Personal Data Processing Policy - Владисарт

1. General provisions

This Policy regarding the processing of personal data at Vladisart Joint Stock Company (hereinafter referred to as the Policy) has been developed in accordance with Federal Law № 152–FZ of 27.07.2006 on Personal Data (hereinafter referred to as Law № 152-FZ) for the purposes of implementation by Vladisart Joint Stock Company (hereinafter referred to as the Operator, Company). the provisions of the Legislation of the Russian Federation, which define the cases and specifics of personal data processing (hereinafter referred to as PD), as well as establish requirements for PD processing, and are aimed at ensuring the protection of human and civil rights and freedoms (of a PD subject) when organizing and/or processing his personal data by a Company, including the protection of privacy rights. life, personal and family secrets.

The Policy is the foundation for organizing the processing and protection of personal data within the Company, including for the development of local regulations governing the procedure for processing and protecting personal data within the Company, and it defines:

the principles of personal data processing;
the legal grounds for processing personal data;
the purposes of processing personal data, the categories and list of personal data being processed, the categories of data subjects whose personal data is being processed, the methods, timeframes for processing and storing personal data, and the procedure for their destruction;
the organization of the process for managing the processing of personal data within the Company.

The basics of the procedure for considering requests from personal data subjects regarding the processing of personal data; measures to ensure the confidentiality and security of personal data; the Company’s rights and obligations, and the rights of the personal data subject. The Company’s employees are familiarized with this Policy, including any amendments to this Policy, by signing a document. The provisions and requirements of this Policy are mandatory for all Company employees who have access to personal data. This Policy is to be posted on the Company’s website at https://vladisart.ru/ in the information and telecommunications network “Internet”, as well as on all pages of the Company’s website that are used to collect personal data of data subjects.

2. Basic concepts

Personal data (PD) – any information related directly or indirectly to a specific or identifiable natural person (PD subject).

The subject of PD is an individual who is directly or indirectly identified or identifiable.

Automated PD processing is the processing of personal data using computer technology.

PD security is the state of PD security, which is characterized by the ability of users, technical means and information technologies to ensure the confidentiality, integrity and accessibility of PD during their processing.

Biometric personal data is information that characterizes the physiological and biological characteristics of a personal data subject, makes it possible to establish (identify) his identity and is used by the Company to establish (identify) his identity.

PD blocking is the temporary termination of PD processing (except in cases where processing is necessary to clarify PD) at the request of the PD subject or Roskomnadzor.

The legislation of the Russian Federation is a set of provisions of the regulatory legal acts of the Russian Federation, which define the cases and features of personal data processing, as well as establish requirements for the processing of personal data.

Personal Data Information System (ISPD) – a set of personal data contained in databases and information technologies and technical means that ensure their processing.

Confidentiality of personal data is the obligation not to disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law.

A supervisory authority is a body authorized to exercise state control and supervision over the compliance of PD processing with legal requirements, as well as compliance with the rights of PD subjects (Roskomnadzor).

PD processing is any action (operation) or set of actions (operations) performed with or without the use of automation tools with PD, including collection, recording, systematization, accumulation, storage, refinement (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deleting, and destroying personal data.

Operator – a state body, municipal body, legal entity or individual who independently or jointly with other persons organize and (or) process personal data, as well as determine the purposes of personal data processing, the composition of personal data to be processed, and actions (operations) performed with personal data.

Special categories of PD are PD related to race, national origin, political views, religious or philosophical beliefs, health status, intimate life, as well as information about criminal records.

Cross‑border transfer of PD is the transfer of PD to the territory of a foreign state to a foreign government authority, a foreign individual, or a foreign legal entity.

Destruction of personal data (PD) refers to actions that make it impossible to restore the content of personal data in the PD information system and/or that result in the destruction of material media containing personal data.

3. Principles of Personal Data Processing

Personal Data Processing in the Company is carried out in compliance with the following principles established by the legislation of the Russian Federation:

Personal Data is processed on a lawful and fair basis;
Personal Data processing is limited to achieving specific, predetermined and lawful purposes;
PD processing that is incompatible with the purposes for which the Personal Data was collected is not permitted;
only those Personal Data that meet the purposes of Personal Data processing are processed;
it is not permitted to combine databases containing PD that are processed for purposes that are incompatible with each other;
the content and volume of the processed personal data correspond to the stated purposes of processing the personal data and must not be excessive in relation to the stated purposes of their processing;
when processing personal data, the accuracy of the data, its sufficiency, and, where necessary, its relevance in relation to the stated purposes of processing the personal data are ensured;
personal data is stored in a form that allows the identification of the data subject no longer than is required by the purposes of their processing, unless the storage period for the personal data is established by the legislation of the Russian Federation or by a contract to which the data subject is a party;
the destruction or ensuring the destruction of personal data (if the processing of personal data is carried out by another person acting on behalf of the Company) is carried out upon achievement of the purposes of its processing or in the event that the need to achieve these purposes ceases, unless otherwise provided for by the legislation of the Russian Federation.

4. Legal grounds for processing personal data

The legal grounds for processing the personal data of data subjects are established taking into account the conditions for processing personal data specified in Law № 152-FZ. The legal grounds for processing personal data are:

the consent of the data subject to the processing of personal data, taking into account the requirements provided for by the legislation of the Russian Federation for the relevant category of personal data;
the provisions of regulatory legal acts, in pursuance of which and in accordance with which the Company processes personal data;
court orders, acts of another body or official that the Company is required to comply with in accordance with the provisions of Russian Federation law on enforcement proceedings;
a contract in which the subject of personal data is a party, or the beneficiary or guarantor, if the processing of personal data is necessary to conclude the said contract or to fulfill the obligations under the contract;
ensuring and/or providing protection of the life, health, or other vital interests of the subject of personal data, if obtaining the consent of the subject of personal data is impossible;
the rights and legitimate interests of the Company, other persons, or the achievement of socially significant goals, provided that the rights and freedoms of the PD subject are not violated;
processing of personal data for statistical or other research purposes, subject to mandatory anonymization of personal data;
processing of personal data subject to publication or mandatory disclosure in accordance with the legislation of the Russian Federation and other applicable regulatory legal acts of the Russian Federation;
PD processing is necessary for carrying out scientific, literary or other creative activities, provided that the rights and legitimate interests of the PD subject are not violated;
the processing of personal data obtained as a result of the anonymization of personal data, for the purposes provided for in Federal Law № 123‑FZ dated April 24, 2020, in accordance with the procedure and on the terms provided for by the said federal laws, provided that the Company participates in the relevant experimental regimes.

5. The purposes of processing personal data, the categories and list of personal data being processed, the categories of subjects whose personal data is being processed, the methods and duration of processing and storage of personal data, and the procedure for their destruction

The Company processes the personal data of data subjects for predetermined purposes. Depending on the specific purposes of processing the personal data, such processing may include, in particular, performing all or some of the following actions (operations) with the personal data: collection (acquisition), recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (provision, access), blocking, deletion, destruction of the personal data.

For each purpose of processing personal data, the Company defines:

categories and the list of personal data being processed;
categories of data subjects whose personal data is processed by the Company;
methods and timeframes for processing and storing personal data;
the procedure for destroying personal data.

The purposes of processing personal data and the corresponding categories, as well as the list of processed personal data and categories of data subjects, are set out in Appendix № 1 to this Policy, which is an integral part of it.

For the purposes of processing personal data specified in Appendix № 1 to this Policy, the following methods of processing personal data are provided:

automated processing of personal data (using computer technology);
non‑automated processing of personal data (without using computer technology).

When processing personal data using an automated method, the Company takes the necessary measures to ensure the security of the processed personal data.

Processing personal data using a non‑automated method, including the storage of physical carriers of personal data, is carried out in premises that ensure their safety, with the possibility of identifying the storage locations for personal data (physical carriers) in accordance with the procedure established by the legislation of the Russian Federation.

The duration for processing and storing personal data for each purpose of processing personal data specified in Appendix No. 1 to this Policy is established taking into account compliance with requirements, including the conditions for processing personal data as defined by the legislation of the Russian Federation, and/or taking into account the provisions of a contract in which the data subject is a party, beneficiary, or guarantor, and/or the consent of the data subject to the processing of their personal data. At the same time, the processing and storage of personal data shall not exceed the period required to achieve the purpose of processing personal data, unless otherwise established by the legislation of the Russian Federation.

Procedure for the destruction of personal data. The destruction of personal data, the processing of which is carried out within the framework of the purposes specified in Appendix № 1 to this Policy, is carried out in the following cases:

achievement of the purpose(s) of personal data processing or in the event of the loss of necessity to achieve the purpose(s) of personal data processing, unless otherwise established by Law № 152‑FZ and/or other applicable regulatory legal acts of the Russian Federation;
detection of the fact of unlawful processing of personal data;
the subject of personal data may revoke their consent to the processing of personal data, unless otherwise provided for by Law № 152‑FZ;
the subject of personal data may submit a request to stop the processing of personal data, unless otherwise established by Law № 152‑FZ.

The methods for destroying personal data are determined by the Company’s local regulatory acts on the processing and protection of personal data, depending on the methods of processing personal data and the material carriers of personal data on which the data is recorded and stored. The fact of data destruction is confirmed in accordance with the procedure provided for in clause 6.8 of this Policy.

6. Organization of the process for managing the processing of personal data in the Company

6.1. When processing personal data, the Company adheres to the principles and requirements for the procedure and conditions for processing personal data as established by the provisions of the legislation of the Russian Federation, this Policy, and other local regulatory acts of the Company.

6.2. The collection (acquisition) and subsequent actions (operations) related to the processing of personal data are carried out in compliance with the rights and legitimate interests of the subjects of personal data within the framework of the approved processes and/or local regulatory acts of the Company, which define:

the legal grounds (conditions) and sources for collecting (obtaining) personal data;
the purposes of processing personal data, the categories and list of processed personal data, the categories of data subjects;
the timeframes for processing and storing personal data; the actions and methods of processing personal data;
the procedure for employees of the Company to access personal data and process it;
the procedure for transferring personal data to third parties, the procedure for disseminating personal data to an indefinite number of persons;
the procedure for updating (updating, changing) personal data;
the procedure for archival storage of personal data.

The procedure for stopping the processing and destruction/ensuring the destruction of personal data (if the processing of personal data is carried out by a person acting on behalf of the Company).

6.3. The Company defines the list of persons who process personal data. Access to the processed personal data is granted only to those Company employees who need it to perform specific functions as part of their job duties. The job descriptions of Company employees and/or employment contracts, including, if applicable, additional agreements to employment contracts, include obligations to ensure the confidentiality and security of personal data and liability measures for failure to comply with these obligations.

Prior to processing personal data, the Company’s employees whose job functions and responsibilities include processing personal data must be familiarized, by signature, with the provisions of Russian legislation on personal data, including the requirements for the protection of personal data, as well as with the requirements of the Company’s local regulatory acts regulating the processing and protection of personal data.

6.4. When processing personal data in the Company, timely clarification (update, modification) of the personal data of the data subject is ensured, which is carried out, in particular, in the event of confirmation of the fact that the personal data is inaccurate, based on:

an application to the Company by the data subject, their representative (who has the authority to represent the interests of the data subject), or the Supervisory Authority, accompanied by documents confirming the fact of inaccuracy and the change in the personal data;
the Company identifies discrepancies between the previously received personal data of the data subject and the personal data provided by the data subject, their representative (who has the authority to represent the interests of the data subject), or the supervisory authority, along with supporting documents.

6.5. The Company’s receipt of personal data from a third party and/or the transfer (provision, access) of personal data to a third party, as well as the assignment of the processing of personal data to a third party, is permitted with the consent of the data subject to the processing of personal data, including that provided to a third party, or if there are other grounds provided for by the legislation of the Russian Federation. The Company’s receipt of personal data from a third party and/or the transfer (provision, access) The processing of personal data by a third party, as well as the assignment of such processing to a third party, is carried out on the basis of an appropriate agreement with the third party, which includes the terms of the personal data processing, the requirements for ensuring the confidentiality and security of personal data during its processing, and other requirements in accordance with Law № 152‑FZ.

The transfer of personal data to government bodies and institutions, municipal authorities, and state extra‑budgetary funds, as well as the receipt of personal data from government bodies and institutions, municipal authorities, and state extra‑budgetary funds, is permitted in the absence of the subject’s consent to the processing of their personal data, in accordance with the procedure and in cases provided for by the legislation of the Russian Federation.

Transboundary transfer of personal data is not carried out.

6.6. PD processing is terminated upon achievement of the purposes of such processing, as well as upon expiration of the period stipulated by the legislation of the Russian Federation, the agreement or the consent of the PD subject to the processing of his personal data. If the PD subject withdraws consent to the processing of his personal data and/or demands to stop processing personal data, the Company has the right to continue processing personal data without the PD subject’s consent, provided that there are grounds (conditions for processing personal data) provided for by Law № 152-FZ.

6.7. If the Company does not have legal grounds for processing personal data (conditions for processing personal data), the Company, in accordance with the procedure established by Law № 152‑FZ, destroys the personal data or ensures its destruction (if the processing of personal data is carried out by a person acting on behalf of the Company). The destruction is carried out by performing actions that make it impossible to restore the content of the personal data in the information system for processing personal data and/or that result in the destruction of the material carriers of the personal data. Based on the results of the destruction, a Certificate of Destruction of Personal Data is drawn up, and an entry is made in the electronic log of events in the Personal Data Processing System in accordance with the requirements of Roskomnadzor Order № 179 dated 28.10.2022 “On Approval of the Requirements for Confirmation of Destruction of Personal Data,” or, in the event that these requirements lose force or are declared invalid in full or in part, in accordance with the provisions of Russian legislation.

7. Fundamentals of the procedure for considering appeals from data subjects regarding the processing of personal data

In order to comply with the rights and legitimate interests of data subjects, the requirements regarding the timeframes for processing appeals and/or requests, to ensure the quality and completeness of measures taken in response to a legitimate request from a data subject, and to provide the necessary information regarding their appeal and/or request, the collection and processing of appeals from data subjects are carried out, as well as monitoring to ensure such collection and processing.

When considering appeals and/or requests from data subjects, the Company adheres to the provisions of Russian legislation, according to which a request and/or appeal submitted by a data subject must contain the information specified in Law № 152‑FZ, namely:

the number of the main document certifying the identity of the personal data subject or their representative;
information about the date of issue of the specified document and the issuing authority;
information confirming the participation of the personal data subject in relations with the Company (contract number, date of contract conclusion, условное словесное обозначение and/or other information), or information otherwise confirming the fact that the Company is processing the personal data;
the signature of the personal data subject or their representative.

If the appeal and/or request is submitted in the form of an electronic document, the document is signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Company provides information and/or takes other measures in response to appeals and/or requests from subjects of personal data in the scope and within the timeframes provided for by the legislation of the Russian Federation. The deadline established by the Legislation of the Russian Federation for responding to a PD subject to an appeal and/or request for information related to the processing of his PD may be extended based on the restrictions established by Law № 152-FZ, with a reasoned notification addressed to the PD subject containing information on the reasons for extending the deadline for providing the requested information.

Upon receiving an appeal and/or request from a data subject and having verified its legitimacy, the Company shall provide the data subject and/or their representative, who has the authority to represent the data subject’s interests, with the information specified in the request in the same form in which the relevant appeal or request was sent, unless otherwise specified in the appeal or request, and/or take other measures depending on the specifics (features) of the appeal and/or request. The information provided by the Company may not contain personal data belonging to other data subjects, except in cases where there are lawful grounds for disclosing such personal data.

The Company has the right to refuse to meet the requirements specified in the appeal and/or request by sending a reasoned refusal to the data subject or their representative if, in accordance with the Laws of the Russian Federation, the Company has lawful grounds to refuse to comply with/meet the received requirements.

The Company monitors the receipt and processing of requests from personal data subjects in order to ensure compliance with the rights and legitimate interests of personal data subjects, adherence to the deadlines for processing requests, and the quality and completeness of measures taken in response to a legitimate request from a personal data subject, as well as the provision of the necessary information regarding their request in accordance with the Company’s local regulatory acts.

8. Measures to ensure the confidentiality and security of personal data

To ensure the confidentiality and security of personal data of data subjects, to protect personal data from unlawful or accidental access to it, destruction, alteration, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions regarding personal data in accordance with Law № 152‑FZ, the Company takes the necessary legal, organizational and technical measures or ensures that they are taken (if the processing of personal data is carried out by a person acting on behalf of the Company). In particular, the following measures are taken:

the current threats to the security of personal data processed in the information system are identified, and the appropriate organizational and technical protection measures are applied to meet the established levels of personal data protection;
to neutralize the current threats to the security of personal data, information protection tools that correspond to the levels of personal data protection and have undergone the established conformity assessment procedure are used;
access control and management are provided for personal data, technical means used in the processing of personal data, information protection tools, and means of ensuring the operation of information systems, as well as access control and management for the premises and facilities where these tools are installed;
registration and accounting of all actions performed with personal data in the personal data processing system are ensured;
the organization of accounting for technical means included in the personal data processing system, as well as for machine media, is carried out;
the list of persons (employees of the Company) who need access to personal data for the performance of their job duties, and whose processing is carried out in the personal data processing system, is determined and, if necessary, updated;
access to the processed personal data is also provided to those Company employees who need this access in connection with the performance of their job duties. automatic registration of security events related to changes in access rights to personal data is provided;
access to the content of security events is provided to a limited number of people, in particular, the Company’s ISPD is located inside a secure perimeter located within a controlled area;
measures are being implemented aimed at preventing and detecting unauthorized access to personal data, and taking measures, including preventing, detecting and eliminating the consequences of computer attacks on personal data and responding to computer incidents in them;
the restoration of personal data modified or destroyed as a result of unauthorized access to it is ensured;
the operation of software and/or its components permitted for use is carried out, and control over their installation and updating is ensured;
incidents are identified and responded to, and measures are implemented to eliminate incidents if they occur;
interaction with GosSOPKA is carried out to the required extent;
external and internal instrumental monitoring of the security of the system components of the information structure is carried out to detect vulnerabilities;
monitoring is carried out to ensure that measures taken to protect personal data and the level of security of information systems processing personal data are effective.

In addition, an assessment is carried out of the harm that may be caused to personal data subjects in the event of a violation of Law № 152‑FZ, as well as the relationship between this harm and the measures taken to ensure compliance with the obligations stipulated by Law № 152‑FZ.

9. Rights and obligations of the Company, rights of the subject of personal data

9.1. The Company is obliged to:

when processing personal data, comply with the requirements of the Russian Federation’s legislation regarding the processing and protection of personal data, including the requirements stipulated for the collection of personal data;
when collecting personal data, including through the information and telecommunications network “Internet”, ensure the recording, systematization, accumulation, storage, clarification (update, modification), and extraction of the personal data of data subjects (citizens of the Russian Federation) using databases located on the territory of the Russian Federation, except in cases provided for by the Russian Federation’s legislation;
when collecting personal data using information and telecommunication networks, publish in the relevant information and telecommunication network, including on the pages of the Company’s website in the information and telecommunication network “Internet”, through which personal data is collected, a document defining the Company’s policy regarding the processing of personal data, and information on the requirements implemented for the protection of personal data, as well as provide access to the specified document using the means of the relevant information and telecommunications network;
if the provision of personal data and/or consent to their processing is mandatory in accordance with the requirements of the Legislation of the Russian Federation and the PD subject refuses to provide personal data and/or consent to their processing, explain the legal consequences of not providing personal data and/or consent to their processing;
in the event that personal data is received from a party other than the data subject, prior to the processing of the personal data, provide the data subject with the information stipulated by Law № 152‑FZ, taking into account the exceptions established by the legislation of the Russian Federation;
fulfill the obligations prescribed for data controllers upon receiving requests and/or appeals regarding personal data from the data subject and/or their representative (who has the authority to represent the data subject’s interests) and/or from the supervisory authority; take measures aimed at ensuring compliance with the requirements of Law № 152‑FZ;
take measures to ensure the security of personal data during its processing;
fulfill the obligations to eliminate violations of the Russian Federation’s legislation if such violations have been committed during the processing of personal data, as well as fulfill the obligations to clarify, block, and destroy personal data in cases provided for by the Russian Federation’s legislation;
fulfill the obligations established by Law № 152‑FZ for personal data operators in the event of receiving a request from the subject of personal data to stop the processing of personal data and/or to withdraw consent to the processing of personal data;
interact with the supervisory authority on issues related to the processing and protection of personal data, in cases provided for by Law № 152‑FZ;
perform other duties provided for by the legislation of the Russian Federation.

9.2. The Company has the right to:

process personal data of data subjects in the absence of consent to process personal data in cases provided for by Law № 152‑FZ;
transfer personal data of data subjects to third parties, government bodies, municipal authorities, state institutions, state extra‑budgetary funds, and also entrust the processing of personal data of data subjects to third parties, provided that there are appropriate legal grounds and the requirements of Law № 152‑FZ are met;
refuse to provide the subject of personal data with information about the processing of their personal data in cases provided for by Law № 152‑FZ;
independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by Law № 152‑FZ and the regulatory legal acts adopted in accordance with it, unless otherwise provided for by the legislation of the Russian Federation;
independently, taking into account the requirements of Law № 152‑FZ, to determine the list of necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access to it, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions regarding personal data, based on the assessment of current threats to the security of personal data, and also to determine the procedure for implementing these measures and to assess the effectiveness of the measures taken;
to exercise other rights provided for by the legislation of the Russian Federation.

9.3. The subject of personal data has the right to:

freely, of their own free will and in their own interest, to provide consent to the processing of personal data, taking into account the requirements of Law No. 152‑FZ regarding the form and content of consents to the processing of personal data;
to send requests and/or appeals, including repeated ones, and to receive information regarding the processing of personal data belonging to the subject of personal data, in the manner, form, scope, and within the timeframes established by the legislation of the Russian Federation;
to require the Company to clarify its personal data, block them, or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing, as well as to take measures provided for by the Legislation of the Russian Federation to protect its rights, taking into account the exceptions established by Law No. 152-FZ;
request the Company to stop processing your personal data, as well as revoke the consent provided for the processing of personal data;
to exercise other rights stipulated by the Legislation of the Russian Federation.

10. Prohibitions and restrictions on the processing of personal data permitted by the data subject for dissemination

access to personal data is restricted in accordance with the legislation of the Russian Federation;
access to the processed personal data is granted only to those Company employees who need it in connection with the performance of their official duties;
company employees who have gained access to personal data assume obligations to ensure the confidentiality and security of the processed personal data;
the Company does not disclose personal data to third parties and does not distribute personal data without the consent of the data subject, unless otherwise provided for by the legislation of the Russian Federation;
third parties who have obtained access to personal data or who process personal data on behalf of the Company undertake to comply with the requirements of contracts and agreements with the Company regarding the confidentiality and security of personal data.

11. Final Provisions

This Policy comes into effect and becomes mandatory for all employees of the Company from the moment it is approved.

This Policy may be amended at any time at the Company’s discretion, including in cases of changes to the legislation of the Russian Federation or the Company’s local regulatory acts that determine the procedure for processing and protecting personal data.

If, for any reason, one or more provisions of this Policy are found to be invalid or without legal force, these circumstances will not affect the validity or applicability of the remaining provisions of the Policy.

The Company’s employees are responsible for non‑compliance with the requirements for the processing and protection of personal data, including for the disclosure or illegal use of personal data, in accordance with the procedure and upon the occurrence of the conditions provided for by the Labour Code of the Russian Federation, and may also be held liable under civil, administrative and criminal law in accordance with the applicable regulatory legal acts of the Russian Federation.

Monitoring compliance with the requirements of this Policy is carried out by the person responsible for organizing the processing of personal data.

The Company’s Personal Data Processing Policy is published on the Company’s website on the Internet at: https://vladisart.ru/en/personal-policy/. The Policy is available for unrestricted access.

Contact information

Any inquiries regarding the processing of personal data should be directed to the Company:

Email: info@vladisart.ru

Phone: +7 4922 37-72-80 / 8 800 30 10 700

Address: 600031, Vladimir, Dobroselskaya St., 188A