These Regulations on the Procedure for Processing Personal Data of ООО «101 ГРУПП» (hereinafter the Regulations) define the purposes, conditions and procedure for processing personal data and establish general requirements for the security of personal data processed by ООО «101 ГРУПП» (hereinafter the Company), with or without automated means.
This application has been developed taking into account the requirements of Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”.
1. TERMS AND DEFINITIONS
The Regulations use the terms and definitions set out in Article 3 of Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”:
1.1. Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify the personal data.
1.2. Personal data information system means the combination of personal data contained in databases and the information technologies and technical facilities used to process them.
1.3. Depersonalization of personal data means actions that make it impossible to determine, without additional information, whether personal data belong to a specific personal data subject.
1.4. Processing of personal data means any action (operation) or set of actions (operations) performed on personal data, with or without automated means, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, blocking, deletion and destruction of personal data.
1.5. Operator means a state authority, municipal authority, legal entity or individual that, independently or jointly with others, organizes and/or carries out personal data processing and determines its purposes, the personal data to be processed and the actions (operations) performed on those data.
1.6. Personal data means any information relating to a directly or indirectly identified or identifiable individual (personal data subject).
1.7. Dissemination of personal data means actions intended to disclose personal data to an indefinite group of persons.
1.8. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to a foreign state authority, a foreign individual or a foreign legal entity.
1.9. Destruction of personal data means actions that make it impossible to restore the content of personal data in a personal data information system and/or result in the destruction of physical media containing personal data.
1.10. Automatic processing of personal data means processing personal data using computing equipment.
1.11. Provision of personal data means actions intended to disclose personal data to a specific person or a specific group of persons.
2. GENERAL PROVISIONS
2.1. Purposes and scope of the Regulations
The Regulations define the purposes of personal data processing and establish general security requirements for personal data processed by the Company with or without automated means.
Every Company employee who processes personal data must be familiarized with the Regulations against signature. By signing personally, each employee confirms that they have been informed that they process personal data and of the categories of data processed, and that they are familiar with the processing and security requirements of the Regulations and other internal documents governing personal data processing insofar as they relate to their job duties.
2.2. Principles of personal data processing
Personal data must be processed in accordance with the following principles:
- Lawfulness of the purposes and methods of personal data processing and good faith
- Consistency of personal data processing purposes with the purposes defined in advance and declared when collecting personal data, and with the Company's powers
- Consistency of the scope and nature of the personal data processed and the processing methods with the purposes of personal data processing
- Accuracy of personal data, their sufficiency for processing purposes, and prohibition of processing personal data excessive in relation to the purposes declared at collection
- Prohibition of combining databases of personal data information systems established for mutually incompatible purposes.
2.3. Storage of personal data
Personal data must be stored in a form that allows the personal data subject to be identified. Personal data must be stored no longer than required by the processing purposes, unless a storage period is established by federal law or by a contract to which the personal data subject is a party, beneficiary or guarantor. Personal data being processed must be destroyed or depersonalized when the processing purposes have been achieved or when achieving them is no longer necessary, unless otherwise provided by federal law.
2.4. Methods of personal data processing
The Company may process personal data with or without automated means. All protection measures applicable to personal data processing cover both paper and electronic information media.
The Company may perform the following actions when processing personal data:
- Collection
- Recording
- Systematization
- Accumulation
- Storage
- Clarification (updating, modification)
- Retrieval
- Use
- Transfer (dissemination, provision, access)
- Depersonalization
- Blocking
- Deletion
- Destruction.
2.5. Requirement to notify the authorized body for the protection of personal data subjects' rights
The Company must notify the authorized body for the protection of personal data subjects' rights of its processing of personal data in accordance with Article 22 of Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”.
3. PERSONAL DATA SUBJECTS AND CATEGORIES
3.1. Personal data subjects
The Company may process personal data of the following categories of personal data subjects:
- Employees who were or are in an employment relationship with the Company
- Individuals who were or are in contractual or other civil-law relationships with the Company
- Users of the 101 GROUP mobile application (hereinafter the Mobile Application)
- Visitors to the website 101-app.com (hereinafter the website).
It is recommended that the following categories of personal data be distinguished:
- Personal data classified as special categories of personal data under Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”
- Personal data classified as biometric personal data under Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”
- Personal data classified as publicly available or depersonalized personal data under Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”
- Personal data that cannot be classified as special categories of personal data, biometric personal data, publicly available personal data or depersonalized personal data.
The Company's information systems must not process personal data relating to:
- Special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs, health, intimate life or criminal convictions
- Personal data concerning private life, personal data subjects' membership of public associations or their trade union activities.
The personal data specified in clause 3.2.2 of the Regulations may be processed only in cases prescribed by law.
4. PURPOSES OF PERSONAL DATA PROCESSING
The Company has established the following purposes for processing personal data:
4.1. Personal data of Company employees may be processed for the following purposes:
- Organizing employee records
- Maintaining personnel and accounting records
- Assisting employees with employment
- Training
- Career advancement
- Ensuring employees' personal safety
- Monitoring the quantity and quality of work performed
- Ensuring the safekeeping of property
- Opening employees' personal bank accounts for salary payments
- Insurance under voluntary medical insurance programs
- Transferring insurance contributions to non-state pension funds
- Using various benefits under the Labour Code of the Russian Federation, the Tax Code of the Russian Federation, other federal laws, and the Company's charter and regulations.
4.2. Personal data of individuals who were or are in contractual or other civil-law relationships with the Company are processed for the following purposes:
- Generating profit
- Entering into contracts and performing obligations under concluded contracts
- Carrying out the activities provided for in the Company's constituent documents.
4.3. Personal data of Mobile Application users are processed for the following purposes:
- Registration and authorization of Mobile Application users
- Sending users informational and service messages
- Providing information to users by telephone
- Evaluating and analyzing the operation of the Mobile Application
- Improving the operation and functionality of the Mobile Application
- Sending Mobile Application users notifications about new products and services, special offers and various events.
4.4. Personal data of website visitors are processed for the following purposes:
- Communicating with website visitors and sending them notifications, requests and information relating to the operation of the website and services
- Performing agreements with website visitors and processing their requests and applications
- Periodically providing information about the Company's services and activities
- Evaluating and analyzing the operation of the website
- Improving the operation and functionality of the website
- Providing information to website visitors by telephone.
5. SCOPE AND CONTENT OF PERSONAL DATA
For the processing purposes defined in Section 4 of the Regulations, the following scope and content of personal data have been established:
5.1. Scope and content of personal data of Company employees:
- Surname, first name and patronymic
- Date of birth
- Place of birth
- Sex
- Citizenship
- Passport details or details of another identity document (series, number, date of issue and issuing authority)
- Information describing physiological characteristics (facial image)
- Residential address
- Telephone number
- Email address
- Other contact information
- Information on education, qualifications, specialist knowledge and special training
- Information on employment, salary and other income and expenses
- Military registration information
- Information on marital status and children
- Information on compulsory and/or voluntary medical insurance policies
- Taxpayer identification number information
- Employment contract and employment record book
- Copies of orders on hiring, transfers, dismissal, salary increases, bonuses, rewards and disciplinary penalties
- Personal record card in Form Т-2
- Employee applications, explanatory notes and internal memoranda
- Other information necessary to achieve the above purposes and provided for by current labour legislation.
5.2. Scope and content of personal data of individuals who were or are in contractual or other civil-law relationships with the Company:
- Surname, first name and patronymic
- Date of birth
- Place of birth
- Sex
- Citizenship
- Passport details or details of another identity document (series, number, date of issue and issuing authority)
- Information describing physiological characteristics (facial image)
- Taxpayer identification number information
- Residential address
- Telephone number
- Email address
- Other contact information
- Other information necessary to achieve the above purposes and provided for by current labour legislation.
5.3. Scope and content of personal data of Mobile Application users:
- Surname, first name and patronymic
- Telephone number
- Email address
- Depersonalized visitor data processed using Yandex Metrica and Google Analytics services.
5.4. Scope and content of personal data of individuals visiting the website:
- Surname, first name and patronymic
- Telephone number
- Email address
- Depersonalized visitor data processed using Yandex Metrica and Google Analytics services.
6. PERSONAL DATA PROCESSING PERIODS
The following personal data processing periods have been established for the purposes defined in Section 4 of the Regulations:
- For personal data of Company employees: for the duration of the employment contract. The Company processes personal data of former employees for the period established by clause 5 of part 3 of Article 24 of Part One of the Tax Code of the Russian Federation and part 1 of Article 29 of Federal Law No. 402-ФЗ of 06.12.2011 “On Accounting”.
- For personal data of individuals who were or are in contractual or other civil-law relationships with the Company: for the duration of the contracts concluded with them. The Company may process clients' personal data after those contracts expire for the period established by clause 5 of part 3 of Article 24 of Part One of the Tax Code of the Russian Federation and part 1 of Article 29 of Federal Law No. 402-ФЗ of 06.12.2011 “On Accounting”.
- For personal data of Mobile Application users: until the account in the Mobile Application is deleted.
- For personal data of website visitors: until the purpose of personal data processing is achieved.
7. REQUIREMENT FOR CONSENT TO PERSONAL DATA PROCESSING
Personal data of the categories of subjects specified in clause 3.1 of the Regulations may be processed only with the written consent of the personal data subjects.
For each category of personal data subjects defined in clause 3.1 of the Regulations, a personal data processing consent form must be developed and approved by order of the Company's head. The consent form must be developed in accordance with Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”.
8. CONDITIONS FOR PERSONAL DATA PROCESSING
8.1. Confidentiality of personal data
Under Decree No. 188 of the President of the Russian Federation of 06.03.1997 “On Approval of the List of Information of a Confidential Nature”, personal data constitute confidential information.
8.1.1 The Company must document and approve a list of the personal data it processes.
8.1.2. When personal data are processed by the Company and third parties granted access to them, their confidentiality must be ensured, meaning that conditions must be established to prevent dissemination without the personal data subject's consent, except in the following cases:
- Where personal data have been depersonalized
- In respect of publicly available personal data.
8.2. Entrusting personal data processing to a third party
If the Company entrusts another person with personal data processing under a contract, an essential contractual condition must be that person's obligation to maintain the confidentiality and security of personal data during processing.
8.3. Storage and destruction of personal data
Personal data must be stored in a form allowing the personal data subject to be identified, for no longer than required by the processing purposes.
Unless otherwise provided by law, the Company must stop processing and destroy the personal data collected in the following cases, within the periods prescribed by law:
- When processing purposes have been achieved or achieving them is no longer necessary
- At the request of the personal data subject or the authorized body for the protection of personal data subjects' rights, if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the declared processing purpose
- When the personal data subject withdraws consent to processing their personal data, where such consent is required by law
- Where the operator cannot remedy violations committed during personal data processing.
8.4. Personal data processing to promote goods and services
Personal data may be processed to promote goods and services in the market through direct contact with potential consumers by means of communication only with the personal data subject's prior consent, developed and approved in accordance with clause 7.2 of the Regulations.
8.5. Cross-border transfer of personal data
Cross-border transfer of personal data (transfer across the state border of the Russian Federation to a foreign state authority, individual or legal entity) may take place only with the personal data subject's written consent, developed and approved in accordance with clause 7.2 of the Regulations.
Cross-border transfer of personal data may take place without the personal data subject's consent in the following cases:
- Performance of a contract to which the personal data subject is a party
- Protection of the life, health or other vital interests of the personal data subject or other persons where obtaining the personal data subject's written consent is impossible.
8.6. Handling enquiries and requests
The Company must define and document procedures for responding to requests from authorized bodies for the protection of personal data subjects' rights or other supervisory authorities exercising control and supervision in the field of personal data.
9. PERSONAL DATA SECURITY MEASURES
9.1. General provisions
Measures to ensure personal data security form an integral part of the Company's activities.
9.1.1 An organization holding a duly issued licence for activities involving the technical protection of confidential information may be engaged to select and implement methods and means of personal data protection.
9.1.2. The Company must define, document and approve a list of persons who require access to personal data processed in the Company's information systems to perform their official, employment or job duties.
9.1.3. Employees may be included in the list on a role-based basis, according to their position, subject to the following requirements:
- Employee roles must be identified and documented.
- Roles must be assigned to specific persons with responsibility for their performance, and that responsibility must be documented in the job description.
- Procedures for monitoring employees holding a combination of powers (roles) that allows them to gain control over a protected information asset of the Company must be documented and implemented.
- Recruitment procedures affecting information security must be documented and must require the results of checks to be recorded. They must include verification of the authenticity of submitted documents, claimed qualifications, and the accuracy and completeness of biographical information, as well as checks of professional skills and an assessment of professional suitability.
- Procedures must be documented for regular checks of employees' professional skills and assessments of professional suitability, with recorded results, and for unscheduled checks, with recorded results, upon discovery of unusual behaviour, involvement in information security incidents or suspicion of such behaviour or involvement.
- All Company employees must give a written undertaking to maintain confidentiality and comply with corporate ethics rules, including requirements to avoid conflicts of interest.
- When interacting with external organizations and clients, information security requirements must be governed by provisions included in the contracts (agreements) concluded with them.
- Employees' obligation to comply with information security requirements must be included in employment contracts and/or job descriptions.
9.1.4. Company employees may access personal data, and personal data of Company employees may be processed, only for the performance of their job duties.
9.1.5. The Company must define and document the procedure for access by employees and other persons to premises where personal data are processed.
9.1.6. Failure by Company employees to comply with information security requirements must be treated as failure to perform job duties and must result, at a minimum, in disciplinary liability.
9.2. Measures to ensure personal data security during automated processing
The security of personal data processed in personal data information systems is ensured through a personal data protection system that includes organizational measures, information protection tools and the information technologies used in those systems.
9.2.1. The types of threats to every Company personal data information system must be identified.
9.2.2. The Company must identify the types of threats to personal data information systems in accordance with:
- The requirements for protecting personal data processed in personal data information systems approved by Resolution No. 1119 of the Government of the Russian Federation of 01.11.2012.
- The results of identifying the types of threats to personal data information systems must be recorded in an appropriate formal report.
- The following approach is used when classifying automated systems (АБС) as personal data information systems: automated systems whose creation and use include personal data processing as a purpose must be included in the list of information systems in which personal data are processed.
- For each personal data information system, the processing purposes, scope and content of personal data processed, list of actions performed on personal data and processing methods must be defined.
- Roles must be assigned to specific persons with responsibility for their performance, and that responsibility must be documented in the job description.
- The scope and content of personal data, and the list of actions and processing methods, must correspond to the processing purposes.
- When interacting with external organizations and clients, information security requirements must be governed by provisions included in the contracts (agreements) concluded with them.
9.2.3. For personal data processed in the Company's information systems, personal data protection levels must be established and documented.
9.3. Measures to ensure personal data security during processing without automated means
When the Company processes personal data on paper media, particularly when using standard document forms whose information implies or permits the inclusion of personal data, it must comply with the “Regulations on the Specifics of Personal Data Processing without Automated Means” approved by Resolution No. 687 of the Government of the Russian Federation of 15.09.2008.
9.3.1. Personal data processing without automated means must be organized so that, for each personal data category, it is possible to determine the storage locations of the personal data (physical media) and establish a list of persons processing or having access to them.
9.3.2. Personal data (physical media) processed for different purposes must be stored separately.
9.3.3. Physical media must be stored under conditions that ensure the safekeeping of personal data and prevent unauthorized access.
9.3.4. Storage of physical media is permitted subject to conditions that ensure the safekeeping of personal data and prevent unauthorized access.
9.3.5. Company employees processing personal data without automation must be informed that they process personal data without automated means, of the categories of data processed, and of the specific features and Rules governing such processing.
9.3.6. A list of storage locations for personal data processed without automated means must be approved by order of the Company's head.
9.3.7. When using standard document forms whose information implies or permits the inclusion of personal data, the following conditions must be met:
The standard form must contain:
- Information on the purpose of personal data processing
- The Company's name and address
- The personal data subject's surname, first name, patronymic and address
- A list of the actions to be performed on personal data during processing
- A general description of the personal data processing methods used by the Company.
9.3.8. The standard form must include a field in which the personal data subject can indicate their consent to the processing of their personal data.
9.3.9. Physical media containing personal data must be destroyed when the purposes of processing the personal data they contain have been achieved, unless otherwise provided by law (complete, physical and irreversible destruction of the personal data contained on those media). The Company must define and document a procedure for destroying physical media containing personal data.
9.4. Measures to ensure personal data security when storing personal data media
The Company must define and document a procedure for recording and storing physical media containing personal data, establishing:
- Storage locations for personal data media
- Requirements for personal data security when storing their media
- Persons responsible for implementing personal data security requirements
- The procedure for monitoring compliance with personal data security requirements when storing personal data media.
10. PERSON PERFORMING PERSONAL DATA PROTECTION FUNCTIONS
10.1 The person responsible for personal data processing performs the functions of organizing personal data protection in the Company.
10.2. The person responsible for personal data processing is appointed by order of the Company's head.
10.3. The person responsible for personal data processing is appointed by order of the Company's head.
10.4. In their work, the person responsible for personal data processing is guided by the laws and regulations of the Russian Federation on personal data protection, the Regulations and other Company regulations.
10.5. The rights, duties and liability of the person responsible for personal data processing are defined in their job description.
11. MONITORING COMPLIANCE WITH THE REGULATIONS
11.1. Compliance with the requirements of the Regulations is subject to monitoring.
11.2. The list and frequency of monitoring measures are determined by the Plan for Monitoring Personal Data Security, covering both internal monitoring and monitoring involving external independent auditing organizations.
11.3. Monitoring consists of checking compliance with the requirements of information protection regulations and assessing the justification and effectiveness of the measures taken.
11.4. A report is prepared based on the monitoring results.
11.5. Monitoring measures may be carried out by third-party organizations under contract.
11.6. Persons responsible for violating the Regulations are subject to civil, administrative, disciplinary, criminal and other liability provided by law.