1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy (hereinafter – "Policy") has been developed in compliance with the requirements of paragraph 2 of part 1 of Article 18.1 of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data" (hereinafter – "Personal Data Law") to ensure the protection of human and citizen rights and freedoms in the processing of their personal data, including protection of rights to privacy, personal and family secrets.
1.2. This Policy applies to the following categories of personal data subjects whose information is processed by the Operator: employees; counterparties; clients; website visitors.
1.3. Key concepts used in the Policy:
- Personal data – any information relating to a directly or indirectly identified or identifiable natural person (personal data subject);
- Personal data processing – any action (operation) or set of actions (operations) with personal data performed using automated means or without them. Personal data processing includes in particular: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transmission (distribution, provision, access), anonymization, blocking, deletion, destruction;
- Automated personal data processing – personal data processing using computer equipment;
- Personal data distribution – actions aimed at disclosing personal data to an indefinite circle of persons;
- Personal data provision – actions aimed at disclosing personal data to a specific person or specific circle of persons;
- Personal data blocking – temporary cessation of personal data processing (except where processing is necessary to clarify personal data);
- Personal data destruction – actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and (or) as a result of which material carriers of personal data are destroyed;
- Personal data anonymization – actions as a result of which it becomes impossible without the use of additional information to determine the attribution of personal data to a specific personal data subject;
- Personal data information system – a set of personal data contained in databases and information technologies and technical means ensuring their processing;
- Transborder personal data transmission – transmission of personal data to the territory of a foreign state to a foreign state authority, foreign natural person or foreign legal entity;
- Website – a set of programs for electronic computing machines and other information contained in an information system accessible through the information and telecommunications network Internet located at: https://stroyrem-nn.ru
1.4. Principal rights and obligations of the Operator.
1.4.1. The Operator has the right to:
- independently determine the composition and list of measures necessary and sufficient to ensure fulfillment of the obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided for by the Personal Data Law or other federal laws;
- entrust personal data processing to another person with the consent of the personal data subject, unless otherwise provided for by federal law, on the basis of a contract concluded with that person. A person performing personal data processing at the Operator's request is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law;
- in the event of withdrawal by the personal data subject of consent to personal data processing, the Operator has the right to continue personal data processing without the consent of the personal data subject if there are grounds specified in the Personal Data Law.
1.4.2. The Operator is obliged to:
- organize personal data processing in accordance with the requirements of the Personal Data Law;
- respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
- notify the authorized body for the protection of personal data subjects' rights (hereinafter – "Roskomnadzor") upon request with necessary information within 10 business days from the date of receipt of such request.
1.5. Principal rights of Personal Data Subjects.
A personal data subject has the right to:
- obtain information concerning the processing of his personal data, except in cases provided for by federal laws;
- require from the Operator clarification of his personal data, their blocking or destruction if personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
- appeal to Roskomnadzor or court against unlawful actions or inaction of the Operator in the processing of his personal data.
1.6. Monitoring compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing personal data processing at the Operator.
1.7. Liability for violation of the requirements of the legislation of the Russian Federation and local acts of the Operator in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.
2. PRINCIPLES OF PERSONAL DATA PROCESSING
2.1. Personal data processing is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation and on the basis of the following principles:
- lawfulness and fair basis;
- limitation of personal data processing to the achievement of specific, predetermined and lawful purposes;
- prevention of personal data processing incompatible with the purposes of personal data collection;
- prevention of combining databases containing personal data whose processing is carried out for purposes incompatible with each other;
- processing only those personal data that meet the purposes of their processing;
- correspondence of the content and scope of processed personal data to the stated purposes of processing;
- prevention of processing of excessive personal data in relation to the stated purposes of their processing;
- ensuring accuracy, adequacy and relevance of personal data in relation to the purposes of personal data processing;
- destruction or anonymization of personal data upon achievement of the purposes of their processing or if there is no longer a need to achieve these purposes.
3. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING
3.1. The legal basis for personal data processing is a set of regulatory legal acts including:
- Constitution of the Russian Federation;
- Labor Code of the Russian Federation;
- Civil Code of the Russian Federation;
- Tax Code of the Russian Federation;
- Federal Law of December 6, 2011 No. 402-FZ "On Accounting";
- other regulatory legal acts regulating relations related to the Operator's activities.
3.2. The legal basis for personal data processing also includes contracts concluded with the Personal Data Subject and consent of the Personal Data Subject to personal data processing.
4. SCOPE, CATEGORIES AND CONDITIONS OF PROCESSED PERSONAL DATA
Personal data is processed by the Operator for the purposes of:
- ensuring compliance with Russian labor legislation;
- preparation, conclusion and performance of contracts;
- offering and promoting its own products and brand on the market through marketing activities;
- processing incoming applications from the Website;
- maintaining statistics on Website visits.
Categories of personal data subjects:
- Operator's employees;
- Operator's counterparties;
- Operator's clients;
- Operator's Website visitors.
4.1. Processing of employee personal data
General personal data: surname, name, patronymic; residential address; education; profession; passport details; contact telephone number; income; position; INN; SNILS; marital status.
Special categories: health information; national origin.
Biometric personal data: facial image data.
Processing and storage periods: during the validity of the employment contract and 5 years after its termination.
4.2. Processing of personal data of counterparties and clients
Personal data processed: surname, name, patronymic; residential address; passport details; contact telephone number; email address; gender.
Processing and storage periods: during the validity of the contract and 5 years after its termination.
4.3. Processing of personal data of Website visitors
Personal data processed: surname, name, patronymic; contact telephone number; email address; information collected through metric programs.
5. PROCEDURE FOR PROCESSING PERSONAL DATA USING COOKIE FILES
Cookie files transmitted to the technical devices of the Personal Data Subject may be used to provide personalized services, analyze website traffic, and collect statistical information.
The user may manage the receipt of cookie files by configuring the browser accordingly.
6. ENSURING SECURITY OF PERSONAL DATA
The Operator takes necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access to it, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data.
7. TRANSBORDER TRANSMISSION OF PERSONAL DATA
The Operator does not carry out transborder transmission of personal data without the consent of the personal data subject.
With the consent of visitors, the Operator may transmit their personal data to LLC "Yandex" (INN 7736207543) when using the software tool "Yandex.Metric".
8. CONCLUDING PROVISIONS
8.1. This Policy is an internal document of the Operator, is publicly available and shall be posted on the Operator's official website.
8.2. This Policy may be amended or supplemented by the Operator unilaterally without special notification of Personal Data Subjects.
8.3. The current version of the Policy is posted on the page at: https://stroyrem-nn.ru/privacy-policy-en.html