Documents

Personal Data Processing Policy

1. This Personal Data Processing Policy (the “Policy”) has been developed to protect the rights and freedoms of personal data subjects when their personal data are processed, including the rights to privacy and to personal and family secrecy.

2. This Policy establishes the principles and rules governing the processing and protection of personal data implemented by Hiring Talents LLC (the “Operator”).

3. This Policy has been developed on the basis of the Constitution of the Russian Federation, the Labour Code of the Russian Federation, the Civil Code of the Russian Federation, the federal laws “On Ratification of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data”, “On Personal Data”, “On Information, Information Technologies and Information Protection”, and other regulatory legal acts of the Russian Federation.

4. The Operator shall publish this Policy or otherwise provide unrestricted access to it.

5. The following terms are used in this Policy:

personal data — any information relating directly or indirectly to an identified or identifiable individual (personal data subject);
special categories of personal data — personal data concerning race, nationality, political opinions, religious or philosophical beliefs, health or intimate life;
biometric personal data — information characterising physiological and biological features of a person that may be used to establish identity and that is used by the Operator for that purpose;
operator — a state or municipal authority, legal entity or individual that, independently or jointly with other persons, organises and/or carries out personal data processing and determines the purposes of processing, the categories of personal data to be processed, and the actions performed with such data;
processing of personal data — any action or set of actions performed with personal data, with or without automation, including collection, recording, organisation, accumulation, storage, clarification (updating or alteration), retrieval, use, transfer (distribution, provision or access), depersonalisation, blocking, deletion and destruction;
automated processing of personal data — processing of personal data using computing equipment;
provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons;
blocking of personal data — temporary suspension of personal data processing, except where processing is required to clarify the personal data;
destruction of personal data — actions making it impossible to restore the contents of personal data in a personal data information system and/or resulting in the destruction of physical media containing personal data;
personal data information system — a set of personal data contained in databases together with information technologies and technical means used for their processing;
cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign individual or a foreign legal entity;
user of the Operator’s services — an individual or legal entity using services provided by the Operator;
confidentiality of personal data — the Operator’s obligation not to disclose personal data to third parties, distribute them or permit their distribution without the consent of the personal data subject or another lawful basis;
representative of a personal data subject — a representative of the personal data subject determined in accordance with applicable law.

6. Personal data of personal data subjects are confidential information except in cases provided for by applicable law.

7. Purposes of personal data processing.

8. The Operator processes personal data for the following purposes:

compliance with the Labour Code, Civil Code, Tax Code and other regulatory acts of the Russian Federation;
making decisions on employing a candidate by the Operator or by a client of the Operator;
entering into and performing obligations under employment agreements, non-state pension agreements and compulsory pension insurance agreements;
entering into and performing obligations under civil-law service agreements for services provided by the Operator.

III. Principles and Conditions of Personal Data Processing

8. The Operator processes personal data with due regard for the need to protect the rights and freedoms of personal data subjects, including the right to privacy and personal and family secrecy, and on the basis of the following principles:

personal data shall be processed lawfully and fairly;
processing shall be limited to specific, predetermined and lawful purposes; processing incompatible with the purposes for which the data were collected is not permitted;
databases containing personal data processed for mutually incompatible purposes shall not be combined;
only personal data relevant to the purposes of processing shall be processed;
the content and volume of processed personal data shall correspond to the stated purposes and shall not be excessive in relation to those purposes;
accuracy, sufficiency and, where necessary, relevance of personal data shall be ensured; the Operator shall take measures to delete or correct incomplete or inaccurate data;
personal data shall be stored in a form permitting identification of the subject for no longer than required by the purposes of processing, unless a retention period is established by federal law or by an agreement to which the subject is a party, beneficiary or guarantor;
processed personal data shall be destroyed or depersonalised once the purposes of processing have been achieved or the need to achieve them has ceased, unless otherwise provided by federal law.

9. The Operator processes personal data in the following cases:

processing is necessary for performance of an agreement to which the personal data subject is a party, beneficiary or guarantor, or for entering into an agreement at the initiative of the subject or an agreement under which the subject will be a beneficiary or guarantor;
the personal data subject has consented to processing; where required by law, written consent is used, generally in the form set out in the Personal Data Processing and Protection Regulations of Hiring Talents LLC;
processing is necessary for the administration of justice, enforcement of a judicial act or an act of another authority or official enforceable under Russian enforcement legislation, or for the performance of functions, powers and duties imposed on the Operator by Russian law;
processing is necessary to protect the life, health or other vital interests of the personal data subject where obtaining consent is impossible;
personal data made publicly available by the subject or at the subject’s request are processed;
personal data subject to publication or mandatory disclosure under federal law are processed;
in other cases provided for by Russian law.

10. Processing of special categories of personal data concerning race, nationality, political opinions, religious or philosophical beliefs, health or intimate life is prohibited except in the following cases:

the subject has given written consent to processing;
the subject has made the personal data publicly available;
processing is carried out in accordance with legislation on state social assistance, labour legislation or Russian pension legislation;
processing is necessary to protect the life, health or other vital interests of other persons and obtaining the subject’s consent is impossible;
processing is necessary for the exercise of the rights of the subject or third parties, or in connection with the administration of justice;
processing is carried out in accordance with legislation governing particular types of insurance and insurance legislation;
in other cases provided for by Russian law.

11. Biometric personal data may be processed by the Operator only with the written consent of the personal data subject, except where such processing is carried out in connection with international readmission treaties of the Russian Federation, the administration of justice and enforcement of judicial acts, or in cases provided for by Russian legislation on defence, security, counter-terrorism, transport security, anti-corruption, operational-search activities, public service, criminal enforcement, exit from and entry into the Russian Federation, citizenship, and other cases established by law.

The Operator does not process biometric personal data, except for photographic images of personal data subjects where the conditions prescribed by law are observed.

12. When collecting personal data, including via the Internet, the Operator ensures that personal data of citizens of the Russian Federation are recorded, organised, accumulated, stored, clarified (updated or altered) and retrieved using databases located in the Russian Federation.

Cross-border transfer of personal data by the Operator may take place only subject to the restrictions and procedures established by applicable law.

13. For information purposes, the Operator may use publicly available sources of personal data, including directories and address books. With the subject’s written consent, such sources may include surname, first name, patronymic, year and place of birth, address, telephone number, occupation and other personal data provided by the subject.

Information about a personal data subject shall be removed from publicly available sources at any time at the subject’s request or by decision of a court or other authorised authority.

14. The Operator may process personal data on behalf of another person (operator), unless otherwise provided by federal law, under an agreement with that person, including a state or municipal contract, or under an act adopted by a state or municipal authority (an “operator instruction”).

A company processing personal data on behalf of an operator shall comply with the principles and rules established by Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Federal Law on Personal Data”).

The operator instruction shall specify the actions to be performed with personal data and the purposes of processing, impose an obligation to maintain confidentiality and security of personal data, and specify the requirements for protection of processed personal data in accordance with Article 19 of the Federal Law on Personal Data.

15. An Operator processing personal data on behalf of another person that is a personal data operator is not required to obtain the personal data subject’s consent to such processing.

16. Where another personal data operator instructs the Operator to process personal data, that other person is responsible to the personal data subject for the Operator’s actions. The Operator is responsible to the person that instructed it to process the personal data.

17. When processing personal data, the Operator shall ensure confidentiality and shall not disclose personal data to third parties or distribute them without the subject’s consent unless otherwise provided by federal law.

18. Personal data subjects.

19. The Operator processes personal data of the following categories of subjects:

employees of the Operator, applicants for vacant positions with the Operator, and former employees of the Operator;
individual users of the Operator’s services;
employees of or applicants for vacant positions with a legal entity or individual entrepreneur using the Operator’s services, including where the Operator has received an appropriate instruction from such service user;
any other individual whose personal data become known to the Operator in connection with social benefits, guarantees or compensation provided by the Operator.

1. Personal data processed.

2. The Operator processes the following categories of personal data: surname, first name, patronymic; date of birth; place of birth; residential address; marital status; financial/property status; education; occupation; taxpayer identification number; insurance certificate details; and other personal data processed on the basis of Russian law and/or the Operator’s internal documents, including the Personal Data Processing and Protection Regulations of Hiring Talents LLC.

The Operator may also process other personal data necessary to achieve the purposes specified in clause 7 of this Policy.

20. Personal data of employees processed by the Operator are determined on the basis of the Labour Code of the Russian Federation and the Operator’s internal regulations.

21. Processing and protection of personal data by the Operator.

22. Personal data are processed with the consent of personal data subjects unless otherwise provided by Russian law.

23. Personal data contained in or retrieved from a personal data information system are processed using computing equipment; however, actions such as use, clarification, distribution and destruction in relation to each personal data subject are carried out with direct human involvement.

24. Only employees of the Operator whose duties include personal data processing are permitted to process personal data. Such employees may receive only the personal data necessary for the performance of their duties.

25. Personal data are processed by:

obtaining information containing personal data orally or in writing directly from personal data subjects;
subjects providing originals or copies of documents;
obtaining duly certified copies of documents containing personal data or copying original documents;
obtaining personal data by sending requests to state authorities, state extra-budgetary funds, other state bodies, local authorities, commercial and non-commercial organisations and individuals in cases and in the manner provided by Russian law;
obtaining personal data from publicly available sources in accordance with legal requirements;
recording personal data in journals, books, registers and other accounting forms;
entering personal data into the Operator’s information systems;
using other means and methods of recording personal data obtained in the course of the Operator’s activities.

25. Transfer of personal data to third parties is permitted with the consent of personal data subjects (where required by law, written consent), except where such transfer is permitted by law without the subject’s consent.

When transferring personal data to third parties under concluded agreements, the Operator ensures mandatory compliance with Russian law and the Operator’s internal personal data regulations. Transfer of personal data to authorised executive authorities, including the Federal Tax Service of the Russian Federation, the Pension Fund of the Russian Federation and the Federal Compulsory Medical Insurance Fund, is carried out in accordance with Russian law.

26. Personal data are stored in a form permitting identification of the subject for no longer than required by the purposes of processing. Once those purposes are achieved or cease to be necessary, personal data shall be destroyed. Retention periods are determined in accordance with Russian law and the Operator’s internal regulations.

27. The Operator is prohibited from making decisions that produce legal consequences for a personal data subject or otherwise affect the subject’s rights and legitimate interests solely on the basis of automated processing, except in cases provided for by federal law.

28. The Operator applies necessary and sufficient organisational and technical measures to protect personal data, including information-security tools, detection of unauthorised access, restoration of personal data, access rules, monitoring of security measures and assessment of their effectiveness.

29. The Operator recognises the need for, and is committed to, an appropriate level of security for personal data processed in the course of its core activities, both in terms of compliance with Russian regulatory requirements and on the basis of a reasonable assessment of business risks.

VII. Rights of Personal Data Subjects

30. A personal data subject has the right to:

obtain, in accordance with Russian law, information concerning the Operator’s processing of his or her personal data, except in cases provided by law;
require correction of inaccurate or incomplete personal data and data processed in violation of Russian law;
require blocking or destruction of personal data that are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing;
require notification to all persons to whom inaccurate or incomplete personal data were previously disclosed of all corrections made;
withdraw consent to processing of personal data;
challenge the Operator’s actions or omissions in processing personal data in accordance with Russian law;
exercise other rights provided for by Russian law.

VIII. Obligations of the Operator as a Personal Data Operator

31. When processing personal data, the Operator shall:

take the measures necessary to fulfil the obligations imposed on an operator by Russian legislation on personal data processing and protection;
explain to the personal data subject the legal consequences of refusing to provide personal data where provision is mandatory under Russian law;
block personal data processed unlawfully;
terminate personal data processing in accordance with Russian law;
notify the personal data subject that violations have been remedied or that his or her personal data have been destroyed;
at the request of the subject or the subject’s representative, provide information concerning processing of the subject’s personal data in the manner established by Russian law and the Operator’s regulations.

32. In order to implement the measures necessary to fulfil obligations under Russian law and the Operator’s regulations, the Operator’s General Director appoints, by order, a person responsible for organising personal data processing.

33. The person responsible for organising personal data processing receives instructions directly from the Operator’s General Director and reports to the General Director.

34. The person responsible for organising personal data processing shall, in particular:

organise legal, organisational and technical measures to protect personal data processed by the Operator against unlawful or accidental access, destruction, alteration, blocking, copying, distribution and other unlawful actions;
exercise internal control over compliance with Russian legislation and the Operator’s regulations in the field of personal data, including personal data protection requirements;
inform the Operator’s employees of the provisions of personal data legislation, the Operator’s regulations on personal data processing and personal data protection requirements;
organise the receipt and processing of requests and applications from personal data subjects or their representatives and supervise their handling by the Operator.

1. Liability for violation of personal data processing and protection requirements.

2. Liability for violation of Russian legislation and the Operator’s regulations in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.