Personal Data Processing Policy
1. General provisions
This Policy of the Limited Liability Company “NCD” regarding the processing of personal data (hereinafter referred to as the “Policy”) has been developed in accordance with the requirements of clause 2 of part 1 of Article 18.1 of the Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) in order to ensure the protection of the rights and freedoms of an individual and a citizen in the processing of their personal data, including the protection of the right to privacy and the protection of personal and family secrets.
The Policy applies to all personal data processed by the limited liability company “National Cableways” (hereinafter referred to as the Operator, LLC “NCD”).
The Policy covers relationships in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
In accordance with the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in the public domain on the Operator’s website on the information and telecommunications network of the Internet.
The main concepts used in the Policy are:
personal data - any information relating directly or indirectly to a specific or identifiable natural person (personal data subject);
personal data operator (operator) is a state body, municipal body, legal entity or individual who independently or jointly with other persons organize and (or) process personal data, as well as determine the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data.;
Processing of personal data is any action (operation) or a set of actions (operations) with personal data, carried out using automation tools or without their use. Processing of personal data includes, among other things:
collection;
recording;
systematization;
accumulation;
storage;
clarification (update, modification);
extraction;
use;
transfer (dissemination, provision, access);
anonymization.
blocking;
deletion;
destruction;
automated processing of personal data — processing of personal data using computer equipment.
dissemination of personal data - actions aimed at disclosing personal data to an unspecified group of people;
providing personal data is an action aimed at disclosing personal data to a specific person or a specific group of people.;
blocking of personal data is the temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data);
destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed;
Anonymization of personal data is the process of taking actions that make it impossible to determine, without the use of additional information, whether the personal data belongs to a specific personal data subject.
A personal data information system is a set of personal data contained in databases and the information technologies and technical means that ensure their processing.
The Operator’s main rights and obligations.
The Operator has the right to:
independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws.;
to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data provided for in the Law on Personal Data, to maintain the confidentiality of personal data, and to take the necessary measures to ensure the fulfillment of the obligations provided for in the Law on Personal Data;
in the event that the subject of personal data withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal Data.
The Operator is obliged:
to organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
to respond to appeals and requests from subjects of personal data and their legal representatives in accordance with the requirements of the Personal Data Law;
to report to the authorized body responsible for protecting the rights of subjects of personal data (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) the necessary information at the request of this body within 10 working days from the date of receipt of such a request. This period may be extended, but not by more than five working days. To do this, the Operator must send a reasoned notice to Roskomnadzor indicating the reasons for extending the deadline for providing the requested information.
In accordance with the procedure established by the federal executive authority authorized in the field of security, ensure interaction with the state system for detecting, preventing, and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing it about computer incidents that have resulted in the unlawful transfer (provision, distribution, access) of personal data..
The main rights of the subject of personal data. The subject of personal data has the right:
to receive information regarding the processing of their personal data, except in cases provided for by federal laws. The information is provided to the subject of personal data by the Operator in an accessible form, and it must not contain personal data relating to other subjects of personal data, except in cases where there are lawful grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
to require the Operator to clarify their personal data, block it, or delete it if the personal data is incomplete, outdated, inaccurate, obtained illegally, or not necessary for the stated purpose of processing, as well as to take the measures provided for by law to protect their rights.
to give prior consent to the processing of personal data for the purpose of promoting goods, works, and services on the market;
to appeal to Roskomnadzor or in court against unlawful actions or inaction by the Operator in the processing of their personal data..
Monitoring compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing the processing of personal data by the Operator..
Liability for violating the requirements of the legislation of the Russian Federation and the regulatory acts of LLC “NCD” in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.
2. Purposes of personal data processing
Personal data processing is limited to achieving specific, predetermined, and lawful purposes. Processing of personal data that is incompatible with the purposes for which the personal data was collected is not permitted.
Only personal data that meets the purposes for which it is processed is subject to processing.
The Operator processes personal data for the following purposes: carrying out its activities in accordance with the charter of LLC “NCD”, including concluding and executing contracts with counterparties.
Compliance with labor legislation within the framework of labor and other directly related relations, including: assisting employees in finding employment, obtaining education, and advancing in their careers; attracting and selecting candidates for employment with the Operator; ensuring the personal safety of employees; monitoring the quantity and quality of work performed; ensuring the safety of property; maintaining personnel and accounting records; filling out and submitting the required reporting forms to the authorized bodies; organizing the registration of employees in the individual (personalized) accounting systems for mandatory pension insurance and mandatory social insurance; implementing the access control regime.
The processing of employees’ personal data may be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal grounds for processing personal data
The legal basis for processing personal data is the set of regulatory legal acts, in accordance with which and pursuant to which the Operator processes personal data, including:
the Constitution of the Russian Federation;
the Civil Code of the Russian Federation;
the Labour Code of the Russian Federation;
the Tax Code of the Russian Federation;
Federal Law No. 14‑FZ dated 08.02.1998 “On Limited Liability Companies”.
Federal Law No. 402-FZ dated December 6, 2011, “On Accounting”;
Federal Law No. 167-FZ dated December 15, 2001, “On Compulsory Pension Insurance in the Russian Federation”;
other regulatory legal acts regulating relations related to the Operator’s activities.
The legal basis for the processing of personal data also includes:
the charter of LLC “NCD”;
contracts concluded between the Operator and the subjects of personal data;
Consent of personal data subjects to the processing of their personal data.
4. The scope and categories of personal data being processed, and the categories of personal data subjects.
The content and scope of the personal data being processed must correspond to the stated processing purposes provided for in section 2 of this Policy. The personal data being processed must not be excessive in relation to the stated processing purposes..
The operator may process the personal data of the following categories of personal data subjects.
Candidates for employment with the Operator — for the purposes of complying with labor legislation within the framework of labor and other directly related relations, and for implementing the access control regime:
surname, first name, patronymic;
gender;
citizenship;
date and place of birth;
contact details;
information about education, work experience, and qualifications;
other personal data provided by candidates in resumes and cover letters.
Employees and former employees of the Operator — for the purposes of complying with labour legislation within the framework of labour and other directly related relations, and for the purposes of implementing the access control regime:
- surname, first name, patronymic;
gender;
citizenship;
date and place of birth;
image (photo);
passport data;
registration address;
actual residence address;
contact details;
individual taxpayer number;
individual insurance account number (SNILS).
Information about education, qualifications, professional training, and professional development;
marital status, presence of children, family relationships;
information about employment history, including the presence of incentives, awards, and (or) disciplinary penalties;
data on marriage registration;
information about military registration;
information about disability;
information about alimony withholding;
information about income from a previous place of employment;
other personal data provided by employees in accordance with the requirements of labor legislation.
Family members of the Operator’s employees — for the purposes of complying with labour legislation within the framework of employment and other directly related relations:
surname, first name, patronymic;
degree of kinship;
year of birth;
other personal data provided by employees in accordance with the requirements of labour legislation.
Clients and counterparties of the Operator (individuals) — for the purposes of carrying out their activities in accordance with the charter of LLC “NCD” and implementing the access control regime:
last name, first name, patronymic;
date and place of birth;
passport details;
registration address at the place of residence;
contact details;
current position;
individual taxpayer number;
bank account number;
other personal data provided by clients and counterparties (individuals) necessary for concluding and executing contracts.
Representatives (employees) of the Operator’s clients and counterparties (legal entities) — for the purposes of carrying out their activities in accordance with the charter of LLC “NCD” and implementing the access control regime:
- surname, first name, patronymic;
passport data;
contact details;
position held;
other personal data provided by representatives (employees) of clients and counterparties, which are necessary for concluding and executing contracts.
The Operator processes biometric personal data (information that characterizes a person’s physiological and biological characteristics, on the basis of which their identity can be established) in accordance with the legislation of the Russian Federation..
The Operator does not process special categories of personal data related to race, national origin, political views, religious or philosophical beliefs, health status, or intimate life, except in cases provided for by the legislation of the Russian Federation.
5. Procedure and conditions for processing personal data
The Operator processes personal data in accordance with the requirements of the legislation of the Russian Federation.
The processing of personal data is carried out with the consent of the subjects of personal data to process their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
The Operator processes personal data for each purpose of their processing using the following methods:
non‑automated processing of personal data;
automated processing of personal data with or without the transfer of the obtained information via information and telecommunications networks;
Mixed processing of personal data..
The Operator’s employees whose job responsibilities include processing personal data are allowed to process personal data..
Processing of personal data for each processing purpose specified in clause 2.3 of the Policy is carried out by:
obtaining personal data in oral and written form directly from the subjects of personal data;
entering personal data into the Operator’s logs, registers and information systems;
using other methods of processing personal data.
Disclosure to third parties and distribution of personal data without the consent of the data subject is not permitted, unless otherwise provided for by federal law. Consent to the processing of personal data permitted by the data subject for distribution is issued separately from other consents given by the data subject to the processing of their personal data.
The requirements for the content of consent to the processing of personal data permitted by the data subject for distribution are approved by Order of Roskomnadzor dated 24.02.2021 No. 18.
The transfer of personal data to investigative and inquiry bodies, to the Federal Tax Service, the Social Fund of Russia, and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation..
The operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access to it, destruction, modification, blocking, dissemination, and other unauthorized actions, including:
identifies threats to the security of personal data during its processing;
adopts local regulatory acts and other documents regulating relations in the field of processing and protection of personal data.
appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;
creates the necessary conditions for working with personal data;
organizes the accounting of documents containing personal data;
organizes work with information systems in which personal data is processed;
stores personal data under conditions that ensure their preservation and prevent unlawful access to them.
The Operator organizes training for its employees who process personal data..
The Operator stores personal data in a form that allows identifying the subject of the personal data for no longer than required by each purpose of processing personal data, unless the period for storing personal data is established by federal law or a contract.
Personal data on paper is stored by LLC “NCD” for the duration of document retention periods that are stipulated by the legislation on archival affairs in the Russian Federation (Federal Law No. 125‑FZ dated October 22, 2004, “On Archival Affairs in the Russian Federation”; List of Standard Management Archival Documents Generated in the Course of the Activities of State Bodies, Local Self‑Government Bodies and Organizations, with Indicated Retention Periods (approved by Order of Rosarkhiv No. 236 dated December 20, 2019)).
The retention period for personal data processed in information systems is the same as the retention period for personal data on paper media.
The operator stops processing personal data in the following cases:
if a fact of their unlawful processing is detected. The period is within three working days from the date of detection;
the purpose of their processing has been achieved;
the validity period has expired or the consent of the personal data subject to the processing of these data has been revoked, when, under the Law on Personal Data, the processing of this data is permitted only with consent.
Upon achieving the purposes of processing personal data, as well as in the event that the subject of personal data revokes their consent to the processing of such data, the Operator shall cease processing this data, unless:
otherwise provided for in a contract, the party, beneficiary, or guarantor of which is the subject of personal data;
the Operator is not entitled to process the data without the consent of the subject of personal data on the grounds provided for in the Law on Personal Data or other federal laws;
otherwise provided for in another agreement between the Operator and the subject of personal data.
When a subject of personal data contacts the Operator with a request to stop processing personal data within a period not exceeding 10 working days from the date the Operator receives the relevant request, the processing of personal data is stopped, except in cases provided for by the Law on Personal Data. The specified period may be extended, but not by more than five working days. To do this, the Operator must send the subject of personal data a reasoned notification indicating the reasons for extending the period.
When collecting personal data, including through the информационно‑telecommunications network Internet, the recording, systematization, accumulation, storage, clarification (update, modification), and extraction of personal data of citizens of the Russian Federation using databases located outside the Russian Federation are not permitted, except in cases specified in the Personal Data Law.
6. Updating, correcting, deleting, and destroying personal data; responding to requests from data subjects for access to their personal data.
The Operator shall confirm the fact that personal data has been processed, the legal grounds and purposes for processing personal data, as well as other information specified in Part 7 of Article 14 of the Personal Data Law, to the data subject or their representative within 10 business days from the date of the request or receipt of the request from the data subject or their representative. This period may be extended, but not for more than five working days. To do this, the Operator must send the subject of personal data a reasoned notice indicating the reasons for extending the deadline for providing the requested information..
The information provided does not include personal data relating to other subjects of personal data, except in cases where there are lawful grounds for disclosing such personal data..
The request must contain:
the number of the main document удостоверяющего the identity of the subject of personal data or their representative, information about the date of issue of the said document and the issuing authority;
Information confirming the participation of the personal data subject in relations with the Operator (contract number, date of contract conclusion, условное словесное обозначение and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator;
signature of the personal data subject or their representative..
The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
The operator provides the information specified in Part 7 of Article 14 of the Personal Data Law to the subject of personal data or their representative in the form in which the relevant appeal or request was sent, unless otherwise specified in the appeal or request.
If the appeal (request) of the subject of personal data does not contain all the necessary information in accordance with the requirements of the Personal Data Law, or if the subject does not have the right to access the requested information, a reasoned refusal is sent to them.
The right of a personal data subject to access their personal data may be restricted in accordance with Part 8 of Article 14 of the Personal Data Law, including if the personal data subject’s access to their personal data violates the rights and legitimate interests of third parties.
If inaccurate personal data is identified upon the request of the data subject or their representative, or at their request, or at the request of Roskomnadzor, the Operator shall block the personal data relating to that data subject from the moment of such request or receipt of the specified request for the period of verification, provided that blocking the personal data does not violate the rights and legitimate interests of the data subject or third parties.
If the inaccuracy of personal data is confirmed, the Operator, based on the information provided by the data subject or their representative, or by Roskomnadzor, or on other necessary documents, clarifies the personal data within seven working days from the date such information is submitted, and lifts the blocking of the personal data.
If unlawful processing of personal data is detected upon an appeal (request) from the data subject or their representative, or from Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to that data subject from the moment of such an appeal or receipt of the request.
If the Operator, Roskomnadzor, or any other interested party identifies a case of unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator shall:
within 24 hours — notify Roskomnadzor of the incident that has occurred, the suspected causes that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident; and also provide information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident.
Within 72 hours, the Operator notifies Roskomnadzor of the results of the internal investigation into the identified incident and provides information about the persons whose actions caused it (if any).
The procedure for the destruction of personal data by the Operator.
Conditions and deadlines for the destruction of personal data by the Operator:
achievement of the purpose of processing personal data or loss of the need to achieve this purpose — within 30 days;
achievement of the maximum storage periods for documents containing personal data — within 30 days.
The subject of personal data (or their representative) must provide confirmation that the personal data was obtained illegally or is not necessary for the stated purpose of processing — within seven working days;
the subject of personal data may revoke their consent to the processing of their personal data if their retention for the purpose of processing is no longer required — within 30 days.
Upon achieving the purpose of processing personal data, as well as in the event that the subject of personal data withdraws their consent to their processing, the personal data shall be destroyed, unless:
otherwise provided for in a contract, the party, beneficiary, or guarantor of which is the subject of personal data;
the operator is not entitled to carry out processing without the consent of the subject of personal data on the grounds provided for in the Law on Personal Data or other federal laws;
otherwise provided for in another agreement between the Operator and the subject of personal data.
The destruction of personal data is carried out by a commission established by order of the General Director of LLC “NCD”.
The methods for destroying personal data are established in the Operator’s local regulatory acts.