Policy of Avangard Group Limited Liability Company
on personal data processing
1. General provisions
1.1. This Personal Data Processing Policy of Avangard Group Limited Liability Company (the Policy) has been developed pursuant to clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the Personal Data Law) to protect human and civil rights and freedoms when personal data is processed, including the rights to privacy and personal and family confidentiality.
1.2. The Policy applies to all personal data processed by Avangard Group Limited Liability Company (the Controller, Avangard Group LLC).
1.3. The Policy applies to personal data processing relationships arising both before and after its approval.
1.4. Pursuant to part 2 of Article 18.1 of the Personal Data Law, this Policy is made publicly available on a noticeboard at the company’s office.
1.5. Principal terms used in the Policy:
personal data — any information relating directly or indirectly to an identified or identifiable individual (the data subject);
personal data controller (controller) — a state or municipal authority, legal entity or individual that independently or jointly with others organises and/or carries out personal data processing and determines its purposes, the personal data to be processed and the actions (operations) performed on it;
personal data processing — any action (operation) or set of actions (operations) performed on personal data, with or without automated means. Processing includes:
• collection;
• recording;
• organisation;
• accumulation;
• storage;
• updating (revision, alteration);
• retrieval;
• use;
• transfer (dissemination, disclosure, access);
• depersonalisation;
• blocking;
• deletion;
• destruction;
automated personal data processing — processing personal data using computer technology;
dissemination of personal data — actions intended to disclose personal data to an indefinite group of persons;
disclosure of personal data — actions intended to disclose personal data to a specific person or group of persons;
blocking of personal data — temporarily suspending personal data processing, except where processing is necessary to update the data;
destruction of personal data — actions that make it impossible to restore personal data in a personal data information system and/or destroy the physical media containing the data;
depersonalisation of personal data — actions that make it impossible, without additional information, to attribute personal data to a specific data subject;
personal data information system — a combination of personal data held in databases and the information technologies and technical means used to process it.
1.6. Principal rights and obligations of the Controller.
1.6.1. The Controller may:
1) independently determine the measures necessary and sufficient to fulfil the obligations imposed by the Personal Data Law and regulations adopted pursuant to it, unless otherwise provided by that Law or other federal laws;
2) entrust personal data processing to another person with the data subject’s consent, unless otherwise provided by federal law, under a contract with that person. Anyone processing personal data on the Controller’s behalf must comply with the processing principles and rules established by the Personal Data Law, maintain confidentiality and take the measures necessary to fulfil the obligations imposed by that Law;
3) continue processing personal data without the data subject’s consent after its withdrawal where grounds specified in the Personal Data Law exist.
1.6.2. The Controller must:
1) organise personal data processing in accordance with the Personal Data Law;
2) respond to enquiries and requests from data subjects and their legal representatives in accordance with the Personal Data Law;
3) provide the authorised authority for the protection of data subjects’ rights (the Federal Service for Supervision of Communications, Information Technology and Mass Media — Roskomnadzor) with the information it requests within 10 working days of receipt of the request. This period may be extended by no more than five working days, provided the Controller sends Roskomnadzor a reasoned notice explaining the extension;
4) cooperate, in the manner prescribed by the federal executive authority responsible for security, with the state system for detecting, preventing and mitigating computer attacks on Russian information resources, including reporting computer incidents resulting in unlawful transfer (disclosure, dissemination, access) of personal data.
1.7. Principal rights of data subjects. A data subject may:
1) obtain information about the processing of their personal data, except as provided by federal laws. The Controller must provide the information in an accessible form without including other data subjects’ personal data, unless lawful grounds for disclosure exist. The Personal Data Law determines the information to be provided and the procedure for obtaining it;
2) require the controller to update, block or destroy personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and take measures provided by law to protect their rights;
3) give prior consent to personal data processing for promoting goods, works and services;
4) challenge the Controller’s unlawful acts or omissions in personal data processing before Roskomnadzor or a court.
1.8. Compliance with this Policy is monitored by the authorised person responsible for organising personal data processing at the Controller.
1.9. Liability for breaches of Russian legislation and Avangard Group LLC’s regulations on personal data processing and protection is determined under Russian legislation.
2. Purposes of personal data processing
2.1. Personal data processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes for which personal data was collected is prohibited.
2.2. Only personal data relevant to the processing purposes may be processed.
2.3. The Controller processes personal data for the following purposes:
• conducting its activities in accordance with the Charter of Avangard Group LLC, including entering into and performing contracts with counterparties;
• complying with employment legislation within employment and directly related relationships, including helping employees obtain employment, education and promotion; recruiting and selecting applicants; ensuring employees’ personal safety; monitoring the quantity and quality of work; protecting property; maintaining personnel and accounting records; completing and submitting required reports to authorised authorities; and arranging employees’ individual registration in the mandatory pension and social insurance systems;
2.4. Employees’ personal data may be processed exclusively to ensure compliance with laws and other regulations.
3. Legal grounds for personal data processing
3.1. The legal grounds for processing are the regulations pursuant to and in accordance with which the Controller processes personal data, including:
• the Constitution of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Labour Code of the Russian Federation;
• the Tax Code of the Russian Federation;
• Federal Law No. 14-FZ of 8 February 1998 “On Limited Liability Companies”;
• Federal Law No. 402-FZ of 6 December 2011 “On Accounting”;
• Federal Law No. 167-FZ of 15 December 2001 “On Mandatory Pension Insurance in the Russian Federation”;
• other regulations governing relationships connected with the Controller’s activities.
3.2. The legal grounds for processing also include:
• the Charter of Avangard Group LLC;
• contracts between the Controller and data subjects;
• data subjects’ consent to the processing of their personal data.
4. Scope and categories of personal data processed,
and categories of data subjects
4.1. The content and scope of the personal data processed must correspond to the stated purposes set out in section 2 of this Policy. Personal data must not be excessive in relation to those purposes.
4.2. The Controller may process the personal data of the following categories of data subjects.
4.2.1. Applicants for employment with the Controller — for compliance with employment legislation within employment and directly related relationships and for access control:
• surname, first name and patronymic;
• sex;
• citizenship;
• date and place of birth;
• contact details;
• education, work experience and qualifications;
• other personal data provided by applicants in CVs and cover letters.
4.2.2. Current and former employees of the Controller — for compliance with employment legislation within employment and directly related relationships and for access control:
• surname, first name and patronymic;
• sex;
• citizenship;
• date and place of birth;
• image (photograph);
• passport details;
• registered residential address;
• actual residential address;
• contact details;
• taxpayer identification number;
• individual insurance account number (SNILS);
• education, qualifications, vocational training and continuing professional development;
• marital status, children and family relationships;
• employment history, including incentives, awards and/or disciplinary sanctions;
• marriage registration details;
• military registration information;
• disability information;
• maintenance deductions;
• income from previous employment;
• other personal data supplied by employees as required by employment legislation.
4.2.3. Family members of the Controller’s employees — for compliance with employment legislation within employment and directly related relationships:
• surname, first name and patronymic;
• relationship to the employee;
• year of birth;
• other personal data supplied by employees as required by employment legislation.
4.2.4. Representatives (employees) of the Controller’s clients and counterparties that are legal entities — for conducting activities under the Charter of Avangard Group LLC and for access control:
• surname, first name and patronymic;
• passport details;
• contact details;
• position held;
• other personal data provided by representatives (employees) of clients and counterparties that is necessary for entering into and performing contracts.
4.3. The Controller processes biometric personal data (information about a person’s physiological and biological characteristics that can be used to establish their identity) in accordance with Russian legislation.
4.4. The Controller does not process special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs, health or intimate life, except as provided by Russian legislation.
5. Procedure and conditions for personal data processing
5.1. The Controller processes personal data in accordance with Russian legislation.
5.2. Personal data is processed with data subjects’ consent, or without it in cases provided by Russian legislation.
5.3. For each processing purpose, the Controller uses the following methods:
• non-automated personal data processing;
• automated personal data processing, with or without transmission of the information obtained over information and telecommunications networks;
• mixed personal data processing.
5.4. Only the Controller’s employees whose duties include personal data processing are permitted to process it.
5.5. For each purpose specified in clause 2.3 of the Policy, personal data is processed by:
• obtaining personal data orally and in writing directly from data subjects;
• entering personal data in the Controller’s logs, registers and information systems;
• using other methods of personal data processing.
5.6. Personal data may not be disclosed to third parties or disseminated without the data subject’s consent, unless otherwise provided by federal law. Consent to processing personal data authorised by the data subject for dissemination is obtained separately from other consents to processing their personal data.
5.7. Personal data is transferred to inquiry and investigation authorities, the Federal Tax Service, the Social Fund of Russia and other authorised executive authorities and organisations in accordance with Russian legislation.
5.8. The Controller takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, dissemination and other unauthorised actions, including:
• identifying threats to personal data security during processing;
• adopting internal regulations and other documents governing personal data processing and protection;
• appointing persons responsible for personal data security in the Controller’s departments and information systems;
• providing the necessary conditions for working with personal data;
• maintaining records of documents containing personal data;
• organising work with information systems that process personal data;
• storing personal data under conditions that ensure its safety and prevent unlawful access;
• arranging training for the Controller’s employees who process personal data.
5.9. The Controller stores personal data in a form that permits identification of the data subject for no longer than required by each processing purpose, unless a retention period is established by federal law or contract.
5.9.1. Avangard Group LLC retains personal data on paper for the document retention periods established by Russian archival legislation: Federal Law No. 125-FZ of 22 October 2004 “On Archival Affairs in the Russian Federation” and the List of Standard Administrative Archival Documents Generated by State Authorities, Local Authorities and Organisations, with Their Retention Periods (approved by Rosarkhiv Order No. 236 of 20 December 2019).
5.9.2. The retention period for personal data processed in personal data information systems corresponds to the retention period for personal data on paper.
5.10. The Controller ceases processing personal data in the following cases:
• unlawful processing is discovered — within three working days of discovery;
• the processing purpose has been achieved;
• the data subject’s consent has expired or been withdrawn, where the Personal Data Law permits processing only with consent.
5.11. Once processing purposes have been achieved or the data subject has withdrawn consent, the Controller ceases processing the data if:
• otherwise is not provided by a contract to which the data subject is a party, beneficiary or guarantor;
• the Controller has no right to process it without consent on grounds provided by the Personal Data Law or other federal laws;
• otherwise is not provided by another agreement between the Controller and the data subject.
5.12. If a data subject requests that processing cease, the Controller ceases processing within no more than 10 working days of receiving the request, except in cases provided by the Personal Data Law. This period may be extended by no more than five working days, provided the Controller sends the data subject a reasoned notice explaining the extension.
5.13. When collecting personal data, including via the Internet, the Controller ensures that Russian citizens’ personal data is recorded, organised, accumulated, stored, updated (revised, altered) and retrieved using databases located in the Russian Federation, except in cases specified in the Personal Data Law.
6. Updating, correction, deletion and destruction
of personal data, and responses to data subjects’ requests
for access to personal data
6.1. The Controller provides the data subject or their representative with confirmation of processing, its legal grounds and purposes, and other information specified in part 7 of Article 14 of the Personal Data Law within 10 working days of the enquiry or receipt of the request. This period may be extended by no more than five working days, provided the Controller sends the data subject a reasoned notice explaining the extension.
The information provided must not include other data subjects’ personal data unless lawful grounds for disclosure exist.
The request must include:
• the number of the principal identity document of the data subject or their representative, its issue date and the issuing authority;
• information confirming the data subject’s relationship with the Controller (contract number, contract date, a reference designation and/or other information), or information otherwise confirming that the Controller processes their personal data;
• the signature of the data subject or their representative.
A request may be submitted as an electronic document signed with an electronic signature in accordance with Russian legislation.
The Controller provides the information specified in part 7 of Article 14 of the Personal Data Law in the same form as the enquiry or request, unless the enquiry or request specifies otherwise.
If the enquiry or request does not contain all information required by the Personal Data Law, or the data subject has no right to access the information requested, a reasoned refusal is sent.
A data subject’s right of access may be restricted under part 8 of Article 14 of the Personal Data Law, including where access would infringe third parties’ rights and legitimate interests.
6.2. If inaccurate personal data is identified following an enquiry or request from the data subject, their representative or Roskomnadzor, the Controller blocks the relevant data from the time of the enquiry or receipt of the request for the verification period, provided blocking does not infringe the rights and legitimate interests of the data subject or third parties.
If the inaccuracy is confirmed, the Controller updates the data within seven working days of receiving information from the data subject, their representative or Roskomnadzor, or other necessary documents, and unblocks it.
6.3. If unlawful processing is identified following an enquiry or request from the data subject, their representative or Roskomnadzor, the Controller blocks the unlawfully processed data relating to that data subject from the time of the enquiry or receipt of the request.
6.4. If the Controller, Roskomnadzor or another interested party discovers unlawful or accidental transfer (disclosure, dissemination) of or access to personal data resulting in a violation of data subjects’ rights, the Controller:
• within 24 hours, notifies Roskomnadzor of the incident, its presumed causes, the presumed harm to data subjects’ rights and the measures taken to mitigate the consequences, and provides details of the person authorised to liaise with Roskomnadzor about the incident;
• within 72 hours, notifies Roskomnadzor of the internal investigation results and provides details of the persons whose actions caused the incident, if known.
6.5. Procedure for destruction of personal data by the Controller.
6.5.1. Conditions and time limits for destruction:
• the processing purpose has been achieved or is no longer necessary — within 30 days;
• the maximum retention period for documents containing personal data has been reached — within 30 days;
• the data subject or their representative provides confirmation that the data was obtained unlawfully or is unnecessary for the stated purpose — within seven working days;
• the data subject withdraws consent, where retention is no longer necessary for the processing purpose — within 30 days.
6.5.2. Once the purpose has been achieved or the data subject has withdrawn consent, personal data must be destroyed if:
• otherwise is not provided by a contract to which the data subject is a party, beneficiary or guarantor;
• the Controller has no right to process it without consent on grounds provided by the Personal Data Law or other federal laws;
• otherwise is not provided by another agreement between the Controller and the data subject.
6.5.3. Personal data is destroyed by a commission established by order of the General Director of Avangard Group LLC.
6.5.4. Methods of destroying personal data are established in the Controller’s internal regulations.