Personal Data Processing Policy

List of abbreviations

Terms and definitions

Updating – a review of a document for compliance with the laws of the RF, business requirements and the like, as a result of which the text of the document may be amended.

Blocking of personal data – the temporary cessation of the collection, systematisation, accumulation, use and dissemination of personal data, including its transfer.

Processing of personal data – any action (operation) or set of actions (operations) performed on personal data, with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction of personal data.

Personal data – any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).

Provision of personal data – actions aimed at disclosing personal data to a specific natural or legal person or to a specific group of natural or legal persons.

Employee – a natural person who has entered into an employment relationship with the Operator.

Personal data subject – a natural person who is directly or indirectly identified or identifiable by means of personal data.

Destruction of personal data – actions as a result of which the content of personal data in a personal data information system can no longer be restored, or as a result of which the physical media containing personal data are destroyed.

1. General provisions

This Personal Data Processing Policy of Jet Infosystems (hereinafter, the Policy) has been prepared in accordance with the requirements of Federal Law of the RF No. 152-FZ “On Personal Data” of 27 July 2006 (hereinafter, 152-FZ) and sets out the position of Jet Infosystems, registered address: 127015, Moscow, Bolshaya Novodmitrovskaya St., Building 14, Structure 2, Floor 6, Room 13, Office 2.654 (hereinafter, the Operator), on the processing and protection of personal data (hereinafter, PD) and on respect for the rights and freedoms of PD subjects.

The Policy takes effect from the moment it is signed.

The Policy applies to PD obtained both before and after it came into effect.

Recognising the importance and value of PD, and committed to upholding the constitutional rights of citizens of the RF and of other states, the Operator ensures reliable protection of PD.

Taking into account the requirements of 152-FZ and of other laws and regulations of the RF that govern specific cases and aspects of PD processing, the Operator approves internal regulations (and amends existing internal regulations) that define the specifics of processing the PD of particular categories of PD subjects.

If, as a result of changes to the laws and regulations of the RF, individual clauses of this Policy come into conflict with them, those clauses cease to have effect. Until this Policy has been amended, the Operator's employees and the other persons referred to in the Policy are guided by the laws and regulations of the RF.

2. Policy provisions

2.1 Purposes of PD processing

Under this Policy, the Operator processes PD for the following purposes:

• considering candidates for a vacant position with the Operator or for participation in an internship programme;
• publishing PD on the Operator's corporate website, on its honours board and on social media;
• maintaining access control and on-site security procedures;
• enabling visits to the Operator's office to obtain information about the Operator's products and services;
• making the information posted on the Operator's websites available to the general public;
• sending informational and news communications about the Operator's services, products and events;
• enabling participation in events and surveys, and visits to the Operator's office to obtain information about the Operator's products and services;
• prize draws for merchandise;
• carrying out analytical research into market trends, relationship patterns and sales prospects;
• responding to enquiries and to requests for additional information and reference materials.

2.2 Categories of PD subjects

The Operator processes the PD of:

• job applicants, for the purpose of considering candidates for a vacant position with the Operator or for participation in an internship programme;
• visitors to the Operator's website, for the following purposes:
  • making the information posted on the Operator's websites available to the general public;
  • sending informational and news communications about the Operator's services, products and events;
  • enabling participation in events and surveys, and visits to the Operator's office to obtain information about the Operator's products and services;
  • prize draws for merchandise;
  • carrying out analytical research into market trends, relationship patterns and sales prospects;
  • responding to enquiries and to requests for additional information and reference materials.

2.3 Legal grounds for PD processing

The Operator processes PD in accordance with the applicable laws of the RF and on the following legal grounds:

• contracts with third-party organisations;
• the PD subject's consent to the processing of PD.

2.4 Principles and rules of PD processing

When processing PD, the Operator adheres to the following principles:

• processing PD only on a lawful and fair basis;
• disseminating and disclosing PD to third parties with the consent of the PD subject (unless otherwise provided by the applicable laws of the RF);
• defining specific lawful purposes of PD processing before processing (including collection) of PD begins;
• collecting only such PD as is necessary and sufficient for the stated purpose of processing;
• limiting PD processing to the achievement of specific, predefined and lawful purposes;
• destroying PD once the purposes of processing have been achieved or it is no longer necessary to achieve them.
• The Operator does not process PD concerning race, nationality, political views, religious, philosophical or other beliefs, intimate life, or membership of public associations, including trade unions, nor does it process biometric personal data. Health information is processed only to the extent necessary to comply with the labour laws of the RF.
• The Operator may entrust the processing of a PD subject's PD to third parties with the consent of the PD subject (where such consent is required by the laws of the RF) and on the basis of a contract concluded with those parties.
• Persons processing PD under a contract concluded with the Operator (on the Operator's instruction) undertake to comply with the principles and rules for processing and protecting PD laid down in 152-FZ. For each such person, the contract specifies the list of actions (operations) with PD to be performed by the person processing the PD and the purposes of processing, establishes that person's obligation to maintain confidentiality and ensure the security of PD during processing, and sets out the requirements for protecting the PD being processed in accordance with 152-FZ.
• In order to comply with the applicable laws of the RF and with contractual obligations, the Operator processes PD both with and without the use of automation tools. The set of PD processing operations includes collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), blocking, deletion and destruction of PD.
• The Operator prohibits the making of decisions based solely on automated processing of PD that produce legal effects concerning the PD subject or otherwise affect the PD subject's rights and legitimate interests, except in cases provided for by the laws of the RF.

2.5 Rights and obligations of PD subjects and of the Operator in relation to PD processing

A PD subject whose PD is processed by the Operator has the rights provided for by 152-FZ, including the right to:

• obtain from the Operator:
  • confirmation that PD is being processed and information on whether PD relating to that PD subject is held;
  • information on the legal grounds for and purposes of PD processing;
  • information on the methods of PD processing used by the Operator;
  • information on the Operator's name and location;
  • information on the persons (other than the Operator's employees) who have access to the PD or to whom the PD may be disclosed under a contract with the Operator or under 152-FZ;
  • a list of the PD being processed that relates to the PD subject, and information on its source, unless 152-FZ provides for a different procedure for providing such PD;
  • information on the periods of PD processing, including retention periods;
  • information on how the PD subject may exercise the rights provided for by 152-FZ;
  • information on any cross-border transfer of PD that has taken place or is planned;
  • the name or full name and address of the person processing PD on the Operator's instruction, if processing has been or will be entrusted to such a person;
  • other information provided for by 152-FZ or other laws and regulations of the RF;
• require the Operator to rectify, block or destroy their PD in the cases provided for by the laws of the RF;
• withdraw their consent to the processing of PD;
• require the Operator to cease any unlawful actions in relation to their PD;
• appeal against the Operator's actions or inaction to the Federal Service for Supervision of Communications, Information Technology and Mass Media or to a court, if the PD subject believes that the Operator is processing their PD in breach of 152-FZ or is otherwise violating their rights and freedoms;
• protect their rights and legitimate interests, including by claiming damages and/or compensation for moral harm (through the courts).

In the course of PD processing, the Operator fulfils the obligations laid down in 152-FZ.

2.6 PD protection requirements

When processing PD, the Operator takes the necessary legal, organisational and technical measures to protect PD against unlawful or accidental access, destruction, modification, blocking, copying, provision and dissemination, and against other unlawful actions in relation to PD.

In accordance with 152-FZ, these measures include the following:

• appointing a person responsible for organising PD processing;
• developing and approving internal regulations on the processing and protection of PD;
• applying legal, organisational and technical measures to ensure the security of PD:
  • identifying threats to the security of PD when it is processed in PDIS;
  • applying the organisational and technical measures for ensuring the security of PD processed in PDIS that are needed to meet the PD protection requirements whose fulfilment provides the levels of PD protection established by the Government of the RF;
• using information security tools;
• keeping records of machine-readable PD storage media;
• detecting instances of UA to PD and taking measures to prevent such incidents in future;
• restoring PD that has been modified or destroyed as a result of UA;
• establishing rules for access to PD processed in PDIS, and ensuring that all actions performed on PD in PDIS are logged and recorded;
• monitoring the measures taken to ensure the security of PD and the level of protection of PDIS;
• maintaining conditions that prevent UA to paper media containing PD and keep PD safe;
• familiarising the Operator's employees who directly process PD with the provisions of the laws of the RF on PD, including PD protection requirements, and with internal regulations on the processing and protection of PD.

2.7 PD processing periods

PD processing periods are determined on the basis of the purposes of PD processing, in accordance with the term of the contract with the PD subject and with the laws and regulations of the Russian Federation that set retention periods for documents generated in the course of an organisation's activities.

PD processed by the Operator is to be destroyed in the following cases:

• when the purpose of PD processing has been achieved or it is no longer necessary to achieve it, unless otherwise provided by the laws of the RF;
• when the laws and regulations establishing the legal grounds for PD processing are amended or repealed;
• when unlawful processing of PD is discovered;
• when the PD subject withdraws consent, unless otherwise provided by the laws of the RF.

2.8 Procedure for obtaining clarification on PD processing

PD subjects whose PD is processed by the Operator may obtain clarification on matters relating to the processing of their PD (and may withdraw their consent to the processing of PD) by contacting the Operator in person or by sending a written request to the address of the Operator's head office: 127015, Moscow, Bolshaya Novodmitrovskaya St., Building 14, Structure 2, Floor 6, Room 13, Office 2.654 (registered address).

Where a formal request is sent to the Operator, the request must state:

• the full name of the PD subject or their representative;
• the number of the main identity document of the PD subject or their representative, the date of issue of that document and the authority that issued it;
• information confirming that the PD subject has a relationship with the Operator;
• the signature of the PD subject (or their representative). If the request is sent electronically, it must be drawn up as an electronic document and signed with an electronic signature in accordance with the laws of the RF.

3. Confidentiality guarantees

Information relating to PD that has become known in connection with an employment relationship is confidential information and is protected in accordance with the provisions of 152-FZ.

The Operator's employees and other persons who have been given access to the PD being processed have been warned that they may incur disciplinary, administrative, civil or criminal liability if they breach the rules and requirements of the applicable laws governing the processing and protection of PD.

4. Duties and liability

The Operator's employees and other persons in a contractual relationship with the Operator who are guilty of breaching the rules governing the processing and protection of PD bear civil, disciplinary, administrative or criminal liability in the manner prescribed by the laws of the RF, the employment contract or another contract.

Disclosure of a PD subject's PD (its transfer to unauthorised persons, including employees of the Operator who do not have access to it), its public disclosure, the loss of documents or other media containing a PD subject's PD, and other breaches of the obligations to protect and process such data laid down in this Policy and other internal regulations of the Operator result in a disciplinary sanction – an admonition, a reprimand or dismissal – being imposed on the employee who has access to the PD of PD subjects.

An employee of the Operator who has access to the PD of PD subjects and has committed the disciplinary offence described above bears full financial liability if their actions cause damage to the Operator (clause 7, part 1, Article 243 of the Labour Code of the RF).

Compliance with the requirements of this Policy is monitored by the person responsible for organising PD processing.

5. Final provisions

This Policy is an internal regulation of the Operator.

All amendments to this document are made and approved in accordance with the procedure established by the Operator.

The Policy is updated in any of the following cases:

• by decision of the Operator's management;
• when the laws of the RF on the protection and processing of PD change;
• upon receipt of orders to remedy non-compliance that affect the scope of the Policy;
• when it becomes necessary to change the PD processing procedure in connection with the Operator's activities.