This Policy of LLC "Arbitr.Group" in relation to the organization of processing and security of personal data (hereinafter - Policy), is developed in order to implement the requirements of legislation of the Russian Federation in the field of processing and protection of personal data.
Policy discloses the methods and principles of LLC "Arbitr.Group" of personal data, its rights and duties at processing of personal data, the rights of subjects of personal data, and also includes a list of measures applied by LLC "Arbitr.Group" in order to ensure security of personal data at their processing. This Policy is a publicly available document declaring conceptual bases of LLC "Arbitration group" activity at processing of personal data and their protection.
– Personal data - any information, related to directly or indirectly defined or identifiable individual (subject of personal data)
– Operator of personal data (hereinafter - the Operator) - "Arbitration group" LLC, carrying out processing of personal data, as well as defining the purpose of processing of personal data, composition of personal data to be processed, actions (operations) performed with personal data
– Processing of personal data - any action (operation) or set of actions (operations) with personal data, performed with or without the use of automation;
– Automated processing of personal data - processing of personal data by computer equipment;
- Distribution of personal data - actions aimed at disclosure of personal data to an indefinite range of persons;
– Provision of personal data - actions aimed at disclosure of personal data to a certain person or a certain circle of persons;
– Blocking of personal data - temporary termination of processing of personal data (except in cases where the processing is necessary to clarify personal data)
– Destruction of personal data - actions, as a result of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which material carriers of personal data are destroyed;
– Information system of personal data - a set of personal data contained in databases of personal data and information technologies and technical means ensuring its processing;
– Transborder transfer of personal data - transfer of personal data to the territory of a foreign state to a foreign state authority, foreign individual or foreign legal entity.
The subjects of personal data include individuals:
- Who are the Operator's employees and/or candidates for vacant jobs;
- The personal data processing of which is carried out by the Operator or assigned to the Operator within the framework of execution of contracts for services, works (clients and counterparties of the Operator);
- Persons who have contacted the Operator with an appeal, complaint, suggestion or application;
- Who have provided their personal data as part of the Operator's statutory activities;
- who are representatives (legal representatives) of individuals and legal entities specified in this paragraph.
4.1 The subject of personal data has the right to receive information about the processing of their personal data by the operator, to access their personal data in accordance with the Federal Law of 27.07.2006 № 152-FZ "On Personal Data" (hereinafter - the Law on Personal Data).
4.2 The subject of personal data has the right to require the operator to clarify this personal data, block or destroy it if it is incomplete, outdated, inaccurate, illegally obtained or cannot be recognized as necessary for the operator's stated purpose of processing, as well as to take statutory measures to protect his rights.
4.3 The right of the subject of personal data to access his/her personal data may be restricted in accordance with federal laws.
4.4 To exercise and protect his rights and legitimate interests, the subject of personal data has the right to apply to the Operator. The operator considers any appeals and complaints from subjects of personal data, thoroughly investigates the circumstances set forth in these appeals, complaints, and in case of establishing the facts of violations, takes all necessary measures for their immediate elimination, punishment of guilty persons and settlement of disputable and conflict situations in pre-trial order.
4.5 The subject of personal data shall have the right to appeal the operator's actions or omissions by appealing to the competent authority for the protection of the rights of subjects of personal data.
4.6 The subject of personal data has the right to protect his or her rights and legitimate interests, including compensation for losses or compensation for moral harm in court.
5.1 The operator is obliged not to distribute and not to provide to third parties personal data without the consent of the subject of personal data, except in cases stipulated by the legislation of the Russian Federation.
5.2 When collecting personal data, the operator is obliged to provide the subject of personal data, upon their request, with information about the grounds, purposes and conditions for the use of personal data.
5.3 When processing personal data, the operator shall take necessary legal, organizational and technical measures or ensure their adoption to protect personal data from unlawful or accidental access to it, destruction, modification, blocking, copying, distribution of personal data, as well as from other unlawful actions in relation to personal data.
5.4 If the subject of personal data withdraws their consent to the processing of their personal data, the operator shall stop processing the personal data, and, if the preservation of personal data is no longer required for the purpose of processing the personal data, shall destroy the personal data within the period specified by law or by contract.
The purposes of collection and processing of personal data are:
- To ensure compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation, constituent entities of the Russian Federation, accounting, tax and military records, personnel work and records, participation of citizens in contests to fill vacant jobs;
- Carrying out activities for the creation, use and maintenance of databases and information resources (including Web sites hosted on the Internet), which entails the need to process personal data
- performance of other works, provision of other services related to processing of personal data.
The legal basis for the processing of personal data by the Operator shall be:
- Federal laws and regulatory legal acts adopted on their basis, regulating relations related to the Operator's activities;
- Articles of Association of the Operator;
- Contracts concluded between the Operator and the subject of personal data;
- consent to process personal data (in cases not expressly provided for in the laws of the Russian Federation, but consistent with the operator's powers);
- Contracts for the provision of services, performance of work on behalf of another personal data operator.
Processed personal data includes:
- surname, first name, patronymic
- date of birth
- telephone number
- link to a social network profile
- E-mail address (for the above-mentioned subjects of personal data)
- photo or video presentation
- information necessary for the operator to meet the requirements of the labor legislation of the Russian Federation, to keep accounting, tax and military records
- data automatically transmitted to Web site services in the process of their use through the software installed on the device of the subject of personal data user, including the IP-address, information from Cookies, information about the browser (or other program through which access to services).
The following principles shall be strictly observed in processing of personal data:
- the processing of personal data shall be lawful and fair:
- processing of personal data is limited to achieving specific, predetermined and legitimate purposes. Processing of personal data that is incompatible with the purposes of personal data processing shall not be permitted;
- No pooling of databases containing personal data, whose processing is incompatible with the purposes of personal data processing, shall be permitted;
- Only personal data that meets the purposes of its processing shall be processed;
- The content and scope of processed personal data shall comply with the stated personal data processing purposes. Processed personal data shall not be excessive in relation to the stated purposes of its processing;
- Processing of personal data shall ensure accuracy of personal data, its sufficiency, and, if necessary, relevance in relation to the purpose of personal data processing. The operator shall take necessary measures or ensure that they are taken to remove or clarify incomplete or inaccurate data;
- Personal data shall be stored in a form that allows identifying the subject of personal data, no longer than required by the purposes of personal data processing, unless the period of storage of personal data is established by federal law, the contract, which party, beneficiary or guarantor, under which the subject of personal data is. Processed personal data shall be destroyed or depersonalized upon attainment of processing objectives or in case of loss of necessity in attainment of such objectives, unless otherwise provided by the federal law.
10.1 In accordance with the requirements established by Art. 7 of the Personal Data Law, the operator undertakes not to disclose to third parties and not to distribute personal data without the consent of the subject of personal data, unless otherwise provided by federal law. In particular, the operator has the right to transfer personal data to bodies of inquiry and investigation, other authorized bodies on the grounds stipulated by the current legislation of the Russian Federation.
10.2 The list of actions performed by the operator with the subjects' personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, destruction.
10.3 Processing of the above personal data shall be carried out in a mixed way (with and without the use of automation means), with transfer via the internal network of the legal entity, as well as via the Internet.
10.4 When storing personal data, the operator uses databases located in the territory of the Russian Federation; the operator does not transfer personal data across borders.
10.5 For the proper fulfillment of the personal data processing obligations, the operator has taken the measures stipulated by the legislation of the Russian Federation, including Articles 18.1. and 19 of the Personal Data Law.
10.6 The operator shall store personal data in a form that allows the personal data subject to be identified no longer than the purposes of personal data processing require, except in cases where the period of storage of personal data is not set by federal law, by an agreement to which the personal data subject is a party, a beneficiary or a guarantor.
10.7 In the course of its activities, the operator may provide and or assign processing of personal data to another person with the consent of the subject of personal data, unless otherwise provided by the legislation in the field of personal data. At the same time, an obligatory condition for providing and or entrusting the processing of personal data to another person is the obligation of the parties to ensure confidentiality and security of personal data during their processing.
10.8 Processing of personal data by the Operator shall be terminated on the grounds stipulated by legislation in the field of personal data, as well as upon termination of the Operator's activities (liquidation, reorganization).
11.1 Actualization, correction, deletion and destruction of personal data processed by the Operator shall be performed on the basis of requests from subjects of personal data within the terms and manner prescribed by the legislation of the Russian Federation in the field of personal data.
11.2 If the fact of inaccuracy of personal data or the illegality of its processing is confirmed, the personal data shall be updated by the Operator, and the processing shall be terminated, respectively.
11.3. Destruction of documents and information with expired shelf life, depersonalization of personal data shall be carried out in the manner prescribed by the laws of the Russian Federation and the acts of the Operator.
11.4 When the objectives of personal data processing are achieved, and if the subject of personal data withdraws their consent to the processing of personal data, personal data shall be destroyed, unless
- otherwise is not provided by the contract, to which the personal data subject is a party, beneficiary or guarantor;
- The operator may not process without the consent of the subject of personal data on the grounds provided by the Personal Data Law or other federal laws;
- Unless otherwise provided by any other agreement between the operator and the subject of personal data.