Privacy Policy

AGWPrivacy Policy

POLICY OF LIMITED LIABILITY COMPANY «UNITED GLASS PLANTS – MANAGEMENT COMPANY» ON PERSONAL DATA

I. GENERAL PROVISIONS

1. Purpose of the Policy

1.1. This Policy (hereinafter — the Policy) on the processing of personal data at LLC «United Glass Plants – Management Company» (hereinafter — the Company, the Operator) has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006 «On Personal Data» (hereinafter — FZ-152).

1.2. The Policy enters into force from the moment of its approval by the General Director of the Company.

1.3. The Policy is subject to review during periodic analysis by authorized persons of the Company, as well as in cases of changes to the legislation of the Russian Federation in the field of personal data.

1.4. The Policy shall be published on the official website of the Company.

2.2. Purposes of the Policy

2.1. The purpose of the Policy is to ensure the protection of the rights and freedoms of personal data subjects when their personal data are processed by the Company.

3. Basic Terms

3.1. For the purposes of the Policy, the following terms are used:

personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
personal data permitted by the personal data subject for dissemination — personal data to which an unlimited number of persons are granted access by the personal data subject by giving consent to the processing of personal data permitted by the personal data subject for dissemination in the manner provided for by FZ-152;
personal data subject — an individual who is directly or indirectly identified or identifiable through personal data;
operator — a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and (or) carries out the processing of personal data, and also determines the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;
processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data;
automated processing of personal data — processing of personal data using computer technology;
dissemination of personal data — actions aimed at disclosure of personal data to an indefinite number of persons;
provision of personal data — actions aimed at disclosure of personal data to a specific person or a specific group of persons;
blocking of personal data — temporary cessation of personal data processing (except in cases where processing is necessary to clarify personal data);
destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed;
depersonalization of personal data — actions as a result of which it becomes impossible without the use of additional information to determine the ownership of personal data to a specific personal data subject;
personal data information system — a set of personal data contained in databases and information technologies and technical means that ensure their processing;
confidentiality of information — a mandatory requirement for a person who has gained access to certain information not to transfer such information to third parties without the consent of its owner;
cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity; threats to the security of personal data — a set of conditions and factors creating the danger of unauthorized, including accidental, access to personal data, the result of which may be destruction, modification, blocking, copying, provision, dissemination of personal data, as well as other unlawful actions during their processing in the personal data information system;
level of protection of personal data — a comprehensive indicator characterizing the requirements, compliance with which ensures neutralization of certain threats to the security of personal data during their processing in personal data information systems.

3.2. Scope

3.2.1 The provisions of the Policy apply to all relations related to the processing of personal data carried out by the Company:

– using automation tools, including in information and telecommunication networks, or without the use of such tools, if the processing of personal data without the use of such tools corresponds to the nature of actions (operations) performed with personal data using automation tools, that is, allows searching for personal data recorded on a material medium and contained in card indexes or other systematized collections of personal data in accordance with a given algorithm, and (or) access to such personal data;
– without the use of automation tools;
– mixed.

3.2.2. All employees of the Company who process personal data or have access to them shall be guided by the Policy.

3.2.3. All local acts of the Company are developed on the basis of the Policy.

II. PURPOSES OF PERSONAL DATA PROCESSING

4. Personal data are processed by the Company for the following purposes:

Maintaining personnel and accounting records;
Ensuring compliance with labor legislation of the Russian Federation;
Ensuring compliance with tax legislation of the Russian Federation;
Ensuring compliance with pension legislation of the Russian Federation;
Ensuring compliance with healthcare legislation of the Russian Federation;
Preparation, conclusion and performance of civil law contracts;
Recruitment of personnel (applicants) for vacant positions;
Ensuring completion of introductory, production or pre-graduation internships under an agreement with an educational institution;
Ensuring timely and full consideration of oral and written appeals from citizens, as well as authorized bodies;
Creation of publicly available sources of information support (including directories, address books, maintenance of the organization’s official website);
Promotion of goods, works and services on the market through direct contact with a potential consumer by means of communication, sending advertising and information materials, information on medical care provided, notifications, requests and other information;
Carrying out activities provided for by the Charter of the Company;
Calculation and payment of wages and other remuneration, calculation and transfer of taxes and insurance contributions, provision of additional guarantees, compensations and benefits to employees;
Exchange of information between the Company and other organizations, including government authorities and public companies, non-profit organizations and funds for the purposes of industrial, commercial and other interaction, development and implementation of innovative products, production systems and integrated solutions.
Ensuring compliance with the legislation of the Russian Federation on defense capability and security of the Russian Federation, countering terrorism, ensuring economic and environmental security of the Company, and human life safety;
Conflict of interest verification;
Information support for the provision of services via the Internet;
For public interests related to shaping the company’s image in the external market, promoting services and building an HR brand;
Assistance in training and career advancement, ensuring personal safety of employees, monitoring the quantity and quality of work performed, ensuring property safety, arranging business trips, providing corporate and mobile communications, ensuring access control;
Improving service quality and conducting marketing programs and statistical research;
Posting (publishing) photo and video materials on the Internet, including social networks, Internet video channels, TV channels, and paper media (posters, billboards, thematic magazines, etc.)

III. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

5. The following regulations and documents are the grounds for personal data processing by the Company:

Constitution of the Russian Federation;
Tax Code of the Russian Federation;
Labor Code of the Russian Federation;
Civil Code of the Russian Federation;
Law of the Russian Federation No. 2300-1 of February 7, 1992 «On Protection of Consumer Rights»;
Federal Law No. 323-FZ of November 21, 2011 «On the Fundamentals of Health Protection of Citizens in the Russian Federation»;
Federal Law No. 326-FZ of November 29, 2010 «On Mandatory Medical Insurance in the Russian Federation»;
Federal Law No. 223-FZ of July 18, 2011 «On Procurement of Goods, Works and Services by Certain Types of Legal Entities»;
Federal Law No. 152-FZ of July 27, 2006 «On Personal Data»;
Federal Law No. 59-FZ of May 2, 2006 «On the Procedure for Consideration of Appeals from Citizens of the Russian Federation»;
Federal Law No. 402-FZ of December 6, 2011 «On Accounting»;
Federal Law No. 166-FZ of December 15, 2001 «On State Pension Provision in the Russian Federation»;
Federal Law No. 167-FZ of December 15, 2001 «On Mandatory Pension Insurance in the Russian Federation»;
Federal Law No. 27-FZ of April 1, 1996 «On Individual (Personalized) Accounting in the Systems of Mandatory Pension Insurance and Mandatory Social Insurance»;
Federal Law No. 53-FZ of March 28, 1998 «On Military Duty and Military Service»;
Federal Law No. 98-FZ of July 29, 2004 «On Trade Secrets»;
Charter of the Company;
Consent to personal data processing;
License for the right to carry out medical activities.
Civil law contracts;
Order of the Federal Archival Agency No. 236 of December 20, 2019 «On Approval of the List of Standard Management Archival Documents Generated in the Course of Activities of State Bodies, Local Government Bodies and Organizations, with Indication of Their Retention Periods»;
Other federal and departmental regulations and local acts of the Company.

5.1. In cases not directly provided for by the legislation of the Russian Federation, but corresponding to the powers of the Company, personal data processing is carried out with the consent of the personal data subject to the processing of his/her personal data.

5.2. Personal data processing is terminated upon reorganization or liquidation of the Company.

IV. SCOPE AND CATEGORIES OF PROCESSED PERSONAL DATA, CATEGORIES OF PERSONAL DATA SUBJECTS

6. In accordance with the purposes of personal data processing specified in Section II of the Policy, the Company processes personal data in relation to the following categories of persons:

Employees;
Relatives of employees;
Former employees;
Counterparties;
Representatives of counterparties;
Clients;
Applicants;
Pupils;
Students;
Persons who have submitted appeals;
Website visitors;

6.1. For the purposes of maintaining personnel and accounting records in relation to employees, relatives of employees and former employees, the following personal data are processed:

surname, first name, patronymic (if available), as well as previous surname, first name, patronymic (if available), date and place of their change (in case of change); gender; date (day, month, year) and place of birth; citizenship information; type, series, number of identity document, name of the issuing authority, date of issue; insurance number of an individual personal account (SNILS); taxpayer identification number (INN); address and date of registration at place of residence (place of stay), actual residence address; contact phone number, email address and (or) information about other means of communication; details of certificates of state registration of civil status acts and information contained therein; information on marital status and family composition (degree of kinship, surnames, first names, patronymics (if available), dates (day, month, year) and places of birth); information on education and (or) qualification or availability of special knowledge (including name of educational and (or) other organization, year of graduation, education level, qualification, details of education document); information on foreign language proficiency; information on military duty, military registration and details of military registration documents (series, number, date of issue of the document, name of the issuing authority); information on employment, as well as information on previous places of work, periods and length of service; information contained in documents granting the right to stay and work in the territory of the Russian Federation (for foreign citizens staying in the Russian Federation); information contained in a temporary residence permit, temporary residence permit for educational purposes (for foreign citizens temporarily residing in the Russian Federation), residence permit (for foreign citizens permanently residing in the Russian Federation), certificate of asylum, temporary certificate of a stateless person; income information, obligations under enforcement documents; bank account numbers; health status information (for certain categories of applicants); information on the presence (absence) of a criminal record and (or) the fact of criminal prosecution or termination of criminal prosecution on rehabilitative grounds (for certain categories of employees); other personal data contained in documents the submission of which is provided for by the legislation of the Russian Federation, including audio and video recording files of security control systems for facilities and personnel at facilities; health status information related to the ability to perform labor functions; data of a mandatory health insurance policy; data of a voluntary health insurance policy; information on social benefits; information on pensions on preferential terms due to old age (by age); facial image data; information on advanced training; identification details of a sick leave certificate.

6.2. For the purposes of compliance with labor legislation of the Russian Federation in relation to employees, relatives of employees and former employees, the following personal data are processed:

surname, first name, patronymic (if available), as well as previous surname, first name, patronymic (if available), date and place of their change (in case of change); gender; date (day, month, year) and place of birth; citizenship information; type, series, number of identity document, name of the issuing authority, date of issue; insurance number of an individual personal account (SNILS); taxpayer identification number (INN); address and date of registration at place of residence (place of stay), actual residence address; contact phone number, email address and (or) information about other means of communication; details of certificates of state registration of civil status acts and information contained therein; information on marital status and family composition (degree of kinship, surnames, first names, patronymics (if available), dates (day, month, year) and places of birth); information on education and (or) qualification or availability of special knowledge (including name of educational and (or) other organization, year of graduation, education level, qualification, details of education document); information on foreign language proficiency; information on military duty, military registration and details of military registration documents (series, number, date of issue of the document, name of the issuing authority); information on employment, as well as information on previous places of work, periods and length of service; information contained in documents granting the right to stay and work in the territory of the Russian Federation (for foreign citizens staying in the Russian Federation); information contained in a temporary residence permit, temporary residence permit for educational purposes (for foreign citizens temporarily residing in the Russian Federation), residence permit (for foreign citizens permanently residing in the Russian Federation), certificate of asylum, temporary certificate of a stateless person; income information, obligations under enforcement documents; bank account numbers; health status information (for certain categories of employees); information on the presence (absence) of a criminal record and (or) the fact of criminal prosecution or termination of criminal prosecution on rehabilitative grounds (for certain categories of employees); other personal data contained in documents the submission of which is provided for by the legislation of the Russian Federation, including audio and video recording files of security control systems for facilities and personnel at facilities; other personal data that the employee wished to provide about himself/herself and the processing of which corresponds to the purpose of processing; health status information related to the ability to perform labor functions.

6.3. For the purposes of compliance with tax legislation in relation to employees, counterparties, representatives of counterparties, legal representatives and patients, the following personal data are processed:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; income; gender; type, series, number of identity document, name of the issuing authority, date of issue; insurance number of an individual personal account (SNILS); taxpayer identification number (INN); address and date of registration at place of residence (place of stay), actual residence address; contact phone number, email address and (or) information about other means of communication; bank account number; position; information on family composition; information on social benefits; information on the organization that provided medical services; type of medical care provided; fact of a citizen’s request for medical care; bank account number.

6.4. For the purposes of compliance with pension legislation in relation to employees and patients, the following personal data are processed:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; citizenship; income information; gender; type, series, number of identity document, name of the issuing authority, date of issue; insurance number of an individual personal account (SNILS); address and date of registration at place of residence (place of stay), actual residence address; contact phone number, email address and (or) information about other means of communication; place of work, position; information on family composition; information on social benefits; information on the organization that provided medical services; type of medical care provided; fact of a citizen’s request for medical care; health status information.

6.5. For the purposes of concluding civil law contracts in relation to employees, counterparties and representatives of counterparties, the following personal data are processed:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; citizenship; income information; gender; type, series, number of identity document, name of the issuing authority, date of issue; insurance number of an individual personal account (SNILS); taxpayer identification number (INN); address and date of registration at place of residence (place of stay), actual residence address; contact phone number, email address and (or) information about other means of communication; bank account number.

6.6. For the purposes of recruiting personnel (applicants) for vacant positions of the Company in relation to applicants, the following personal data are processed:

surname, first name, patronymic (if available), as well as previous surname, first name, patronymic (if available), date and place of their change (in case of change); gender; date (day, month, year) and place of birth; citizenship information; type, series, number of identity document, name of the issuing authority, date of issue; insurance number of an individual personal account (SNILS); taxpayer identification number (INN); address and date of registration at place of residence (place of stay), actual residence address; contact phone number, email address and (or) information about other means of communication; details of certificates of state registration of civil status acts and information contained therein; information on marital status and family composition (degree of kinship, surnames, first names, patronymics (if available), dates (day, month, year) and places of birth); information on education and (or) qualification or availability of special knowledge (including name of educational and (or) other organization, year of graduation, education level, qualification, details of education document); information on foreign language proficiency; information on military duty, military registration and details of military registration documents (series, number, date of issue of the document, name of the issuing authority); information on employment, as well as information on previous places of work, periods and length of service; information contained in documents granting the right to stay and work in the territory of the Russian Federation (for foreign citizens staying in the Russian Federation); information contained in a temporary residence permit, temporary residence permit for educational purposes (for foreign citizens temporarily residing in the Russian Federation), residence permit (for foreign citizens permanently residing in the Russian Federation), certificate of asylum, temporary certificate of a stateless person; income information, obligations under enforcement documents; bank account numbers; health status information (for certain categories of applicants); information on the presence (absence) of a criminal record and (or) the fact of criminal prosecution or termination of criminal prosecution on rehabilitative grounds (for certain categories of employees); other personal data contained in documents the submission of which is provided for by the legislation of the Russian Federation, including audio and video recording files of security control systems for facilities and personnel at facilities; other personal data that the applicant wished to provide about himself/herself; health status information related to the ability to perform labor functions.

6.7. For the purposes of completing introductory, production or pre-graduation internships in relation to employees, students and pupils, the following personal data are processed:

6.8. For the purposes of creating publicly available sources of information support (including directories, address books, maintenance of the official website of the Company), shaping the company’s image in the external market and building an HR brand in relation to employees, the following personal data are processed:

surname, first name, patronymic (if available); email address; phone number; position; length of service; education information; year of birth; accreditation information; information on degree awarded; information on state awards, other awards, incentives and distinctions; information on scientific and practical activities; facial image.

6.9. For the purposes of promoting goods, works and services on the market through direct contact with a potential consumer by means of communication, sending advertising and information materials, information on medical care provided, notifications, requests and other information, as well as posting photo, video and audio materials on the Internet, TV channels and printed products (brochures, catalogs, booklets, etc.), ensuring the provision of services on the Internet, improving service quality, and conducting marketing and other strategic research in relation to patients and legal representatives, the following personal data are processed:

surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; citizenship; income information; gender; type, series, number of identity document, name of the issuing authority, date of issue; insurance number of an individual personal account (SNILS); taxpayer identification number (INN); address and date of registration at place of residence (place of stay), actual residence address; contact phone number, email address and (or) information about other means of communication; bank account number; position; information on concluded contracts and results of their performance; bank account number; results of control of volumes, deadlines, quality and conditions of medical care provided; facial image.

V. PROCEDURE AND CONDITIONS FOR PERSONAL DATA PROCESSING

7. Principles of personal data processing.

7.1. Personal data are processed by the Company in accordance with the following principles:

personal data are processed on a lawful and fair basis;
personal data processing is limited to achieving specific, predetermined and lawful purposes; processing of personal data incompatible with the purposes of personal data collection is not permitted;
merging databases containing personal data processed for incompatible purposes is not permitted;
only personal data that meet the purposes of their processing are subject to processing;
the content and scope of processed personal data correspond to the stated purposes of processing; processed personal data are not excessive in relation to the stated purposes of their processing;
when processing personal data, accuracy, sufficiency and, where necessary, relevance of personal data in relation to the purposes of personal data processing are ensured; the Company takes necessary measures or ensures their adoption to delete or clarify incomplete or inaccurate data;
personal data are stored in a form that allows identification of the personal data subject for no longer than required by the purposes of personal data processing, if the retention period is not established by federal law or a contract to which the personal data subject is a party, beneficiary or guarantor; processed personal data are subject to destruction or depersonalization upon achievement of processing purposes or loss of the need to achieve these purposes, unless otherwise provided by federal law.

8. Conditions for personal data processing.

Conditions for personal data processing other than obtaining the consent of the personal data subject to the processing of his/her personal data are alternative.

8.1. Conditions for processing special categories of personal data

Special categories of personal data are processed by the Company subject to the following conditions:

processing of personal data is carried out in accordance with the legislation on state social assistance, labor legislation, and pension legislation of the Russian Federation;
the subject of personal data has given consent in writing to the processing of his personal data;
processing of personal data is necessary for the execution of an agreement to which the subject of personal data is a party or a beneficiary or guarantor, as well as for concluding an agreement on the initiative of the subject of personal data or an agreement under which the subject of personal data will be a beneficiary or guarantor;
the processing of personal data is carried out for medical and preventive purposes, in order to establish a medical diagnosis, provide medical and medical and social services, on the condition that the processing of personal data is carried out by a person professionally engaged in medical activities and obliged in accordance with the legislation of the Russian Federation to maintain medical confidentiality.

8.2. Conditions for processing biometric personal data

Information that characterizes the physiological and biological characteristics of a person, and on the basis of which one can establish his identity (biometric personal data) and which is used by the Company to establish the identity of the subject of personal data, is not processed by the Company with the exception of the image of the face.

8.3. Conditions for processing other categories of personal data.

The processing of other categories of personal data is carried out by the Company in compliance with the following conditions.

the processing of personal data is necessary to achieve the goals provided for by international treaties of the Russian Federation or the law, to implement and fulfill the functions, powers and responsibilities assigned to the Company by the legislation of the Russian Federation;
processing of personal data is carried out with the consent of the subject of personal data to the processing of his personal data;
the processing of personal data is necessary for the execution of an agreement to which the subject of personal data is a party or a beneficiary or guarantor, as well as for concluding an agreement on the initiative of the subject of personal data or an agreement under which the subject of personal data will be a beneficiary or guarantor.

8.4. Entrustment of personal data processing.

8.4.1. The Company has the right to entrust the processing of personal data to another person with the consent of the subject of personal data, unless otherwise provided by federal law.

8.4.2. The Company has the right to entrust the processing of personal data of patients for the purpose of exchanging information with medical organizations, including those posted in medical information systems, for the purpose of providing medical care, including transfer to insurance organizations within the framework of voluntary medical insurance, transfer of information on the results of laboratory, clinical and other studies in organizations established by additional local acts of the Company and on the basis of an order.

8.4.3. The person processing personal data on behalf of the Company complies with the principles and rules for processing personal data provided for in the Policy. The Company’s order defines a list of actions (operations) with personal data that will be performed by the person processing personal data, the methods and purposes of processing, establishes the obligation of such a person to maintain the confidentiality of personal data and ensure the security of personal data during their processing, and also specifies requirements for the protection of processed personal data.

When entrusting the processing of personal data to another person, the Company bears responsibility to the subject of personal data for the actions of said person. The person processing personal data on behalf of the Company is responsible to the Company.

8.5. Transfer of personal data.

The Company has the right to transfer personal data to authorized bodies on the grounds provided for by the current legislation of the Russian Federation.

8.6. Confidentiality of personal data.

Company employees who have access to personal data do not disclose or distribute personal data to third parties without the consent of the subject of personal data, unless otherwise provided by federal law.

8.7. Publicly available sources of personal data.

8.7.1 For the purpose of information support, the Company creates publicly available sources of personal data. Personal data is included in publicly available sources on the basis of the consent of the subject of personal data to include personal data in publicly available sources or for the purpose of fulfilling the functions, powers and responsibilities assigned by the legislation of the Russian Federation to federal executive authorities, executive authorities of constituent entities of the Russian Federation, local self-government bodies. Information about the subject of personal data is excluded from publicly available sources of personal data at the request of the subject of personal data or by decision of a court or other authorized government bodies.

8.7.2. Public sources of personal data include the information named in clause 6.8 of the Policy:

8.8. Consent of the subject of personal data to the processing of his personal data.

8.8.1. If it is necessary to ensure the conditions for processing the subject’s personal data, the consent of the subject of personal data to the processing of his personal data may be provided.

8.8.2. The subject of personal data decides to provide his personal data and consents to their processing freely, of his own free will and in his own interest. Consent to the processing of personal data must be specific, informed and conscious. Consent to the processing of personal data can be given by the subject of personal data or his representative in any form that allows confirmation of the fact of its receipt, unless otherwise provided by current legislation. If consent to the processing of personal data is received from a representative of the subject of personal data, the authority of this representative to give consent on behalf of the subject of personal data is verified by the Company.

8.8.3. Consent to the processing of personal data may be withdrawn by the subject of personal data. If the subject of personal data withdraws consent to the processing of personal data, the Company has the right to continue processing personal data without the consent of the subject of personal data if alternative conditions for processing personal data are met.

8.8.4. The obligation to provide proof of obtaining the consent of the subject of personal data to the processing of his personal data or proof of compliance with alternative conditions for processing personal data rests with the Company.

8.8.5. In cases provided for by federal law, the processing of personal data is carried out only with the written consent of the subject of personal data. Consent in the form of an electronic document signed in accordance with federal law with a qualified electronic signature (QES or UQES) is equivalent to consent containing the personal data subject’s handwritten signature in writing on paper. The written consent of the personal data subject to the processing of his personal data must include:

last name, first name, patronymic, address of the subject of personal data, number of the main document proving his identity, information about the date of issue of the specified document and the issuing authority;
last name, first name, patronymic, address of the representative of the personal data subject, number of the main document proving his identity, information about the date of issue of the specified document and the issuing authority, details of the power of attorney or other document confirming the authority of this representative (upon obtaining consent from the representative of the personal data subject);
Operator details;
purpose of processing personal data;
list of personal data for the processing of which the consent of the subject of personal data is given;
name and/or other identifiers of the person processing personal data on behalf of the Company, in the case of entrusting processing to such a person;
a list of actions with personal data for which consent is given;
the period during which the consent of the subject of personal data is valid, as well as the method of its withdrawal, unless otherwise established by federal law;
signature of the subject of personal data;

8.8.6. In case of incapacity of the subject of personal data, consent to the processing of his personal data is given by the legal representative of the subject

8.8.7. In the event of the death of the subject of personal data, consent to the processing of his personal data is given by the heirs of the subject of personal data, if such consent was not given by the subject of personal data during his lifetime.

8.8.8. Personal data may be received by the Company from a person who is not the subject of personal data, subject to the Company providing confirmation of the availability of alternative conditions for processing the information.

8.9. The Company does not carry out cross-border transfer of personal data.

8.10. Features of the processing of personal data authorized by the subject of personal data for distribution.

8.10.1. The processing of personal data authorized by the subject of personal data for distribution is carried out on the basis of the appropriate consent of the subject of personal data.

8.10.2. Consent to the processing of personal data authorized by the subject of personal data for distribution is issued separately from other consents of the subject of personal data to the processing of personal data.

8.10.3. The consent contains a list of personal data for each category of personal data specified in the consent to the processing of personal data authorized by the subject of personal data for distribution.

8.10.4. Consent to the processing of personal data authorized by the subject of personal data for distribution is provided directly to the Company.

8.10.5. Silence or inaction of the subject of personal data is not considered consent to the processing of personal data authorized by the subject of personal data for distribution.

8.10.6. In consent to the processing of personal data authorized by the subject of personal data for distribution, the subject of personal data has the right to establish prohibitions on the transfer (except for providing access) of this personal data to the Company to an unlimited number of persons, as well as prohibitions on the processing or conditions for processing (except for gaining access) of this personal data by an unlimited number of persons. The refusal of the Company to establish by the subject of personal data the prohibitions and conditions provided for in Article 10.1 of FZ-152 is not permitted.

8.10.7. The prohibitions established by the subject of personal data on the transfer (except for providing access), as well as on the processing or conditions for processing (except for gaining access) of personal data authorized by the subject of personal data for distribution, do not apply to cases of processing personal data in state, public and other public interests determined by the legislation of the Russian Federation.

8.10.8. The transfer (distribution, provision, access) of personal data authorized by the subject of personal data for distribution must be stopped at any time at the request of the subject of personal data. This requirement must include identification and contact information of the subject of personal data, as well as a list of personal data, the processing of which is subject to termination. The personal data specified in this requirement can only be processed by the operator to whom it is sent. The consent of the subject of personal data to the processing of personal data authorized by the subject of personal data for distribution is terminated from the moment the relevant request is considered by the Company, but no later than 3 business days from the date of receipt of the request.

8.10.9. The requirements specified above do not apply in the case of processing personal data for the purposes of fulfilling the functions, powers and responsibilities assigned by the legislation of the Russian Federation to federal executive authorities, executive authorities of constituent entities of the Russian Federation, and local government bodies.

9. Processing of personal data carried out without the use of automation tools.

9.1. The processing of personal data contained in the personal data information system or extracted from such a system is considered to be carried out without the use of automation tools (non-automated), if such actions with personal data, such as the use, clarification, distribution, destruction of personal data in relation to each of the subjects of personal data, are carried out with the direct participation of a person.

9.1.1. Personal data, when processed without the use of automation tools, is separated from other information, in particular by recording it on separate tangible personal data media, in special sections or in the fields of forms (forms).

9.1.2. When recording personal data on tangible media, it is not permitted to record personal data on one material medium, the purposes of which are obviously incompatible for processing. To process various categories of personal data, carried out without the use of automation tools, a separate material medium is used for each category of personal data.

9.1.3. Persons processing personal data without the use of automation tools (including employees of the Company or persons carrying out such processing under an agreement with the Company) are informed about the fact of their processing of personal data, the processing of which is carried out by the Company without the use of automation tools, the categories of processed personal data, as well as the features and rules for such processing established by regulatory legal acts of federal executive authorities, executive authorities of constituent entities of the Russian Federation, as well as local legal acts of the Company.

9.1.4. When using standard forms of documents, the nature of the information in which suggests or allows the inclusion of personal data (hereinafter referred to as the standard form), the following conditions are met:

the standard form or related documents (instructions for filling it out, cards, registers and journals) contain information about the purpose of processing personal data, carried out without the use of automation tools, the name (title) and address of the Operator, the surname, first name, patronymic and address of the subject of personal data, the source of obtaining personal data, the terms of processing personal data, a list of actions with personal data that will be performed in the process of processing, a general description of the methods of processing personal data used by the Company;
the standard form provides a field in which the subject of personal data can mark his consent to the processing of personal data carried out without the use of automation tools – if it is necessary to obtain written consent to the processing of personal data;
the standard form is drawn up in such a way that each of the subjects of personal data contained in the document has the opportunity to familiarize himself with his personal data contained in the document without violating the rights and legitimate interests of other subjects of personal data;
The standard form excludes the combination of fields intended for entering personal data, the purposes of processing of which are obviously incompatible.

9.1.5. If the purposes of processing personal data recorded on one material medium are incompatible, if the material medium does not allow the processing of personal data separately from other personal data recorded on the same medium, measures are taken to ensure separate processing of personal data, in particular:

if it is necessary to use or distribute certain personal data separately from other personal data located on the same material medium, the personal data that is subject to distribution or use is copied in ways that exclude simultaneous copying of personal data that is not subject to distribution and use, and a copy of the personal data is used (distributed);
if it is necessary to destroy or block part of the personal data, the material medium is destroyed or blocked with preliminary copying of information that is not subject to destruction or blocking, in a manner that precludes simultaneous copying of personal data subject to destruction or blocking.

9.1.6. Destruction of personal data, if permitted by a tangible medium, can be carried out in a way that excludes further processing of this personal data while maintaining the possibility of processing other data recorded on a tangible medium (deletion, erasure). These rules also apply if it is necessary to ensure separate processing of personal data recorded on one material medium and information that is not personal data.

9.1.7. Clarification of personal data when processing them without the use of automation tools is carried out by updating or changing the data on a tangible medium, and if this is not allowed by the technical features of the material medium, by recording information on the changes made to them on the same material medium, or by producing a new material medium with updated personal data.

9.2. Measures to ensure the security of personal data during processing carried out without the use of automation tools.

9.2.1. The processing of personal data, carried out without the use of automation tools, is carried out in such a way that for each category of personal data it is possible to determine the storage locations of personal data (tangible media) and establish a list of persons processing personal data or having access to it.

9.2.2. Separate storage of personal data (tangible media) is ensured, the processing of which is carried out for various purposes.

9.2.3. When storing material media, conditions are observed that ensure the safety of personal data and exclude unauthorized access to it. The list of measures necessary to ensure such conditions, the procedure for their adoption, as well as the list of persons responsible for the implementation of these measures are established by the Company.

10. Processing of metric data

10.1. General provisions

10.1.1. On the Company’s website https://agwgroup.ru/ the following web analytics tools are used: Yandex.Metrica (Yandex LLC, 119021, Moscow, Lev Tolstoy St., 16). Web analytics tools are domestic and are used to analyze the use of the Company’s website and improve its performance. To maintain the confidentiality of personal data, the terms of use of the Yandex.Metrica service prohibit the transfer of identification information, and therefore information collected using cookies cannot identify the subject of personal data.

10.1.2. The processing of cookies by the Operator is carried out in a generalized form and is never correlated with personal information of users.

10.1.3. A warning is displayed on the Company’s website informing users about the processing of metric data.

10.1.4. When visiting the site, the user gives consent to the Operator to process the specified data using metric services to analyze use, measure and improve the performance level of the Operator’s site. The consent is valid from the moment it is provided and during the entire period of use of the site by the user.

10.1.5. If you refuse to process cookies, the user must stop using the Operator’s website or disable the use of cookies in the browser settings, and some functions of the Operator’s website may become unavailable.

10.1.6 The site is located at the facilities of Adminvps LLC, address: 115280, Moscow st. Leninskaya Sloboda, 19

VI. UPDATE, CORRECTION, REMOVAL AND DESTRUCTION OF PERSONAL DATA, RESPONSES TO REQUESTS OF SUBJECTS FOR ACCESS TO PERSONAL DATA

11. Rights of personal data subjects

11.1. The right of the subject of personal data to access his personal data.

The subject of personal data has the right to receive information (hereinafter referred to as the information requested by the subject) regarding the processing of his personal data, including containing:

confirmation of the fact of processing of personal data by the Company;
legal grounds and purposes of processing personal data;
methods used by the Company for processing personal data;
name and location of the Company, information about persons (except for employees of the Company) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Company or on the basis of federal law;
processed personal data related to the relevant subject of personal data, the source of their receipt, unless a different procedure for the presentation of such data is provided for by federal law;
terms of processing of personal data, including periods of their storage;
the procedure for the exercise by the subject of personal data of the rights provided for by Federal Law No. 152;
information about completed or intended cross-border data transfers;
name or surname, first name, patronymic and address of the person processing personal data on behalf of the Company, if the processing has been or will be assigned to such a person;
other information provided for by the legislation of the Russian Federation.

11.1.1. The subject of personal data has the right to receive the information requested by the subject, except for the following cases:

the processing of personal data, including personal data obtained as a result of operational search, counterintelligence and intelligence activities, is carried out for the purposes of national defense, state security and law enforcement;
the processing of personal data is carried out by authorities that detained the subject of personal data on suspicion of committing a crime, or brought charges against the subject of personal data in a criminal case, or applied a preventive measure to the subject of personal data before filing charges, with the exception of cases provided for by the criminal procedural legislation of the Russian Federation, if familiarization of the suspect or accused with such personal data is allowed;
processing of personal data is carried out in accordance with the legislation on combating the legalization (laundering) of proceeds from crime and the financing of terrorism;
access of the personal data subject to his personal data violates the rights and legitimate interests of third parties;
the processing of personal data is carried out in cases provided for by the legislation of the Russian Federation on transport security, in order to ensure the sustainable and safe functioning of the transport complex, protect the interests of the individual, society and the state in the field of the transport complex from acts of illegal interference.

11.1.2. The subject of personal data has the right to demand from the Company clarification of his personal data, blocking or destruction of it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as take measures provided by law to protect his rights.

11.1.3. The information requested by the subject must be provided to the subject of personal data by the Company in an accessible form, and it should not contain personal data relating to other subjects of personal data, unless there are legal grounds for the disclosure of such personal data.

11.1.4. The requested information is provided by the Company to the subject of personal data or his representative upon application or upon receipt of a request from the subject of personal data or his representative. The request must contain the number of the main document identifying the subject of personal data or his representative, information about the date of issue of the specified document and the issuing authority, information confirming the participation of the subject of personal data in relations with the Company (agreement number, date of conclusion of the contract, name of the agreement and (or) other information), or information otherwise confirming the fact of processing personal data by the Company, the signature of the subject of personal data or his representative (hereinafter referred to as the information necessary for the request). The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

11.1.5. If the information requested by the subject, as well as the personal data being processed, was provided for familiarization to the subject of personal data at his request, the subject of personal data has the right to contact the Company again or send a repeated request in order to receive the information requested by the subject and familiarize himself with such personal data no earlier than ten days after the initial request or sending the initial request, unless a shorter period is established by current legislation or a contract to which the personal data subject is a party, beneficiary or guarantor.

11.1.6. The subject of personal data has the right to contact the Company again or send a repeated request in order to receive the information requested by the subject, as well as in order to familiarize himself with the processed personal data before the expiration of the normalized request period in the event that such information and (or) the processed personal data were not provided to him for review in full based on the results of consideration of the initial appeal. A repeated request, along with the information necessary for the request, must contain a justification for sending a repeated request.

11.2. The Company has the right to refuse to fulfill a repeated request by a personal data subject that does not comply with the conditions of the repeated request. Such refusal must be motivated.

12. Rights of personal data subjects when processing their personal data in order to promote goods, works, and services on the market.

Processing of personal data for the purpose of promoting goods, works, services on the market by making direct contacts with potential consumers using communication means. Processing of personal data for the purpose of promoting goods, works, and services on the market by making direct contacts with potential consumers via communication means is carried out only with the prior consent of the subject of personal data. The specified processing of personal data is recognized as carried out without the prior consent of the subject of personal data, unless the Company proves that such consent has been obtained. The Company undertakes to immediately stop, at the request of the personal data subject, the specified processing of his personal data.

12.1. Rights of personal data subjects when making decisions based solely on automated processing of their personal data.

12.1.1. The Company does not make decisions based solely on automated processing of personal data that give rise to legal consequences in relation to the subject of personal data or otherwise affect his rights and legitimate interests.

12.1.2. In the event of a possible or suspected violation of the rights of the subject of personal data by the Company, the subject of personal data has the right to appeal such actions or decisions of the Company in the manner prescribed by law.

13. Responsibilities of the Operator

13.1. When collecting personal data, the Company provides the subject of personal data, at his request, with the requested information regarding the processing of his personal data. If the provision of personal data is mandatory in accordance with federal law, the Company explains to the subject of personal data the legal consequences of refusal to provide his personal data.

13.2. If personal data is not received from the subject of personal data, the Company, before processing such personal data, provides the subject of personal data with the following information:

name or surname, first name, patronymic and address of the Operator or the Operator’s representative;
the purpose of processing personal data and its legal basis;
intended users of personal data;
the rights of the subject of personal data established by Federal Law No. 152;
sources of obtaining personal data.

13.3. The Company does not provide the subject with information provided when receiving personal data not from the subject of personal data in cases where:

the subject of personal data is notified of the processing of his personal data by the Company;
personal data was obtained by the Company on the basis of federal law or in connection with the execution of an agreement to which the subject of personal data is a party or beneficiary or guarantor;
the processing of personal data authorized by the subject of personal data for distribution is carried out in compliance with the prohibitions and conditions provided for by Federal Law No. 152;
The Company processes personal data for statistical or other research purposes, unless the rights and legitimate interests of the subject of personal data are violated;
Providing the subject of personal data with information provided when receiving personal data not from the subject of personal data violates the rights and legitimate interests of third parties.

14. Measures aimed at ensuring the Company fulfills its obligations:

14.1. The Company takes measures necessary and sufficient to ensure the fulfillment of its obligations. The Company independently determines the composition and list of measures necessary and sufficient to ensure the fulfillment of its obligations, taking into account the requirements of current legislation. Such measures include:

appointment of a person responsible for organizing the processing of personal data; development and approval of the Policy, local acts on the processing of personal data, as well as local acts establishing procedures aimed at preventing and identifying violations of the legislation of the Russian Federation, eliminating the consequences of such violations;
application of legal, organizational and technical measures to ensure the security of personal data
implementation of internal control and (or) audit of compliance of personal data processing with the requirements for the protection of personal data, Policy, and local regulations of the Company;
assessment of the harm that may be caused to subjects of personal data in the event of a violation of Federal Law No. 152, the relationship between the said harm and the measures taken by the Company aimed at ensuring the fulfillment of the obligations provided for by the Federal Law «On Personal Data»;
familiarization of the Company’s employees directly involved in the processing of personal data with the provisions of the legislation of the Russian Federation on personal data, including requirements for the protection of personal data, documents, Policies, local regulations on the processing of personal data, and (or) training of these employees.

15. Measures to ensure the security of personal data during their processing

15.1. When processing personal data, the Company takes the necessary legal, organizational and technical measures or ensures their adoption to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data.

15.2. Ensuring the security of personal data is achieved by:

identifying threats to the security of personal data during their processing in personal data information systems;
application of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems necessary to fulfill the requirements for the protection of personal data, the implementation of which ensures the levels of personal data security established by the legislation of the Russian Federation;
application of information security means that have passed the compliance assessment procedure in accordance with the established procedure;
assessing the effectiveness of measures taken to ensure the security of personal data before putting into operation the personal data information system;
accounting of computer storage media of personal data;
detecting facts of unauthorized access to personal data and taking measures;
restoration of personal data modified or destroyed due to unauthorized access to it;
establishing rules for access to personal data processed in the personal data information system, as well as ensuring registration and accounting of all actions performed with personal data in the personal data information system;
control over the measures taken to ensure the security of personal data and the level of security of personal data information systems.

15.3. The use and storage of biometric personal data outside personal data information systems can only be carried out on such tangible media and using such storage technology that protect this data from unauthorized or accidental access to it, its destruction, modification, blocking, copying, provision, distribution.

15.4. The Operator’s responsibilities when a personal data subject contacts him or upon receiving a request from a personal data subject or his representative, as well as an authorized body for the protection of the rights of personal data subjects:

informs in the prescribed manner to the subject of personal data or his representative information about the availability of personal data relating to the corresponding subject of personal data, and also provides the opportunity to familiarize himself with this and personal data upon application by the subject of personal data or his representative or within ten days from the date of receipt of the request of the subject of personal data or his representative.
sends a reasoned written response to the subject of personal data or his representative in the event of a refusal to provide information about the availability of personal data about the corresponding subject of personal data or personal data upon their request or upon receipt of a request from the subject of personal data or his representative. The response is sent within a period not exceeding ten days from the date of application by the subject of personal data or his representative or from the date of receipt of the request of the subject of personal data or his representative.
provides free of charge to the subject of personal data or his representative the opportunity to familiarize himself with personal data relating to this subject of personal data.
within a period not exceeding seven working days from the date the subject of personal data or his representative provided information confirming that the personal data is incomplete, inaccurate or irrelevant, makes the necessary changes to them.
within a period not exceeding seven working days from the date the subject of personal data or his representative provided information confirming that such personal data was illegally obtained or is not necessary for the stated purpose of processing, destroys such personal data and notifies the subject of personal data or his representative about the changes made and the measures taken and takes reasonable measures to notify third parties to whom the personal data of this subject were transferred.

15.5. The Company reports to the authorized body for the protection of the rights of personal data subjects, at the request of this body, the necessary information within ten days from the date of receipt of such a request.

15.6. Obligations of the Operator to eliminate violations of the law committed during the processing of personal data, to clarify, block and destroy personal data:

in case of detection of unlawful processing of personal data upon the request of the subject of personal data or his representative or at the request of the subject of personal data or his representative or the authorized body for the protection of the rights of subjects of personal data, the Operator blocks unlawfully processed personal data relating to this subject of personal data, or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of the Company) from the moment of such application or receipt of the specified request for the period of verification.
in the event of identification of inaccurate personal data when contacting a subject of personal data or his representative or at their request or at the request of an authorized body for the protection of the rights of subjects of personal data, the Operator blocks personal data relating to this subject of personal data or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of the Company) from the moment of such application or receipt of the specified request for the period of verification, if the blocking of personal data does not violate the rights and legitimate interests of the subject of personal data or third parties.
in case of confirmation of the fact of inaccuracy of personal data, the Company, on the basis of information provided by the subject of personal data or his representative or an authorized body for the protection of the rights of subjects of personal data, or other necessary documents, clarifies the personal data or ensures their clarification (if the processing of personal data is carried out by another person acting on behalf of the Company) within seven working days from the date of submission of such information and stops blocking personal data.
in case of detection of unlawful processing of personal data carried out by the Company or a person acting on behalf of the Company, within a period not exceeding three working days from the date of this detection, the Company stops the unlawful processing of personal data or ensures the termination of unlawful processing of personal data by a person acting on behalf of the Company. If it is impossible to ensure the legality of the processing of personal data, the Company, within a period not exceeding ten working days from the date of detection of unlawful processing of personal data, destroys such personal data or ensures its destruction. The Company notifies the subject of personal data or his representative about the elimination of violations or the destruction of personal data, and if the appeal of the subject of personal data or his representative or the request of the authorized body for the protection of the rights of personal data subjects was sent by the authorized body for the protection of the rights of personal data subjects, also the specified body.
if the purpose of processing personal data is achieved, the Company stops processing personal data or ensures its termination (if the processing of personal data is carried out by another person acting on behalf of the Company) and destroys personal data or ensures its destruction (if the processing of personal data is carried out by another person acting on behalf of the Company) within a period not exceeding ten days from the date of achieving the purpose of processing personal data, unless otherwise provided by the agreement to which the subject of personal data is a party, beneficiary or guarantor, another agreement between the Company and the subject of personal data, or if the Company does not have the right to process personal data without the consent of the subject of personal data on the grounds provided for by current legislation.
in the event that the subject of personal data withdraws consent to the processing of his personal data, the Company stops their processing or ensures the termination of such processing (if the processing of personal data is carried out by another person acting on behalf of the Company) and in the event that the preservation of personal data is no longer required for the purposes of processing personal data, destroys personal data or ensures their destruction within a period not exceeding ten days from the date of receipt of the said revocation, unless otherwise provided by the agreement to which the party, beneficiary or guarantor is the subject of personal data, another agreement between the Company and the subject of personal data, or if the Company does not have the right to process personal data without the consent of the subject of personal data on the grounds provided for by current legislation.
If it is not possible to destroy personal data within the specified period, the Company blocks such personal data or ensures their blocking and ensures the destruction of personal data within a period of no more than six months, unless another period is established by law.

16. Before starting the processing of personal data, the Company notifies, in accordance with the procedure established by law, the authorized body for the protection of the rights of personal data subjects of its intention to process personal data.

VII. AREAS OF RESPONSIBILITY

18. Persons responsible for organizing the processing of personal data in the Company:

18.1. The Company appoints a person responsible for organizing the processing of personal data.

18.2. The person responsible for organizing the processing of personal data receives instructions directly from the General Director of the Company and is accountable to him.

18.3. The Company provides the person responsible for organizing the processing of personal data with the necessary information.

18.4. The person responsible for organizing the processing of personal data, in particular, performs the following functions:

exercises internal control over compliance by the Company and the Company’s employees with the legislation of the Russian Federation on personal data, including requirements for the protection of personal data;
brings to the attention of the Company’s employees the provisions of the legislation of the Russian Federation on personal data, local regulations on the processing of personal data, requirements for the protection of personal data;
organizes the reception and processing of appeals and requests from subjects of personal data, their representatives and (or) government bodies, exercises control over the receipt and consideration of such appeals and requests.

19. Persons guilty of violating the requirements of the legislation on personal data bear responsibility as provided for by the legislation of the Russian Federation.

VIII. TERMS FOR PROCESSING AND STORING PERSONAL DATA

20. The terms of processing and storage of personal data in the Company are determined in accordance with the legislation of the Russian Federation.

If legal acts do not establish a specific period for the processing and storage of personal data, then their processing is carried out until the purpose of processing personal data is achieved or the need to achieve the purpose of processing personal data is no longer necessary.

21. The storage period for personal data in electronic form must correspond to the storage period for personal data on paper, unless otherwise established by the legislation of the Russian Federation.

22. If the subject of personal data withdraws consent to the processing of his personal data, the processing of the relevant personal data in the Company must be terminated, if the Company does not have the right to process such personal data without the consent of the subject of personal data on the grounds provided for by FZ-152 or other federal laws.

23. Taking into account the provisions of the legislation of the Russian Federation, the following terms for the processing and storage of personal data are established:

for dismissed employees: the storage period for documents included in the personal file of dismissed employees is 75 years if they were concluded before 2003. Dated after 2003 are stored for 50 years or another period provided for by the legislation of the Russian Federation;
documents necessary for the calculation, withholding and transfer of taxes and accounting documentation – at least five years;
for applicants: for the period necessary to achieve the stated purposes of processing. In case of refusal to hire, the information provided by the applicant is destroyed within 30 days;
for individuals with whom a civil law agreement has been concluded: for the period of approval of the agreement between the Company and the counterparty, the validity period of such an agreement, as well as 5 years after the expiration of the agreement, or another period provided for by the legislation of the Russian Federation;
for employees: personal data contained in orders for vacations, short-term domestic and foreign business trips, and disciplinary sanctions against the Company’s employees – for five years with subsequent destruction;
for site visitors until the purpose of processing personal data is achieved or the need to achieve the purpose of processing personal data is lost.
personal data of citizens who sent requests are stored for five years.

24. Control over the storage and use of tangible media of personal data, preventing unauthorized use, clarification, distribution and destruction of personal data located on these media, is carried out by the heads of the structural divisions of the Company or authorized employees of the Company.

25. If the subject of personal data withdraws consent to the processing of his personal data, the processing of the relevant personal data in the Company must be stopped if the processing of such personal data is impossible without the consent of the subject of personal data.

XI. KEY RESULTS

Upon achieving the goals, the following results are expected:

ensuring the protection of the rights and freedoms of personal data subjects when processing their personal data by the Company;
increasing the overall level of information security of the Company;
minimizing legal and economic risks of the Company and subjects of personal data.