relation to certain categories of personal data subjects).
4.3. The purposes of personal data processing by the Operator include:
- promoting works and services, goods on the market, including through disseminating information about the Operator's activities on the Internet, in the media, on the Operator's website (including communication via the feedback form);
- conclusion, execution and termination of civil law contracts, other transactions;
- organization and holding of negotiations, meetings, events;
- organization of the organization's personnel records, ensuring compliance with laws, conclusion and performance of obligations under labor and civil law contracts;
- maintaining personnel records management, assisting employees in employment, training and promotion, and use of benefits;
- maintaining accounting records;
- ensuring compliance with labor, tax, pension, insurance legislation of the Russian Federation, legislation in the field of healthcare, education in the Russian Federation, legislation on the state civil service, legislation on municipal service in the Russian Federation;
- ensuring compliance with the legislation of the Russian Federation on defense, security, countering terrorism, countering the legalization of proceeds of crime and the financing of terrorism, countering corruption, operational-search activities, and enforcement proceedings;
- participation in constitutional, civil, administrative, criminal proceedings, proceedings in arbitration cases, execution of judicial acts;
- filling in primary statistical documentation in accordance with labor, tax legislation and other federal laws;
- ensuring access control.
5. BASIC RIGHTS AND OBLIGATIONS OF THE OPERATOR AND THE PERSONAL DATA SUBJECT
5.1. The Operator has the right to:5.1.1. independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Personal Data Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
5.1.2. entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law, to maintain the confidentiality of personal data, to take the necessary measures aimed at ensuring the fulfillment of the obligations provided for by the Personal Data Law;
5.1.3. in the event of withdrawal by the personal data subject of consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Personal Data Law;
5.1.4. carry out cross-border transfer of personal data subject to the requirements of the Personal Data Law.
5.2. The Operator is obliged to:
5.2.1. organize the processing of personal data in accordance with the requirements of the Personal Data Law;
5.2.2. respond to appeals and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
5.2.3. inform the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Communications (Roskomnadzor)) at the request of this body of the necessary information within 10 working days from the date of receipt of such a request. This period may be extended by no more than five working days. To do so, the Operator must send a reasoned notice to Roskomnadzor indicating the reasons for extending the period for providing the requested information;
5.2.4. in the manner determined by the federal executive body authorized in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing it of computer incidents that resulted in the unlawful transfer (provision, dissemination, access) of personal data.
5.3. The personal data subject has the right to:
5.3.1. receive information concerning the processing of his/her personal data, except as provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form, and it should not contain personal data relating to other personal data subjects, except where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law
5.3.2. require the operator to clarify his/her personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also take measures provided by law to protect his/her rights;
5.3.3. give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
5.3.4. appeal against unlawful actions or inaction of the Operator in processing his/her personal data to Roskomnadzor or in court.
5.4. The personal data subject is obliged to:
5.4.1. provide the Operator with reliable data about himself/herself;
5.4.2. inform the Operator about the clarification (updating, change) of his/her personal data.
6. SCOPE AND CATEGORIES OF PROCESSED PERSONAL DATA, CATEGORIES OF PERSONAL DATA SUBJECTS
6.1. The content and scope of the processed personal data must correspond to the stated processing purposes provided for in Section 4 of this Policy. The processed personal data must not be excessive in relation to the stated purposes of their processing.
6.2. The Operator may process personal data of the following categories of personal data subjects:
6.2.1. Candidates for employment with the Operator – for the purposes of executing labor legislation within the framework of labor and other directly related relations, implementing access control:
- last name, first name, patronymic (if any);
- gender;
- citizenship;
- date and place of birth;
- contact details (phone number, email address);
- information on education, work experience, qualifications;
- other personal data provided by candidates in resumes and cover letters.
6.2.2. Employees and former employees of the Operator – for the purposes of executing labor legislation within the framework of labor and other directly related relations, implementing access control:
- last name, first name, patronymic (if any);
- gender;
- citizenship;
- date and place of birth;
- image (photograph);
- passport data;
- registered address at the place of residence;
- actual residence address;
- contact details (phone number, email address);
- individual taxpayer number;
- insurance number of individual personal account (SNILS);
- information on education, qualifications, vocational training and advanced training;
- marital status, presence of children, family relations;
- information on labor activity, including the presence of incentives, awards and (or) disciplinary penalties;
- data on marriage registration;
- information on military registration;
- information on disability;
- information on alimony withholding;
- information on income from the previous place of work;
- other personal data provided by employees in accordance with the requirements of labor legislation.
- last name, first name, patronymic (if any);
- degree of kinship;
- year of birth;
- other personal data provided by employees in accordance with the requirements of labor legislation.
- last name, first name, patronymic (if any);
- date and place of birth;
- passport data;
- registered address at the place of residence;
- contact details (phone number, email address);
- position held;
- individual taxpayer number;
- settlement account number;
- other personal data provided by clients and counterparties (natural persons) necessary for the conclusion and performance of contracts.
- last name, first name, patronymic (if any);
- passport data;
- contact details (phone number, email address);
- position held;
- other personal data provided by representatives (employees) of clients and counterparties necessary for the conclusion and performance of contracts.
6.4. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, except as provided for by the legislation of the Russian Federation.
7. PROCEDURE AND CONDITIONS OF PERSONAL DATA PROCESSING
7.1. Personal data processing is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.7.2. Personal data processing is carried out with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
7.3. The Operator processes personal data for each purpose of their processing by the following methods:
- non-automated processing of personal data;
- automated processing of personal data with or without the transfer of received information via information and telecommunication networks;
- mixed processing of personal data.
7.5. Processing of personal data for each processing purpose specified in Section 4 of the Policy is carried out by:
- obtaining personal data orally and in writing directly from personal data subjects;
- entering personal data into the Operator's logs, registers and information systems;
- using other methods of personal data processing.
7.7. The transfer of personal data to bodies of inquiry and investigation, to the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
7.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, dissemination and other unauthorized actions, including:
- identifies threats to the security of personal data during their processing;
- adopts local regulations and other documents governing relations in the field of processing and protection of personal data;
- appoints persons responsible for ensuring the security of personal data in the structural subdivisions and information systems of the Operator;
- creates the necessary conditions for working with personal data;
- organizes the accounting of documents containing personal data;
- organizes work with information systems in which personal data are processed;
- stores personal data in conditions that ensure their safety and exclude unauthorized access to them;
- organizes training for the Operator's employees processing personal data.
7.9.1. Personal data on paper carriers are stored in PANELAO FM LLC for the periods of document storage for which these periods are provided for by the legislation on archiving in the Russian Federation (Federal Law No. 125-FZ of 22.10.2004 "On Archiving in the Russian Federation", the List of Standard Management Archival Documents Generated in the Course of Activities of State Bodies, Local Self-Government Bodies and Organizations, with Indication of Their Storage Periods (approved by Rosarkhiv Order No. 236 dated 20.12.2019)).
7.9.2. The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper carriers.
7.10. The Operator ceases processing personal data in the following cases:
- the fact of their unlawful processing has been identified. Timeframe – within three working days from the date of identification;
- the purpose of their processing has been achieved;
- the consent of the personal data subject to the processing of the said data has expired or been withdrawn, when processing of these data is allowed only with consent under the Personal Data Law.
- otherwise is not provided for by the contract, a party to which, a beneficiary or a guarantor under which is the personal data subject;
- the Operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
- otherwise is not provided for by another agreement between the Operator and the personal data subject.
7.13. When collecting personal data, including through the Internet information and telecommunication network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, except for the cases specified in the Personal Data Law.
7.14. The Operator also processes the personal data of a personal data subject if they are filled in and/or sent by the subject independently through special forms located on the website https://panelao.ru/en/or sent to the Operator via email, as well as through filling in the feedback form.
7.15. By filling in the relevant forms on the website, the personal data subject expresses their consent to this Policy.
7.16. The Operator processes anonymized data about the personal data subject if this is allowed in the settings of the subject's browser.
7.17. The personal data subject independently makes a decision on providing their personal data and gives consent freely, of their own will and in their own interest.
8. UPDATING, CORRECTION, DELETION, DESTRUCTION OF PERSONAL DATA, RESPONSES TO SUBJECTS' REQUESTS FOR ACCESS TO PERSONAL DATA
8.1. Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of personal data processing, as well as other information specified in Part 7 of Article 14 of the Personal Data Law, are provided by the Operator to the personal data subject or their representative within 10 working days from the moment of application or receipt of the request of the personal data subject or their representative. This period may be extended by no more than 5 working days. To do this, the Operator should send a reasoned notice to the personal data subject indicating the reasons for extending the period for providing the requested information.The provided information does not include personal data relating to other personal data subjects, except where there are legal grounds for disclosing such personal data.
The request must contain:
- the number of the main document proving the identity of the personal data subject or their representative, information on the date of issue of the said document and the issuing authority;
- information confirming the participation of the personal data subject in relations with the Operator (contract number, date of contract conclusion, conventional verbal designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator;
- the signature of the personal data subject or their representative.
The Operator provides the information specified in Part 7 of Article 14 of the Personal Data Law to the personal data subject or their representative in the form in which the relevant appeal or request was sent, unless otherwise specified in the appeal or request.
If the appeal (request) of the personal data subject does not reflect, in accordance with the requirements of the Personal Data Law, all necessary information or the subject does not have access rights to the requested information, then a reasoned refusal is sent to them.
The right of the personal data subject to access their personal data may be restricted in accordance with Part 8 of Article 14 of the Personal Data Law, including if the access of the personal data subject to their personal data violates the rights and legitimate interests of third parties.
8.2. In the event of identifying inaccurate personal data upon the application of the personal data subject or their representative, or at their request or at the request of Roskomnadzor, the Operator blocks the personal data relating to this personal data subject from the moment of such application or receipt of the said request for the verification period, if blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
In the event of confirming the fact of inaccuracy of personal data, the Operator, based on the information provided by the personal data subject or their representative or Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and lifts the blocking of personal data.
8.3. In the event of identifying unlawful processing of personal data upon the application (request) of the personal data subject or their representative or Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to this personal data subject from the moment of such application or receipt of the request.
8.4. When the Operator, Roskomnadzor or another interested party identifies a fact of unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has led to a violation of the rights of personal data subjects, the Operator:
- within 24 hours – notifies Roskomnadzor of the incident, the alleged reasons that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
- within 72 hours – notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information about the persons whose actions caused it (if available).
8.5. Procedure for destruction of personal data by the Operator
8.5.1. Conditions and terms for destruction of personal data by the Operator:
- achievement of the purpose of processing personal data or loss of the need to achieve this purpose – within 30 days;
- reaching the maximum storage periods for documents containing personal data – within 30 days;
- provision by the personal data subject (their representative) of confirmation that the personal data were obtained illegally or are not necessary for the stated purpose of processing – within 7 working days;
- withdrawal by the personal data subject of consent to the processing of their personal data, if their preservation for the purpose of their processing is no longer required – within 30 days.
8.5.2. Upon achieving the purpose of processing personal data, as well as in the event of withdrawal by the personal data subject of consent to their processing, personal data are subject to destruction if:
- otherwise is not provided for by the contract, a party to which, a beneficiary or a guarantor under which is the personal data subject;
- the Operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
- otherwise is not provided for by another agreement between the Operator and the personal data subject.
8.5.4. Methods for destroying personal data may be established in local regulations, orders of the General Director of PANELAO FM LLC.
9. FINAL PROVISIONS
9.1. The personal data subject may obtain any clarifications on issues of interest regarding the processing of their personal data by contacting the Operator via email: info@panelao.ru9.2. This document will reflect any changes to the Personal Data Processing Policy by the Operator. The Policy is valid indefinitely until replaced by a new version.
9.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
9.4. The Operator has the right to unilaterally update, amend and supplement this Policy at any time. The current version of the Policy is freely available on the Internet at: https://panelao.ru/
9.5. The Operator ceases processing personal data in the event of the Operator's liquidation as a legal entity, in the event of withdrawal of consent and in other cases provided for by current legislation and the Policy.