1. General provisions
1.1. This Personal Data Processing Policy of PanEco Research and Production Enterprise LLC (hereinafter the Policy) has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter the Federal Law on Personal Data), and the Labour Code of the Russian Federation.
1.2. The Policy establishes the procedures and conditions for processing personal data at PanEco Research and Production Enterprise LLC (hereinafter the Operator), both by automated means and without such means.
1.3. Personal data are processed to fulfil the terms of employment contracts with employees; ensure compliance with laws and other regulatory legal acts; assist employees with employment; ensure employees' personal safety, monitor the quantity and quality of work performed and safeguard property; prepare, conclude and perform civil-law contracts; and for other purposes provided for by law and necessary for the Operator to exercise its powers.
2. Key terms used in this Policy
2.1. Personal data means any information relating to a directly or indirectly identified or identifiable individual (the personal data subject).
2.2. Personal data processing means any action (operation) or set of actions (operations) performed on personal data, by automated means or otherwise, including collection, recording, systematization, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision or access), depersonalization, blocking, deletion and destruction of personal data.
2.3. Automated personal data processing means processing personal data using computer technology.
2.4. Dissemination of personal data means actions intended to disclose personal data to an unspecified group of persons.
2.5. Provision of personal data means actions intended to disclose personal data to a specified person or specified group of persons.
2.6. Blocking of personal data means temporary suspension of personal data processing, except where processing is necessary to clarify the personal data.
2.7. Destruction of personal data means actions that make it impossible to restore the content of personal data in a personal data information system and/or that destroy physical media containing personal data.
2.8. Depersonalization of personal data means actions that make it impossible, without additional information, to determine whether personal data relate to a particular personal data subject.
2.9. A personal data information system means the personal data contained in databases, together with the information technology and technical facilities used to process them.
2.10. Cross-border transfer of personal data means transferring personal data to the territory of a foreign state, to a foreign public authority, a foreign individual or a foreign legal entity.
3. Principles of personal data processing
3.1. Personal data are processed on a lawful basis.
3.2. Personal data processing is limited to achieving specific, predetermined and lawful purposes. Processing that is incompatible with the purposes for which personal data were collected is not permitted.
3.3. Databases containing personal data processed for mutually incompatible purposes must not be combined.
3.4. Only personal data that meet the purposes of their processing are processed.
3.5. The content and scope of personal data correspond to the stated purposes of processing. The personal data processed are not excessive in relation to those purposes.
3.6. Personal data processing ensures the accuracy and sufficiency of personal data and, where necessary, that they are up to date in relation to the purposes of processing. The Operator ensures that necessary measures are taken to delete or clarify incomplete or inaccurate data.
3.7. Personal data are stored in a form that permits identification of the personal data subject for no longer than required by the purposes of processing, unless a storage period is established by federal law or by a contract to which the personal data subject is a party, beneficiary or guarantor. Personal data must be destroyed or depersonalized when the purposes of processing have been achieved or are no longer necessary, unless otherwise provided by federal law.
4. Conditions for personal data processing
4.1. Personal data are processed in compliance with the principles and rules established by the Federal Law on Personal Data. Personal data processing is permitted in the following cases:
4.1.1. The personal data subject has consented to the processing of their personal data;
4.1.2. Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, or to exercise and perform the functions, powers and duties imposed on the Operator by the legislation of the Russian Federation;
4.1.3. Processing is necessary for federal executive authorities, state extra-budgetary funds, executive authorities of constituent entities of the Russian Federation, local authorities and organizations participating in the provision of state and municipal services to exercise their powers and functions under Federal Law No. 210-FZ of 27.07.2010 "On the Organization of the Provision of State and Municipal Services", including registration of the personal data subject on the unified portal of state and municipal services and/or regional portals of state and municipal services;
4.1.4. Processing is necessary to perform a contract to which the personal data subject is a party, beneficiary or guarantor, or to conclude a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;
4.1.5. Processing is necessary to protect the life, health or other vital interests of the personal data subject where it is impossible to obtain their consent;
4.1.6. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve purposes of public importance, provided that the rights and freedoms of the personal data subject are not infringed;
4.1.7. The personal data being processed have been made accessible to an unlimited group of persons by the personal data subject or at their request;
4.1.8. The personal data being processed are subject to publication or mandatory disclosure under federal law.
4.2. If the Operator entrusts personal data processing to another person, the Operator is liable to the personal data subject for that person's actions. The person processing personal data on the Operator's instructions is liable to the Operator.
5. Confidentiality of personal data
5.1. The Operator and other persons who have obtained access to personal data must not disclose them to third parties or disseminate them without the consent of the personal data subject, unless otherwise provided by federal law.
6. The personal data subject's right of access to their personal data
6.1. The personal data subject has the right to receive the information specified in clause 6.7 of this Policy, except where access to their personal data would infringe the rights and legitimate interests of third parties. The personal data subject may require the Operator to clarify, block or destroy their personal data if the data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and may take the measures provided by law to protect their rights.
6.2. The Operator must provide the information specified in clause 6.7 of this Policy to the personal data subject in an accessible form. It must not contain personal data relating to other personal data subjects unless there are lawful grounds for disclosing such data.
6.3. The Operator provides the information specified in clause 6.7 of this Policy to the personal data subject or their representative upon an enquiry or receipt of a request from the subject or their representative. The request must contain the number of the primary identity document and details of the issuing authority; information confirming the personal data subject's relationship with the Operator (contract number, contract date, an agreed verbal identifier and/or other information), or other information confirming that the Operator processes the personal data; and the signature of the subject or their representative. The request may be sent as an electronic document signed with an electronic signature in accordance with the legislation of the Russian Federation.
6.4. If the information specified in clause 6.7 of this Policy and the personal data being processed have been made available to the personal data subject at their request, the subject may make a further enquiry or submit a further request to the Operator to obtain the information specified in clause 6.7 and review those personal data no earlier than thirty days after the initial enquiry or request, unless a shorter period is established by federal law, a regulatory legal act adopted under it, or a contract to which the personal data subject is a party, beneficiary or guarantor.
6.5. The personal data subject may make a further enquiry or submit a request to the Operator to obtain the information specified in clause 6.7 of this Policy and review the personal data being processed before the period specified in clause 6.4 expires if that information and/or those personal data were not made available in full following consideration of the initial enquiry. In addition to the information specified in clause 6.3 of this Policy, the further request must state the grounds for submitting it.
6.6. The Operator may refuse to comply with a further request that does not meet the conditions specified in clauses 6.3 and 6.4 of this Policy. Such refusal must state its reasons. The Operator bears the burden of proving that refusal to comply with the further request is justified.
6.7. The personal data subject has the right to receive information concerning the processing of their personal data, including:
6.7.1. Confirmation that the Operator processes personal data;
6.7.2. The legal grounds and purposes of personal data processing;
6.7.3. The purposes of processing and the methods used by the Operator;
6.7.4. The Operator's name and location, and details of persons other than the Operator's employees who have access to personal data or to whom personal data may be disclosed under a contract with the Operator or under federal law;
6.7.5. The personal data being processed that relate to the relevant personal data subject and the source from which they were obtained, unless federal law establishes a different procedure for providing such data;
6.7.6. The periods for processing personal data, including their storage periods;
6.7.7. The procedure by which the personal data subject may exercise the rights provided by the Federal Law on Personal Data;
6.7.8. Information on completed or proposed cross-border transfers of data;
6.7.9. The name, or surname, first name and patronymic, and address of the person processing personal data on the Operator's instructions, if processing has been or will be entrusted to that person;
6.7.10. Other information provided for by the Federal Law on Personal Data or other federal laws.
7. The right to challenge the Operator's actions or omissions
7.1. If a personal data subject believes that the Operator processes their personal data in breach of the Federal Law on Personal Data or otherwise infringes their rights and freedoms, they may challenge the Operator's actions or omissions before the authority responsible for protecting the rights of personal data subjects or in court.
7.2. The personal data subject has the right to protect their rights and legitimate interests, including by seeking compensation for losses and/or non-pecuniary damage in court.
8. The Operator's obligations when collecting personal data
8.1. When collecting personal data, the Operator must, at the personal data subject's request, provide the information specified in clause 6.7 of this Policy.
8.2. If the provision of personal data is mandatory under federal law, the Operator must explain to the personal data subject the legal consequences of refusing to provide their personal data.
8.3. If personal data have not been obtained from the personal data subject, the Operator must, before starting to process them, provide the following information to the subject, except in the cases specified in clause 8.4 of this Policy:
8.3.1. The name, or surname, first name and patronymic, and address of the Operator or its representative;
8.3.2. The purpose and legal basis of personal data processing;
8.3.3. The intended users of the personal data;
8.3.4. The personal data subject's rights under this Federal Law;
8.3.5. The source from which the personal data were obtained.
8.4. The Operator is exempt from the obligation to provide the personal data subject with the information specified in clause 8.3 of this Policy if:
8.4.1. The personal data subject has been notified that the Operator processes their personal data;
8.4.2. The Operator obtained the personal data under federal law or in connection with the performance of a contract to which the personal data subject is a party, beneficiary or guarantor;
8.4.3. The personal data were made publicly available by the personal data subject or obtained from a publicly available source;
8.4.4. Providing the information specified in clause 8.3 of this Policy would infringe the rights and legitimate interests of third parties.
9. Measures to ensure that the Operator fulfils its obligations under the Federal Law on Personal Data
9.1. A person responsible for organizing personal data processing has been appointed.
9.2. Documents establishing the Operator's personal data processing policy have been issued, together with internal regulations on personal data processing and internal regulations establishing procedures to prevent and detect breaches of the legislation of the Russian Federation and remedy their consequences.
9.3. Rules have been approved for internal monitoring of compliance of personal data processing with the Federal Law on Personal Data, regulatory legal acts adopted under it, this Policy and internal regulations.
9.4. An assessment has been conducted of the harm that could be caused to personal data subjects and of the relationship between that harm and the measures applied by the Operator.
9.5. Employees directly involved in personal data processing have been familiarized with the provisions of Russian personal data legislation, including the documents establishing the Operator's personal data processing policy and internal regulations on personal data processing.
10. Measures to ensure the security of personal data during processing
10.1. Threats to the security of personal data during processing in personal data information systems have been identified.
10.2. Organizational and technical security measures necessary to meet personal data protection requirements are applied when personal data are processed in personal data information systems.
10.3. Information security tools that have undergone the prescribed conformity assessment procedure are used.
10.4. Records of computer media containing personal data are maintained.
10.5. Measures are taken to detect unauthorized access to personal data and respond appropriately.
10.6. A set of measures has been established to restore personal data modified or destroyed as a result of unauthorized access.
10.7. Rules have been established for access to personal data processed in personal data information systems, and all actions involving personal data in those systems are logged and recorded.
10.8. The personal data security measures taken and the level of protection of personal data information systems are monitored.
11. Final provisions
11.1. The Operator's other rights and obligations in connection with personal data processing are determined by the personal data legislation of the Russian Federation.
11.2. This Policy is a publicly available document and must be made available to the public at the Company's office and on its website at: www.paneco.ru
11.3. If the provisions of this Policy are not complied with, the Company is liable in accordance with the legislation of the Russian Federation.
11.4. The liability of Company officers who have access to personal data for failing to comply with the rules governing personal data processing and protection is determined in accordance with the legislation of the Russian Federation and the Company's internal regulatory, organizational and administrative documents.
Requests from personal data subjects or their representatives are accepted at: Building 1, Innovatsionny Proyezd, Technopark Industrial Zone, Gorki Leninskiye urban-type settlement, Leninsky Urban District, Moscow Region, 142712, Russia.
A request signed with an electronic signature may also be sent to: info@paneco.ru .