1. General provisions
1.1. This Personal Data Processing Policy of InvestStroy Specialized Developer Limited Liability Company (the Policy) has been developed pursuant to Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 (the Personal Data Law) to protect the rights and freedoms of individuals and citizens when their personal data is processed, including the right to privacy and to personal and family secrecy.
1.2. The Policy applies to all personal data processed by InvestStroy Specialized Developer Limited Liability Company (the Operator, InvestStroy Specialized Developer LLC).
1.3. The Policy covers personal data processing relationships that arose for the Operator both before and after this Policy was approved.
1.4. Pursuant to Part 2 of Article 18.1 of the Personal Data Law, this Policy is publicly available on the Internet on the Operator’s websites at:
avtor-ternika.ru
https://gk-avtor.ru/
(the website)
and on the Operator’s social media pages at:
https://vk.com/avtor_gk
(the Operator’s social media pages).
1.5. Key terms used in the Policy:
personal data: any information relating to a directly or indirectly identified or identifiable individual (data subject);
personal data operator (operator): a state body, municipal body, legal entity or individual that, alone or jointly with others, organizes and/or carries out the processing of personal data and determines the purposes of processing, the personal data to be processed and the actions (operations) performed on it;
personal data processing: any action (operation) or set of actions (operations) performed on personal data, with or without automation. Personal data processing includes, among other things:
collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
retrieval;
use;
transfer (dissemination, provision, access);
depersonalization;
blocking;
deletion;
destruction;
automated processing of personal data: processing of personal data using computer technology;
dissemination of personal data: actions aimed at disclosing personal data to an indefinite range of persons;
provision of personal data: actions aimed at disclosing personal data to a specific person or a specific range of persons;
blocking of personal data: temporary suspension of personal data processing (except where processing is needed to clarify the personal data);
destruction of personal data: actions that make it impossible to restore the content of personal data in a personal data information system and/or that destroy the physical media containing personal data;
depersonalization of personal data: actions that make it impossible, without additional information, to attribute personal data to a specific data subject;
personal data information system: the personal data contained in databases together with the information technologies and technical means used to process it;
cross-border transfer of personal data: transfer of personal data to the territory of a foreign state, to a foreign state authority, a foreign individual or a foreign legal entity;
social network: an online resource for sharing information via personal user pages, accessed by more than 500 thousand users in the Russian Federation per day;
data subject: the individual to whom the personal data belongs and who can be identified by it;
user: any person who accesses the website and/or the Operator’s social media pages via the Internet and uses them for their own purposes (a data subject).
Other terms used in the Policy are interpreted in accordance with the legislation of the Russian Federation.
1.6. Main rights and obligations of the Operator.
1.6.1. The Operator has the right to:
independently determine the composition and list of measures necessary and sufficient to fulfill the obligations under the Personal Data Law and the regulations adopted under it, unless otherwise provided by the Personal Data Law or other federal laws;
entrust personal data processing to another person with the data subject’s consent, unless otherwise provided by federal law, under a contract with that person. A person processing personal data on behalf of the Operator must follow the principles and rules of processing set out in the Personal Data Law, keep personal data confidential and take the measures necessary to fulfill the obligations under the Personal Data Law;
if a data subject withdraws consent to processing, continue processing personal data without the data subject’s consent where there are grounds specified in the Personal Data Law.
1.6.2. The Operator must:
organize personal data processing in accordance with the Personal Data Law;
respond to inquiries and requests from data subjects and their legal representatives in accordance with the Personal Data Law;
provide the authorized body for the protection of data subjects’ rights (the Federal Service for Supervision of Communications, Information Technology and Mass Media, Roskomnadzor), at its request, with the necessary information within 10 business days of receiving the request. This period may be extended by no more than five business days, for which the Operator must send Roskomnadzor a reasoned notice stating the reasons for the extension;
in the manner established by the federal executive body responsible for security, interact with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including notifying it of computer incidents that resulted in unlawful transfer (provision, dissemination, access) of personal data.
1.7. Main rights of the data subject.
1.7.1. The data subject has the right to:
receive information about the processing of their personal data, except as provided by federal laws. The Operator provides this information in an accessible form, and it must not contain personal data of other data subjects unless there are legal grounds for disclosing it. The list of information and the procedure for obtaining it are established by the Personal Data Law;
require the operator to clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and take legal measures to protect their rights;
give prior consent to the processing of personal data for marketing goods, works and services;
appeal to Roskomnadzor or to a court against unlawful actions or inaction of the Operator in processing their personal data.
1.7.2. The data subject must:
1) provide the Operator with accurate personal data;
2) promptly inform the Operator of any changes to their personal data. The Operator is not liable for failing to amend, supplement or remove personal data if the data subject has not provided updated information.
1.8. Compliance with this Policy is monitored by the authorized person responsible for organizing personal data processing at the Operator.
1.9. Liability for violating the legislation of the Russian Federation and the internal regulations of InvestStroy Specialized Developer LLC on personal data processing and protection is determined in accordance with the legislation of the Russian Federation.
1.10. The Operator processes personal data on the following principles:
- lawful purposes and methods of processing, and good faith and fairness in the Operator’s activities;
- processing limited to achieving specific, predetermined and lawful purposes;
- accuracy of personal data and its sufficiency for the purposes of processing; no processing of personal data that is excessive in relation to the purposes stated at collection;
- processing only personal data that meets the purposes of processing. Processing incompatible with the purposes of collection is not allowed;
- the content and scope of processed personal data must match the stated purposes. Processed personal data must not be excessive in relation to those purposes;
- no merging of databases containing personal data processed for mutually incompatible purposes;
- ensuring the accuracy, sufficiency and, where necessary, relevance of personal data to the purposes of processing. The Operator takes or ensures the necessary measures to delete or clarify incomplete or inaccurate data;
- storing personal data in a form that identifies the data subject no longer than the purposes of processing require, unless the storage period is set by federal law or by a contract to which the data subject is a party, beneficiary or guarantor.
2. Purposes of personal data collection
2.1. Personal data processing is limited to achieving specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is not allowed.
2.2. Only personal data that meets the purposes of processing may be processed.
2.3. The Operator processes personal data for the following purposes:
2.3.1. HR and accounting records, including compliance with labor law in employment and directly related relationships, completing and submitting required reports to the authorities, and registering employees individually in the compulsory pension insurance and compulsory social insurance systems.
2.3.2. Recruiting staff (candidates) for the Operator’s vacancies.
2.3.3. Preparing, concluding and performing civil law contracts to carry out its activities in accordance with the charter of InvestStroy Specialized Developer LLC.
2.3.4. Marketing the Operator’s goods, works and services through direct contact with users of the website and the Operator’s social media pages, including contacting them and sending notices, information and requests related to marketing the Operator’s goods, works and services, handling user inquiries and requests, and sending informational and promotional emails.
3. Legal grounds for personal data processing
3.1. The legal basis for personal data processing is the set of regulations pursuant to and in accordance with which the Operator processes personal data, including:
the Constitution of the Russian Federation;
the Civil Code of the Russian Federation;
the Labor Code of the Russian Federation;
the Tax Code of the Russian Federation;
Federal Law No. 14-FZ “On Limited Liability Companies” of 08.02.1998;
Federal Law No. 402-FZ “On Accounting” of 06.12.2011;
Federal Law No. 167-FZ “On Compulsory Pension Insurance in the Russian Federation” of 15.12.2001;
other regulations governing relationships related to the Operator’s activities.
3.2. The legal basis for personal data processing also includes:
the charter of InvestStroy Specialized Developer LLC;
contracts concluded between the Operator and data subjects;
the consent of data subjects to the processing of their personal data.
4. Scope and categories of personal data processed; categories of data subjects
4.1. The content and scope of processed personal data must match the purposes stated in Section 2 of this Policy. Processed personal data must not be excessive in relation to those purposes.
4.2. The Operator may process the personal data of the following categories of data subjects:
4.2.1. Candidates, for recruiting staff for the Operator’s vacancies:
surname, first name, patronymic;
date of birth;
place of birth;
gender;
residential address;
registered address;
phone number;
citizenship;
profession;
position;
employment history (including length of service and current employment with the name of the organization);
education, work experience and qualifications;
other personal data provided by candidates in resumes and cover letters.
4.2.2. The Operator’s current and former employees and their relatives, for compliance with labor law and related relationships, and for HR and accounting records:
surname, first name, patronymic;
date of birth;
place of birth;
marital status, children, family relationships;
gender;
residential address;
registered address;
phone number;
SNILS (individual insurance account number);
TIN;
citizenship;
identity document details;
birth certificate details;
bank card details;
current account number;
personal account number;
profession;
employment history (including length of service and current employment with the name of the organization);
military service status and military registration details;
education details;
other personal data provided by employees as required by labor law.
4.2.3. The Operator’s counterparties (individuals), counterparty representatives, clients and contract beneficiaries, for preparing, concluding and performing civil law contracts and carrying out activities in accordance with the charter of InvestStroy Specialized Developer LLC:
surname, first name, patronymic;
date of birth;
email address;
registered address;
phone number;
SNILS (individual insurance account number);
TIN;
identity document details;
bank card details;
current account number;
personal account number;
position;
other personal data provided by clients and counterparties (individuals) that is necessary to conclude and perform contracts.
4.2.4. Users (visitors) of the website and the Operator’s social media pages:
surname, first name, patronymic;
phone number;
email address;
other personal data.
4.3. The Operator does not process biometric personal data (information describing a person’s physiological and biological characteristics that can be used to establish their identity).
4.4. The Operator does not process special categories of personal data relating to race, ethnicity, political views, religious or philosophical beliefs, health or intimate life, except as provided by the legislation of the Russian Federation.
4.5. The Operator does not carry out cross-border transfers of personal data.
5. Procedure and conditions of personal data processing
5.1. The Operator processes personal data in accordance with the legislation of the Russian Federation.
5.2. Personal data is processed with the consent of data subjects, and without it in cases provided for by the legislation of the Russian Federation.
5.3. The data subject decides to provide their personal data and consents to its processing freely, of their own will and in their own interest. Consent may be given by the data subject or their representative in any form that allows its receipt to be confirmed, unless otherwise established by federal law.
5.4. Users of the website and the Operator’s social media pages give consent to personal data processing by:
- filling in the “Request a call” form and ticking the “I agree to the terms of the personal data processing policy” checkbox on the website and/or the Operator’s social media page;
- consent to receive informational and promotional mailings is given by entering an email address in the above subscription form and then activating the link sent to that email address.
5.5. Use of the website and/or the Operator’s social media pages also constitutes the user’s unconditional acceptance of the Policy and the personal data processing terms it sets out. Users who do not agree with this Policy should refrain from using the website and/or the Operator’s social media pages.
5.6. For each purpose of processing, the Operator processes personal data by the following methods:
non-automated processing of personal data;
automated processing of personal data with or without transmission of the information over telecommunication networks;
mixed processing of personal data.
5.7. For the purpose of “HR and accounting records” set out in clause 2.3.1 of the Policy, the Operator processes the personal data of the following categories of data subjects:
- employees;
- relatives of employees;
- former employees;
- other categories of data subjects whose personal data is processed.
Mixed processing is carried out for these categories of data subjects. Information is transmitted over the Operator’s internal network and over the Internet.
Actions performed on personal data for this purpose: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision), blocking, deletion, destruction.
For this purpose, personal data is transferred to the following third parties:
the Federal Tax Service of the Russian Federation;
the Pension and Social Insurance Fund of the Russian Federation (Social Fund of Russia, SFR);
authorized bodies on grounds provided for by the current legislation of the Russian Federation;
other third parties specified by the data subject in their consent to personal data processing.
The storage procedure and periods are determined by Federal Law No. 125-FZ “On Archiving in the Russian Federation” of 22.10.2004. Personal data may be stored for up to 50 years.
5.8. For the purpose of “Recruiting staff (candidates) for the Operator’s vacancies” set out in clause 2.3.2 of the Policy, the Operator processes the personal data of the following categories of data subjects:
- candidates.
Mixed processing is carried out for these categories of data subjects. Information is transmitted over the Operator’s internal network, without transmission over the Internet.
Actions performed on personal data for this purpose: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, blocking, deletion, destruction.
For this purpose, personal data is not transferred to third parties.
The storage procedure and periods are determined by Federal Law No. 125-FZ “On Archiving in the Russian Federation” of 22.10.2004.
5.9. For the purpose of “Preparing, concluding and performing civil law contracts to carry out its activities in accordance with the charter of InvestStroy Specialized Developer LLC” set out in clause 2.3.3 of the Policy, the Operator processes the personal data of the following categories of data subjects:
- the Operator’s counterparties (individuals);
- counterparty representatives;
- clients;
- contract beneficiaries;
- other categories of data subjects whose personal data is processed.
Mixed processing is carried out for these categories of data subjects. Information is transmitted over the Operator’s internal network and over the Internet.
Actions performed on personal data for this purpose: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, blocking, deletion, destruction.
For this purpose, personal data is not transferred to third parties.
Personal data is stored for 5 years after this purpose is achieved and is then destroyed in the established manner.
5.10. For the purpose of “Marketing the Operator’s goods, works and services through direct contact with users of the website and the Operator’s social media pages” set out in clause 2.3.4 of the Policy, the Operator processes the personal data of the following categories of data subjects:
- users (visitors) of the website and the Operator’s social media pages.
Automated processing is carried out for these categories of data subjects. Information is transmitted over the Operator’s internal network and over the Internet.
Actions performed on personal data for this purpose: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, blocking, deletion, destruction.
For this purpose, personal data is not transferred to third parties.
The data subject’s personal data is processed solely to inform and advise the data subject about the goods, works and services offered by the Operator.
Personal data is stored for 5 years after this purpose is achieved and is then destroyed in the established manner.
5.11. Personal data may be processed by the Operator’s employees whose job duties include such processing. Employees may be given access to personal data to perform their duties only after signing a non-disclosure undertaking.
Temporary or one-off access to personal data for business needs may be granted to an employee of the Operator with the approval of the General Director.
Access to personal data by third parties who are not employees of the Operator without the data subject’s consent is prohibited, except for access by officials of executive authorities as part of oversight and supervision of compliance with the law and the exercise of the functions and powers of the relevant state bodies.
5.12. Personal data is processed for the purposes set out in clause 2.3 of the Policy by:
obtaining personal data orally and in writing, on paper or electronic media, directly from data subjects;
entering personal data into the Operator’s logs, registers and information systems;
obtaining original documents containing personal data in cases established by law;
storing personal data both on paper and electronically;
destroying personal data;
using other methods of personal data processing.
5.13. Personal data may not be disclosed to third parties or disseminated without the data subject’s consent, unless otherwise provided by federal law. Consent to the processing of personal data that the data subject has authorized for dissemination is executed separately from the data subject’s other consents to the processing of their personal data.
5.14. Personal data is transferred to inquiry and investigative bodies, the Federal Tax Service, the Social Fund of Russia and other authorized executive bodies and organizations in accordance with the legislation of the Russian Federation.
5.15. The Operator takes or ensures the necessary and sufficient legal, organizational and technical measures to protect personal data from unlawful or accidental access, unauthorized destruction, modification, blocking, copying, provision or dissemination, and from other unlawful actions.
5.16. Such measures include:
· appointing a person responsible for organizing personal data processing;
· issuing internal regulations on personal data processing that define, for each purpose, the categories and list of personal data processed, the categories of data subjects, the methods and periods of processing and storage, and the procedure for destroying personal data once the purposes are achieved or other legal grounds arise, as well as internal regulations establishing procedures to prevent and detect violations of Russian personal data legislation and to eliminate their consequences;
· internal control and/or audits of compliance of personal data processing with Russian personal data legislation, data protection requirements and the Operator’s internal documents on personal data processing and protection;
· assessing the harm that may be caused to data subjects if the Personal Data Law is violated, and weighing that harm against the measures the Operator takes to fulfill its obligations under the Personal Data Law;
· familiarizing the Operator’s employees who directly process personal data with Russian personal data legislation, the Operator’s internal documents on personal data processing and data protection requirements;
· applying or ensuring the application of legal, organizational and technical measures to secure personal data in accordance with Article 19 of the Personal Data Law, in particular:
- identifying security threats to personal data processed in the Operator’s personal data information systems;
- applying organizational and technical measures to secure personal data processed in the Operator’s personal data information systems, based on the requirements approved by Russian Government Resolution No. 1119 of 01.11.2012 “On Approval of Requirements for the Protection of Personal Data Processed in Personal Data Information Systems” and FSTEC of Russia Order No. 21 of 18.02.2013 “On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data Processed in Personal Data Information Systems”;
- using information security tools that have passed conformity assessment in the established manner;
- assessing the effectiveness of personal data security measures before a personal data information system is put into operation;
- recording and safekeeping of machine media containing personal data;
- detecting unauthorized access to personal data and taking action, including detecting, preventing and eliminating the consequences of computer attacks on personal data information systems and responding to computer incidents in them;
- restoring personal data modified or destroyed as a result of unauthorized access;
- establishing rules for access to personal data processed in the personal data information system, and logging and recording all actions performed on personal data in that system;
- monitoring the personal data security measures taken and the level of protection of personal data information systems.
5.17. Data subjects’ personal data on paper is kept in lockable cabinets or lockable rooms with restricted access.
5.18. Personal data processed for different purposes is stored separately.
5.19. The Operator does not allow electronic images of documents or electronic documents containing data subjects’ personal data to be stored or placed in open electronic directories (file-sharing services) in the Operator’s information system.
5.20. The Operator stores personal data in a form that identifies the data subject no longer than each purpose of processing requires, unless the storage period is set by Russian law or by contract.
5.21. Personal data processed in the Operator’s information systems is exchanged over communication channels protected by appropriate organizational measures and by software and hardware tools.
5.22. Employees of the Operator must pass identification and authentication to access data subjects’ personal data in the Operator’s information systems. An employee authorized to process personal data is given a unique login and password to access the relevant information system of the Operator in the established manner.
5.23. When collecting personal data, including via the Internet, the Operator records, systematizes, accumulates, stores, clarifies (updates, modifies) and retrieves the personal data of Russian citizens using databases located in the Russian Federation, except in cases specified in the Personal Data Law.
5.24. At the end of the working day and when staff are absent, the Operator’s office and premises are locked and windows are closed. Network equipment and servers are located in places inaccessible to unauthorized persons (dedicated rooms).
5.25. In the manner established by the federal executive body responsible for security, the Operator interacts with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including notifying that body of computer incidents that resulted in unlawful transfer (provision, dissemination, access) of personal data.
6. Updating, correction, deletion and destruction of personal data; responses to data subjects’ access requests
6.1. Confirmation that the Operator processes personal data, the legal grounds and purposes of processing, and other information specified in Part 7 of Article 14 of the Personal Data Law are provided by the Operator to the data subject or their representative within 10 business days of the inquiry or request. This period may be extended by no more than five business days, for which the Operator sends the data subject a reasoned notice stating the reasons for the extension.
The information provided does not include personal data of other data subjects unless there are legal grounds for disclosing it.
The data subject’s request must contain:
the number of the main identity document of the data subject or their representative, its date of issue and the issuing authority;
information confirming the data subject’s relationship with the Operator (contract number, contract date, reference name and/or other details), or information otherwise confirming that the Operator processes their personal data;
the signature of the data subject or their representative.
The request may be sent as an electronic document signed with an electronic signature in accordance with the legislation of the Russian Federation.
The Operator provides the information specified in Part 7 of Article 14 of the Personal Data Law to the data subject or their representative in the same form as the inquiry or request was sent, unless the inquiry or request states otherwise.
If the data subject’s inquiry (request) does not contain all the information required by the Personal Data Law, or the data subject has no right of access to the requested information, a reasoned refusal is sent.
The data subject’s right of access to their personal data may be restricted in accordance with Part 8 of Article 14 of the Personal Data Law, including where such access would violate the rights and legitimate interests of third parties.
The Operator must, free of charge, give the data subject or their representative the opportunity to review the personal data relating to that data subject at the Operator’s premises during business hours.
6.2. If inaccurate personal data is identified upon an inquiry or request from the data subject or their representative, or at the request of Roskomnadzor, the Operator blocks the personal data relating to that data subject from the moment of the inquiry or request for the duration of the check, provided that blocking does not violate the rights and legitimate interests of the data subject or third parties.
If the inaccuracy is confirmed, the Operator corrects the personal data within seven business days of receiving the information from the data subject, their representative or Roskomnadzor, or other necessary documents, and unblocks the personal data.
6.3. If unlawful processing of personal data is identified upon an inquiry (request) from the data subject, their representative or Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to that data subject from the moment of the inquiry or request.
6.4. If the Operator, Roskomnadzor or another interested party identifies an unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has violated data subjects’ rights, the Operator:
within 24 hours, notifies Roskomnadzor of the incident, its presumed causes, the presumed harm to data subjects’ rights and the measures taken to eliminate its consequences, and provides details of the person authorized by the Operator to liaise with Roskomnadzor on the incident;
within 72 hours, notifies Roskomnadzor of the results of the internal investigation of the incident and provides details of the persons whose actions caused it (if any).
6.5. The Operator must stop processing and destroy personal data within:
- 30 (thirty) days of achieving the purposes of processing, the expiry of the maximum storage periods, the date the purposes no longer need to be achieved, or the date the Subject withdraws consent, if the personal data is no longer required for the purposes of processing, unless otherwise provided by a contract to which the Subject is a party, beneficiary or guarantor, by another agreement between the Operator and the Subject, or if the Operator may not process personal data without the Subject’s consent on grounds provided by the federal laws of the Russian Federation;
- 10 (ten) business days of identifying unlawful processing of personal data;
- 7 (seven) business days if the Subject or their legal representative provides confirmation that the personal data was unlawfully obtained or is not necessary for the stated purpose of processing;
- 2 (two) business days if the Subject withdraws consent to the use of personal data for contacting potential customers when marketing goods and services.
6.6. If unlawful processing of personal data by the Operator is identified, the Operator must stop the unlawful processing within 3 (three) business days of identification. If processing cannot be made lawful, the Operator must destroy such personal data. The Operator must notify the Subject or their representative that the violations have been remedied or the personal data destroyed, and, if the inquiry of the Subject or their representative or the request was sent by the authorized body for the protection of data subjects’ rights, also notify that body.
6.7. Personal data is destroyed by a commission established by order of the General Director of InvestStroy Specialized Developer LLC.
6.8. Methods of destroying personal data are set out in the Operator’s internal regulations.
6.9. If a data subject requests that the Operator stop processing their personal data, processing stops within 10 business days of the Operator receiving the request, except in cases provided for by the Personal Data Law. This period may be extended by no more than five business days, for which the Operator must send the data subject a reasoned notice stating the reasons for the extension.
7. Additional terms
7.1. Operator contact details:
InvestStroy Specialized Developer LLC
OGRN 1235800006518
TIN/KPP 5837084358/583701001
Legal address: office 9, bldg. 9A, Biyskaya St., Penza, Penza Region, 440058.
Phone: +7 (8412) 20-28-58
E-mail: szinveststroy@mail.ru.
7.2. The Operator may amend this Policy without the consent of data subjects (users).