Personal Data Processing Policy

1. General Provisions

1.1. This Personal Data Processing Policy of GETH LLC (hereinafter — the Policy) has been developed pursuant to the requirements of Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (hereinafter — the Personal Data Law) in order to ensure the protection of the rights and freedoms of individuals and citizens in the processing of their personal data, including the protection of the rights to privacy and to personal and family secrecy.

1.2. The Policy applies to all personal data processed by GETH LLC (hereinafter — the Operator, GETH).

1.3. The Policy applies to relations in the field of personal data processing that arose for the Operator both before and after the approval of this Policy.

1.4. Pursuant to the requirements of Part 2, Article 18.1 of the Personal Data Law, this Policy is published in open access on the Internet on the Operator’s website.

1.5. Key terms used in the Policy:

personal data — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject);
personal data operator (operator) — a state body, municipal body, legal entity or natural person that, independently or jointly with other persons, organizes and (or) carries out the processing of personal data and also determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data;
personal data processing — any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools.

Personal data processing includes, among other things:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
extraction;
use;
transfer (dissemination, provision, access);
depersonalization;
blocking;
deletion;
destruction;
automated personal data processing — processing of personal data by means of computer technology;
dissemination of personal data — actions aimed at disclosing personal data to an unlimited number of persons;
provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons;
blocking of personal data — temporary suspension of personal data processing (except where processing is necessary to clarify the personal data);
destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the physical media of personal data are destroyed;
depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine which specific personal data subject the personal data belongs to;
personal data information system — a set of personal data contained in databases together with the information technologies and technical means that enable their processing;
cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to a foreign government authority, a foreign natural person or a foreign legal entity.

1.6. Principal rights and obligations of the Operator.

1.6.1. The Operator has the right to:

independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Personal Data Law and the regulatory legal acts adopted pursuant to it, unless otherwise provided by the Personal Data Law or other federal laws;
entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with that person. A person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law;
in the event that the personal data subject withdraws consent to the processing of personal data, the Operator is entitled to continue processing the personal data without the consent of the personal data subject where there are grounds specified in the Personal Data Law.

1.6.2. The Operator is obliged to:

organize the processing of personal data in accordance with the requirements of the Personal Data Law;
respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
provide the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)), upon request of that body, with the necessary information within 30 days from the date of receipt of such request.

1.7. Principal rights of the personal data subject. The personal data subject has the right to:

receive information concerning the processing of their personal data, except in cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
require the operator to clarify their personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and also take measures provided for by law to protect their rights;
require prior consent as a condition for the processing of personal data for the purpose of promoting goods, works and services on the market;
appeal to Roskomnadzor or to a court against unlawful actions or omissions of the Operator in the processing of their personal data.

1.8. Compliance with the requirements of this Policy is monitored by an authorized person responsible for organizing the processing of personal data at the Operator.

1.9. Liability for violation of the requirements of the legislation of the Russian Federation and the internal regulations of GETH in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.

2. Purposes of Personal Data Collection

2.1. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes.

Processing of personal data that is incompatible with the purposes of personal data collection is not permitted.

2.2. Only personal data that meet the purposes of their processing are subject to processing.

2.3. The Operator processes personal data for the following purposes:

ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation;
carrying out its activities in accordance with the Articles of Association of GETH;
maintaining HR records;
assisting employees with employment, education and career advancement, ensuring the personal safety of employees, monitoring the quantity and quality of work performed, and ensuring the safety of property;
attracting and selecting candidates for employment with the Operator;
arranging the individual (personalized) registration of employees in the mandatory pension insurance system;
completing and submitting the required reporting forms to executive authorities and other authorized organizations;
carrying out civil-law relations;
maintaining accounting records;
maintaining access control.

2.4. The personal data of employees may be processed solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

3. Legal Grounds for the Processing of Personal Data

3.1. The legal grounds for the processing of personal data are the set of regulatory legal acts pursuant to which and in accordance with which the Operator processes personal data, including:

the Constitution of the Russian Federation;
the Civil Code of the Russian Federation;
the Labor Code of the Russian Federation;
the Tax Code of the Russian Federation;
Federal Law No. 14-FZ of February 8, 1998 “On Limited Liability Companies”;
Federal Law No. 402-FZ of December 6, 2011 “On Accounting”;
Federal Law No. 167-FZ of December 15, 2001 “On Mandatory Pension Insurance in the Russian Federation”;
other regulatory legal acts governing relations connected with the Operator’s activities.

3.2. The legal grounds for the processing of personal data also include:

the Articles of Association of GETH;
agreements concluded between the Operator and personal data subjects;
the consent of personal data subjects to the processing of their personal data.

4. Scope and Categories of Personal Data Processed; Categories of Personal Data Subjects

4.1. The content and scope of the personal data processed must correspond to the stated purposes of processing set out in Section 2 of this Policy. The personal data processed must not be excessive in relation to the stated purposes of their processing.

4.2. The Operator may process the personal data of the following categories of personal data subjects.

4.2.1. Candidates for employment with the Operator:

surname, first name, patronymic;
gender;
citizenship;
date and place of birth;
contact details;
information on education, work experience and qualifications;
other personal data provided by candidates in résumés and cover letters.

4.2.2. Current and former employees of the Operator:

surname, first name, patronymic;
gender;
citizenship;
date and place of birth;
image (photograph);
passport details;
registered residential address;
actual residential address;
contact details;
individual taxpayer number;
individual insurance account number (SNILS);
information on education, qualifications, professional training and advanced training;
marital status, children, family relationships;
information on employment history, including incentives, awards and (or) disciplinary sanctions;
marriage registration details;
military registration details;
disability details;
information on alimony withholdings;
information on income from the previous place of employment;
other personal data provided by employees in accordance with the requirements of labor legislation.

4.2.3. Family members of the Operator’s employees:

surname, first name, patronymic;
degree of kinship;
year of birth;
other personal data provided by employees in accordance with the requirements of labor legislation.

4.2.4. Clients and counterparties of the Operator (natural persons):

surname, first name, patronymic;
date and place of birth;
passport details;
registered residential address;
contact details;
position held;
individual taxpayer number;
bank account number;
other personal data provided by clients and counterparties (natural persons) that are necessary for the conclusion and performance of agreements.

4.2.5. Representatives (employees) of the Operator’s clients and counterparties (legal entities):

surname, first name, patronymic;
passport details;
contact details;
position held;
other personal data provided by representatives (employees) of clients and counterparties that are necessary for the conclusion and performance of agreements.

4.3. The Operator processes biometric personal data (information characterizing the physiological and biological features of a person on the basis of which their identity can be established) in accordance with the legislation of the Russian Federation.

4.4. The Operator does not process special categories of personal data relating to race, ethnicity, political views, religious or philosophical beliefs, health or intimate life, except in cases provided for by the legislation of Russia.

5. Procedure and Conditions for the Processing of Personal Data

5.1. Personal data are processed by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. Personal data are processed with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.

5.3. The Operator carries out both automated and non-automated processing of personal data.

5.4. Only employees of the Operator whose job duties include the processing of personal data are permitted to process personal data.

5.5. Personal data are processed by means of:

obtaining personal data orally and in writing directly from personal data subjects;
obtaining personal data from publicly available sources;
entering personal data into the Operator’s logs, registers and information systems;
using other methods of personal data processing.

5.6. Disclosure of personal data to third parties and dissemination of personal data without the consent of the personal data subject is not permitted, unless otherwise provided by federal law.

5.7. Personal data are transferred to inquiry and investigative bodies, the Federal Tax Service, the Pension Fund of the Russian Federation, the Social Insurance Fund and other authorized executive authorities and organizations in accordance with the requirements of the legislation of the Russian Federation.

5.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, dissemination and other unauthorized actions, including:

identifying threats to the security of personal data during their processing;
adopting internal regulations and other documents governing relations in the field of personal data processing and protection;
appointing persons responsible for ensuring the security of personal data in the Operator’s structural units and information systems;
creating the necessary conditions for working with personal data;
keeping records of documents containing personal data;
organizing work with the information systems in which personal data are processed;
storing personal data under conditions that ensure their preservation and prevent unauthorized access to them;
organizing training for the Operator’s employees who process personal data.

5.9. The Operator stores personal data in a form that makes it possible to identify the personal data subject for no longer than is required by the purposes of personal data processing, unless the retention period for personal data is established by federal law or an agreement.

5.10. When collecting personal data, including via the Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification) and extraction of the personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, except in cases specified in the Personal Data Law.

6. Updating, Correction, Deletion and Destruction of Personal Data; Responses to Data Subject Access Requests

6.1. Confirmation of the fact that personal data are processed by the Operator, the legal grounds and purposes of personal data processing, as well as other information specified in Part 7, Article 14 of the Personal Data Law, are provided by the Operator to the personal data subject or their representative upon application or upon receipt of a request from the personal data subject or their representative.

The information provided does not include personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data.

The request must contain:

the number of the primary identity document of the personal data subject or their representative, information on the date of issue of that document and the issuing authority;
information confirming the personal data subject’s relationship with the Operator (agreement number, date of conclusion of the agreement, conventional verbal designation and (or) other information), or information otherwise confirming the fact that the Operator processes the personal data;
the signature of the personal data subject or their representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

If the application (request) of the personal data subject does not contain all the necessary information in accordance with the requirements of the Personal Data Law, or if the subject does not have the right of access to the requested information, a reasoned refusal is sent to them.

The right of the personal data subject to access their personal data may be restricted in accordance with Part 8, Article 14 of the Personal Data Law, including where the personal data subject’s access to their personal data violates the rights and legitimate interests of third parties.

6.2. If inaccurate personal data are identified upon application by the personal data subject or their representative, or at their request or at the request of Roskomnadzor, the Operator blocks the personal data relating to that personal data subject from the moment of such application or receipt of the said request for the period of verification, provided that blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties. If the inaccuracy of the personal data is confirmed, the Operator, on the basis of the information submitted by the personal data subject or their representative or by Roskomnadzor, or other necessary documents, clarifies the personal data within seven business days from the date such information is submitted and lifts the blocking of the personal data.

6.3. If unlawful processing of personal data is identified upon application (request) by the personal data subject or their representative or by Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to that personal data subject from the moment of such application or receipt of the request.

6.4. Once the purposes of personal data processing have been achieved, and also in the event that the personal data subject withdraws consent to their processing, the personal data are subject to destruction, unless:

otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
the Operator is entitled to process the data without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
otherwise provided by another agreement between the Operator and the personal data subject.