Privacy Policy on the Processing of Personal Data of Visitors to the Website https://eduardlebedev.io
1. General Provisions
1.1 This Privacy Policy on the Processing of Personal Data of Visitors to the Website https://eduardlebedev.io/en (hereinafter referred to as the “Policy”) has been developed in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” for the purpose of protecting the rights and freedoms of individuals and citizens in connection with the processing of their personal data, including the rights to privacy and to personal and family secrets.This Policy establishes the principles, circumstances, procedures, and conditions governing the processing of personal data organised and/or carried out by Eduard Lebedev (hereinafter referred to as the “Operator”), the fundamental rights and freedoms of personal data subjects and the procedure for exercising them, and information on the measures taken by the Operator to ensure compliance with the obligations established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.
This Policy applies to the processing of personal data of visitors to the website https://eduardlebedev.io/en (hereinafter referred to as the “Information Resource”).
1.2 The meanings of the terms used in this Policy are set out in Section 2 of this Policy. The application and interpretation, where necessary, of the terms used herein shall be carried out in accordance with the applicable federal laws and other regulatory legal acts of the Russian Federation.
2. List of Terms and Definitions
Automated Processing of Personal Data means the processing of personal data using computer technology.
Personal Data Security means the state of protection of personal data characterised by the ability of users, technical means, and information technologies to ensure the confidentiality, integrity, and availability of personal data during its processing.
Biometric Personal Data means information that characterises the physiological and biological features of a personal data subject, makes it possible to establish or identify their identity, and is used for such identification, including voice recordings, fingerprints and/or palm vein patterns, digital photographic images, and iris patterns.
Blocking of Personal Data means the temporary suspension of the processing of personal data, except where processing is necessary to clarify or update personal data, at the request of the personal data subject or Roskomnadzor.
Access to Personal Data means the ability to obtain and use personal data.
Personal Data Legislation means the body of provisions contained in regulatory legal acts of the Russian Federation that establish the circumstances and specific features of personal data processing and the requirements applicable to such processing, including the provisions of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.
Personal Data Information System, or PDIS, means a combination of information technologies and technical means that enable the processing of personal data, together with the databases and data storage systems in which personal data is processed.
Other Personal Data means personal data that does not fall within the special categories of personal data, personal data authorised by the personal data subject for dissemination, or biometric personal data.
Confidentiality of Personal Data means the obligation of the Operator or any other person who has obtained access to personal data not to disclose or transfer such data without the consent of the personal data subject or another lawful basis.
Tangible Medium Containing Personal Data means paper, electronic, machine-readable, and other information media used to reproduce, including by copying, downloading, saving, or recording, and/or store information containing personal data processed either in an automated manner, using computer technology, or in a non-automated manner, without the use of computer technology.
Supervisory Authority means the authority authorised to exercise state control and supervision over the compliance of personal data processing with applicable legislation and over the observance of the rights of personal data subjects, namely Roskomnadzor.
Processing of Personal Data means any action or operation, or any set of actions or operations, performed on personal data with or without the use of automated means, including collection, recording, organisation, accumulation, storage, clarification or updating, modification, retrieval, use, transfer, including dissemination, provision, or granting of access, depersonalisation, blocking, deletion, and destruction of personal data.
Operator means a state authority, municipal authority, legal entity, or individual that, independently or jointly with other persons, organises and/or carries out the processing of personal data and determines the purposes of personal data processing, the categories of personal data to be processed, and the actions or operations to be performed on personal data.
Personal Data means any information relating to an identified or identifiable individual, directly or indirectly, who is the personal data subject.
Personal Data Authorised by the Personal Data Subject for Dissemination means personal data to which the personal data subject has granted access to an unlimited number of persons in accordance with the procedure established by personal data legislation.
Russian Federation, or RF, means the Russian Federation.
Mixed Processing of Personal Data means personal data processing that includes both automated processing and processing performed without the use of automated means, or non-automated processing.
Special Categories of Personal Data means personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health, intimate life, and criminal convictions.
Personal Data Subject means an individual who is directly or indirectly identified or identifiable.
Cross-Border Transfer of Personal Data means the transfer of personal data to the territory of a foreign state, to a public authority of a foreign state, a foreign individual, or a foreign legal entity.
Destruction of Personal Data means actions as a result of which it becomes impossible to restore the contents of personal data in a personal data information system and/or as a result of which tangible media containing personal data are destroyed.
3. Principles and Rules for the Processing of Personal Data
3.1. The Operator shall process personal data in compliance with the following principles established by personal data legislation:
3.3. The Operator does not process special categories of personal data.
3.4. The Operator does not process biometric personal data.
3.5. The Operator does not make decisions concerning personal data subjects that produce legal consequences or otherwise affect their rights and legitimate interests solely on the basis of automated personal data processing.
3.6. The Operator may process personal data authorised by the personal data subject for dissemination only where a lawful basis exists and subject to compliance with the requirements established by personal data legislation.
3.7. The Operator does not process personal data for the purpose of promoting goods, work, or services on the market by making direct contact with potential consumers through means of communication.
4. Lawful Bases for the Processing of Personal Data
The lawful bases for processing the personal data of personal data subjects shall be determined taking into account the conditions for personal data processing established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.
The lawful bases for processing personal data through the Information Resource are:
3.1. The Operator shall process personal data in compliance with the following principles established by personal data legislation:
- personal data shall be processed lawfully and fairly;
- personal data processing shall be limited to the achievement of specific, predetermined, and lawful purposes;
- personal data shall not be processed for purposes that are incompatible with the purposes for which the relevant personal data was collected;
- databases containing personal data processed for mutually incompatible purposes shall not be combined;
- only personal data that is relevant to the purposes of processing and necessary to achieve those purposes shall be processed;
- the contents and volume of the personal data processed shall correspond to the stated purposes of processing;
- personal data that is excessive in relation to the stated purposes of processing shall not be processed;
- the accuracy and sufficiency of personal data shall be ensured and, where necessary, such personal data shall be kept up to date in relation to the purposes of its processing;
- personal data shall be stored in a form that makes it possible to identify the personal data subject for no longer than is required by the purposes of processing, unless the personal data retention period is established by federal law or by an agreement to which the personal data subject is a party, beneficiary, or guarantor; and
- personal data shall be destroyed, or its destruction shall be ensured where processing is carried out by another person acting on the Operator’s instructions, once the purposes of processing have been achieved or the need to achieve those purposes no longer exists, unless otherwise provided by personal data legislation.
3.3. The Operator does not process special categories of personal data.
3.4. The Operator does not process biometric personal data.
3.5. The Operator does not make decisions concerning personal data subjects that produce legal consequences or otherwise affect their rights and legitimate interests solely on the basis of automated personal data processing.
3.6. The Operator may process personal data authorised by the personal data subject for dissemination only where a lawful basis exists and subject to compliance with the requirements established by personal data legislation.
3.7. The Operator does not process personal data for the purpose of promoting goods, work, or services on the market by making direct contact with potential consumers through means of communication.
4. Lawful Bases for the Processing of Personal Data
The lawful bases for processing the personal data of personal data subjects shall be determined taking into account the conditions for personal data processing established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.
The lawful bases for processing personal data through the Information Resource are:
- the personal data subject’s consent to the processing of their personal data, taking into account the requirements established by personal data legislation for the relevant category of personal data; and
- an agreement to which the personal data subject is a party, beneficiary, or guarantor, where the processing of personal data is necessary for entering into that agreement or performing obligations under it.
5. Purposes of Personal Data Processing; Categories and List of Personal Data Processed; Categories of Personal Data Subjects; Methods and Periods of Processing and Storage; and the Procedure for Destruction
5.1. The Operator processes the personal data of personal data subjects on the Information Resource for predetermined purposes.
Depending on the specific purposes of personal data processing, such processing may include, in particular, all or some of the following actions or operations involving personal data: collection or receipt, recording, systematisation, accumulation, storage, clarification, including updating and modification, retrieval, use, transfer, including dissemination, provision and access, depersonalisation, blocking, deletion, and destruction of personal data.
For each purpose of personal data processing, the Operator determines:
5.3. For the personal data processing purposes specified in Appendix No. 1 to this Policy, mixed personal data processing shall be performed using the following methods:
The non-automated processing of personal data, including the storage of tangible media containing personal data, shall be carried out in premises that ensure the security of such media and make it possible to identify the locations in which personal data and the corresponding tangible media are stored, in accordance with the procedure established by personal data legislation.
5.4. The periods for processing and storing personal data for each personal data processing purpose specified in Appendix No. 1 to this Policy shall be established taking into account the applicable requirements, including the personal data processing conditions established by personal data legislation, and/or the provisions of an agreement to which the personal data subject is a party, beneficiary, or guarantor, and/or the personal data subject’s consent to the processing of their personal data.
Personal data shall not be processed or stored for longer than is required for the purposes of personal data processing, unless otherwise established by personal data legislation.
5.5. Procedure for the Destruction of Personal Data. Personal data processed for the purposes specified in Appendix No. 1 to this Policy shall be destroyed in the following circumstances:
The destruction of personal data shall be documented in accordance with Clause 6.14 of this Policy.
6. Procedure and Conditions for the Processing of Personal Data
6.1. When processing personal data, the Operator shall be guided by the applicable principles and by the requirements governing the procedure and conditions for personal data processing established by the legislation of the Russian Federation, this Policy, and the Operator’s other local regulatory documents.
6.2. The Operator shall determine the list of persons authorised to process personal data. Access to the personal data being processed shall be granted only to those employees of the Operator who require such access in order to perform specific functions as part of their official duties. Employees’ job descriptions and/or employment agreements, including, where applicable, supplementary agreements to employment agreements, shall specify their obligations to ensure the confidentiality and security of personal data and the measures of liability applicable in the event of failure to perform those obligations.
6.3. Before commencing the processing of personal data, employees of the Operator whose employment functions and duties include personal data processing shall acknowledge in writing that they have reviewed the provisions of personal data legislation, including the applicable personal data protection requirements, and the requirements of the Operator’s local regulatory documents governing personal data processing and protection.
6.4. Employees of the Operator who directly process personal data shall undergo regular training on matters relating to personal data processing.
6.5. When processing personal data, the Operator shall ensure that the personal data of the relevant personal data subject is clarified, updated, or amended in a timely manner. Such clarification, updating, or amendment shall be carried out, in particular, where the inaccuracy of personal data has been confirmed on the basis of:
6.7. Personal data may be transferred to state authorities and institutions, municipal authorities, and state extra-budgetary funds, and a personal data subject’s personal data may be obtained from state authorities and institutions, municipal authorities, and state extra-budgetary funds, without the personal data subject’s consent, in accordance with the procedure and in the circumstances established by personal data legislation.
6.8. The Operator does not carry out cross-border transfers of personal data.
6.9. In accordance with the procedure and requirements established by personal data legislation, the Operator shall assess the harm that may be caused to personal data subjects in the event of a violation of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”. The Operator shall also determine the proportionality between the potential harm and the measures taken to ensure compliance with the obligations established by personal data legislation.
6.10. When processing personal data, the Operator shall use only databases located within the territory of the Russian Federation.
6.11. When personal data is collected using the Internet information and telecommunications network, the Operator shall publish this Policy and any specific policies on personal data processing, where such policies have been developed, on the relevant information resources, including the pages of the websites owned by the Operator on which personal data is collected. The Operator shall also ensure that the relevant documents and information can be accessed using the facilities of the applicable information and telecommunications network.
6.12. The Operator shall cease processing personal data once the purposes of such processing have been achieved and upon expiry of the period established by personal data legislation, an agreement, or the personal data subject’s consent to the processing of their personal data. Where the personal data subject withdraws their consent to the processing of their personal data and/or submits a request for the cessation of personal data processing, the Operator may continue processing the personal data without the personal data subject’s consent where a lawful basis, or applicable condition for personal data processing, established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” exists.
6.13. The Operator shall conduct internal controls and/or audits to verify that personal data processing complies with the requirements of personal data legislation, the applicable requirements for personal data protection, this Policy, and the Operator’s other local regulatory documents.
6.14. Where no appropriate lawful basis for processing personal data exists, the Operator shall destroy the personal data, or ensure its destruction where the personal data is processed by a person acting on the Operator’s instructions, in accordance with the procedure established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”. Personal data shall be destroyed by carrying out actions as a result of which it becomes impossible to restore the contents of the personal data in the Personal Data Information System and/or as a result of which the tangible media containing the personal data are destroyed. Following the destruction of personal data, a Personal Data Destruction Certificate shall be drawn up and an entry shall be created in the electronic event log of the Personal Data Information System in accordance with the requirements of Roskomnadzor Order No. 179 dated 28 October 2022 “On Approval of the Requirements for Confirming the Destruction of Personal Data”. If those requirements cease to have legal effect or are declared invalid in whole or in part, the destruction of personal data shall be documented in accordance with the applicable provisions of personal data legislation.
5.1. The Operator processes the personal data of personal data subjects on the Information Resource for predetermined purposes.
Depending on the specific purposes of personal data processing, such processing may include, in particular, all or some of the following actions or operations involving personal data: collection or receipt, recording, systematisation, accumulation, storage, clarification, including updating and modification, retrieval, use, transfer, including dissemination, provision and access, depersonalisation, blocking, deletion, and destruction of personal data.
For each purpose of personal data processing, the Operator determines:
- the categories and list of personal data processed;
- the categories of personal data subjects whose personal data is processed by the Operator;
- the methods and periods of personal data processing and storage; and
- the procedure for the destruction of personal data.
5.3. For the personal data processing purposes specified in Appendix No. 1 to this Policy, mixed personal data processing shall be performed using the following methods:
- automated processing of personal data using computer technology; and
- non-automated processing of personal data without the use of computer technology, with personal data being recorded on tangible media containing personal data.
The non-automated processing of personal data, including the storage of tangible media containing personal data, shall be carried out in premises that ensure the security of such media and make it possible to identify the locations in which personal data and the corresponding tangible media are stored, in accordance with the procedure established by personal data legislation.
5.4. The periods for processing and storing personal data for each personal data processing purpose specified in Appendix No. 1 to this Policy shall be established taking into account the applicable requirements, including the personal data processing conditions established by personal data legislation, and/or the provisions of an agreement to which the personal data subject is a party, beneficiary, or guarantor, and/or the personal data subject’s consent to the processing of their personal data.
Personal data shall not be processed or stored for longer than is required for the purposes of personal data processing, unless otherwise established by personal data legislation.
5.5. Procedure for the Destruction of Personal Data. Personal data processed for the purposes specified in Appendix No. 1 to this Policy shall be destroyed in the following circumstances:
- the purpose or purposes of personal data processing have been achieved, or the need to achieve such purposes no longer exists, unless otherwise established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and/or other applicable regulatory legal acts of the Russian Federation;
- unlawful processing of personal data has been identified;
- the personal data subject has withdrawn their consent to the processing of personal data, unless otherwise provided by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”; or
- the personal data subject has submitted a request for the cessation of personal data processing, including the cessation of the dissemination of personal data through the Operator’s information resources, unless otherwise established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.
The destruction of personal data shall be documented in accordance with Clause 6.14 of this Policy.
6. Procedure and Conditions for the Processing of Personal Data
6.1. When processing personal data, the Operator shall be guided by the applicable principles and by the requirements governing the procedure and conditions for personal data processing established by the legislation of the Russian Federation, this Policy, and the Operator’s other local regulatory documents.
6.2. The Operator shall determine the list of persons authorised to process personal data. Access to the personal data being processed shall be granted only to those employees of the Operator who require such access in order to perform specific functions as part of their official duties. Employees’ job descriptions and/or employment agreements, including, where applicable, supplementary agreements to employment agreements, shall specify their obligations to ensure the confidentiality and security of personal data and the measures of liability applicable in the event of failure to perform those obligations.
6.3. Before commencing the processing of personal data, employees of the Operator whose employment functions and duties include personal data processing shall acknowledge in writing that they have reviewed the provisions of personal data legislation, including the applicable personal data protection requirements, and the requirements of the Operator’s local regulatory documents governing personal data processing and protection.
6.4. Employees of the Operator who directly process personal data shall undergo regular training on matters relating to personal data processing.
6.5. When processing personal data, the Operator shall ensure that the personal data of the relevant personal data subject is clarified, updated, or amended in a timely manner. Such clarification, updating, or amendment shall be carried out, in particular, where the inaccuracy of personal data has been confirmed on the basis of:
- a request submitted to the Operator by the personal data subject, their representative duly authorised to represent the personal data subject’s interests, or representatives of the Supervisory Authority, accompanied by documents confirming the inaccuracy of and changes to the personal data; or
- the Operator identifying discrepancies between the personal data previously received and the personal data provided by the personal data subject, their representative duly authorised to represent the personal data subject’s interests, or the Supervisory Authority, together with supporting documents.
6.7. Personal data may be transferred to state authorities and institutions, municipal authorities, and state extra-budgetary funds, and a personal data subject’s personal data may be obtained from state authorities and institutions, municipal authorities, and state extra-budgetary funds, without the personal data subject’s consent, in accordance with the procedure and in the circumstances established by personal data legislation.
6.8. The Operator does not carry out cross-border transfers of personal data.
6.9. In accordance with the procedure and requirements established by personal data legislation, the Operator shall assess the harm that may be caused to personal data subjects in the event of a violation of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”. The Operator shall also determine the proportionality between the potential harm and the measures taken to ensure compliance with the obligations established by personal data legislation.
6.10. When processing personal data, the Operator shall use only databases located within the territory of the Russian Federation.
6.11. When personal data is collected using the Internet information and telecommunications network, the Operator shall publish this Policy and any specific policies on personal data processing, where such policies have been developed, on the relevant information resources, including the pages of the websites owned by the Operator on which personal data is collected. The Operator shall also ensure that the relevant documents and information can be accessed using the facilities of the applicable information and telecommunications network.
6.12. The Operator shall cease processing personal data once the purposes of such processing have been achieved and upon expiry of the period established by personal data legislation, an agreement, or the personal data subject’s consent to the processing of their personal data. Where the personal data subject withdraws their consent to the processing of their personal data and/or submits a request for the cessation of personal data processing, the Operator may continue processing the personal data without the personal data subject’s consent where a lawful basis, or applicable condition for personal data processing, established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” exists.
6.13. The Operator shall conduct internal controls and/or audits to verify that personal data processing complies with the requirements of personal data legislation, the applicable requirements for personal data protection, this Policy, and the Operator’s other local regulatory documents.
6.14. Where no appropriate lawful basis for processing personal data exists, the Operator shall destroy the personal data, or ensure its destruction where the personal data is processed by a person acting on the Operator’s instructions, in accordance with the procedure established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”. Personal data shall be destroyed by carrying out actions as a result of which it becomes impossible to restore the contents of the personal data in the Personal Data Information System and/or as a result of which the tangible media containing the personal data are destroyed. Following the destruction of personal data, a Personal Data Destruction Certificate shall be drawn up and an entry shall be created in the electronic event log of the Personal Data Information System in accordance with the requirements of Roskomnadzor Order No. 179 dated 28 October 2022 “On Approval of the Requirements for Confirming the Destruction of Personal Data”. If those requirements cease to have legal effect or are declared invalid in whole or in part, the destruction of personal data shall be documented in accordance with the applicable provisions of personal data legislation.
7. Basic Procedure for Reviewing Inquiries and Requests from Personal Data Subjects Concerning Personal Data Processing
7.1. For the purpose of observing the rights and legitimate interests of personal data subjects, complying with the applicable deadlines for processing inquiries and/or requests, ensuring the quality and completeness of measures taken in response to lawful demands made by personal data subjects, and providing the information required in connection with such inquiries and/or requests, the Operator shall receive and process inquiries and/or requests from personal data subjects and shall monitor the proper receipt and processing thereof.
7.2. When reviewing inquiries and/or requests from personal data subjects, the Operator shall be guided by the provisions of personal data legislation, according to which a request and/or inquiry submitted by a personal data subject must contain the information required under Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”, namely:
7.4. The Operator shall provide information and/or take other measures in response to inquiries and/or requests received from personal data subjects to the extent and within the time limits established by personal data legislation. The deadline established by personal data legislation for responding to a personal data subject’s inquiry and/or request for information relating to the processing of their personal data may be extended on the grounds permitted by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”. In such a case, the Operator shall send the personal data subject a reasoned notice setting out the reasons for extending the period within which the requested information will be provided.
7.5. To exercise their right to submit an inquiry and/or request to the Operator, a personal data subject or another authorised person acting in the interests of the personal data subject may send the Operator an inquiry or request by email to: media@eduardlebedev.io
7.6. Upon receiving an inquiry and/or request from a personal data subject and verifying that it is lawful, the Operator shall provide the personal data subject and/or their duly authorised representative with the information specified in the request. The information shall be provided in the same form in which the corresponding inquiry or request was submitted, unless otherwise specified in the inquiry or request. Depending on the nature and specific features of the inquiry and/or request, the Operator may also take other appropriate measures. Information provided by the Operator may not contain personal data relating to other personal data subjects, except where lawful grounds for disclosing such personal data exist.
7.7. The Operator may refuse to comply with the requirements stated in an inquiry and/or request submitted by a personal data subject or their representative by sending the personal data subject or their representative a reasoned refusal, where the Operator has lawful grounds for such refusal under personal data legislation.
7.8. The Operator shall monitor the receipt and processing of inquiries from personal data subjects for the purpose of ensuring compliance with the rights and legitimate interests of personal data subjects, the applicable deadlines for processing inquiries, the quality and completeness of measures taken in response to lawful demands made by personal data subjects, and the provision of the information required in connection with their inquiries, in accordance with the Operator’s local regulatory documents.
8. Measures to Ensure the Confidentiality and Security of Personal Data
8.1. When processing personal data, the Operator shall ensure its confidentiality and security by taking the necessary legal, organisational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions involving personal data.
8.2. To ensure the security of personal data, the Operator shall take measures including, but not limited to, the following:
7.1. For the purpose of observing the rights and legitimate interests of personal data subjects, complying with the applicable deadlines for processing inquiries and/or requests, ensuring the quality and completeness of measures taken in response to lawful demands made by personal data subjects, and providing the information required in connection with such inquiries and/or requests, the Operator shall receive and process inquiries and/or requests from personal data subjects and shall monitor the proper receipt and processing thereof.
7.2. When reviewing inquiries and/or requests from personal data subjects, the Operator shall be guided by the provisions of personal data legislation, according to which a request and/or inquiry submitted by a personal data subject must contain the information required under Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”, namely:
- the number of the principal identity document of the personal data subject or their representative;
- the date of issue of that document and the authority that issued it;
- information confirming the personal data subject’s relationship with the Operator, including the agreement number, the date on which the agreement was entered into, a reference designation and/or other relevant information, or information otherwise confirming that the Operator processes the personal data subject’s personal data; and
- the signature of the personal data subject or their representative.
7.4. The Operator shall provide information and/or take other measures in response to inquiries and/or requests received from personal data subjects to the extent and within the time limits established by personal data legislation. The deadline established by personal data legislation for responding to a personal data subject’s inquiry and/or request for information relating to the processing of their personal data may be extended on the grounds permitted by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”. In such a case, the Operator shall send the personal data subject a reasoned notice setting out the reasons for extending the period within which the requested information will be provided.
7.5. To exercise their right to submit an inquiry and/or request to the Operator, a personal data subject or another authorised person acting in the interests of the personal data subject may send the Operator an inquiry or request by email to: media@eduardlebedev.io
7.6. Upon receiving an inquiry and/or request from a personal data subject and verifying that it is lawful, the Operator shall provide the personal data subject and/or their duly authorised representative with the information specified in the request. The information shall be provided in the same form in which the corresponding inquiry or request was submitted, unless otherwise specified in the inquiry or request. Depending on the nature and specific features of the inquiry and/or request, the Operator may also take other appropriate measures. Information provided by the Operator may not contain personal data relating to other personal data subjects, except where lawful grounds for disclosing such personal data exist.
7.7. The Operator may refuse to comply with the requirements stated in an inquiry and/or request submitted by a personal data subject or their representative by sending the personal data subject or their representative a reasoned refusal, where the Operator has lawful grounds for such refusal under personal data legislation.
7.8. The Operator shall monitor the receipt and processing of inquiries from personal data subjects for the purpose of ensuring compliance with the rights and legitimate interests of personal data subjects, the applicable deadlines for processing inquiries, the quality and completeness of measures taken in response to lawful demands made by personal data subjects, and the provision of the information required in connection with their inquiries, in accordance with the Operator’s local regulatory documents.
8. Measures to Ensure the Confidentiality and Security of Personal Data
8.1. When processing personal data, the Operator shall ensure its confidentiality and security by taking the necessary legal, organisational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions involving personal data.
8.2. To ensure the security of personal data, the Operator shall take measures including, but not limited to, the following:
- identifying current threats to the security of personal data processed in Personal Data Information Systems and applying appropriate organisational and technical protection measures corresponding to the established levels of personal data security;
- using information security tools that correspond to the applicable personal data security levels and that have undergone the required conformity assessment procedure in order to neutralise current threats to personal data security;
- assessing the effectiveness of the measures adopted and implemented to protect and ensure the security of personal data, including before information systems are placed into operation; such assessments may be conducted independently and/or under contract by legal entities holding a licence to perform technical protection of confidential information;
- implementing access control and managing access to personal data, the technical equipment used to process personal data, information security tools, and the equipment used to maintain the operation of information systems, as well as controlling access to the premises and facilities in which such equipment is installed;
- registering and recording all actions performed on personal data within Personal Data Information Systems;
- organising records of the technical equipment forming part of Personal Data Information Systems and of machine-readable data storage media;
- determining and, where necessary, updating the list of persons or employees of the Operator who require access to personal data processed in Personal Data Information Systems in order to perform their employment duties, and ensuring that access to the personal data being processed is granted only to those employees who require such access in connection with their employment duties;
- ensuring the automatic recording of security events relating to changes in access rights to personal data;
- restricting access to the contents of security event records to a limited number of persons, including by placing the Operator’s Personal Data Information Systems within a protected perimeter located inside a controlled area;
- implementing measures intended to prevent and detect unauthorised access to personal data and taking appropriate measures, including measures to prevent, detect, and remedy the consequences of computer attacks against Personal Data Information Systems and to respond to computer incidents occurring within such systems;
- restoring personal data that has been altered or destroyed as a result of unauthorised access;
- using only software and/or software components authorised for use and monitoring their installation and updating;
- identifying and responding to incidents and implementing measures to remedy incidents when they occur;
- detecting incidents involving breaches of personal data security, including unauthorised access to personal data and the unlawful transfer, provision, dissemination, or granting of access to personal data resulting from computer attacks against Personal Data Information Systems;
- taking measures to detect, prevent, and remedy the consequences of incidents involving personal data security breaches, including computer attacks against Personal Data Information Systems and computer incidents occurring within such systems;
- conducting external and internal technical security assessments of the system components of the information infrastructure to identify vulnerabilities; and
- monitoring the measures taken to ensure personal data security and the security level of Personal Data Information Systems.
- ensuring the separate storage of personal data and tangible media containing personal data where such data is processed for different and mutually incompatible purposes;
- establishing the measures necessary to ensure the security of personal data and the tangible media containing such data and to prevent unauthorised access thereto;
- ensuring that it is possible to identify the locations in which personal data and tangible media containing such data are stored and the persons who process or have access to each category of personal data, including by approving a list of personal data storage locations and a list of persons or positions involved in the non-automated processing of personal data or having access to such personal data and the corresponding tangible media; and
- implementing measures to ensure the security of personal data and the tangible media containing such data and to prevent unauthorised access thereto, including by appointing persons responsible for compliance with the conditions established to ensure the security of personal data and the corresponding tangible media.
9. Rights and Obligations of the Operator and Rights and Obligations of Personal Data Subjects
9.1. The Operator shall::
10.1. Visitors to the website, being an unlimited number of persons, and any third-party operators may not process, except by obtaining access to, personal data relating to personal data subjects that is disseminated through the Operator’s information resource, including its website and/or mobile application, unless an appropriate lawful basis for such processing exists.
10.2. A personal data subject whose personal data is disseminated through the Operator’s information resource may establish specific conditions applicable to the processing of, and restrictions on the processing of, personal data authorised by the personal data subject for dissemination. Where a personal data subject establishes conditions applicable to the processing of and/or restrictions on the processing of personal data authorised for dissemination, the corresponding information shall be published on the page of the Operator’s website or mobile application containing the disseminated personal data of the personal data subject who established the relevant conditions and/or restrictions. In the absence of such conditions and/or restrictions, it shall be presumed that the personal data subject has not established them.
10.3. When processing personal data authorised by the personal data subject for dissemination, all third-party operators shall comply with the conditions applicable to the processing of and/or restrictions on the processing of personal data specified in Clause 10.2 of this Policy.
9.1. The Operator shall::
- comply with the requirements of personal data legislation governing the processing and protection of personal data, including the requirements applicable to the collection of personal data;
- when collecting personal data, including through the Internet information and telecommunications network, ensure that the recording, organisation, accumulation, storage, clarification, updating, modification, and retrieval of personal data relating to personal data subjects who are citizens of the Russian Federation are carried out using databases located within the territory of the Russian Federation, except in the circumstances provided for by personal data legislation;
- when collecting personal data through information and telecommunications networks, publish within the relevant information and telecommunications network, including on the pages of the Operator’s website through which personal data is collected, a document setting out the Operator’s personal data processing policy, or a specific personal data processing policy where one has been developed, together with information concerning the personal data protection requirements being implemented, and ensure that such document or documents can be accessed using the facilities of the relevant information and telecommunications network;
- where the provision of personal data and/or consent to its processing is mandatory under personal data legislation and the personal data subject refuses to provide the personal data and/or consent, explain to the personal data subject the legal consequences of failing to provide such personal data and/or consent;
- where personal data is obtained from a person other than the personal data subject, provide the personal data subject, before commencing the processing of the personal data, with the information required by personal data legislation, subject to the exceptions established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
- perform the obligations applicable to operators upon receiving personal data inquiries and/or requests from the personal data subject, their representative duly authorised to represent their interests, and/or the Supervisory Authority;
- take measures intended to ensure compliance with the requirements of personal data legislation;
- take measures to ensure the security of personal data during its processing;
- perform the obligations to remedy violations of personal data legislation where such violations have occurred in the course of personal data processing, and perform the obligations relating to the clarification, blocking, and destruction of personal data in the circumstances established by personal data legislation;
- perform the obligations imposed on operators by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” where the personal data subject submits a request to cease personal data processing and/or withdraws their consent to personal data processing;
- cooperate with the Supervisory Authority on matters relating to personal data processing and protection in the circumstances established by personal data legislation; and
- perform any other obligations established by personal data legislation.
- process personal data without the personal data subject’s consent in the circumstances established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
- transfer personal data to third parties, state authorities, municipal authorities, state institutions, and state extra-budgetary funds, and appoint third parties to process personal data, where an appropriate lawful basis exists and the requirements of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” are observed;
- refuse to provide a personal data subject with information concerning the processing of their personal data in the circumstances established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
- independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and the regulatory legal acts adopted pursuant thereto, unless otherwise provided by personal data legislation;
- independently determine, taking into account the requirements of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”, the list of legal, organisational, and technical measures necessary to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions involving personal data, based on an assessment of current threats to personal data security, and determine the procedure for implementing such measures and assess their effectiveness; and
- exercise any other rights established by personal data legislation.
- provide the Operator with accurate information about themselves; and
- notify the Operator promptly of any changes to their personal data.
- freely give consent to the processing of personal data of their own will and in their own interests, subject to the requirements imposed by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” concerning the form and contents of such consent;
- submit inquiries and/or requests, including repeated inquiries and requests, and receive information concerning the processing of their personal data in accordance with the procedure, form, scope, and time limits established by personal data legislation;
- require the Operator to clarify, block, or destroy their personal data where the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, and take other measures available under personal data legislation to protect their rights, subject to the exceptions established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
- request that the Operator cease processing their personal data, including the dissemination of their personal data, and withdraw any consent to personal data processing previously provided to the Operator;
- require the cessation of personal data processing carried out for the purpose of promoting goods, work, or services on the market through direct contact with potential consumers using means of communication; and
- exercise any other rights established by personal data legislation.
10.1. Visitors to the website, being an unlimited number of persons, and any third-party operators may not process, except by obtaining access to, personal data relating to personal data subjects that is disseminated through the Operator’s information resource, including its website and/or mobile application, unless an appropriate lawful basis for such processing exists.
10.2. A personal data subject whose personal data is disseminated through the Operator’s information resource may establish specific conditions applicable to the processing of, and restrictions on the processing of, personal data authorised by the personal data subject for dissemination. Where a personal data subject establishes conditions applicable to the processing of and/or restrictions on the processing of personal data authorised for dissemination, the corresponding information shall be published on the page of the Operator’s website or mobile application containing the disseminated personal data of the personal data subject who established the relevant conditions and/or restrictions. In the absence of such conditions and/or restrictions, it shall be presumed that the personal data subject has not established them.
10.3. When processing personal data authorised by the personal data subject for dissemination, all third-party operators shall comply with the conditions applicable to the processing of and/or restrictions on the processing of personal data specified in Clause 10.2 of this Policy.
11. Final Provisions
11.1. This Policy shall enter into force upon its approval and shall be published on the Operator’s information resources, including websites on the Internet information and telecommunications network and mobile applications, within the time limits established by the relevant administrative document.
11. 2. The Operator may amend this Policy unilaterally, including for the purpose of updating any rules and requirements established herein or where amendments are necessary to bring the Policy into compliance with the applicable personal data legislation.
To familiarise personal data subjects with the provisions of a new version of the Policy, the Operator shall provide unrestricted access to its contents by publishing it on the Operator’s information resources, including websites on the Internet information and telecommunications network and mobile applications.
11.3. A new version of the Operator’s Policy shall enter into force upon its approval and shall be published on the Operator’s information resources, including websites on the Internet information and telecommunications network and mobile applications, within the time limits established by the Operator’s administrative document.
11.4. If, for any reason, one or more provisions of this Policy are declared invalid or unenforceable, this shall not affect the validity or enforceability of the remaining provisions of the Policy.
11.5. The Operator’s employees shall be liable for failure to comply with the requirements governing personal data processing and protection, including the disclosure or unlawful use of personal data, in accordance with the procedure and subject to the conditions established by the Labour Code of the Russian Federation.
Such employees may also be subject to civil, administrative, and criminal liability in accordance with the procedure established by the applicable regulatory legal acts of the Russian Federation.
11.6. Compliance with the requirements of this Policy shall be monitored by the person responsible for organising personal data processing.
11.1. This Policy shall enter into force upon its approval and shall be published on the Operator’s information resources, including websites on the Internet information and telecommunications network and mobile applications, within the time limits established by the relevant administrative document.
11. 2. The Operator may amend this Policy unilaterally, including for the purpose of updating any rules and requirements established herein or where amendments are necessary to bring the Policy into compliance with the applicable personal data legislation.
To familiarise personal data subjects with the provisions of a new version of the Policy, the Operator shall provide unrestricted access to its contents by publishing it on the Operator’s information resources, including websites on the Internet information and telecommunications network and mobile applications.
11.3. A new version of the Operator’s Policy shall enter into force upon its approval and shall be published on the Operator’s information resources, including websites on the Internet information and telecommunications network and mobile applications, within the time limits established by the Operator’s administrative document.
11.4. If, for any reason, one or more provisions of this Policy are declared invalid or unenforceable, this shall not affect the validity or enforceability of the remaining provisions of the Policy.
11.5. The Operator’s employees shall be liable for failure to comply with the requirements governing personal data processing and protection, including the disclosure or unlawful use of personal data, in accordance with the procedure and subject to the conditions established by the Labour Code of the Russian Federation.
Such employees may also be subject to civil, administrative, and criminal liability in accordance with the procedure established by the applicable regulatory legal acts of the Russian Federation.
11.6. Compliance with the requirements of this Policy shall be monitored by the person responsible for organising personal data processing.
Appendix No. 1
to the Personal Data Processing Policy
List of Personal Data Processing Purposes and the Corresponding Categories and List of Personal Data Processed, Categories of Personal Data Subjects, Processing and Storage Methods and Periods, and the Procedure for Personal Data Destruction
This Appendix to the Personal Data Processing Policy (hereinafter referred to as the “Policy”) defines the purposes for which the Operator processes personal data (hereinafter referred to as “Personal Data” or “PD”), the corresponding categories and list of PD processed, the categories of subjects whose PD is processed, the methods and periods of PD processing and storage, and the procedure for their destruction upon achievement of the purposes of processing or upon the occurrence of other lawful grounds (hereinafter referred to as the “Appendix”).
The list of PD presented in this Appendix has been prepared taking into account the requirements of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” in order to provide information about the PD that may be processed within the purposes of personal data processing defined in the Appendix.
The specific list of PD is determined by the relevant agreement, consent to the processing of PD, and the requirements of personal data legislation, taking into account the specific features of the process and/or product, service, or offering.1. Purpose of PD Processing: “Popularisation of the Expert’s Activities”
1.1. Within the purpose of “Popularisation of the Expert’s Activities”, the Operator processes PD of the following categories of PD subjects: individuals (experts).
1.2. With respect to the purpose specified in Clause 1 of this Appendix, subject to the existence of and taking into account the conditions and lawful grounds for PD processing, the following personal data may be processed:
- PD falling within the category of “Other PD” (Personal Data Authorised by the Personal Data Subject for Dissemination): surname, first name; information from employment history; information about principal activities; work experience.
- PD falling within the category of “Special Categories of PD”: not processed.
- PD falling within the category of “Biometric PD”: not processed.
1.4. The periods of PD processing and storage for the purpose specified in Clause 1 of this Appendix are defined in Clause 5.4 of the Policy.
1.5. The procedure for the destruction of PD for the purpose specified in Clause 1 of this Appendix is defined in Clause 5.5 of the Policy.
2. Purpose of PD Processing: “Processing Incoming Inquiries and Preparing Responses to Them”
2.1. Within the purpose of “Processing Incoming Inquiries and Preparing Responses to Them”, the Operator processes PD of the following categories of PD subjects: website visitors who have submitted inquiries.
2.2. With respect to the purpose specified in Clause 2 of this Appendix, subject to the existence of and taking into account the conditions and lawful grounds for PD processing, the following PD may be processed:
- PD falling within the category of “Other PD”: surname, first name, patronymic; telephone number; email address; product description or contents of the inquiry.
- PD falling within the category of “Special Categories of PD”: not processed.
- PD falling within the category of “Biometric PD”: not processed.
2.4. The periods of PD processing and storage for the purpose specified in Clause 2 of this Appendix are defined in Clause 5.4 of the Policy.
2.5. The procedure for the destruction of PD for the purpose specified in Clause 2 of this Appendix is defined in Clause 5.5 of the Policy.
3. Purpose of PD Processing: “Provision of the Functionality of Information Resources”
3.1. Within the purpose of “Provision of the Functionality of Information Resources”, the Operator processes PD of the following categories of PD subjects: website visitors.
3.2. With respect to the purpose specified in Clause 3 of this Appendix, subject to the existence of and taking into account the conditions and lawful grounds for PD processing, the following PD may be processed:
- PD falling within the category of “Other PD”: technical cookies, as well as the following: IP address; location, including country or city; type and version of the device’s operating system; type and version of the browser on the device; device type and display resolution; traffic source; operating system and browser language; data concerning your activities on the website; information contained in a document that may be attached by a website user when submitting an inquiry.
- PD falling within the category of “Special Categories of PD”: not processed.
- PD falling within the category of “Biometric PD”: not processed.
3.4. The periods of PD processing and storage for the purpose specified in Clause 3 of this Appendix are defined in Clause 5.4 of the Policy.
3.5. The procedure for the destruction of PD for the purpose specified in Clause 3 of this Appendix is defined in Clause 5.5 of the Policy.