Personal data processing policy

1. General Provisions

Personal Data Processing Policy

1.1. This Policy has been developed to determine the legal grounds, purposes and methods of processing personal data in Alkor Technologies LLC, categories and list of processed personal data and contains other provisions related to the processing and protection of personal data, in accordance with the current legislation of the Russian Federation.

1.2. For the purposes of this Policy, the concepts established by Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as Law No. 152-FZ) are used.

1.3. In order to implement this Policy, Alkor Technologies LLC develops local regulations specifying the issues of processing and protecting personal data.

1.4. This Policy is the basis for the development and updating by subsidiaries and organizations of Alkor Technologies LLC of local regulations defining the policy for processing personal data in them.

2. Principles and legal grounds for processing personal data

2.1. The processing of personal data in Alkor Technologies LLC is carried out in accordance with the principles established by Article 5 of Law No. 152-FZ.

2.2. The legal grounds for processing personal data in Alkor Technologies LLC are:

the provisions of regulatory legal acts, in pursuance of and in accordance with which Alkor Technologies LLC processes personal data, including the Constitution of the Russian Federation, the Labor Code of the Russian Federation, the Civil Code of the Russian Federation, the Civil Procedure Code of the Russian Federation, the Tax Code of the Russian Federation, the Arbitration Procedure Code of the Russian Federation, the Code of the Russian Federation on Administrative Offenses, the Federal Law of December 26, 1995 No. 208-FZ "On Joint-Stock Companies", the Federal Law of February 8, 1998 No. 14-FZ "On Limited Liability Companies", the Federal Law of December 6, 2011 No. 402-FZ "On Accounting", the Federal Law of April 1, 1996 No. 27-FZ "On Individual (Personalized) Accounting in the Systems of Compulsory Pension Insurance and Compulsory Social Insurance", Federal Law of December 28, 2013 No. 400-FZ "On Insurance Pensions", Federal Law of April 22, 1996 No. 39-FZ "On the Securities Market", Law No. 152-FZ, Federal Law of July 27, 2006 No. 149-FZ "On Information, Information Technologies and the Protection of Information";
other regulatory legal acts of the Russian Federation and authorized government bodies;
Charter of Alkor Technologies LLC and local regulatory acts of Alkor Technologies LLC;
agreements concluded between Alkor Technologies LLC and the subject of personal data or a third party, under which the subject of personal data data is the beneficiary or guarantor;
consent of the subjects of personal data to the processing of personal data, drawn up in accordance with the requirements of the legislation of the Russian Federation for the relevant category of personal data.

3. The purposes of processing personal data in Alkor Technologies LLC, categories and list of personal data processed, categories of subjects whose personal data are processed, methods, terms of their processing and storage, the procedure for the destruction of personal data

3.1. Processing of personal data of personal data subjects is carried out by Alkor Technologies LLC for the following purposes:

implementation by Alkor Technologies LLC of the functions, powers and duties stipulated by the legislation of the Russian Federation and the Charter of Alkor Technologies LLC;
regulation of labor and other directly related relations with employees;
selection of personnel to fill positions in Alkor Technologies LLC, formation of a personnel reserve in Alkor Technologies LLC, its subsidiaries and organizations;
provision of additional guarantees and compensation to employees of Alkor Technologies LLC and members of their families, as well as other subjects of personal data entitled to social security in accordance with local regulations of Alkor Technologies LLC;
preparation, conclusion, execution and termination of a civil law contract to which LLC is a party "Alkor Technologies";
protection of rights and legitimate interests of Alkor Technologies LLC in administrative and judicial proceedings;
consideration of appeals from citizens of the Russian Federation and other individuals;
ensuring access control and internal facility regimes at the facilities of Alkor Technologies LLC;
organization of socially significant and corporate events of Alkor Technologies LLC;
implementation of sponsorship and charitable activities of Alkor Technologies LLC;
coverage of the activities of Alkor Technologies LLC, its subsidiaries and organizations on the websites of Alkor Technologies LLC in the information and telecommunications network "Internet";
formation of reference materials for internal information support of the activities of Alkor Technologies LLC, its subsidiaries and organizations.

3.2. The structural divisions of Alkor Technologies LLC develop regulations for the processing of personal data (hereinafter referred to as the Regulations of the structural divisions), which, depending on the tasks and functions performed by the said structural divisions of Alkor Technologies LLC, may specify the purposes of processing personal data determined by Alkor Technologies LLC, and also indicate additional information defining the specifics of processing personal data in the structural divisions of Alkor Technologies LLC within the framework of the purposes defined by this Policy.

3.3. The categories of subjects whose personal data are processed by Alkor Technologies LLC to ensure the implementation of the purposes of processing personal data specified in paragraph 3.1 of this Policy include:
employees of Alkor Technologies LLC;
employees of subsidiaries and organizations of Alkor Technologies LLC;
family members and close relatives of employees of Alkor Technologies LLC, including those insured (subject to insurance) under voluntary health insurance contracts concluded by Alkor Technologies LLC;
candidates for positions in Alkor Technologies LLC;
family members and close relatives of candidates for positions in Alkor Technologies LLC;
candidates for management positions in subsidiaries and organizations of Alkor Technologies LLC;
retirees of Alkor Technologies LLC;
family members of retirees of Alkor Technologies LLC, insured (subject to insurance) under voluntary health insurance contracts concluded by Alkor LLC Technologies";
former employees of Alkor Technologies LLC;
individuals nominated for corporate awards of Alkor Technologies LLC;
counterparties of Alkor Technologies LLC (individuals);
representatives of counterparties of Alkor Technologies LLC (legal entities);
individuals in the chain of owners of counterparties of Alkor Technologies LLC, including beneficiaries;
shareholders of Alkor Technologies LLC and their authorized representatives;
candidates for nomination for election to the management and control bodies of Alkor Technologies LLC;
individuals who are shareholders and (or) participants in long-term financial investment objects of Alkor Technologies LLC, its subsidiaries and organizations;
holders of depositary receipts for shares of Alkor Technologies LLC and other persons exercising rights under depositary receipts;
insiders of Alkor Technologies LLC;
persons included in the management bodies of Alkor Technologies LLC and bodies controlling the financial and economic activities of Alkor Technologies LLC;
persons included in the management bodies of organizations controlled by Alkor Technologies LLC, information about which is subject to inclusion in the issuer's reports;
holders of bonds of Alkor Technologies LLC;
individuals who are participants in the procurement of goods, works, services carried out by Alkor Technologies LLC;
individuals participating in judicial and arbitration cases concerning the protection of the rights and legitimate interests of Alkor Technologies LLC, its subsidiaries societies and organizations (participants in the case, their representatives, defense attorneys, defendants, victims, witnesses, experts and other persons, as well as officials of state authorities authorized to consider cases of administrative offenses);
visitors allowed into the facilities of Alkor Technologies LLC;
individuals sending requests to Alkor Technologies LLC;
users of Alkor Technologies LLC websites on the Internet;
other individuals who have provided their personal data for the purposes of their processing, as provided for in paragraph 3.1 of this Policy.

3.4. The categories and list of personal data processed by Alkor Technologies LLC for each of the categories of personal data subjects specified in paragraph 3.3 of this Policy are determined in accordance with the legislation of the Russian Federation and international treaties of the Russian Federation, local regulations of Alkor Technologies LLC, taking into account the purposes of processing personal data specified in paragraph 3.1 of this Policy, and include:
last name, first name, patronymic (if any) (including previous last names, first names and (or) patronymics (if any) in case of their change); date and place of birth; date of death; information contained in identity documents; gender; citizenship (including citizenship of a foreign state, nationality); registration address; actual address of residence; taxpayer identification number; insurance number of an individual personal account; information contained in military registration documents; information contained in documents on education, qualifications; place of work; information on the position held; address of remote performance of work function; data on labor activity; information on income; information on inclusion in the personnel reserve; information on classification as a veteran in accordance with the Federal Law "On Veterans"; information on participation in the governing bodies of legal entities; information on marital status; information on family composition; information on access to information constituting a state secret; information contained in documents on awards; information on social benefits that are provided in accordance with the legislation of the Russian Federation, as well as collective agreements and local regulations of Alkor Technologies LLC, its subsidiaries and organizations; information on proficiency in foreign languages; information on the presence of an academic degree, academic title; information on scientific works and inventions; information on membership in elected bodies; information on the results of certification; information on disciplinary sanctions; information contained in the employment contract; information about state or municipal service; information about stay abroad; other information specified in the autobiography; telephone subscriber number (service, personal); email address; information about dependents; bank card account number; photograph; data generated when visiting the websites of Alkor Technologies LLC (cookies); other information that meets the purposes of processing personal data specified in paragraph 3.1 of this Policy and is provided by the subject of personal data;
personal data included in the category of "special categories of personal data" - information about the presence or absence of a criminal record; information about the state of health in cases stipulated by the legislation of the Russian Federation.

Processing of special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, intimate life, is not carried out in Alkor Technologies LLC.

Processing of biometric personal data in Alkor Technologies LLC is allowed only with the written consent of the subject of personal data, except for cases stipulated by the legislation of the Russian Federation.

Processing of personal data permitted by the subject of personal data for distribution is carried out in Alkor Technologies LLC on the basis of the consent of the subject of personal data for distribution in compliance with the prohibitions and conditions for the processing of personal data established by the subject of personal data.

3.5. For each purpose of personal data processing specified in paragraph 3.1 of this Policy, one of the methods of personal data processing is used - automated, non-automated or mixed:
automated - using computer technology and special network directories designed to work with confidential information and (or) in personal data information systems;
non-automated - by maintaining journals, files in accordance with the nomenclature of files and recording personal data on other paper media in accordance with the appendices to the Regulations of structural divisions;
mixed - a combination of the specified methods.

3.6. The terms of processing and storage of personal data of the categories of personal data subjects specified in paragraph 3.3 of this Policy are determined in accordance with the requirements of the legislation of the Russian Federation and local regulations of Alkor Technologies LLC governing these issues, as well as the provisions of the agreement, the party, beneficiary or guarantor of which is the personal data subject, and in their absence - the consent of the personal data subject to the processing of personal data.

In this case, the processing and storage of personal data is carried out no longer than required by the purposes of processing the personal data, unless otherwise established by the legislation of the Russian Federation.

3.7. Alkor Technologies LLC monitors the terms of processing and storage of personal data.

Documents and (or) other tangible media containing personal data, as well as personal data contained in personal data information systems, network file directories or on external rewritable electronic media, shall be destroyed upon achieving the processing objectives or upon the occurrence of other legal grounds:
in the event of loss of need to achieve the purpose of processing personal data, unless otherwise provided by the agreement to which the personal data subject is a party, beneficiary or guarantor, and (or) other applicable regulatory legal acts of the Russian Federation;
upon detection of the fact of unlawful processing of personal data;
in the event of withdrawal of consent to the processing of personal data by the personal data subject, unless otherwise provided by the legislation of the Russian Federation;
upon expiration of the personal data processing period established during the collection of personal data;
in the event of an appeal by the personal data subject with a request to terminate the processing of personal data, except for cases established by Law No. 152-FZ.

The procedure and methods for destroying personal data are determined by local regulations of Alkor Technologies LLC in the field of personal data and confidential office work, depending on the methods of processing personal data and the tangible media of personal data on which the recording and storage of personal data is carried out.

4. Terms and procedure for processing personal data in Alkor Technologies LLC

4.1. Processing of personal data in Alkor Technologies LLC is permitted in cases established by Article 6 of Law No. 152-FZ.

4.2. Alkor Technologies LLC does not disclose to third parties or distribute personal data without the consent of the personal data subject, unless otherwise provided by Law No. 152-FZ.

4.3. Alkor Technologies LLC has the right to entrust the processing of personal data to another person with the consent of the personal data subject on the basis of an agreement concluded with this person in accordance with the requirements of Part 3 of Article 6 of Law No. 152-FZ.

4.4. For the purposes of internal information support, Alkor Technologies LLC may create directories and other sources that may include personal data with the written consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation.

4.5. Access to personal data processed by Alkor Technologies LLC is permitted only to employees of Alkor Technologies LLC holding positions included in the list of positions of structural divisions of the administration of Alkor Technologies LLC, its branches and representative offices, the replacement of which involves the processing of personal data (hereinafter referred to as the List).

4.6. Transfer of personal data of employees of Alkor Technologies LLC and other entities whose personal data is processed by Alkor Technologies LLC to third parties is permitted with the written consent of the said entities, except for cases when it is necessary to prevent a threat to the life and health of the entities, as well as in other cases stipulated by the Labor Code of the Russian Federation and other federal laws.

5. Rights of personal data entities

The rights of personal data entities are defined by the current legislation of the Russian Federation and include the right to:
receive information about their personal data processed by Alkor Technologies LLC in the amount of information stipulated by Article 14 of Law No. 152-FZ. The subject of personal data may send an appeal to Alkor Technologies LLC in writing to the postal address published on the "Contact Information" page of the official website of Alkor Technologies LLC on the Internet, or to the e-mail address technologies@alkor.net in the manner prescribed by Federal Law No. 152-FZ;
access to their personal data, the processing of which is carried out by Alkor Technologies LLC, including the right to receive a copy of any record containing their personal data, except for cases provided for by Federal Law No. 152-FZ;
clarification of their personal data, the processing of which is carried out by Alkor Technologies LLC, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;
revocation of consent to the processing of personal data provided to Alkor LLC Technologies";
taking measures provided by law to protect their rights;
appealing the actions or inactions of Alkor Technologies LLC, carried out in violation of the requirements of the legislation of the Russian Federation in the field of personal data, to the authorized body for the protection of the rights of personal data subjects or to the court;
sending a request to Alkor Technologies LLC to stop the transfer (distribution, provision, access) of their personal data, previously permitted by the subject of personal data for distribution;
exercise of other rights provided for by the legislation of the Russian Federation.

6. Measures taken by Alkor Technologies LLC to ensure the fulfillment of the operator's duties when processing personal data

6.1. Alkor Technologies LLC takes the necessary and sufficient measures aimed at ensuring the fulfillment of the operator's duties stipulated by the legislation of the Russian Federation in the field of personal data, which include:
appointment of a person responsible for organizing the processing of personal data in Alkor Technologies LLC;
publication of local regulations in the field of processing and protection of personal data;
publication of this Policy on the websites of Alkor Technologies LLC in the information and telecommunications network "Internet", including on the pages of the websites of Alkor Technologies LLC, with the use of which personal data is collected;
obtaining consent from personal data subjects to the processing of their personal data, with the exception of cases stipulated by the legislation of the Russian Federation;
provision of personal data subjects or their representatives with information on the availability of personal data related to the relevant subjects, providing the opportunity to familiarize themselves with this personal data upon request and (or) receipt of requests from the said personal data subjects or their representatives, unless otherwise is not established by the legislation of the Russian Federation;
implementation of internal control over the compliance of personal data processing with the provisions of Federal Law No. 152-FZ and regulatory legal acts adopted in accordance with it, requirements for the protection of personal data, this Policy, local regulatory acts of Alkor Technologies LLC;
assessment of the harm that may be caused to personal data subjects in the event of a violation of the legislation of the Russian Federation on personal data, as well as the relationship between the said harm and the measures taken by Alkor Technologies LLC aimed at ensuring the fulfillment of obligations stipulated by the legislation of the Russian Federation in the field of personal data;
organization of training and conducting methodological work with employees of Alkor Technologies LLC holding positions included in the List;
separation of personal data processed without the use of automation tools from other information, in particular by recording them on separate tangible personal data carriers, in special sections or in the fields of forms (blanks);
ensuring separate storage of personal data and their tangible media, the processing of which is carried out for different purposes and which contain different categories of personal data;
ensuring the security of personal data when they are transmitted via open communication channels;
storage of tangible media of personal data in compliance with the conditions that ensure the safety of personal data and exclude unauthorized access to them;
termination of processing and destruction of personal data in cases stipulated by the legislation of the Russian Federation in the field of personal data;
other measures stipulated by the legislation of the Russian Federation in the field of personal data.

6.2. Measures to ensure the security of personal data when they are processed in the personal data information systems are established in accordance with local regulations of Alkor Technologies LLC governing the issues of ensuring the security of personal data when they are processed in the personal data information systems of Alkor Technologies LLC.

7. Internal control of compliance of personal data processing with the provisions of Federal Law No. 152-FZ and regulatory legal acts adopted in accordance with it, requirements for the protection of personal data, this Policy and local regulations of Alkor Technologies LLC

7.1. Internal control of compliance of personal data processing with the provisions of Federal Law No. 152-FZ and regulatory legal acts adopted in accordance with it, requirements for the protection of personal data, this Policy and local regulations of Alkor Technologies LLC is carried out by the person responsible for organizing the processing of personal data in Alkor Technologies LLC, in the manner determined by local regulations of Alkor Technologies LLC in the field of personal data.

7.2. Persons guilty of violating the provisions of the legislation of the Russian Federation and local regulations of Alkor Technologies LLC in the field of personal data bear disciplinary, administrative, civil and criminal liability in accordance with the legislation of the Russian Federation.