Policy of confidentiality

1. General provisions

1.1. The real Policy of Delfiniya limited liability company for processing of personal data (further - Policy) is developed in pursuance of requirements of Paragraph 2 of Part 1 of Article 18.1 of the Federal law of 27.07.2006 N 152-FZ "About personal data" (further - the Law on personal data) for ensuring protection of the rights and freedoms of the person and the citizen when processing his personal data, including protection of the rights to personal privacy, a personal and family secret.

1.2. The policy works for all personal data which are processed by Delfiniya limited liability company (further - the Operator, LLC Delfiniya).

1.3. The policy extends to the relations in the field of processing of personal data which arose at the Operator both to and after the statement of the real Policy.

1.4. In pursuance of requirements of Part 2 of Article 18.1 of the Law on personal data the real Policy is published in free access on the information and telecommunication Internet on the website of the Operator.

1.5. The basic concepts used in Policy:

personal data - any information relating to directly or indirectly to the defined or defined natural person (the subject of personal data);

the operator of personal data (operator) - public authority, municipal body, the legal or natural person, independently or together with other persons the purposes of processing of personal data organizing and (or) carrying out processing of personal data and also defining, structure of the personal data which are subject to processing, actions (operation) made with personal data;

processing of personal data - any action (operation) or set of actions (operations) with personal data made with use of the automation equipment or without their use. Processing of personal data includes including:

  • collecting;
  • record;
  • systematization;
  • accumulation;
  • storage;
  • specification (updating, change);
  • extraction;
  • use;
  • transfer (distribution, granting, access);
  • depersonalization;
  • blocking;
  • removal;
  • destruction;

the automated processing of personal data - processing of personal data by means of computer aids;

dissemination of personal data - the actions directed to disclosure of personal data to an uncertain circle of people;

providing personal data - the actions sent on disclosure of personal data to a certain person or a certain circle of people;

blocking of personal data - the temporary termination of processing of personal data (except for cases if processing is necessary for specification of personal data);

destruction of personal data - actions as a result of which becomes impossible to restore contents of personal data in an information system of personal data and (or) as a result of which material carriers of personal data are destroyed;

depersonalization of personal data - actions as a result of which becomes impossible without use of additional information to define accessory of personal data to a concrete subject of personal data;

information system of personal data - set of the personal data and information technologies and technical means providing their processing which are contained in databases;

cross-border transfer of personal data - transfer of personal data on the territory of the foreign state to authority of the foreign state, the foreign natural person or the foreign legal entity.

1.6. Basic rights and obligations of Operator.

1.6.1. The operator has the right:

  • to independently define structure and the list of the measures necessary and the duties, sufficient for ensuring performance, provided by the Law on personal data and regulations adopted according to it if other is not provided by the Law on personal data or other federal laws;
  • to charge processing of personal data to other person with the consent of the subject of personal data if other is not provided by the federal law, on the basis of the contract signed with this person. The person which is carrying out processing of personal data at the request of the Operator is obliged to follow the principles and rules of processing of personal data provided by the Law on personal data;
  • in case of a response the Operator has the right to continue by a subject of personal data of consent to processing of personal data processing of personal data without the consent of the subject of personal data in the presence of the bases specified in the Law on personal data.

1.6.2. The operator is obliged:

  • to organize processing of personal data according to requirements of the Law on personal data;
  • to respond to appeals and inquiries of subjects of personal data and their lawful representatives according to requirements of the Law on personal data;
  • to report in authorized body on protection of the rights of subjects of personal data (Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) at the request of this body necessary information within 30 days from the date of receipt of such inquiry.

1.7. Basic rights of the subject of personal data. The subject of personal data has the right:

  • to obtain information concerning processing of his personal data except for the cases provided by federal laws. The information is provided to the subject of personal data by the Operator in an available form, and they should not contain the personal data relating to other subjects of personal data except for cases when there is legal basis for disclosure of such personal data. The list of information and an order of its receiving is established by the Law on personal data;
  • to demand from the operator of specification of his personal data, their blocking or destruction in case personal data are incomplete, outdated, inexact, illegally received or are not necessary for a stated purpose of processing and also to take the measures for protection of the rights provided by the law;
    to lay down a condition of prior consent when processing personal data for advance on commodity market, works and services;
  • to appeal in Roskomnadzor or in a judicial proceeding against illegal actions or inaction of the Operator when processing his personal data.

1.8. Control of execution of requirements of the real Policy is exercised by the authorized person responsible for the organization of processing of personal data at the Operator.

1.9. The responsibility for violation of requirements of the legislation of the Russian Federation and regulations of LLC Delfiniya in the sphere of processing and protection of personal data is defined according to the legislation of the Russian Federation.

 

2. Purposes of collecting personal data

2.1. Processing of personal data is limited to achievement of concrete, in advance definite and lawful purposes. The processing of personal data incompatible with the purposes of collecting personal data is not allowed.

2.2. Only personal data which answer the purposes of their processing are subject to processing.

2.3. Processing of personal data by the Operator is carried out in the following purposes:

  • ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulations of the Russian Federation;
  • implementation of the activity according to the charter of LLC Delfiniya;
  • conducting personnel office-work;
  • assistance to workers in employment, education and promotion, ensuring personal security of workers, control of
  • quantity and quality of the performed work, ensuring safety of property;
  • attraction and selection of candidates for work at the Operator;
  • the organization of statement on the individual (personified) accounting of workers in the system of mandatory pension insurance;
  • filling and transfer to executive authorities and other authorized organizations of the required reporting forms;
  • implementation of the civil relations;
  • conducting accounting;
  • implementation of access control.

2.4. Обработка персональных данных работников может осуществляться исключительно в целях обеспечения соблюдения законов и иных нормативных правовых актов.

 

3. Legal grounds of processing of personal data

3.1. A legal ground of processing of personal data is the set of regulations in pursuance of which and according to which the Operator carries out processing of personal data, including:

  • Constitution of the Russian Federation;
  • Civil code of the Russian Federation;
  • Labor Code of the Russian Federation;
  • Tax Code of the Russian Federation;
  • Federal law of 08.02.1998 N 14-FZ "About limited liability companies";
  • Federal law of 06.12.2011 N 402-FZ "About accounting";
  • Federal law of 15.12.2001 N 167-FZ "About mandatory pension insurance in the Russian Federation";
  • other regulations governing the relations connected with activity of the Operator.

3.2. A legal ground of processing of personal data also are:

  • charter of LLC Delfiniya;
  • the contracts signed between the Operator and subjects of personal data;
  • consent of subjects of personal data to processing of their personal data.

 

4. The volume and categories of the processed personal data, categories of subjects of personal data

4.1. Content and volume of the processed personal data have to answer the stated purposes of processing provided in Section 2 of the real Policy. The processed personal data should not be superfluous in relation to stated purposes of their processing.

4.2. The operator can process personal data of the following categories of subjects of personal data.

4.2.1. Candidates for employment to the Operator:

  • surname, name, middle name;
  • floor;
  • nationality;
  • birth date and birth place;
  • contact information;
  • data on education, experience, qualification;
  • other personal data reported by candidates for the summary and cover letters.

4.2.2. Workers and former employees of Operator:

  • surname, name, middle name;
  • floor;
  • nationality;
  • birth date and birth place;
  • image (photo);
  • passport data;
  • residence address;
  • address of the actual accommodation;
  • contact information;
  • taxpayer identification number;
  • insurance number of the individual ledger account (INILA);
  • data on education, qualification, vocational training and professional development;
  • marital status, presence of children, family relations;
  • data on work, including existence of encouragement, rewardings and (or) disciplinary punishments;
  • data on marriage registration;
  • data on military account;
  • data on disability;
  • data on deduction of maintenance;
  • data on income from the previous place of work;
  • other personal data provided by workers according to requirements of the labor law.

4.2.3. Members of the family of employees of Operator:

  • surname, name, middle name;
  • relationship degree;
  • year of birth;
  • other personal data provided by workers according to requirements of the labor law.

4.2.4. Clients and contractors of the Operator (natural persons):

  • surname, name, middle name;
  • birth date and birth place;
  • passport data;
  • residence address;
  • contact information;
  • the replaced position;
  • taxpayer identification number;
  • number of the settlement account;
  • other personal data provided by clients and contractors (natural persons) necessary for the conclusion and
  • performance of contracts.

4.2.5. Representatives (workers) of clients and contractors of the Operator (legal entities):

  • surname, name, middle name;
  • passport data;
  • contact information;
  • the replaced position;
  • other personal data provided by representatives (workers) of clients and contractors necessary for the conclusion
  • and performance of contracts.

4.3. Processing of biometric personal data by the Operator (data which characterize physiological and biological features of the person on the basis of which it is possible to identify his personality) is carried out according to the legislation of the Russian Federation.

4.4. The operator does not carry out processing of special categories of the personal data concerning racial, national identity, political views, religious or philosophical beliefs, the state of health, intimate life except for the cases provided by the legislation of the Russian Federation.

 

5. Order and conditions of processing of personal data

5.1. Processing of personal data is carried out by the Operator according to requirements of the legislation of the Russian Federation.

5.2. Processing of personal data is carried out with the consent of subjects of personal data on processing of their personal data and also without that in the cases provided by the legislation of the Russian Federation.

5.3. The operator carries out as automated, and non-automated processing of personal data.

5.4. Employees of Operator to whose functions processing of personal data belongs are allowed to processing of personal data.

5.5. Processing of personal data is carried out in the way:

  • obtaining personal data in an oral and written form directly from subjects of personal data;
  • obtaining personal data from public sources;
  • entering of personal data into magazines, registers and information systems of the Operator;
  • uses of different ways of processing of personal data.

5.6. Disclosure to the third parties and dissemination of personal data without the consent of the subject of personal data is not allowed if other is not provided by the federal law.

5.7. Transfer of personal data to bodies of inquiry and the investigation, in Federal Tax Service, the Pension Fund of the Russian Federation, Social insurance fund and other authorized bodies of executive power and the organization is carried out according to requirements of the legislation of the Russian Federation.

5.8. The operator takes necessary legal, organizational and technical measures for protection of personal data against illegal or accidental access to them, destruction, change, blocking, distribution and other unauthorized actions, including:

  • defines threats to security of personal data at their processing;
  • adopts the local regulations and other documents governing the relations in the sphere of processing and protection of personal data;
  • appoints the persons responsible for safety of personal data in structural divisions and information systems of the Operator;
  • creates necessary conditions for work with personal data;
  • will organize accounting of the documents containing personal data;
  • will organize work with information systems in which personal data are processed;
  • stores personal data in conditions under which their safety is ensured and illegal access to them is excluded;
  • will organize training of the employees of Operator who are carrying out processing of personal data.

5.9. The operator carries out storage of personal data in the form allowing to define the subject of personal data, not longer than it is demanded by the purposes of processing of personal data if the period of storage of personal data is not established by the federal law, the contract.

5.10. When collecting personal data, including by means of the information and telecommunication Internet, the Operator provides record, systematization, accumulation, storage, specification (updating, change), extraction of personal data of citizens of the Russian Federation with use of the databases which are in the territory of the Russian Federation except for the cases specified in the Law on personal data.

 

6. Updating, correction, removal and destruction of personal data, replies to the requests of subjects on access to personal data

6.1. Confirmation of the fact of processing of personal data by the Operator, legal grounds and the purposes of processing of personal data and also other data specified in Part 7 of Article 14 of the Law on personal data are provided by the Operator to the subject of personal data or his representative to the address or to receiving inquiry of the subject of personal data or his representative.

The provided information does not join the personal data relating to other subjects of personal data except for cases when there is legal basis for disclosure of such personal data.

The inquiry has to contain:

  • number of the main identity document of the subject of personal data or his representative, data on date of issue of the specified document and the body which gave it;
  • the data confirming participation of the subject of personal data in the relations with the Operator (number of the contract, date of signing of the contract, conditional verbal designation and (or) other data), or the data otherwise
  • confirming the fact of processing of personal data by the Operator;
  • signature of the subject of personal data or his representative.

The inquiry can be sent in electronic form and is signed with the digital signature according to the legislation of the Russian Federation.

If all necessary data are not reflected in the address (inquiry) of the subject of personal data according to requirements of the Law on personal data or the subject has no access rights to required information, then to it the motivated refusal goes.

The right of the subject of personal data for access to his personal data can be limited according to Part 8 of Article 14 of the Law on personal data including if access for the subject of personal data to his personal data violates the rights and legitimate interests of the third parties.

6.2. In case of detection of inexact personal data at the address of the subject of personal data or his representative either by their inquiry or at the request of Roskomnadzor the Operator carries out blocking of the personal data relating to this subject of personal data from the moment of such address or receiving the specified request for the check period if blocking of personal data does not violate the rights and legitimate interests of the subject of personal data or the third parties.

In case of confirmation of the fact of inaccuracy of personal data the Operator on the basis of the data provided by the subject of personal data either his representative or Roskomnadzor, or other necessary documents specifies personal data within seven working days from the date of submission of such data and removes blocking of personal data.

6.3. In case of identification of illegal processing of personal data at the address (inquiry) of the subject of personal data or his representative or Roskomnadzor the Operator carries out blocking of illegally processed personal data relating to this subject of personal data from the moment of such address or receiving inquiry.

6.4. At achievement of the goals of processing of personal data and also in case of a response the subject of personal data of consent to their processing personal data are liable to destruction if:

  • other is not provided by the contract which party, the beneficiary or the guarantor on whom the subject of personal data is;
  • The operator has no right to carry out processing without the consent of the subject of personal data on the bases provided by the Law on personal data or other federal laws;
  • other is not provided by other agreement between the Operator and the subject of personal data.