Personal data processing policy

This Personal Data Processing Policy of Limited Liability Company "National Center of Standard Samples" (hereinafter — the Policy) is a document defining the policy of Limited Liability Company "National Center of Standard Samples" regarding the processing of personal data.

GENERAL PROVISIONS

This Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter — the Personal Data Law) and other regulatory legal acts for the purpose of ensuring the protection of the rights and freedoms of Personal Data Subjects when Limited Liability Company "National Center of Standard Samples" processes their personal data, including the protection of the rights to privacy, personal and family secrecy.

The main terms used in this Policy:

Personal data — any information relating to a directly or indirectly identified or identifiable natural person — a Personal Data Subject;
Personal data permitted by the Personal Data Subject for dissemination — personal data to which an unlimited number of persons have been granted access by the Personal Data Subject by giving consent to the processing of personal data permitted by them for dissemination in the manner provided for by the Personal Data Law;
Operator — Limited Liability Company "National Center of Standard Samples";
Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data;
Automated processing of personal data — processing of personal data using computer technology;
Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons;
Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons;
Blocking of personal data — temporary cessation of the processing of personal data (except in cases where processing is necessary for the clarification of personal data);
Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed;
Depersonalization of personal data — actions as a result of which it becomes impossible without the use of additional information to determine the ownership of personal data by a specific Personal Data Subject;
Personal data information system — a set of personal data contained in databases and information technologies and technical means ensuring their processing;
Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign natural person or a foreign legal entity.

Rights and obligations of the Personal Data Subject:

The Personal Data Subject has the right to:

Receive in an accessible form information relating to the processing of their personal data (provided that the information supplied must not contain personal data relating to other Personal Data Subjects, except in cases where there are lawful grounds for disclosing such personal data), including information containing:

Confirmation of the fact of processing of personal data by the Operator;
Legal grounds and purposes of processing of personal data;
Methods of processing of personal data applied by the Operator;
Name and location of the Operator, information about persons (except employees of the Operator) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or on the basis of regulatory legal acts;
Processed personal data relating to the relevant Personal Data Subject, the source of their receipt, unless a different procedure for providing such data is provided for by regulatory legal acts, as well as unless the right of the Personal Data Subject to access their personal data is restricted in accordance with regulatory legal acts, including in the cases specified in Part 8 of Article 14 of the Personal Data Law;
Periods of processing of personal data, including periods of their storage;
Procedure for the exercise by the Personal Data Subject of the rights provided for by the Personal Data Law;
Information on cross-border transfer of data carried out or intended;
Name or surname, first name, patronymic and address of the person processing personal data on behalf of the Operator, if processing has been or will be entrusted to such person;
Information on the methods of fulfillment by the Operator of the obligations established by
Article 18.1 of the Personal Data Law;
Other information provided for by the Personal Data Law or other regulatory legal acts.
Require the Operator to clarify their personal data, block or destroy them if they are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing, as well as take measures to protect their rights provided for by regulatory legal acts.
Appeal against the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects or in court (including to demand compensation for damages and (or) compensation for moral harm in court) if the Personal Data Subject believes that the Operator processes their personal data in violation of the requirements of the Personal Data Law or otherwise violates their rights and freedoms.
Exercise other rights provided for by the Personal Data Law and other regulatory legal acts.

Personal Data Subjects are obliged to fulfill the obligations provided for by the Personal Data Law and other regulatory legal acts.

Rights and obligations of the Operator

The Operator has the right to:

Independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided for by regulatory legal acts.
In the manner established by Part 3 of Article 6 of the Personal Data Law, entrust the processing of personal data to another person with the consent of the Personal Data Subject, unless otherwise provided for by regulatory legal acts. A person processing personal data on behalf of the Operator is not required to obtain the consent of the Personal Data Subject for such processing.
In the event of withdrawal by the Personal Data Subject of consent to the processing of personal data, continue such processing without the consent of the Personal Data Subject if there are grounds specified in clauses 2–11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of the Personal Data Law.
Exercise other rights provided for by the Personal Data Law and other regulatory legal acts.

The Operator is obliged to:

Provide the Personal Data Subject, at their request, with the information provided for by Part 7 of Article 14 of the Personal Data Law.
Explain to the Personal Data Subject the legal consequences of refusal to provide their personal data and (or) to give consent to their processing, if in accordance with regulatory legal acts the provision of personal data and (or) obtaining by the Operator of consent to their processing are mandatory.
Before starting the processing of personal data received not from the Personal Data Subject, provide the latter with the following information: name or surname, first name, patronymic and address of the Operator or its representative; purpose of processing of personal data and its legal basis; list of personal data; intended users of personal data; rights of the Personal Data Subject established by the Personal Data Law; source of receipt of personal data. The Operator is released from the obligation to provide the Personal Data Subject with the specified information in the cases provided for by Part 4 of Article 18 of the Personal Data Law.
Ensure the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in the cases specified in clauses 2, 3, 4, 8 of Part 1 of Article 6 of the Personal Data Law.
Take measures necessary and sufficient to ensure the fulfillment of the obligations provided for by this Policy, the Personal Data Law and regulatory legal acts adopted in accordance with it.
Familiarize its employees directly engaged in the processing of personal data with this Policy and local acts on matters of personal data processing.
Fulfill other obligations provided for by the Personal Data Law and other regulatory legal acts.

PURPOSES OF PERSONAL DATA PROCESSING

Processing of personal data, including their collection, is carried out by the Operator for the purposes of:

Carrying out labor and other relations directly related to labor relations of the Operator with its employees and job applicants, including maintaining personnel and accounting records, assisting in employment (personnel selection), compliance with labor legislation of the Russian Federation;
Filling in and submitting to authorized bodies the required reporting forms, compliance with insurance, pension and tax legislation of the Russian Federation;
Carrying out the business activities of the Operator, including conclusion, performance and termination of contracts with counterparties of the Operator;
Promotion of goods, works, services.

LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

The legal basis for the processing of personal data is a set of regulatory legal and local normative acts, as well as other legally significant documents in execution of and in accordance with which the Operator carries out such processing, including:

Constitution of the Russian Federation;
Civil Code of the Russian Federation;
Labor Code of the Russian Federation;
Tax Code of the Russian Federation;
Personal Data Law;
Federal Law No. 402-FZ of December 6, 2011 "On Accounting";
Federal Law No. 167-FZ of December 15, 2001 "On Mandatory Pension Insurance in the Russian Federation";
Federal Law No. 14-FZ of February 8, 1998 "On Limited Liability Companies";
Other federal laws and subordinate regulatory legal acts adopted on their basis regulating relations related to the activities of the Operator;
Charter of the Operator;
Local normative acts of the Operator;
Contracts, agreements, memoranda concluded between the Operator and Personal Data Subjects.

SCOPE AND CATEGORIES OF PROCESSED PERSONAL DATA. CATEGORIES OF PERSONAL DATA SUBJECTS

Personal Data Subjects to whom this Policy applies include employees of the Operator, their relatives (family members), job applicants (candidates for employment with the Operator), former employees of the Operator, clients and counterparties of the Operator (natural persons) and representatives of clients and counterparties of the Operator (legal entities), visitors to the Operator's website.

Composition (scope) of personal data by categories of Personal Data Subjects:

The following relate to personal data of employees, including former employees, processed by the Operator for the purposes of carrying out labor and other relations directly related to labor relations, including maintaining personnel and accounting records and compliance with the legislation of the Russian Federation:

Surname, first name, patronymic, date and place of birth, sex, citizenship information;
Place of permanent and temporary registration, place of actual residence;
Type, series, number of identity document, date of issue, name of issuing authority, subdivision code;
TIN;
SNILS number;
Information on social, property and family status, family composition, details of marriage certificate, child's birth certificate;
Income information;
Compulsory health insurance policy details;
Bank card details;
Settlement account number;
Personal account number;
Information on employment (profession, position, length of service);
Information on military duty, details of military ID or other military registration document;
Education information, including details of education documents;
Telephone number, email address;
Photo and video image of the face;

Special categories of personal data, namely: health information, information on the presence or absence of a criminal record, — which are processed only for the purpose of establishing compliance of Personal Data Subjects with the requirements of the legislation of the Russian Federation.

The following relate to personal data of a job applicant processed by the Operator for the purposes of assisting in employment (personnel selection) and compliance with the legislation of the Russian Federation:

Surname, first name, patronymic, date and place of birth, sex, citizenship information;
Place of permanent and temporary registration, place of actual residence;
Type, series, number of identity document, date of issue, name of issuing authority, subdivision code;
Employment information;
Education information, including details of education documents;
Telephone number, email address;
Photo and video image of the face;

The following relate to personal data of relatives of employees (family members) processed by the Operator for the purposes of carrying out labor and other relations directly related to labor relations of the Operator with its employees, including maintaining personnel and accounting records and compliance with the legislation of the Russian Federation:

Surname, first name, patronymic, date and place of birth, sex, citizenship information;
Place of permanent and temporary registration, place of actual residence;
Details of marriage certificate (for spouse), birth certificate (for child);
Telephone number.

The following relate to personal data of clients and counterparties of the Operator (natural persons) and representatives of clients and counterparties of the Operator (natural and legal persons) processed by the Operator for the purposes of carrying out its business activities, including conclusion, performance and termination of contracts with its counterparties, as well as compliance with the legislation of the Russian Federation:

Surname, first name, patronymic, date and place of birth, sex, citizenship information;
Place of permanent and temporary registration, place of actual residence;
Type, series, number of identity document, date of issue, name of issuing authority, subdivision code;
TIN;
SNILS number;
Education information;
Bank account details;
Income information;
Details of the document certifying authority to act on behalf of the client or counterparty of the Operator (for representatives of clients and counterparties of the Operator (natural and legal persons));
Photo and video image of the face;
Telephone number, email address.

The following relate to personal data of visitors to the Operator's website processed by the Operator for the purposes of promoting goods, works, services of the Operator and obtaining feedback:

Surname, first name, patronymic, date of birth, sex;
Telephone number, email address;
Information collected through metric programs.

PROCEDURE AND CONDITIONS FOR PERSONAL DATA PROCESSING

Personal data is processed in compliance with the following principles:

Personal data is processed on a lawful and fair basis;
Processing of personal data is limited to the achievement of specific, predetermined and lawful purposes to which the content and scope of processed personal data must correspond;
When processing personal data, their accuracy, sufficiency, and where necessary — relevance in relation to the purposes of processing — is ensured;
Storage of personal data is carried out in a form that makes it possible to identify the Personal Data Subject, and for no longer than required by the purposes of processing of personal data, unless the period of their storage is established by regulatory legal acts or a contract to which the Personal Data Subject is a party, beneficiary or guarantor;
Processed personal data is subject to destruction or depersonalization upon achievement of the purposes of processing or if the need to achieve these purposes has ceased, provided that otherwise is not provided for by regulatory legal acts.

When processing personal data, the following is not permitted:

Processing of personal data incompatible with the purposes of collection of personal data;
Merging of databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
Excessiveness of processed personal data in relation to the stated purposes of their processing.

Processing of personal data is carried out with the consent of the Personal Data Subject except in cases established by the legislation of the Russian Federation.

The Personal Data Subject decides on the provision of their personal data and gives consent to their processing freely, of their own will and in their own interest. Consent to the processing of personal data must be specific, substantive, informed, conscious and unambiguous. Such consent may be given in any form that makes it possible to confirm the fact of its receipt, unless otherwise established by regulatory legal acts.

Consent to the processing of personal data may be withdrawn by the Personal Data Subject.

In cases provided for by regulatory legal acts, processing of personal data is carried out only with consent provided in written form by the Personal Data Subject.

Special categories of personal data are processed with the written consent of the Personal Data Subject, except in cases provided for by the Personal Data Law.

Personal data is processed using automation tools and without the use of automation tools.

Personal data of Personal Data Subjects is placed by the Operator in the following information systems:

Personal data information system of employees of the Operator, as well as persons who are not employees of the Operator but whose personal data the Operator must process in accordance with labor legislation of the Russian Federation;
Personal data information system of clients and counterparties of the Operator (natural persons) and representatives of clients and counterparties of the Operator (natural and legal persons), as well as visitors to the Operator's website.

The Operator carries out the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), including cross-border, depersonalization, blocking, deletion, destruction of personal data.

The Operator transfers personal data to third parties with the written consent of the Personal Data Subject, except in cases established by the legislation of the Russian Federation when such consent is not required. The Operator may transfer personal data to inquiry and investigation bodies, other authorized bodies on the grounds provided for by the current legislation of the Russian Federation.

The Operator disseminates personal data permitted by the Personal Data Subject for dissemination, that is, carries out actions aimed at their disclosure to an indefinite number of persons, in compliance with prohibitions and conditions established by Article 10.1 of the Personal Data Law. Consent to the processing of personal data permitted by the Personal Data Subject for dissemination is executed separately from other consents of such Personal Data Subject to the processing of their personal data.

When collecting personal data, including through the Internet information and telecommunications network, recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located outside the territory of the Russian Federation is not permitted, except in the cases specified in clauses 2, 3, 4, 8 of Part 1 of Article 6 of the Personal Data Law.

The Operator complies with general rules for the storage of personal data, including the following:

Personal data is stored for the period established by the legislation of the Russian Federation.

When processing personal data without the use of automation tools, personal data is separated from other information by recording it on separate material carriers of personal data, in special sections or in fields of forms (templates).

When recording personal data on material carriers, personal data whose purposes of processing are knowingly incompatible are not recorded on one material carrier.

For the purpose of processing different categories of personal data, a separate material carrier is used for each category.

The Operator ensures separate storage of personal data (material carriers) the processing of which is carried out for different purposes.

When storing material carriers, measures are established ensuring the safety of personal data and excluding unauthorized access to them, namely: admission to premises for storage of material carriers with personal data only of those persons who are included in the list of persons having access to personal data for the purpose of performing their labor (official) duties.

The Operator maintains the confidentiality of personal data and ensures compliance with the following measures for the protection of personal data:

The Operator who has gained access to personal data does not disclose to third parties and does not disseminate personal data without the consent of the Personal Data Subject, unless otherwise provided for by regulatory legal acts.

When processing personal data for their protection from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination, as well as from other unlawful actions, the Operator takes necessary legal, organizational and technical measures or ensures their adoption, namely:

Identification of threats to the security of personal data during their processing in personal data information systems (hereinafter — information system);
Application of organizational and technical measures to ensure the security of personal data during their processing in information systems necessary to fulfill the requirements for the protection of personal data, compliance with which ensures the levels of protection of personal data established by the Government of the Russian Federation;
Application of information protection means that have passed the conformity assessment procedure in the prescribed manner;
Application for the destruction of personal data of information protection means (which include a function for the destruction of information) that have passed the conformity assessment procedure in the prescribed manner;
Assessment of the effectiveness of measures taken to ensure the security of personal data before putting the information system into operation;
Maintenance of records of machine-readable carriers of personal data;
Ensuring detection of facts of unauthorized access to personal data and taking measures, including detection, prevention and elimination of consequences of computer attacks on information systems and response to computer incidents in them;
Ensuring restoration of personal data modified or destroyed as a result of unauthorized access to them;
Establishment of rules of access to personal data processed in the information system, as well as ensuring registration and accounting of all actions performed with personal data in the information system;
Exercise of control over measures taken to ensure the security of personal data and the level of protection of information systems.

When processing personal data in information systems, the Operator complies with the requirements established by Decree of the Government of the Russian Federation No. 1119 of November 1, 2012 "On Approval of Requirements for the Protection of Personal Data during Their Processing in Personal Data Information Systems" and other regulatory legal acts.

When processing personal data without the use of automation tools, the Operator complies with the requirements established by the Regulation on the Specifics of Processing of Personal Data Carried Out without the Use of Automation Tools, approved by Decree of the Government of the Russian Federation No. 687 of September 15, 2008.

UPDATING (CLARIFICATION), DELETION AND DESTRUCTION OF PERSONAL DATA. RESPONSES TO REQUESTS OF SUBJECTS FOR ACCESS TO PERSONAL DATA

In the event of confirmation of the fact of inaccuracy of personal data, the Operator on the basis of information submitted by the Personal Data Subject or their representative or the authorized body for the protection of the rights of personal data subjects, or other necessary documents clarifies personal data or ensures their clarification (if processing of personal data is carried out by another person acting on behalf of the Operator) within seven business days from the date of receipt of such information, after which the blocking of personal data is lifted.

The Operator blocks personal data or ensures their blocking (if processing of personal data is carried out by another person acting on behalf of the Operator) in the following cases and within the following periods:

If unlawful processing of personal data is identified upon application of the Personal Data Subject or their representative or upon request of the Personal Data Subject or their representative or the authorized body for the protection of the rights of personal data subjects — from the moment of such application or receipt of the specified request for the period of verification;
If inaccurate personal data are identified upon application of the Personal Data Subject or their representative or upon their request or upon request of the authorized body for the protection of the rights of personal data subjects — from the moment of such application or receipt of the specified request for the period of verification, if blocking of personal data does not violate the rights and legitimate interests of the Personal Data Subject or third parties;
If it is not possible to destroy personal data within the period specified in Parts 3–5.1 of Article 21 of the Personal Data Law — until the moment of destruction.

The Operator ceases processing of personal data or ensures cessation of such processing by a person acting on behalf of the Operator in the following cases:

If the reasons due to which special categories of personal data were processed in the cases provided for by Parts 2 and 3 of Article 10 of the Personal Data Law have been eliminated, provided that otherwise is not established by federal law;
If unlawful processing of personal data carried out by the Operator or a person acting on behalf of the Operator is identified — within a period of no more than three business days from the date of such identification;
If the purposes of processing of personal data have been achieved;
If the Personal Data Subject has withdrawn consent to the processing of their personal data;
If the Personal Data Subject has applied to the Operator with a demand to cease processing — within a period of no more than ten business days from the date of receipt of the relevant demand. This period may be extended, but by no more than five business days, if the Operator sends the Personal Data Subject a reasoned notice indicating the reasons for extension of the period.

The Operator destroys personal data in compliance with the following rules:

The Operator destroys personal data, in particular, in the following cases and within the following periods:

If the purposes of processing of personal data have been achieved or the need to achieve them has ceased — within a period of no more than thirty days from the date of achievement of the specified purposes, unless otherwise provided for by a contract to which the Personal Data Subject is a party, beneficiary or guarantor, another agreement between the Operator and the Personal Data Subject, or if the Operator is not entitled to process personal data without the consent of the Personal Data Subject on the grounds provided for by federal laws;
If the Personal Data Subject or their representative has submitted information confirming that such personal data were obtained unlawfully or are not necessary for the stated purpose of processing — within a period of no more than seven business days from the date of submission of such information;
If unlawful processing of personal data is identified, provided that it is impossible to ensure its lawfulness — within a period of no more than ten business days from the date of identification of unlawful processing;
If the Personal Data Subject has withdrawn consent to the processing of their personal data, provided that retention of such data is no longer required for the purposes of their processing — within a period of no more than thirty days from the date of receipt of the withdrawal, provided that otherwise is not provided for by a contract to which the Personal Data Subject is a party, beneficiary or guarantor, another agreement between the Operator and the Personal Data Subject, or in the event that the Operator is not entitled to process personal data without the consent of the Personal Data Subject on the grounds provided for by federal laws.

When processing personal data without the use of automation tools, the document confirming destruction of personal data is the Act on Destruction of Personal Data.

When processing personal data using automation tools, the documents confirming destruction of personal data are the Act on Destruction of Personal Data and Export from the Event Registration Log in the personal data information system (hereinafter — Export from the Log).

When processing personal data simultaneously with and without the use of automation tools, the documents confirming destruction of personal data are the Act on Destruction of Personal Data and Export from the Log.

The Act on Destruction of Personal Data and Export from the Log are subject to storage for 3 years from the moment of destruction of personal data.

The Operator responds to requests of Personal Data Subjects in compliance with the following rules:

Personal Data Subjects are entitled to apply to the Operator and send requests on matters specified in the Personal Data Law, including requests:

For provision of information specified in Part 7 of Article 14 of the Personal Data Law;
For provision of information on the availability of personal data relating to the relevant Personal Data Subject and for provision of the opportunity to familiarize themselves with such personal data;
For clarification of their personal data, their blocking or destruction if personal data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing;
With a demand to cease processing of personal data.
The Operator provides the information specified in Part 7 of Article 14 of the Personal Data Law to the Personal Data Subject or their representative within ten business days from the moment of application or receipt of the relevant request of the Personal Data Subject or their representative. The specified period may be extended, but by no more than five business days, if the Operator sends the Personal Data Subject a reasoned notice indicating the reasons for extension of the period. The Operator provides the specified information to the Personal Data Subject or their representative in the form in which the relevant application or request was sent, unless otherwise indicated in the application or request.

The request must contain:

Number of the main identity document of the Personal Data Subject or their representative, information on the date of issue of the specified document and the issuing authority;
Information confirming participation of the Personal Data Subject in relations with the Operator (contract number, date of conclusion of the contract, conditional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator;
Signature of the Personal Data Subject or their representative. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator informs the Personal Data Subject or their representative in the manner provided for by Article 14 of the Personal Data Law of information on the availability of personal data relating to the relevant Personal Data Subject, and also provides the opportunity to familiarize themselves with such data upon application of the Personal Data Subject or their representative or within ten business days from the date of receipt of the request of the Personal Data Subject or their representative. The specified period may be extended, but by no more than five business days, if the Operator sends the Personal Data Subject a reasoned notice indicating the reasons for extension of the period.

In the event of refusal to provide information on the availability of personal data relating to the relevant Personal Data Subject or personal data to the Personal Data Subject or their representative upon their application or upon receipt of a request of the Personal Data Subject or their representative, the Operator gives a reasoned response in writing with reference to the provision of Part 8 of Article 14 of the Personal Data Law or another regulatory legal act that is the basis for such refusal. The response is given within a period of no more than ten business days from the date of application of the Personal Data Subject or their representative or from the date of receipt of the request of the Personal Data Subject or their representative. The specified period may be extended, but by no more than five business days, if the Operator sends the Personal Data Subject a reasoned notice indicating the reasons for extension of the period.

FINAL PROVISIONS

This Policy enters into force from the date of its approval and applies to relations arising after its entry into force.

This Policy is posted on the Operator's website on the Internet with the domain name: "нцсо.рф".

In execution of this Policy, the Operator adopts local normative acts.

The Operator has the right to make changes to this Policy. The new version of the Policy is also posted on the Operator's website.

Download printable versionPDF · 4.1 MB · in Russian