Policy on the processing of personal data

1.1. This Policy concerning the processing of personal data (hereinafter – Policy) is made in accordance with paragraph 2 of article 18.1 of the Federal law "On personal data" No. 152-FZ of July 27, 2006, and also other regulatory legal acts of the Russian Federation in the field of protection and processing of personal data and applies to all personal data (hereinafter – data), which the Organization (hereinafter – the Operator) may be obtained from the data subject, who has a civil contract, from the Internet user (hereinafter – User) while using any of the sites, services, services, programs, products or services provided by LLC "ELECTRIC MACHINE", as well as the personal data subject, including with the Statement in the relations regulated by the labor legislation (hereinafter – Worker).

1.2. the Operator ensures that the processed personal data is protected from unauthorized access and disclosure, misuse or loss in accordance with the requirements of Federal law No. 152-FZ of July 27, 2006 "on personal data".

1.3. The operator has the right to make changes in this Policy. When making changes, the Policy header indicates the date when the revision was last updated. The new version of the Policy comes into force from the moment it is posted on the site, unless otherwise provided by the new version of the Policy.

2. Terms and abbreviations used

Personal data – any information relating directly or indirectly to a specific or identifiable natural person (subject of personal data).

Processing of personal data – any action (operation) or a set of actions (operations) performed with or without the use of automation tools with personal data, including the collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

Automated processing of personal data – processing of personal data using computer technology.

Personal data information system (ISPS) – a set of personal data contained in databases and information technologies and technical means that ensure their processing.

Personal data made publicly available by the subject of personal data means personal data that an unlimited number of persons have access to or have requested by the subject of personal data.

Blocking of personal data – temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data).

Destruction of personal data – actions that make it impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.

Operator – an organization that independently or jointly with other persons organizes the processing of personal data, as well as determines the purposes of processing personal data to be processed, actions (operations) performed with personal data. The operator is the limited liability company "ELECTRIC MACHINE", located at the address: 620041, Russia, Sverdlovsk region, Yekaterinburg, ferghanskaya street, house 16, office 309, TIN/KPP 6679134083/667901001, OGRN 1206600032132.

 

3. Processing of personal data

3.1. Receiving personal data.

3.1.1. All personal data shall be obtained from the subject. If the subject's personal data can only be obtained from a third party, then the subject must be notified of this or consent must be obtained from him.

3.1.2. the Operator must inform the subject about the purposes, intended sources and methods of obtaining personal data, the nature of the personal data to be obtained, the list of actions with personal data, the period during which the consent is valid, and the procedure for revoking it, as well as the consequences of the subject's refusal to give written consent to receive them.

3.1.3. Documents containing personal data are created by::

- copying of original documents (passport, education certificate, TIN certificate, pension certificate, etc.);

- entering information in accounting forms;

- obtaining the original required documents (employment record, medical report, characteristics, etc.).

3.2. Processing of personal data.

3.2.1. The personal data shall be processed:

– with the consent of the personal data subject to the processing of his / her personal data;

– in cases where the processing of personal data is necessary for the implementation and fulfillment of the functions, powers and duties assigned by the legislation of the Russian Federation;

in cases where the processing of personal data, unlimited access to which is provided by the data subject or at the request (hereinafter – the personal data made public by the personal data subject).

3.2.2. Purposes of personal data processing:

- implementation of labor relations;

- implementation of civil law relations;

- to identify users (visitors) of the online store's website, to communicate with the user, including sending notifications, requests and information related to the use of the store's website, execution of agreements and contracts, as well as processing requests and requests from the user.

- depersonalization of personal data to obtain depersonalized statistical data that is transmitted to a third party for conducting research, performing work or providing services on behalf of the store.

3.2.3. Categories of personal data subjects.

Personal data of the following personal data subjects is processed:

- individuals who have an employment relationship with the Company;

- individuals who have left the Company;

– individuals who are candidates for the job;

- individuals who have civil relations with the Company;

– individuals who are users of the store's website.

3.2.4. Personal data processed by the Operator:

– data obtained during the implementation of labor relations;

– data obtained for the selection of job candidates;

– data obtained during the implementation of civil law relations;

– data received from users of the store's website.

3.2.5. The processing of personal data is conducted:

– using automation tools;

– without using automation tools.

3.3. Storage of personal data.

3.3.1. personal data of subjects can be obtained, further processed and transferred for storage both on paper and in electronic form.

3.3.2. Personal data recorded on paper is stored in lockable cabinets or in lockable rooms with restricted access rights.

3.3.3. Personal data of the subjects treated with the use of automation for different purposes, are stored in different folders.

3.3.4. it is Not allowed to store and place documents containing personal data in open electronic directories (file sharing sites) in the ISPD.

3.3.5. Storage of personal data in the form that allows you to determine the subject of personal data is carried out for no longer than required by the purpose of their processing, and they are destroyed when the purposes of processing or in case of loss necessary to achieve them.

3.4. Destruction of personal data.

3.4.1. destruction of documents (carriers) containing personal data is carried out by burning, crushing (crushing), chemical decomposition, transformation into a shapeless mass or powder. A shredder may be used to destroy paper documents.

3.4.2. Personal data on electronic media is destroyed by erasing or formatting the media.

3.4.3. the fact of destruction of personal data is documented by the act of destruction of media.

3.5. Transfer of personal data.

3.5.1. The operator transfers the personal data to third parties in the following cases:

– the subject has expressed his consent to such actions;

- the transfer is provided for by Russian or other applicable legislation within the framework of the procedure established by law.

3.5.2. List of persons to whom personal data is transferred.

- Pension Fund of the Russian Federation for accounting purposes (legally);

- tax authorities of the Russian Federation (legally);

– Social insurance Fund of the Russian Federation (legally);

- territorial Fund of compulsory medical insurance (on legal grounds);

– medical insurance organizations that provide compulsory and voluntary medical insurance (legally);

- banks for calculating wages (based on the contract);

- bodies of the Ministry of internal Affairs of Russia in cases established by law;

- depersonalized personal data Of users of the online store's website is transferred to the Store's counterparties.

 

4. Personal data protection

4.1.in accordance with the requirements of regulatory documents, the Operator has created a personal data protection system (FDD) consisting of subsystems of legal, organizational and technical protection.

4.2. the legal protection Subsystem is a set of legal, organizational, administrative, and regulatory documents that ensure the creation, operation, and improvement of the NWPD.

4.3. the Subsystem of organizational protection includes the organization of the management structure of the FDD, the licensing system, and information protection when working with employees, partners, and third parties.

4.4. the technical protection Subsystem includes a set of technical, software, software and hardware tools that ensure the protection of personal data.

4.4. The main measures of personal data protection used by the Operator are::

4.5.1. Appointment of a person responsible for the processing of personal data, who organizes the processing of personal data, provides training and instruction, and performs internal control over the compliance of the institution and its employees with the requirements for personal data protection.

4.5.2. Identification of current threats to the security of personal data when processing them in the ISPD and development of measures and measures to protect personal data.

4.5.3. Policy development in relation to the processing of personal data.

4.5.4. Establishing rules for access to personal data processed in THE ISPS, as well as ensuring registration and accounting of all actions performed with personal data in the ISPS.

4.5.5. Setting individual passwords for employees ' access to the information system in accordance with their work responsibilities.

4.5.6. Use of information security tools that have passed the compliance assessment procedure in accordance with the established procedure.

4.5.7. Certified antivirus software with regularly updated databases.

4.5.8. Compliance with the conditions that ensure the security of personal data and exclude unauthorized access to them.

4.5.9. Detection of unauthorized access to personal data and taking measures.

4.5.10. Recovery of personal data modified or destroyed due to unauthorized access to them.

4.5.11. Training of the Operator's employees who directly process personal data on the provisions of the Russian Federation legislation on personal data, including requirements for personal data protection, documents defining the Operator's policy on personal data processing, and local acts on personal data processing.

4.5.12. Implementation of internal control and audit.

 

5. Basic rights of the personal data subject and obligations of the Operator

5.1. Basic rights of the personal data subject.

The subject has the right to access his personal data and the following information:

- confirmation of the processing of personal data by the Operator;

- legal grounds and purposes of personal data processing;

– purposes and methods of processing personal data used by the Operator;

- the name and location of the Operator, information about persons (with the exception of employees of the Operator) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or on the basis of a Federal law;

- terms of processing of personal data, including the terms of their storage;

- procedure for the exercise by the personal data subject of the rights provided for by Federal law;

– name or surname, first name, patronymic and address of the person who processes personal data on behalf of the Operator, if the processing is or will be entrusted to such a person;

- contacting the Operator and sending them requests;

- appeal against the Operator's actions or omissions.

5.2. Operator's Obligations.

The operator must:

- when collecting personal data, provide information about the processing of personal data;

– in cases where the personal data was not received from the personal data subject, notify the subject;

– in case of refusal to provide personal data to the subject, the consequences of such refusal are explained;

- publish or otherwise provide unrestricted access to the document defining its policy regarding the processing of personal data, to information about the implemented requirements for personal data protection;

- take the necessary legal, organizational and technical measures or ensure their adoption to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other illegal actions in relation to personal data;