Personal Data Processing Agreement

Altaylestehmash LLC policy regarding the processing of personal data

General Provisions

This document defines the Policy of Altaylestekhmash LLC regarding the processing of personal data of employees of Altaylestekhmash LLC and other personal data entities that are not in labour relations with Altaylestekhmash LLC.

The policy of processing personal data at Altaylestekhmash LLC defines the basic principles, goals, conditions and methods of processing personal data, lists of subjects and personal data processed at Altaylestekhmash LLC, the functions of the right of personal data subjects, as well as the requirements for Altaylestekhmash LLC personal data protection.

Purpose of Processing Personal Data

Altaylestekhmash LLC carries out the processing of personal data in order to fulfil labour contracts, enforce civil contracts, maintain a customer base, promote Altai brand products and related works and services, including informing about news, promotions and discounts, about new products of the Altai brand, conducting marketing surveys, surveys within the framework of the Quality of Service Assessment program and other events.
The legal justification for the processing of personal data
The processing of personal data of Altaylestekhmash LLC is carried out on the basis of Articles 23.24 of the Constitution of the Russian Federation, Articles 85-90 of the Labor Code of the Russian Federation dated December 30, 2001, No. 197-FZ, Clauses 1, 2 of Part 1 of Article 6 of the Federal Law of July 27, 2006 No. 152- Federal Law “On Personal Data” with the consent of the personal data subject to the processing of his personal data, as well as for the implementation and fulfilment of the functions, powers and duties assigned by Altaylestekhmash LLC to the legislation.

List of processed categories of personal data

Altaylestekhmash LLC processes the categories of personal data necessary and sufficient for the implementation and fulfilment of the obligations assigned to Altaylestekhmash LLC by the legislation of the Russian Federation, as well as those specified in the consent forms for processing personal data filled out by the personal data subject to achieve the goals specified in clause .2 of this Policy. The content and volume of processed personal data are consistent with the stated processing goals. The list of PD categories: name, phone, e-mail, etc.

Conditions for the processing of personal data

The processing of personal data in Altaylestekhmash LLC is carried out with the consent of the personal data subject to the processing of his personal data unless otherwise provided by the legislation of the Russian Federation in the field of personal data.

LLC Altaylestekhmash without the consent of the subject of personal data does not disclose to third parties and does not disseminate personal data. Altaylestekhmash LLC has the right to entrust the processing of personal data to another person with the consent of the personal data subject on the basis of an agreement concluded with this person. The contract should contain a list of actions (operations) with personal data that will be performed by the person processing the personal data, the purposes of the processing, the obligation of such a person to maintain the confidentiality of personal data and ensure the security of personal data during their processing, as well as the requirements for the protection of processed personal data in accordance with article 19 of the Federal Law "On Personal Data".

Storage of personal data of subjects of personal data is carried out in a form that allows you to determine the subject of personal data, no longer than what is required by the purpose of their processing in accordance with the retention periods determined by the legislation of the Russian Federation and regulatory documents of Altaylestekhmash LLC. The processed personal data is subject to destruction or depersonalization upon achievement of the processing goals or in case of loss of the need to achieve these goals unless otherwise provided by applicable law.

Applied organizational and technical measures to protect personal data

When processing personal data, Altaylestekhmash LLC takes the necessary and sufficient organizational and technical measures to protect personal data from unlawful or accidental access to it, destruction, alteration, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data, including
appointment of a person responsible for organizing the processing of personal data; the presence of local administrative and regulatory documents to ensure the security of personal data; familiarization of persons authorized to work with personal data with local administrative and regulatory documents to ensure the security of personal data; registration of persons authorized to work with personal data; restriction of access to premises where personal data are processed and stored; storage of paper and electronic media of personal data in locked rooms in designated places; periodic monitoring of measures taken to ensure the level of security of personal data; implementation of a permit system of access and delimitation of user access to the personal data information system; the use of secure communication channels when transmitting personal data over the Internet; use of antivirus protection; availability of certified FSTEC means of monitoring the security of information from unauthorized access.

Rights of personal data subjects

Personal data subjects have the right to:
full information about their personal data processed by Altaylestekhmash LLC;
access to your personal data, including the right to receive a copy of any record containing their personal data, with the exception of cases provided for by federal law;
clarification of their personal data, their blocking or destruction in the event that the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of the processing;
withdrawal of consent to the processing of personal data; adoption of measures prescribed by law to protect their rights;
the appeal of the action or inaction of Altaylestekhmash LLC, carried out in violation of the requirements of the legislation of the Russian Federation in the field of personal data, to the authorized body for the protection of the rights of personal data subjects or to the court;
exercise of other rights stipulated by the legislation of the Russian Federation.

Operator Responsibilities

In case of unlawful processing of personal data when contacting the subject of personal data or his representative or at the request of the subject of personal data or his representative, Altaylestekhmash LLC blocks or illegally processes personal data relating to this subject of personal data (if processing personal data is carried out by another person acting on behalf of the Office) from the moment of such appeal or receipt of the said request for the period of inspection.

In the event that inaccurate personal data is detected when contacting the subject of personal data or his representative, or at their request, Altaylestekhmash LLC is obliged to block personal data related to this subject of personal data or to ensure their blocking (if the processing of personal data is carried out by another person acting on behalf of Altaylestekhmash LLC) from the moment of such appeal or receipt of the indicated request for the verification period, if the blocking of personal data does not violate the right and the legitimate interests of the subject of personal data or third parties.

In case of confirmation of the inaccuracy of the personal data of Altaylestekhmash LLC, on the basis of information provided by the personal data subject or its representative or other necessary documents, it clarifies personal data or ensures its clarification (if the processing of personal data is carried out by another person acting on behalf of Altaylestekhmash LLC) within seven business days from the date of submission of such information and removes the blocking of personal data.

In the event that unlawful processing of personal data is carried out by Altaylestekhmash LLC or by a person acting on behalf of Altaylestekhmash LLC, Altaylestekhmash LLC within a period not exceeding three business days from the date of this identification is obliged to stop the illegal processing of personal data or to ensure termination illegal processing of personal data by a person acting on behalf of Altaylestekhmash LLC.

In the event that it is impossible to ensure the legitimacy of the processing of personal data, the Office is obligated to destroy such personal data or to ensure its destruction within a period not exceeding ten business days from the date of detection of illegal processing of personal data. Altaylestekhmash LLC is obliged to notify the subject of personal data or its representative about the elimination of the violations committed or about the destruction of personal data, and if the appeal of the personal data subject or his representative or the request of the authorized body for the protection of the rights of personal data subjects was sent by the authorized body for protection rights of personal data subjects, also the specified authority.

If the goal of processing personal data is achieved, Altaylestekhmash LLC is obliged to stop processing personal data or to ensure its termination (if the processing of personal data is carried out by another person acting on behalf of Altaylestekhmash LLC) and to destroy personal data or to ensure their destruction (if processing personal data is carried out by another person acting on behalf of Altaylestekhmash LLC) within a period not exceeding thirty days from the date of achieving the goal of processing personal data, and otherwise is not provided for by the contract to which the beneficiary or guarantor is the personal data subject, another agreement between the Office and the personal data subject, or if Altaylestekhmash LLC is not entitled to process personal data without the consent of the personal data subject on the grounds provided for by federal laws.
Responsibility for violation of personal data processing requirements
The employees of Altaylestekhmash LLC, who are guilty of violating the requirements of the Federal Law “On Personal Data” and regulatory legal acts adopted in accordance with it, bear material, disciplinary, administrative, civil or criminal liability in the manner prescribed by the legislation of the Russian Federation.