Home
Policy

Personal data processing policy

ООО «РК ГРУПП»

This English translation is provided for convenience. If it differs from the Russian original, the Russian text prevails.

1. General provisions

1.1. This Policy on the Processing of Personal Data of RK GROUP Limited Liability Company (hereinafter, the Policy) has been developed pursuant to clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter, the Personal Data Law). It sets out the purposes, content and procedure of personal data processing, the measures aimed at protecting personal data, and the procedures aimed at detecting and preventing violations of the legislation of the Russian Federation in the field of personal data.

1.2. The following key terms are used in this Policy:

Personal data – any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject);
Operator – a state body, municipal body, legal entity or natural person that, independently or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the personal data to be processed and the actions (operations) performed with personal data;
Processing of personal data – any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data;
Automated processing of personal data – processing of personal data by means of computer equipment;
Dissemination of personal data – actions aimed at disclosing personal data to an indefinite range of persons;
Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific range of persons;
Blocking of personal data – temporary suspension of the processing of personal data (except where processing is necessary to clarify the personal data);
Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which the tangible media of personal data are destroyed;
Depersonalisation of personal data – actions as a result of which it becomes impossible, without additional information, to determine to which particular data subject the personal data belong;
Personal data information system – the set of personal data contained in databases together with the information technologies and technical means that ensure their processing;
Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign natural person or a foreign legal entity.

1.3. The Policy applies to all personal data processed by RK GROUP Limited Liability Company (hereinafter, the Operator or RK GROUP LLC).

1.4. The Policy applies to personal data processing relationships that arose for the Operator both before and after the approval of this Policy.

1.5. Main rights and obligations of the Operator.

1.5.1. The Operator has the right to:

independently determine the composition and list of measures necessary and sufficient to fulfil the obligations set out in the Personal Data Law and the regulations adopted under it, unless otherwise provided by the Personal Data Law or other federal laws;
entrust the processing of personal data to another person with the consent of the data subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person. A person processing personal data on the Operator's instructions must comply with the principles and rules of personal data processing set out in the Personal Data Law, keep the personal data confidential and take the measures necessary to fulfil the obligations set out in the Personal Data Law;
if the data subject withdraws consent to the processing of personal data, continue processing the personal data without the data subject's consent where the grounds specified in the Personal Data Law exist.

1.5.2. The Operator is obliged to:

organise the processing of personal data in accordance with the requirements of the Personal Data Law;
respond to appeals and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
provide the authorised body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)), at its request, with the necessary information within 10 working days of receiving such a request. This period may be extended by no more than five working days, for which the Operator must send Roskomnadzor a reasoned notice stating the reasons for extending the period for providing the requested information;
in the manner determined by the federal executive authority responsible for security, interact with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it of computer incidents that resulted in the unlawful transfer (provision, dissemination, access) of personal data.

1.6. Main rights of the personal data subject. The data subject has the right to:

receive information concerning the processing of their personal data, except in cases provided for by federal laws. The information is provided to the data subject by the Operator in an accessible form and must not contain personal data relating to other data subjects, except where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
require the Operator to clarify, block or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and take the measures provided by law to protect their rights;
give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
appeal against unlawful actions or omissions of the Operator in processing their personal data to Roskomnadzor or in court;
exercise other rights provided for by the legislation of the Russian Federation.

1.7. Compliance with the requirements of this Policy is monitored by the authorised person responsible for organising the processing of personal data at the Operator.

1.8. This Policy has been adopted by the Operator in order to comply with the requirements of Russian legislation on the processing of personal data and to protect the rights and freedoms of individuals and citizens when their personal data are processed, including the protection of the rights to privacy and to personal and family secrets.

2. Principles of personal data processing

2.1. Personal data are processed in compliance with the principles and rules set out in the Personal Data Law, namely:

2.1.1. Processing personal data on a lawful and fair basis.

2.1.2. Limiting the processing of personal data to the achievement of specific, predetermined and lawful purposes, and not allowing processing of personal data that is incompatible with the purposes for which the personal data were collected.

2.1.3. Not allowing databases containing personal data processed for mutually incompatible purposes to be combined.

2.1.4. Processing only those personal data that meet the purposes of their processing.

2.1.5. Ensuring that the content and scope of the personal data processed correspond to the stated purposes of processing, and not allowing processing of personal data that is excessive in relation to the stated purposes.

2.1.6. Ensuring the accuracy and sufficiency of personal data and, where necessary, their relevance to the purposes of processing.

2.1.7. Storing personal data in a form that allows the data subject to be identified for no longer than the purposes of processing require, unless a different storage period is established by the legislation of the Russian Federation or by a contract to which the data subject is a party, beneficiary or guarantor.

2.1.8. Destroying personal data, or ensuring their destruction, once the purposes of processing have been achieved or the need to achieve them has ceased, unless otherwise provided by the legislation of the Russian Federation.

3. Purposes, content and methods of personal data processing

3.1. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of their collection is not permitted.

3.2. Only personal data that meet the purposes of their processing are processed.

3.3. The Operator processes personal data for the following purposes:

recruitment of staff (applicants) for the Operator's vacant positions;
management of the Operator's staff;
payment of salaries and other remuneration processes for the Operator's staff;
support and motivation of the Operator's staff (corporate benefits);
organisation of business trips, travel, transport and administrative support for the Operator's staff;
ensuring the security of the Operator's activities and the safety of its property;
information technology support of the Operator's activities;
support of document management processes and of the activities of the Operator's staff and governing bodies;
support of the Operator's core activities in accordance with its Charter;
development of partner relations, promotion of products and improving the effectiveness of interaction with counterparties and persons potentially interested in cooperating with the Operator.

3.4. The Operator may process the personal data of the following data subjects:

employees (current and former) of the Operator;
family members and other relatives or other contact persons of the Operator's employees;
applicants for vacant positions with the Operator;
family members and other relatives, as well as related persons, of applicants for vacant positions with the Operator;
natural persons who have concluded a civil law contract with the Operator;
natural persons who are representatives/employees of the Operator's counterparties;
recipients of payments related to the Operator's employees;
natural persons (employees/representatives of legal entities) who send enquiries to the Operator;
participants in events (conferences, seminars, webinars and other public events held in the interests of the Operator, partner organisations or professional communities);
users/visitors of the Operator's internet resources;
natural persons who have consented to the processing of personal data for the purpose of promoting the goods of the Operator and its partners;
visitors to the Operator's offices and other real estate;
staff of authorised bodies and organisations;
natural persons whose personal data the Operator has been instructed to process;
data subjects who have consented to the cross-border transfer of personal data;
other natural persons who have consented to the processing of their personal data by the Operator.

3.5. The processing of personal data at RK GROUP LLC includes: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, receipt, comparison (matching), combination (linking), transfer (provision, access), depersonalisation, blocking, deletion and destruction.

3.6. The Operator may disseminate personal data where the data subject has consented or another legal ground exists. The Operator may also carry out cross-border transfer of personal data where this is necessary for its statutory activities, subject to the conditions and restrictions established by the Personal Data Law.

3.7. For each purpose of processing, the Operator processes personal data in the following ways:

non-automated processing of personal data;
automated processing of personal data, with or without transmission of the information obtained over information and telecommunication networks;
mixed processing of personal data.

3.8. The list of categories of personal data processed, the categories of data subjects whose personal data are processed, the methods and periods of processing and storage, and the procedure for destroying personal data for each purpose of processing are set out in Appendix No. 1 to this Policy.

4. Legal grounds for personal data processing

4.1. The legal ground for the processing of personal data is the body of regulations in pursuance of and in accordance with which the Operator processes personal data, including:

the Constitution of the Russian Federation;
the Civil Code of the Russian Federation;
the Labour Code of the Russian Federation;
the Tax Code of the Russian Federation;
Federal Law No. 14-FZ of 08.02.1998 "On Limited Liability Companies";
Federal Law No. 152-FZ of 27.07.2006 "On Personal Data";
Resolution of the Government of the Russian Federation No. 1119 of 01.11.2012 "On approval of the requirements for the protection of personal data during their processing in personal data information systems";
Order of FSTEC of Russia No. 21 of 18.02.2013 "On approval of the composition and content of organisational and technical measures to ensure the security of personal data during their processing in personal data information systems";
Federal Law No. 402-FZ of 06.12.2011 "On Accounting";
Federal Law No. 167-FZ of 15.12.2001 "On Compulsory Pension Insurance in the Russian Federation";
other regulations governing relations connected with the Operator's activities.

4.2. The legal grounds for the processing of personal data also include:

the Charter of RK GROUP LLC;
regulations and other local acts on the processing of personal data adopted at RK GROUP LLC;
contracts concluded between the Operator and data subjects;
consents of data subjects to the processing of their personal data.

5. Procedure and conditions of personal data processing

5.1. The Operator processes personal data in accordance with the requirements of the legislation of the Russian Federation.

5.2. Personal data are processed with the consent of data subjects to the processing of their personal data, and without such consent in the cases provided for by the legislation of the Russian Federation.

5.3. Personal data may be processed by those employees of the Operator whose job duties include the processing of personal data.

5.4. For each purpose of processing specified in clause 3.3 of the Policy, personal data are processed by:

obtaining personal data orally and in writing directly from data subjects;
entering personal data into the Operator's logs, registers and information systems;
using other methods of personal data processing.

5.5. Personal data may not be disclosed to third parties or disseminated without the consent of the data subject, unless otherwise provided by federal law. Consent to the processing of personal data that the data subject has permitted for dissemination is executed separately from the data subject's other consents to the processing of their personal data.

The requirements for the content of consent to the processing of personal data permitted by the data subject for dissemination are approved by Roskomnadzor Order No. 18 of 24.02.2021.

5.6. Personal data are transferred to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia and other authorised executive bodies and organisations in accordance with the requirements of the legislation of the Russian Federation.

5.7. The Operator stores personal data in a form that allows the data subject to be identified for no longer than each purpose of processing requires, unless the storage period is established by federal law or a contract.

5.7.1. Personal data on paper are stored at RK GROUP LLC for the retention periods of documents established by the legislation of the Russian Federation on archiving (Federal Law No. 125-FZ of 22.10.2004 "On Archiving in the Russian Federation"; the List of standard administrative archival documents generated in the course of the activities of state bodies, local governments and organisations, indicating their retention periods, approved by Rosarkhiv Order No. 236 of 20.12.2019).

5.7.2. The retention period for personal data processed in personal data information systems corresponds to the retention period for personal data on paper.

5.8. The Operator stops processing personal data in the following cases:

unlawful processing has been detected — within three working days of the date of detection;
the purpose of processing has been achieved;
the data subject's consent to the processing of the data has expired or been withdrawn, where under the Personal Data Law the processing of such data is permitted only with consent.

5.9. When the purposes of processing personal data have been achieved, and when the data subject withdraws consent to their processing, the Operator stops processing those data, unless:

otherwise provided by a contract to which the data subject is a party, beneficiary or guarantor;
the Operator is entitled to process the data without the data subject's consent on the grounds provided for by the Personal Data Law or other federal laws;
otherwise provided by another agreement between the Operator and the data subject.

5.10. When a data subject applies to the Operator with a demand to stop processing personal data, the processing is stopped within no more than 10 working days of the date the Operator receives the demand, except in the cases provided for by the Personal Data Law. This period may be extended by no more than five working days, for which the Operator must send the data subject a reasoned notice stating the reasons for the extension.

5.11. When collecting personal data, including via the internet, the Operator ensures that the recording, systematisation, accumulation, storage, clarification (updating, modification) and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation, except in the cases specified in the Personal Data Law.

6. Updating, correction, deletion and destruction of personal data; responses to data subjects' requests for access to personal data

6.1. Confirmation that the Operator processes personal data, the legal grounds and purposes of processing, and the other information specified in part 7 of Article 14 of the Personal Data Law are provided by the Operator to the data subject or their representative within 10 working days of the application or the receipt of a request from the data subject or their representative. This period may be extended by no more than five working days, for which the Operator should send the data subject a reasoned notice stating the reasons for extending the period for providing the requested information.

The information provided does not include personal data relating to other data subjects, except where there are legal grounds for disclosing such personal data.

The request must contain:

the number of the main identity document of the data subject or their representative, its date of issue and the issuing authority;
information confirming the data subject's participation in relations with the Operator (contract number, contract date, a reference name and/or other information), or information otherwise confirming that the Operator processes the personal data;
the signature of the data subject or their representative.

The request may be sent as an electronic document signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator provides the information specified in part 7 of Article 14 of the Personal Data Law to the data subject or their representative in the same form in which the application or request was sent, unless the application or request states otherwise.

If the data subject's application (request) does not contain all the information required by the Personal Data Law, or the data subject has no right of access to the requested information, a reasoned refusal is sent to them.

The data subject's right of access to their personal data may be restricted in accordance with part 8 of Article 14 of the Personal Data Law, including where the data subject's access to their personal data would violate the rights and legitimate interests of third parties.

6.2. If inaccurate personal data are identified upon an application by the data subject or their representative, at their request or at the request of Roskomnadzor, the Operator blocks the personal data relating to that data subject from the moment of such application or receipt of the request for the period of verification, provided that blocking the personal data does not violate the rights and legitimate interests of the data subject or third parties.

If the inaccuracy of the personal data is confirmed, the Operator, on the basis of the information provided by the data subject, their representative or Roskomnadzor, or of other necessary documents, clarifies the personal data within seven working days of the date such information is provided and unblocks the personal data.

6.3. If unlawful processing of personal data is identified upon an application (request) by the data subject, their representative or Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to that data subject from the moment of such application or receipt of the request.

6.4. If the Operator, Roskomnadzor or another interested person discovers an unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has resulted in a violation of the rights of data subjects, the Operator:

within 24 hours — notifies Roskomnadzor of the incident, the presumed causes of the violation of data subjects' rights, the presumed harm caused to the rights of data subjects and the measures taken to eliminate the consequences of the incident, and provides information about the person authorised by the Operator to interact with Roskomnadzor on matters related to the incident;
within 72 hours — notifies Roskomnadzor of the results of the internal investigation of the incident and provides information about the persons whose actions caused it (if any).

6.5. Procedure for the destruction of personal data by the Operator.

6.5.1. Conditions and time limits for the destruction of personal data by the Operator:

the purpose of processing personal data has been achieved or the need to achieve it has ceased — within 30 days;
the maximum retention periods for documents containing personal data have been reached — within 30 days;
the data subject (or their representative) has provided confirmation that the personal data were obtained unlawfully or are not necessary for the stated purpose of processing — within seven working days;
the data subject has withdrawn consent to the processing of their personal data, if keeping them is no longer required for the purpose of processing — within 30 days.

6.5.2. When the purpose of processing personal data has been achieved, and when the data subject withdraws consent to their processing, the personal data are to be destroyed, unless:

otherwise provided by a contract to which the data subject is a party, beneficiary or guarantor;
the Operator is entitled to process the data without the data subject's consent on the grounds provided for by the Personal Data Law or other federal laws;
otherwise provided by another agreement between the Operator and the data subject.

6.5.3. Personal data are destroyed by a commission established by order of the General Director of RK GROUP LLC.

6.5.4. Personal data are destroyed within the time limits established by law using the standard software tools of the information system; paper media are destroyed by shredding.

7. Protection of personal data

7.1. The Operator takes the legal, organisational and technical measures necessary to protect personal data against unlawful or accidental access, destruction, modification, blocking, dissemination and other unauthorised actions, including:

7.1.1. Identifying threats to the security of personal data during their processing in personal data information systems.

7.1.2. Applying the organisational and technical measures to ensure the security of personal data during their processing in personal data information systems that are necessary to meet the personal data protection requirements, the fulfilment of which ensures the levels of personal data protection established by the Government of the Russian Federation.

7.1.3. Using information security tools that have passed the conformity assessment procedure in the established manner.

7.1.4. Using, for the destruction of personal data, information security tools that have passed the conformity assessment procedure in the established manner and include a function for destroying information.

7.1.5. Assessing the effectiveness of the measures taken to ensure the security of personal data before a personal data information system is put into operation.

7.1.6. Keeping records of machine media of personal data.

7.1.7. Detecting unauthorised access to personal data and taking measures, including measures to detect, prevent and eliminate the consequences of computer attacks on personal data information systems and to respond to computer incidents in them.

7.1.8. Restoring personal data modified or destroyed as a result of unauthorised access to them.

7.1.9. Establishing rules for access to personal data processed in the personal data information system, and ensuring the registration and recording of all actions performed with personal data in the personal data information system.

7.1.10. Monitoring the measures taken to ensure the security of personal data and the level of protection of personal data information systems.

7.1.11. Appointing a person responsible for the processing of personal data, who organises the processing of personal data and carries out internal control over the Operator's compliance with the personal data protection requirements.

7.1.12. Approving local regulations and other documents governing relations in the field of processing and protection of personal data.

7.1.13. Assigning employees individual passwords for access to the information system in accordance with their job duties.

7.1.14. Organising a security regime for the premises housing the information system that prevents uncontrolled entry or presence in those premises of persons who have no right of access to them.

7.1.15. Ensuring the safekeeping of personal data media.

7.1.16. Approving a document that defines the list of persons who need access to the personal data processed in the information system to perform their official (job) duties.

7.1.17. Using information security tools that have passed the procedure for assessing conformity with the requirements of the legislation of the Russian Federation on information security, where the use of such tools is necessary to neutralise current threats.

7.1.18. Applying other legal, organisational and technical measures to ensure the security of personal data in accordance with the Operator's internal local documents.

8. Additional terms

8.1. This Policy is an internal document of RK GROUP LLC, is publicly available and is to be published on the official website of RK GROUP LLC in accordance with part 2 of Article 18.1 of the Personal Data Law.

8.2. The Operator has the right to amend this Policy without prior notice. When amendments are made, the current version states the date of the last update. A new version of the Policy comes into force when it is published, unless the new version provides otherwise. The current version is published at https://rkgroup.ru/policy.

8.3. Compliance with the requirements of this Policy is monitored by the person responsible for organising the processing of personal data at RK GROUP LLC.

8.4. The liability of officers of RK GROUP LLC who have access to personal data for failure to comply with the rules governing the processing and protection of personal data is determined in accordance with the legislation of the Russian Federation and the local documents of RK GROUP LLC.

9. Company details and contact information

Name of the organisation: RK GROUP Limited Liability Company (Общество с ограниченной ответственностью «РК ГРУПП»)

Short name: RK GROUP LLC (ООО «РК ГРУПП»)

Legal and postal address: 12 Kemerovskaya St. (Baysangurovsky district), Grozny, Chechen Republic, 364047, Russia

E-mail: info@rkgroup.ru

INN 2016004205

KPP 201601001

OGRN 1182036003060

Appendix No. 1 to this Policy: List of categories of personal data processed, categories of data subjects whose personal data are processed, methods and periods of their processing and storage, and the procedure for destroying personal data for each purpose of processing.

Appendix No. 1 to the Policy on the Processing of Personal Data of RK GROUP LLC

List of categories of personal data processed, categories of data subjects whose personal data are processed, methods and periods of their processing and storage, and the procedure for destroying personal data for each purpose of processing

Section No. 1. Purpose of processing: recruitment of staff (applicants) for the Operator's vacant positions, namely:

searching for applicants to fill vacant positions;
checking the reliability of applicants, including managing the legal, reputational and compliance (prevention and settlement of conflicts of interest) risks associated with applicants, and verifying the completeness and accuracy of the information provided by applicants;
maintaining a talent pool;
assessing whether applicants meet the applicable requirements, including testing their knowledge and abilities;
deciding whether to hire an applicant or refuse to fill the vacancy (employment);
preparing to conclude an employment contract and pre-contractual interaction with candidates;
informing applicants about suitable vacancies.

1.1. Category of data subjects: applicants for vacant positions; family members and other relatives of applicants for vacant positions with the Operator.

1.2. Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, marital status, social status, property status, income, sex, e-mail address, residential address, registration address, telephone number, SNILS (individual insurance account number), INN (taxpayer identification number), citizenship, identity document details, driving licence details, details of an identity document valid outside the Russian Federation, bank card details, settlement account number, personal account number, profession, position, employment information (including length of service and current employment with the name and settlement account of the organisation), attitude to military duty, military registration information, education information, photographic image of the face (not used for identification),
Other personal data: messenger and/or social network account; references from previous employers; expected salary; information on skills (foreign language proficiency, driving, other work-related skills); information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.);
Special categories of personal data: health information relating to (in)capacity for work; health information relating to disability; health information relating to fitness for military service;
Biometric personal data: not processed.

1.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), depersonalisation, receipt, transfer (provision, access), deletion, destruction. Processing format: both with and without the use of automation.

1.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law or the Data Subject's consent.

1.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 2. Purpose of processing: management of the Operator's staff, namely:

processing hiring / dismissal; conducting interviews (surveys) on hiring / dismissal; induction and adaptation to work and the social environment;
making management and personnel decisions, supporting career development and promotion;
keeping personnel and military records;
organising remote working arrangements;
planning staff work and managing labour productivity, monitoring and controlling the quantity and quality of work performed and the efficient use of working time, checking and assessing the performance of job duties;
considering and resolving labour disputes, conflicts and other disagreements in the context of employment relations;
maintaining effective information (communication) exchange with the Operator's staff;
planning, organising and holding work (business) events of various kinds;
organising and/or conducting training of various kinds (including briefings), professional development, professional (re)training, testing of knowledge and abilities, as well as ensuring, monitoring, training (including briefings), internships and knowledge testing in occupational safety, safety engineering, fire safety, civil defence and protection against emergencies;
conducting the special assessment of working conditions (SOUT) and the assessment of occupational risks (OPR);
organising medical examinations to determine whether staff are able to perform their job functions, and to diagnose and prevent occupational diseases;
investigating, documenting (considering), recording and reporting micro-injuries, accidents and occupational diseases; preventing the spread of infections among staff, and giving staff the necessary support in overcoming infectious diseases and their consequences;
ensuring compliance with labour law, including: completing and submitting the required reporting forms to the authorised bodies, and arranging individual (personalised) registration of employees in the compulsory pension insurance and compulsory social insurance systems.

2.1. Categories of data subjects: employees (current and former) of the Operator; family members, other relatives and other contact persons of employees.

2.2. Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, marital status, social status, property status, income, sex, e-mail address, residential address, registration address, telephone number, SNILS, INN, citizenship, identity document details, driving licence details, details of an identity document valid outside the Russian Federation, bank card details, settlement account number, personal account number, profession, position, employment information (including length of service and current employment with the name and settlement account of the organisation), attitude to military duty, military registration information, education information, photographic image of the face (not used for identification),
Other personal data: messenger and/or social network account data; information on skills (foreign language proficiency, driving, other work-related skills); information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); information on professional development; information on professional preferences and expectations; information on professional and/or scientific interests; information on achievements, merits, incentives and awards; information on the use and operation of software and hardware, information systems, computing and communication networks; information on the use and operation of telecommunication services; information on the results of the special assessment of working conditions; anthropometric data; information on the provision of personal protective equipment; information on accidents in the course of work (official) activities; information on violations of applicable rules (including legal rules) and on the related liability; image data, including the face (not used for identification); information on compulsory medical, pension and social insurance; information on voluntary personal and property insurance;
Personal data in the category "Special categories of personal data": health information relating to (in)capacity for work; health information relating to disability; health information relating to (blood) donation; health information relating to pregnancy; health information relating to fitness for military service;
Personal data in the category "Biometric personal data": not processed.

2.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

2.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

2.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 3. Purpose of processing: payment of salaries and other remuneration processes for the Operator's staff, namely:

calculating and paying salaries, allowances, premiums, bonuses, benefits, reimbursement of expenses incurred, compensation, financial assistance and other payments, and providing tax deductions;
calculating and making deductions from salaries and other income in the cases provided for by law;
keeping accounting and tax records in respect of the Operator's staff;
ensuring compliance with the tax legislation of the Russian Federation, including: completing and submitting the required reporting forms to the authorised bodies;
ensuring compliance with the pension legislation of the Russian Federation, including: completing and submitting the required reporting forms to the authorised bodies;
arranging the issue of bank cards for personal and/or business use.

3.1. Categories of data subjects: employees (current and former) of the Operator; family members and other relatives of the Operator's employees; recipients of payments related to the Operator's employees.

3.2. Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, sex, e-mail address, residential address, registration address, SNILS, INN, citizenship, identity document details, driving licence details, details of an identity document valid outside the Russian Federation, bank card details, settlement account number, personal account number, profession, position, employment information (including length of service and current employment with the name and settlement account of the organisation);
Other personal data: place of work (city or work address); information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); information on income, expenses and deductions related to work (official) activities; information on compulsory medical, pension and social insurance; information on pension provision; financial and payment information; information on enforcement proceedings; information on working time, insurance record and benefits; information on marital status and family composition, details of marriage certificates and children's birth certificates,
Personal data in the category "Special categories of personal data": health information relating to disability;
Personal data in the category "Biometric personal data": not processed.

3.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

3.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

3.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 4. Purpose of processing: support and motivation of the Operator's staff (corporate benefits), namely:

participation in voluntary insurance programmes, including medical insurance;
achieving and maintaining an optimal level of motivation and engagement in work (official) activities, including organising participation in loyalty programmes of various kinds and other incentive (reward) measures;
arranging gifts;
organising voluntary participation in internal events not related to work (official) activities, and in public events.

4.1. Categories of data subjects: employees (current and former) of the Operator.

4.2. Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, marital status, social status, property status, income, sex, e-mail address, residential address, registration address, telephone number, SNILS, INN, citizenship, identity document details, driving licence details, details of an identity document valid outside the Russian Federation, bank card details, settlement account number, personal account number, profession, position, employment information (including length of service and current employment with the name and settlement account of the organisation), attitude to military duty, military registration information, education information, photographic image of the face (not used for identification),
Other personal data: place of work (city or work address); information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); details of marriage/divorce certificates and death certificates; information on insurance coverage; details (series and number, date of issue) of the insurance policy and the name of the insurer; insurance programme number; information on individual insurance indemnity; anthropometric data; image data, including the face (not used for identification);
Personal data in the category "Special categories of personal data": health information;
Personal data in the category "Biometric personal data": not processed.

4.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

4.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

4.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 5. Purpose of processing: organisation of business trips, travel, transport and administrative support for the Operator's staff, namely:

organising (including arranging the paperwork for) business meetings and trips, including business travel and other official trips;
providing vehicles for use and/or their business operation, properly recording and reimbursing the costs of such operation, and providing effective technical assistance during the business operation of vehicles;
assisting with entry documents for the Russian Federation and/or foreign states;
ensuring local transport mobility (individual transport by car);
monitoring and controlling the business operation and safety of vehicles, and protecting the employer's property interests during the business operation of vehicles and in resolving insured/uninsured incidents involving them.

5.1 Categories of data subjects: employees (current and former) of the Operator.

5.2 Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, marital status, social status, property status, income, sex, e-mail address, residential address, registration address, telephone number, SNILS, INN, citizenship, identity document details, driving licence details, details of an identity document valid outside the Russian Federation, bank card details, settlement account number, personal account number, profession, position, employment information (including length of service and current employment with the name and settlement account of the organisation), attitude to military duty, military registration information, education information, photographic image of the face (not used for identification),
Other personal data: place of work (city or work address); information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); information on business trips, including business travel and other official trips; information on visits to and stays in various states; information on driving vehicles; vehicle information; information on the provision and use of a vehicle; information on status and authority to represent interests; information on an offence (misconduct) committed using a vehicle; information on a road traffic or other accident involving a vehicle; geolocation and navigation data;
Personal data in the category "Special categories of personal data": not processed;
Personal data in the category "Biometric personal data": not processed.

5.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

5.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

5.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 6. Purpose of processing: ensuring the security of the Operator's activities and the safety of its property, namely:

ensuring the safety of property and protecting natural persons against unlawful acts (encroachments);
ensuring on-site security and access control at the real estate in use.

6.1. Categories of data subjects: employees (current and former) of the Operator; natural persons who have concluded a civil law contract with the Operator; natural persons who are representatives/employees of the Operator's counterparties; visitors to the Operator's real estate.

6.2. Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, identity document details, driving licence details, details of an identity document valid outside the Russian Federation,
Other personal data: information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); information on controlled presence at real estate; video and audio recordings of images (not used for identification); information on place of residence and/or stay; access pass information; vehicle information;
Personal data in the category "Special categories of personal data": not processed;
Personal data in the category "Biometric personal data": not processed.

6.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

6.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

6.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 7. Purpose of processing: information technology support of the Operator's activities, namely:

IT support for work (official) communications of staff, making them easier and more efficient, keeping software and hardware, systems, networks and services safe, and providing staff with effective technical support in their business use;
ensuring information security, and the proper handling and protection of information constituting secrets protected by law and of intellectual property;
providing for use and/or business operation, and technical support of, software and hardware (including personal computers, office equipment, communication equipment and information security tools), information systems, computing and (tele)communication networks and services;

7.1. Categories of data subjects: employees (current and former) of the Operator;

7.2. Categories and list of personal data:

Personal data: surname, first name, patronymic;
Other personal data: information on the use and operation of software and hardware, information systems, computing and communication networks; information on internet use; information on internet connections; information on visits to and use of internet resources; user device information; information on the use and operation of telecommunication services; identification, authentication and authorisation data; metadata about various objects (files) and their contents; information about the user's web browser; information passing through the Operator's e-mail server and/or other information systems of the Operator (and information systems of third parties that the Operator uses under contracts with them), including the employee's correspondence and its content (any correspondence involving the employee, regardless of its form, on electronic or paper media, that is or may be at the Operator's disposal: on the Operator's property/equipment; on the Operator's resources provided to the employee to perform their job function; on resources interacting with the Operator's resources; on resources of the Operator's counterparties; on resources controlled and/or administered by the Operator; on resources used to conduct the Operator's activities); information on data entry patterns on the user device (without storing the data entered by the user); information on clearance to secrets protected by law.
Personal data in the category "Special categories of personal data": not processed;
Personal data in the category "Biometric personal data": not processed.

7.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

7.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

7.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 8. Purpose of processing: support of document management processes and of the activities of the Operator's staff and governing bodies, namely:

delegating authority to represent the Operator's interests, including issuing powers of attorney and electronic signatures;
organising and maintaining records management, ensuring document flow (in paper and electronic form), conducting legally significant correspondence (in paper and electronic form);
participating in out-of-court and court settlement of disputes, enforcing court decisions, assisting in the administration of justice;
ensuring the efficiency and sustainability (continuity) of operations, organising and managing activities and assets (property), strategic and budget planning, project management, maintaining the necessary reporting, managing reorganisation, merger, acquisition, liquidation or asset disposal transactions;
supporting the activities of the governing bodies;
properly recording, storing and destroying certain categories of tangible information media.

8.1. Categories of data subjects: employees (current and former) of the Operator; founders; natural persons who have concluded a civil law contract with the Operator;

8.2. Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, residential address, registration address, SNILS, INN, citizenship, identity document details, details of an identity document valid outside the Russian Federation, profession, position,
Other personal data: information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); personal handwritten signature (specimen); electronic signature;
Personal data in the category "Special categories of personal data": not processed;
Personal data in the category "Biometric personal data": not processed.

8.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

8.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

8.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 9. Purpose of processing: support of the Operator's core activities in accordance with its Charter, namely:

actually carrying out its main types of activity in accordance with its own founding document;
contract work, including the conclusion, performance, amendment and termination of contracts and agreements with counterparties;
making financial settlements with persons who are not staff, and keeping the related accounting and tax records;
organising, conducting and managing the effectiveness of procurement of products (goods, works, services) from counterparties;
taking due diligence measures in respect of potential and current counterparties, including managing the financial, commercial, legal, regulatory, operational, contractual, reputational and other risks associated with counterparties, and verifying the completeness and accuracy of the information provided by potential and current counterparties;
obtaining permits for certain types of its own activity and/or confirmation that the products sold comply with the applicable requirements;

9.1. Categories of data subjects: natural persons who have concluded a civil law contract with the Operator; natural persons who are representatives/employees of the Operator's counterparties; staff of authorised bodies and organisations;

9.2. Categories and list of personal data:

Personal data: surname, first name, patronymic, year of birth, month of birth, date of birth, place of birth, residential address, registration address, SNILS, INN, citizenship, identity document details, details of an identity document valid outside the Russian Federation, profession, position, e-mail address; telephone number; bank card details, settlement account number, personal account number, place of work (city or work address);
Other personal data: information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); personal handwritten signature (specimen); electronic signature; information on position, department and current place of employment; information on status and authority to represent interests; bank details;
Personal data in the category "Special categories of personal data": not processed;
Personal data in the category "Biometric personal data": not processed.

9.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, transfer (provision, access), depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

9.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

9.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

Section No. 10. Purpose of processing: development of partner relations, promotion of products and improving the effectiveness of interaction with counterparties and persons potentially interested in cooperating with the Operator, namely:

finding, identifying and analysing persons potentially interested in cooperation, establishing and maintaining business communication with interested persons, participating in the procurement procedures of potential and current counterparties;
offering and promoting its own products and brand on the market through marketing communications, including by sending personal offers and advertising messages and by displaying personalised and/or non-personalised advertising;
planning, organising and conducting marketing, promotional, statistical and analytical activities (including surveys and research);
analysing the satisfaction of counterparties and other interested persons with the products sold;
carrying out information (communication) exchange with all interested persons, including information services, sending information messages, processing and considering incoming enquiries and information materials of any kind, providing effective support when interested persons encounter various problems or situations, and managing the quality and effectiveness of such interaction;
providing tools for effective communication and organising business meetings (running websites and social network communities; organising forums, conferences, round tables, etc.).

10.1. Categories of data subjects: representatives/employees of the Operator's counterparties; natural persons (employees/representatives of legal entities) who send enquiries to the Operator; users/visitors of the Operator's internet resources; participants in events (conferences, seminars, webinars and other public events held in the interests of the Operator, partner organisations or professional communities); natural persons who have consented to the processing of personal data for the purpose of promoting the goods, works and services of the Operator and its partners;

10.2. Categories and list of personal data:

Personal data: surname, first name, patronymic; contact e-mail address; telephone number; IP address, cookies,
Other personal data: information on permit documents of foreign citizens and stateless persons (including details of visas, residence permits, temporary residence permits, patents, work permits, migration cards, etc.); identity document information; information on citizenship or nationality; place of birth; sex; date of birth and/or age; information on position, department and current place of employment; information on current work (official) activities; information on education and training; information on current studies; information on scientific and educational activities; information on profession, work/professional qualifications and professional qualities; information on the potential and prospects of cooperation; information on participation in events; information on personal opinions expressed and survey results;
Personal data in the category "Special categories of personal data": not processed;
Personal data in the category "Biometric personal data": not processed.

10.3. Methods of processing personal data: collection, recording, systematisation, accumulation, use, storage, clarification (updating, modification), retrieval, comparison (matching, linking), receipt, depersonalisation, deletion, destruction. Processing format: both with and without the use of automation.

10.4. Periods of processing and storage of personal data: up to 5 years after the termination of the parties' legal relationship, unless otherwise provided by applicable law, the Data Subject's consent or a contract (agreement) between the Operator and the Data Subject.

10.5. Procedure for destroying personal data: when the purpose of processing has been achieved and/or other legal grounds arise, the data are destroyed in accordance with the procedure established by Roskomnadzor Order No. 179 of 28.10.2022; the method of destruction depends on the method of processing: shredding / deletion of information from databases / another method.

In addition: the above personal data are processed with the consent of the Data Subjects. In the cases established by law, the Operator may also process the personal data of Data Subjects on other legal grounds, in particular:

exercising and performing the functions, powers and duties imposed on the operator by the legislation of the Russian Federation (clause 2, part 1, Article 6 of the Personal Data Law);
the processing of personal data is carried out in connection with a person's participation in constitutional, civil, administrative or criminal proceedings, or proceedings in arbitrazh courts (clause 3, part 1, Article 6 of the Personal Data Law);
the processing of personal data is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, and for the conclusion of a contract at the initiative of the data subject or a contract under which the data subject will be a beneficiary or guarantor (clause 5, part 1, Article 6 of the Personal Data Law);
the processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant goals (clause 7, part 1, Article 6 of the Personal Data Law);
on other legal grounds provided for by the Personal Data Law or the legislation of the Russian Federation.