Consent for personal data processing
on the procedure of storage and protection of users' personal data
1. Terms and definitions
Site - a set of software and hardware for computers, providing publication for public viewing of information and data, united by a common purpose, by means of technical means used for communication between computers in the Internet.
The Website in the Regulations means the Website located on the Internet at the address: https://your-transfer.ru.
User means a user of the Internet and, in particular, the Site, who has his/her personal page (profile/account).
Federal Law (FL) - Federal Law No. 152 of July 27, 2006 “On Personal Data”.
Personal data - any information relating directly or indirectly to a certain or definable natural person (subject of personal data).
Translated with DeepL.com (free version)
Operator is an organization that independently or jointly with other persons organizes the processing of personal data, as well as determines the purposes of processing of personal data subject to processing, actions (operations) performed with personal data. The Operator is Denis Vasilyevich Chigileichik, Individual Entrepreneur (OGRNIP 322774600270125, TIN 502915766944), registered in accordance with the laws of the Russian Federation at the address: Amurskaya, 1a building 1, 156, 107553 Moscow, Russia.
Processing of personal data - any action (operation) or set of actions (operations) performed with or without the use of automation means with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
Automated processing of personal data - processing of personal data by means of computer equipment.
Dissemination of personal data - an action aimed at disclosure of personal data to a certain circle of persons upon prior consent, in cases provided for by law.
Translated with DeepL.com (free version)
Provision of personal data - actions aimed at disclosure of personal data to a certain person or a certain circle of persons.
Blocking of personal data - temporary cessation of personal data processing (except for cases when processing is necessary to clarify personal data).
Destruction of personal data - actions, as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which material carriers of personal data are destroyed.
Depersonalization of personal data - actions as a result of which it becomes impossible to determine the affiliation of personal data to a particular subject of personal data without using additional information.
Personal data information system (PDIS) - a set of personal data contained in databases and information technologies and technical means ensuring their processing.
Translated with DeepL.com (free version)
2. General Provisions
2.1 The Regulations on the order of storage and protection of personal data of Users of the Website (hereinafter - the Regulations) are developed in order to comply with the requirements of the legislation of the Russian Federation, containing personal data and identification of Users on the Website.
2.2 The Regulations are developed in accordance with the Constitution of the Russian Federation, the Civil Code of the Russian Federation, the current legislation of the Russian Federation in the field of personal data protection.
2.3 The Regulations define the policy with regard to the processing of personal data, implemented requirements for the protection of personal data and establish the procedure for the processing of personal data of the Website Users: actions to collect, systematize, accumulate, store, clarify (update, change), destroy personal data.
2.4 The Regulation establishes general requirements and rules for handling all types of data carriers containing personal data of the Website Users that are mandatory for the Operator's employees involved in the maintenance of the Website.
2.5 The Regulations do not address the issues of ensuring the security of personal data, which in accordance with the established procedure are classified as information constituting a state secret of the Russian Federation.
2.6 The goals of the Regulations are:
·Ensuring the requirements for the protection of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy, personal and family secrecy;
·Exclusion of unauthorized actions of the Operator's employees and any third parties on collection, systematization, accumulation, storage, clarification (update, change) of personal data, other forms of illegal interference in information resources and local computer network of the Operator, ensuring legal and regulatory regime of confidentiality of undocumented information of the Website Users;
protection of constitutional rights of citizens to personal privacy, confidentiality of information constituting personal data, and prevention of possible threat to the security of the Website Users.
2.7 Principles of personal data processing:
·processing of personal data must be carried out on a lawful and fair basis;
·processing of personal data shall be limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of personal data collection is not allowed;
·databases containing personal data processed for incompatible purposes may not be merged;
·only personal data that meet the purposes of their processing shall be processed;
·the content and scope of processed personal data must correspond to the stated processing purposes. Processed personal data must not be redundant in relation to the stated purposes of their processing;
·when processing personal data, the accuracy of personal data, their sufficiency and, where necessary, relevance in relation to the purposes of personal data processing shall be ensured;
·personal data shall be stored no longer than required for the purposes of personal data processing, unless the period of personal data storage is established by the Federal Law, contract to which the User is a party;
·the processed personal data shall be destroyed or depersonalized upon achievement of the purposes of processing or in case of loss of necessity to achieve these purposes, unless otherwise provided for by the Federal Law.
2.8 Conditions of personal data processing.
2.8.1 The processing of personal data of the Website Users is carried out on the basis of the Civil Code of the Russian Federation, the Constitution of the Russian Federation, the current legislation of the Russian Federation in the field of personal data protection.
2.8.2 The processing of personal data on the Website is carried out in compliance with the principles and rules stipulated by the Regulations and the legislation of the Russian Federation.
Processing of personal data is allowed in the following cases:
·processing of personal data is necessary for the use of the Site, to which the User is a party;
·processing of personal data is necessary for protection of life, health or other vital interests of the User of the Site, if it is impossible to obtain consent;
·processing of personal data is necessary for realization of rights and legitimate interests of the Operator or third parties or for achievement of socially significant purposes provided that the rights and freedoms of the Website Users are not violated;
·processing of personal data is carried out for statistical or other research purposes, except for processing of personal data for the purpose of promotion of goods, works, services on the market by means of direct contacts with potential consumers, as well as for political agitation purposes, provided that personal data are depersonalized.
2.9 The purposes of personal data processing.
2.9.1 The processing of personal data of the Website Users is carried out solely for the purpose of providing the User with an opportunity to interact with the Website.
2.9.2 Information constituting personal data on the Site is any information relating to a certain or determined on the basis of such information natural person (subject of personal data).
2.10. Sources of obtaining Users' personal data.
2.10.1 The source of information about all personal data of the User is the User itself.
2.10.2 The source of information about the User's personal data is the information obtained as a result of the Operator granting the User the right to use the Website.
2.10.3 Users' personal data are confidential information of limited access.
2.10.4 Confidentiality of personal data is not required in case of their depersonalization, as well as in relation to publicly available personal data.
2.10.5 The Operator has no right to collect and process personal data about the User's race, nationality, political views, religious or philosophical beliefs, private life, except for the cases stipulated by the current legislation.
2.10.6 The Operator has no right to receive and process the User's personal data about his/her membership in public associations or his/her trade union activities, except as provided by the Federal Law.
2.11. Methods of personal data processing.
2.11.1 The personal data of the Website Users shall be processed exclusively with the use of means of automation.
2.12. Rights of subjects (Users) of personal data.
2.12.1 The User has the right to obtain information about the Operator, its location, the availability of the Operator's personal data relating to a particular subject of personal data (User), as well as to familiarize with such personal data, except in cases provided for by Part 8 of Article 14 of the Federal Law “On Personal Data”.
2.12.2 The User has the right to receive the following information from the Operator when contacting the Operator in person or when the Operator receives a written request from the User regarding the processing of his/her personal data, including information containing:
·confirmation of the fact of personal data processing by the Operator, as well as the purpose of such processing;
·legal grounds and purposes of personal data processing;
·the purposes and methods of personal data processing applied by the Operator;
·name and location of the Operator, information on persons (except for the Operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or on the basis of the Federal Law;
·personal data being processed relating to the relevant personal data subject, the source of their obtaining, unless another procedure for providing such data is provided for by the Federal Law;
·the terms of personal data processing, including the terms of their storage;
·the procedure for exercising by the subject of personal data the rights provided for by the Federal Law;
·information about the realized or supposed trans-border transfer of data;
·the name or surname, first name, patronymic and address of the person processing personal data on behalf of the Operator, if the processing is or will be entrusted to such a person;
·other information provided for by the Federal Law or other federal laws;
·demand changes, clarification, destruction of information about himself/herself;
·to appeal against unlawful acts or omissions in the processing of personal data and to demand appropriate compensation in court;
·to supplement personal data of an evaluative nature with a statement expressing his/her own point of view;
·to determine representatives for the protection of his/her personal data;
·to demand from the Operator to notify about all changes made in them or exceptions from them.
2.12.3 The User has the right to appeal to the authorized body for the protection of the rights of personal data subjects or in court against actions or inaction of the Operator, if he/she believes that the latter processes his/her personal data in violation of the requirements of the Federal Law “On Personal Data” or otherwise violates his/her rights and freedoms.
2.12.4 The User of personal data has the right to protect his/her rights and legitimate interests, including compensation for losses and (or) compensation for moral damage in court.
2.13. Obligations of the Operator.
2.13.1 Upon personal appeal or upon receipt of a written request of a personal data subject or his/her representative, the Operator, if there are grounds, shall, within 30 days from the date of appeal or receipt of a request of a personal data subject or his/her representative, provide information to the extent required by the Federal Law. Such information shall be provided to the subject of personal data in an accessible form and shall not contain personal data relating to other subjects of personal data, unless there are legal grounds for disclosure of such personal data.
2.13.2 In case of refusal to provide the personal data subject or his/her representative with information on the availability of personal data on the respective personal data subject, the Operator shall be obliged to provide in writing a reasoned response containing a reference to the provision of Article 14, paragraph 8 of the Federal Law “On Personal Data” or other federal law, which is the basis for such refusal, within a period not exceeding 30 days from the date of the personal data subject's request to provide information on the availability of personal data on the respective personal data subject
2.13.3 In case of receiving a request from the authorized body for the protection of the rights of personal data subjects to provide information necessary to carry out the activities of the said body, the Operator is obliged to inform such information to the authorized body within 30 days from the date of receipt of such request.
2.13.4 In case the purpose of personal data processing is achieved, the Operator is obliged to stop personal data processing and destroy personal data within a period not exceeding 30 working days from the date of achievement of the purpose of personal data processing, unless otherwise provided by the contract to which the personal data subject is a party.
2.13.5. It is prohibited to make decisions based solely on automated processing of personal data, which generate legal consequences in relation to the personal data subject or otherwise affect his/her rights and legitimate interests.
2.14. Personal data confidentiality regime.
2.14.1 The Operator shall ensure confidentiality and security of personal data during their processing in accordance with the requirements of the legislation of the Russian Federation.
2.14.2 The Operator shall not disclose to third parties and shall not disseminate personal data without the consent of the subject of personal data, unless otherwise provided for by the Federal Law.
2.14.3 In accordance with the list of personal data processed on the Website, the personal data of the Website Users is confidential information.
2.14.4 Persons processing personal data shall comply with the requirements of the Operator's regulatory documents in terms of ensuring confidentiality and security of personal data.
3. Processing of personal data
3.1 List of processed personal data of Users:
surname;
first name;
patronymic;
social network profile;
position;
company;
contact phone number;
e-mail.
3.2 Persons authorized to access personal data.
3.2.1 The right of access to personal data of subjects shall be vested in persons authorized in accordance with their official duties.
3.2.2 The list of persons having access to personal data shall be approved by the General Director of the Operator.
3.3 Procedure and terms of storage of personal data on the Website.
3.3.1 The Operator shall only store the Users' personal data on the Website.
3.3.2 The terms of storage of Users' personal data on the Website: no longer than required for the purposes of personal data processing, unless the term of storage of personal data is established by federal law, contract to which the subject of personal data is a party, beneficiary or guarantor.
3.3.3 In case of deletion of data from the Website on the initiative of one of the parties, namely termination of use of the Website, the User's personal data shall be stored in the Operator's databases for five years in accordance with the legislation of the Russian Federation.
3.3.4 Upon expiration of the above period of storage of the User's personal data, the User's personal data shall be deleted automatically by the algorithm set by the Operator.
3.3.5 The Operator does not process Users' personal data on paper.
3.4 Blocking of personal data.
3.4.1 Blocking of personal data means temporary termination of personal data processing operations by the Operator at the User's request in case of revealing by the User of unreliability of the processed data or unlawful, in the opinion of the personal data subject, actions in relation to his/her data.
3.4.2 The Operator does not transfer personal data to third parties and does not entrust the processing of personal data to third parties and organizations. Personal data of the Website Users shall be processed only by the Operator's employees (database administrators, etc.) authorized by the established procedure to process the Users' personal data.
3.4.3 Blocking of personal data on the Website is carried out on the basis of a written application from the subject of personal data.
3.5 Destruction of personal data.
3.5.1 Destruction of personal data means actions, as a result of which it becomes impossible to restore the content of personal data on the Site and/or as a result of which material carriers of personal data are destroyed.
3.5.2 The subject of personal data has the right to demand in writing the destruction of his/her personal data if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing.
3.5.3 If it is not possible to destroy personal data, the Operator shall block such personal data.
3.5.4 Destruction of personal data is performed by erasing the information using certified software with guaranteed destruction (in accordance with the specified characteristics for the installed software with guaranteed destruction).
4.1 Responsibilities.
4.1.1 All employees of the Operator who process personal data are obliged to keep secret the information containing personal data in accordance with the Regulation, requirements of the legislation of the Russian Federation.
4.1.2 Persons guilty of violating the requirements of the Regulations shall bear responsibility stipulated by the legislation of the Russian Federation.
4.1.3 Responsibility for observance of the personal data regime in relation to the personal data in the Site databases shall be borne by those responsible for personal data processing.
5. Final provisions
5.1 In case of changes in the current legislation of the Russian Federation, amendments to the regulatory documents on personal data protection, these Regulations shall be in force in the part not contradicting the current legislation until it is brought into compliance with such legislation.
5.2 The terms and conditions of these Regulations are established, amended and canceled by the Operator unilaterally without prior notice to the User. The previous version of the Regulations shall be deemed null and void from the moment of posting a new version of the Regulations on the Website. In case of material changes in the terms and conditions of these Regulations, the Operator shall notify the Users thereof by posting a corresponding notice on the Website.
5.3 If the User does not agree with the terms and conditions of these Regulations, he/she shall immediately delete his/her profile from the Website, otherwise the User's continued use of the Website means that the User agrees with the terms and conditions of these Regulations.