1.1 This Policy of the joint stock company 'Development Corporation of the Republic of Adygea' regarding the processing of personal data (hereinafter referred to as the Policy) was developed in accordance with the requirements of clause 2, part 1, article 18.1 of the Federal Law of July 27, 2006 No. 152-FZ 'On personal data' (hereinafter referred to as the Law on Personal Data) in order to ensure the protection of the rights and freedoms of man and citizen when processing his personal data, including the protection of the rights to privacy, personal and family secrets.
1.2 The Policy applies to all personal data processed by the joint stock company 'Development Corporation of the Republic of Adygea' (hereinafter referred to as the Operator, JSC 'KRRA'), including those received through the Internet site owned by JSC 'KRRA' https: //corpra.ru/ (hereinafter referred to as the Website).
1.3 The Policy applies to relationships in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
1.4 In pursuance of the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in the public domain on the Operator’s Website.
1.5 Basic concepts used in the Policy:
personal data - any information relating to a directly or indirectly identified or identifiable individual (subject of personal data);
personal data operator (operator) - a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
processing of personal data - any action (operation) or set of actions (operations) with personal data, performed using automation tools or without their use. Processing of personal data includes, but is not limited to: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction;
automated processing of personal data - processing of personal data using computer technology;
distribution of personal data - actions aimed at disclosing personal data to an indefinite number of persons;
providing personal data - actions aimed at disclosing personal data to a certain person or a certain circle of persons;
blocking personal data - temporary cessation of processing of personal data (except for cases where processing is necessary to clarify personal data);
destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material media of personal data are destroyed;
depersonalization of personal data - actions as a result of which it becomes impossible, without the use of additional information, to determine the ownership of personal data to a specific subject of personal data;
personal data information system - a set of personal data contained in databases and information technologies and technical means that ensure their processing.
1.6 Basic rights and obligations of the Operator.
1.6.1 The operator has the right:
1) independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Law on Personal Data and regulations adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
2) entrust the processing of personal data to another person with the consent of the subject of personal data, unless otherwise provided by federal law, on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of processing personal data provided for by the Personal Data Law, maintain the confidentiality of personal data, take the necessary measures aimed at ensuring the fulfillment of the obligations provided for by the Personal Data Law,
3) if the subject of personal data withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal Data
1.6.2 The operator must:
1) organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
2) respond to requests and requests from personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
3) report to the authorized body for the protection of the rights of personal data subjects (Federal Service for Supervision in the Sphere of Communications, Information Technologies and Mass Communications (Roskomnadzor)) at the request of this body the necessary information within 10 working days from the date of receipt of such request. This period may be extended, but by no more than five working days. To do this, the Operator must send a motivated notification to Roskomnadzor indicating the reasons for extending the period for providing the requested information;
4) in the manner determined by the federal executive body authorized in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it about computer incidents that resulted in unlawful transfer (provision, distribution, access) of personal data.
1.7 Basic rights of the subject of personal data. The subject of personal data has the right:
1) receive information regarding the processing of his personal data, except for cases provided for by federal laws. Information is provided to the subject of personal data by the Operator in an accessible form, and it should not contain personal data related to other subjects of personal data, except in cases where there are legal grounds for disclosing such personal data, the list of information and the procedure for obtaining it is established by the Law on Personal Data;
2) require the operator to clarify his personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also take measures provided by law to protection of your rights;
3) give prior consent to the processing of personal data in order to promote goods, works and services on the market;
4) appeal to Roskomnadzor or in court against unlawful actions or inaction of the Operator when processing his personal data.
1.8 Use of the Site’s services means the User’s unconditional consent to this Policy and the conditions for processing his personal information specified therein; in case of disagreement with these conditions, the User must refrain from using the services.
1.9 Control over compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing the processing of personal data by the Operator.
1.10 Responsibility for violation of the requirements of the legislation of the Russian Federation and regulations of JSC 'KRRA' in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.
2.1 The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted.
2.2 Only personal data can be processed personal data that meet the purposes of their processing.
2.3 The processing of personal data by the Operator is carried out for the following purposes:
— carrying out its activities in accordance with the charter of KRRA JSC, including the conclusion and execution of agreements with counterparties;
— implementation of labor legislation within the framework of labor and other directly related relations, including: assistance to employees in employment, education and career advancement, attraction and selection of candidates for work with the Operator, ensuring personal safety of employees, control of the quantity and quality of work performed, ensuring the safety of property, maintaining personnel and accounting records, filling out and submitting the required reporting forms to the authorized bodies, organizing individual (personalized) registration of employees in the systems of compulsory pension insurance and compulsory social insurance;
— implementation of access control.
2.4 The processing of personal data of employees may be carried out solely for the purpose of ensuring compliance with laws and other regulations.
3.1 The legal basis for the processing of personal data is a set of regulatory legal acts, in pursuance of which and in accordance with which the Operator processes personal data, including:
— Constitution of the Russian Federation;
— Civil Code of the Russian Federation;
— Labor Code of the Russian Federation;
— Tax Code of the Russian Federation;
— Federal Law of July 27, 2006 No. 149 “On information, information technologies and information protection”;
— Federal Law of July 27, 2006 No. 152-FZ “On Personal Data”;
— Federal Law of December 26, 1995 No. 208-FZ “On Joint-Stock Companies”;
— Federal Law of December 6, 2011 No. 402-FZ “On Accounting”;
— Federal Law of December 15, 2001 N 167-FZ “On Compulsory Pension Insurance in the Russian Federation”;
— other regulatory legal acts governing relations related to the activities of the Operator.
3.2 The legal basis for the processing of personal data is also:
— charter of JSC 'KRRA';
— agreements concluded between the Operator and the subjects of personal data;
— consent of personal data subjects to the processing of their personal data.
4.1 The content and volume of personal data processed must correspond to the stated purposes of processing provided for in Section 2 of this Policy. The personal data processed must not be redundant in relation to the stated purposes of their processing,
4.2 The operator may process personal data of the following categories of personal data subjects.
4.2.1 Candidates for employment with the Operator - for the purposes of implementing labor legislation within the framework of labor and other directly related relations, implementing access control:
— last name, first name, patronymic;
— gender;
— citizenship;
— date and place of birth;
— contact details;
— information about education, work experience, qualifications;
— other personal data provided by candidates in resumes and cover letters.
4.2.2 Employees and former employees of the Operator - for the purposes of implementing labor legislation within the framework of labor and other directly related relations, implementing access control:
— last name, first name, patronymic;
— gender;
— citizenship;
— date and place of birth;
— image (photo);
— passport data;
— registration address at the place of residence;
— address of actual residence;
— contact details;
— individual taxpayer number;
— insurance number of an individual personal account (SNILS);
— information about education, qualifications, professional training and advanced training;
— marital status, presence of children, family ties;
— information about work activity, including the presence of incentives, awards and (or) disciplinary sanctions;
— yes data on marriage registration;
— information about military registration;
— information about disability;
— information about alimony withholding;
— information about income from the previous place of work;
— other personal data provided by employees in accordance with the requirements of labor legislation.
4.2.3 Family members of the Operator's employees - for the purposes of implementing labor legislation within the framework of labor and other directly related relations:
— last name, first name, patronymic;
— degree of relationship;
— year of birth;
— other personal data provided by employees in accordance with the requirements of labor legislation.
4.2.4 Clients and counterparties of the Operator (individuals) - for the purposes of carrying out their activities in accordance with the charter of KRRA JSC, implementing access control:
— last name, first name, patronymic;
— date and place of birth;
— passport data;
— registration address at the place of residence;
— contact details;
— position being filled;
— individual taxpayer number;
4.2.5 Representatives (employees) of the Operator's clients and counterparties (legal entities) - for the purposes of carrying out their activities in accordance with the charter of KRRA JSC, implementing access control:
— last name, first name, patronymic;
— passport data;
— contact information;
— position being filled;
— other personal data provided by representatives (employees) of clients and counterparties, necessary for the conclusion and execution of contracts.
4.3 The Processing by the Operator of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established) is carried out in accordance with the legislation of the Russian Federation.
4.4 The operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, except for cases provided for by the legislation of the Russian Federation.
5.1 The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2 The processing of personal data is carried out with the consent of the subjects of personal data for the processing of their personal data, as well as without it in cases provided for by the legislation of the Russian Federation
5.3 The operator processes personal data for each purpose of their processing in the following ways:
— non-automated processing of personal data;
— automated processing of personal data with or without transmission of the received information via information and telecommunication networks;
— mixed processing of personal data.
5.4 Employees of the Operator whose job responsibilities include the processing of personal data are allowed to process personal data.
5.5 The processing of personal data for each processing purpose specified in clause 2.3 of the Policy is carried out by:
— receiving personal data orally and in writing directly from the subjects of personal data;
— entering personal data into journals, registers and information systems of the Operator;
— use of other methods of processing personal data.
5.6 Disclosure to third parties and dissemination of personal data without the consent of the subject of personal data, unless otherwise provided by federal law. Consent to the processing of personal data authorized by the subject of personal data for distribution is issued separately from other consents of the subject of personal data for processing his personal data.
The requirements for the content of consent to the processing of personal data authorized by the subject of personal data for distribution are approved by Roskomnadzor Order No. 18 dated February 24, 2021.
5.7 Transfer of personal data to the bodies of inquiry and investigation, to the Federal Tax Service, Social Fund Rosions and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8 The Operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution and other unauthorized actions, including:
— identifies threats to the security of personal data during their processing;
— adopts local regulations and other documents regulating relations in the field of processing and protection of personal data;
— appoints persons responsible for ensuring the safety of the Operator’s personal;
— creates the necessary conditions for working with personal data;
— organizes the recording of documents containing personal data;
— organizes work with information systems in which personal data is processed;
— stores personal data under conditions that ensure their safety and prevent unauthorized access to them;
— organizes training for the Operator’s employees processing personal data.
5.9 The operator stores personal data in a form that allows identifying the subject of personal data, no longer than required by each purpose for processing personal data, unless the storage period for personal data is established by federal law or agreement.
5.9.1 Personal data on paper is stored at KRRA JSC for the periods of storage of documents for which these periods are provided for by the legislation on archival affairs in the Russian Federation (Federal Law of October 22, 2004 No. 125-FZ 'On archival affairs in the Russian Federation', List of standard administrative archival documents generated in the process of activities of state bodies, local governments and organizations, indicating their storage periods (approved by Order of the Federal Archives of December 20, 2019 No. 236))
5.9.2 The storage period for personal data processed in personal data information systems corresponds to the storage period for personal data on paper.
5.10 The operator stops processing personal data in the following cases:
— the fact of their unlawful processing has been identified. Deadline - within three working days from the date of detection;
— the purpose of their processing has been achieved;
— the consent of the personal data subject to the processing of the specified data has expired or been revoked, when, according to the Personal Data Law, the processing of this data is permitted only with consent.
5.11 When the purposes of processing personal data are achieved, as well as in the event that the subject of personal data withdraws consent to their processing, the Operator stops processing this data if:
— otherwise not provided for by the agreement to which the subject of personal data is a party, beneficiary or guarantor;
— The operator does not have the right to process without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws;
— otherwise not provided for in another agreement between the Operator and the subject of personal data.
5.12 When a personal data subject applies to the Operator with a request to stop processing personal data within a period not exceeding 10 working days from the date the Operator receives the corresponding request, the processing of personal data is terminated, except in cases provided for by the Law on Personal Data. the period may be extended, but not more than by five working days. To do this, the Operator must send a reasoned notice to the personal data subject indicating the reasons for the extension.
5.13 When collecting personal data, including through the information and telecommunications network Internet, the Operator ensures recording, systematization, accumulation, storage, clarification (updating, changing), retrieving personal data of citizens of the Russian Federation using databases located on territory of the Russian Federation, except for cases specified in the Law on Personal Data.
6.1 Confirmation of the fact of processing of personal data by the Operator, the legal grounds and purposes of processing personal data, as well as other information specified in Part 7 of Article 14 of the Law on Personal Data, is provided by the Operator to the subject of personal data or his representative within 10 working days days from the date of application or receipt of the request of the subject of personal data or his representative. This period may be extended, but not more than by five working days. To do this, the Operator should send a reasoned notice to the subject of personal data indicating the reasons for extending the period for providing the requested information.
The information provided does not include personal data relating to other subjects of personal data, unless there are legal grounds for the disclosure of such personal data.
The request must contain:
— number of the main document identifying the subject of personal data or his representative, information about the date of issue of the specified document and the issuing authority;
— information confirming the participation of the subject of personal data in relations with the Operator (agreement number, date of conclusion of the agreement, symbolic verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator;
— signature of the subject of personal data or his representative.
The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
The operator provides the information specified in Part 7 of Article 14 of the Law on Personal Data to the subject of personal data or his representative in the form in which the relevant appeal or request was sent, unless otherwise specified in the appeal or request.
If the appeal (request) of the personal data subject does not reflect all the necessary information in accordance with the requirements of the Law on Personal Data or the subject does not have the rights to access the requested information, then a reasoned refusal is sent to him.
The right of the personal data subject to access his personal data may be limited in accordance with Part 8 of Article 14 of the Law on Personal Data, including if the personal data subject’s access to his personal data violates the rights and legitimate interests of third parties persons.
6.2 If inaccurate personal data is identified when contacting the subject of personal data or his representative or at their request or at the request of Roskomnadzor, the Operator blocks personal data relating to this subject of personal data from the moment of such request or receipt of the specified request for a period verification, if blocking personal data does not violate the rights and legitimate interests of the subject of personal data or third parties.
If the fact of inaccuracy of personal data is confirmed, the Operator, based on the information provided by the subject of personal data or his representative or Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
6.3 If unlawful processing of personal data is detected upon an appeal (request) from a personal data subject or his representative or Roskomnadzor, the Operator shall block unlawfully processed personal data relating to this personal data subject from the moment of such appeal or receipt of the request.
6.4 If the Operator, Roskomnadzor or another interested party identifies the fact of unlawful or accidental transfer (provision, distribution) of personal data (access to personal data), resulting in a violation of the rights of personal data subjects, the Operator:
— within 24 hours—notifies Roskomnadzor about the incident that occurred, the alleged causes that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and measures taken to eliminate the consequences of the incident, and also provides information about the person , authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
— within 72 hours—notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information about the persons whose actions caused it (if any).
6.5 Procedure for the destruction of personal data by the Operator.
6.5.1 Conditions and terms for the destruction of personal data by the Operator:
— achievement of the purpose of processing personal data or loss of the need to achieve this purpose - within 30 days;
— achieving the maximum storage period for documents containing personal data - within 30 days;
— provision by the subject of personal data (his representative) of confirmation that personal data was obtained illegally or is not necessary for the stated purpose of processing - within seven working days;
— withdrawal by the subject of personal data of consent to the processing of his personal data, if their storage for the purpose of their processing is no longer required - within 30 days.
6.5.2 When the purpose of processing personal data is achieved, as well as in the event that the subject of personal data withdraws consent to their processing, personal data is subject to destruction if:
— otherwise not provided for by the agreement to which the subject of personal data is a party, beneficiary or guarantor;
— the operator does not have the right to process without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws;
— otherwise not provided for in another agreement between the Operator and the subject of personal data.
6.5.3 The destruction of personal data is carried out by a commission created by order of the General Director of KRRA JSC.
6.5.4 Methods of destruction of personal data are established in the local regulations of the Operator.
7.1 Use of the Site services means the unconditional consent of the Site user (hereinafter referred to as the User) with this Policy and the conditions for processing his personal information specified therein; in case of disagreement with these conditions, the User must refrain from using the services.
7.2 This Policy does not control and is not responsible for third party sites to which the User may go ty via the links available on the Website https://corpra.ru/.
7.3 If the User simply browses the site, then personal data is not processed.
7.4 The privacy features of the Site are established in the Site's privacy policy, approved by order of the General Director of KRRA JSC.