Personal Data Processing Policy

1. GENERAL PROVISIONS

1.1. This Policy on the Processing of Personal Data (hereinafter referred to as the “Policy”) has been developed in compliance with the requirements of Paragraph 2, Part 1, Article 18.1 of Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) in order to ensure the protection of human and civil rights and freedoms in the processing of their personal data, including the protection of the right to privacy, personal and family secrets.

1.2. This Policy applies to the following categories of personal data subjects whose data are processed by the Operator: employees; contractors; clients; website visitors.

1.3. Key terms used in the Policy:

1. Personal Data — any information relating directly or indirectly to a specifically identified or identifiable natural person (personal data subject).
2. Personal Data Operator (Operator) — the Non‑Profit Organization Union “International Union of Builders and Industrialists” (OGRN 1213600017641, INN 663156304, legal address: office 36, 1V Mendeleeva St., Voronezh, Voronezh Region, 394014) (hereinafter referred to as the “Operator”), which independently or jointly with other persons organizes and/or carries out the processing of personal data, as well as determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data.
3. Processing of Personal Data — any action (operation) or set of actions (operations) with personal data, performed with or without the use of automation tools. Processing of personal data includes, among other things: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction.
4. Automated Processing of Personal Data — processing of personal data using computer equipment.
5. Distribution of Personal Data — actions aimed at disclosing personal data to an indefinite group of persons.
6. Provision of Personal Data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
7. Blocking of Personal Data — temporary suspension of personal data processing (except where processing is necessary to clarify the personal data).
8. Destruction of Personal Data — actions as a result of which it becomes impossible to recover the content of personal data in the personal data information system and/or as a result of which the physical media containing personal data are destroyed.
9. Depersonalization of Personal Data — actions as a result of which it becomes impossible, without using additional information, to determine to which specific personal data subject the personal data belong.
10. Personal Data Information System — a set of personal data contained in databases and the information technologies and technical means that ensure their processing.
11. Cross‑Border Transfer of Personal Data — transfer of personal data to the territory of a foreign state to a government authority of a foreign state, a foreign individual, or a foreign legal entity.
12. Website — a set of computer programs and other information contained in an information system, access to which is provided via the Internet telecommunications network and located at: https://nko-mssp.ru.

1.4. Main rights and obligations of the Operator.

1.4.1. The Operator has the right to:

1. independently determine the set and list of measures necessary and sufficient to ensure compliance with the obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
2. entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for personal data processing provided for by the Personal Data Law;
3. in the event that the personal data subject revokes consent to the processing of personal data, the Operator may continue processing personal data without the personal data subject’s consent if there are grounds specified in the Personal Data Law.

1.4.2. The Operator is obliged to:

1. organize personal data processing in accordance with the requirements of the Personal Data Law;
2. respond to appeals and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
3. provide the authorized body for the protection of personal data subjects’ rights (hereinafter referred to as “Roskomnadzor”) with the necessary information upon request within 10 working days from the date of receipt of such a request.

1.5. Main rights of Personal Data Subjects. A personal data subject has the right to:

1. obtain information regarding the processing of their personal data, except in cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form; it must not contain personal data relating to other personal data subjects, except where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
2. request from the Operator to clarify their personal data, block or destroy it if the personal data are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, as well as to take measures to protect their rights as provided by law;
3. appeal against unlawful actions or inaction of the Operator in processing their personal data to Roskomnadzor or in court.

A personal data subject may exercise the rights to obtain information regarding the processing of their personal data and to request clarification, blocking, or destruction of their personal data by submitting a corresponding request to the Operator at: office 36, 1V Mendeleeva St., Voronezh, Voronezh Region, 394014, or by sending a corresponding request to the Operator via email at info@nko-mssp.ru. In both cases, the request must be prepared in compliance with the requirements set forth in Section 8 of this Policy.

1.6. Compliance with the requirements of this Policy is monitored by an authorized person responsible for organizing personal data processing at the Operator.

1.7. Liability for violation of the requirements of Russian Federation legislation and the Operator’s local acts in the field of personal data processing and protection is determined in accordance with Russian Federation legislation.

1. PRINCIPLES OF PERSONAL DATA PROCESSING

2.1. Personal data processing by the Operator is carried out in accordance with the requirements of Russian Federation legislation and on the basis of the following principles:

1. legality and fairness;
2. limitation of personal data processing to the achievement of specific, predefined, and lawful purposes;
3. prohibition of personal data processing incompatible with the purposes for which the personal data were collected;
4. prohibition of merging databases containing personal data processed for incompatible purposes;
5. processing only those personal data that correspond to the purposes of their processing;
6. ensuring that the content and volume of the processed personal data correspond to the stated purposes of processing;
7. prohibition of processing personal data in excess of what is necessary for the stated purposes of processing;
8. ensuring the accuracy, sufficiency, and relevance of personal data with respect to the purposes of processing;
9. destruction or depersonalization of personal data upon achievement of the purposes of processing or if there is no longer a need to achieve these purposes, if the Operator is unable to rectify any violations of personal data processing, unless otherwise provided by federal law.
10. LEGAL BASIS FOR PERSONAL DATA PROCESSING

3.1. The legal basis for personal data processing is the set of regulatory legal acts pursuant to and in accordance with which the Operator processes personal data, including:

1. the Constitution of the Russian Federation;
2. the Labor Code of the Russian Federation;
3. the Civil Code of the Russian Federation;
4. the Tax Code of the Russian Federation;
5. Federal Law No. 402‑FZ dated December 6, 2011 “On Accounting”;
6. other regulatory legal acts governing relations related to the Operator’s activities.

3.2. Additional legal grounds for personal data processing also include:

1. contracts concluded with the personal data subject;
2. the personal data subject’s consent to the processing of personal data.
3. SCOPE, CATEGORIES, AND CONDITIONS OF PROCESSED PERSONAL DATA, CATEGORIES OF PERSONAL DATA SUBJECTS IN RELATION TO THE STATED PURPOSES OF PERSONAL DATA PROCESSING

Personal data processing is limited to the achievement of specific, predefined, and lawful purposes. Processing of personal data incompatible with the purposes for which the data were collected is not permitted. Only personal data relevant to the purposes of processing are subject to processing.

The content and volume of the processed personal data must correspond to the stated purposes of processing provided for in this section. Processed personal data must not be excessive in relation to the stated purposes of processing. The Operator processes personal data for the following purposes:

1. ensuring compliance with Russian labor legislation (assisting employees in employment, education, and career advancement, ensuring employees’ personal safety, monitoring the quantity and quality of work performed, ensuring the safety of property, and ensuring compliance with laws and other regulatory acts);
2. preparation, conclusion, and execution of contracts;
3. offering and promoting the Operator’s own products and brand in the market through marketing (advertising, PR) activities and sales stimulation;
4. processing incoming requests from the Website;
5. maintaining statistics on Website visits.

In accordance with this Policy, the Operator may process personal data belonging to the following categories of personal data subjects:

1. clients of the Operator;
2. visitors to the Operator’s Website.

Processing of personal data for the purpose of offering and promoting the Operator’s own products and brand in the market through marketing (advertising, PR) activities and sales stimulation.

Under this section of the Policy, the Operator determines the categories and list of processed personal data, categories of subjects whose personal data are processed, methods, periods of processing and storage, and the procedure for destroying personal data upon achievement of the processing purpose or upon the occurrence of other legal grounds, specifically for the purpose of “offering and promoting the Operator’s own products and brand in the market through marketing (advertising, PR) activities and sales stimulation.”

For this purpose specified in this section of the Policy, the Operator processes personal data belonging to the following category(ies) of personal data subjects:

1. clients of the Operator;
2. visitors to the Operator’s Website.

The Operator processes the following categories and list of personal data of clients and visitors for this purpose:

a) Processing of general (other) categories of personal data of clients and visitors is carried out in accordance with the following list:

1. surname, first name, patronymic;
2. contact phone number;
3. email address;
4. gender.
5. b) Processing of special categories of personal data of clients and visitors is not carried out.
6. c) Processing of biometric personal data of clients and visitors (information characterizing physiological and biological characteristics of a person on the basis of which their identity can be established) is not carried out.

The Operator carries out mixed processing of personal data of clients and visitors for this purpose, with data transmitted via the internal network and via the Internet.

List of actions performed by the Operator with personal data of clients and visitors for this purpose: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction.

Processing of personal data of clients and visitors for this purpose is carried out subject to obtaining prior consent to such processing.

Without the personal data subject’s consent, the Operator does not disclose or distribute personal data of clients and visitors for this purpose to third parties, unless otherwise provided by Russian Federation legislation.

The Operator does not carry out cross‑border transfer of personal data of clients and visitors for this purpose.

The periods for processing and storing personal data of visitors for this purpose are established from the moment the visitors’ personal data are received until the purpose of processing is achieved — offering and promoting the Operator’s own products and brand in the market through marketing (advertising, PR) activities and sales stimulation.

Processing of personal data for the purpose of processing incoming requests from the Website.

Under this section of the Policy, the Operator determines the categories and list of processed personal data, categories of subjects whose personal data are processed, methods, periods of processing and storage, and the procedure for destroying personal data upon achievement of the processing purpose or upon the occurrence of other legal grounds, specifically for the purpose of “processing incoming requests from the Website.”

For this purpose specified in this section of the Policy, the Operator processes personal data belonging to the following category(ies) of personal data subjects:

1. visitors to the Operator’s Website.

The Operator processes the following categories and list of personal data of visitors for this purpose, including via an external personal data collection form (https://form.gle):

a) Processing of general (other) categories of personal data of visitors is carried out in accordance with the following list:

1. surname, first name, patronymic;
2. contact phone number;
3. email address.
4. b) Processing of special categories of personal data of visitors is not carried out.
5. c) Processing of biometric personal data of visitors (information characterizing physiological and biological characteristics of a person on the basis of which their identity can be established) is not carried out.

The Operator carries out mixed processing of personal data of visitors for this purpose, with data transmitted via the internal network and via the Internet.

List of actions performed by the Operator with personal data of visitors for this purpose: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction.

Processing of personal data of visitors for this purpose is carried out subject to obtaining prior consent to such processing.

Without the personal data subject’s consent, the Operator does not disclose or distribute personal data of visitors for this purpose to third parties, unless otherwise provided by Russian Federation legislation.

The Operator does not carry out cross‑border transfer of personal data of visitors for this purpose.

The periods for processing and storing personal data of visitors for this purpose are established from the moment the visitors’ personal data are received until the purpose of processing is achieved — processing incoming requests from the Website.

Processing of personal data for the purpose of maintaining statistics on Website visits.

Under this section of the Policy, the Operator determines the categories and list of processed personal data, categories of subjects whose personal data are processed, methods, periods of processing and storage, and the procedure for destroying personal data upon achievement of the processing purpose or upon the occurrence of other legal grounds, specifically for the purpose of “maintaining statistics on Website visits.”

For this purpose specified in this section of the Policy, the Operator processes personal data belonging to the following category(ies) of personal data subjects:

1. visitors to the Operator’s Website.

The Operator processes the following categories and list of personal data of visitors for this purpose:

a) Processing of general (other) categories of personal data of visitors is carried out in accordance with the following list:

1. data collected via metric programs.
2. b) Processing of special categories of personal data of visitors is not carried out.
3. c) Processing of biometric personal data of visitors (information characterizing physiological and biological characteristics of a person on the basis of which their identity can be established) is not carried out.

The Operator carries out mixed processing of personal data of visitors for this purpose, with data transmitted via the internal network and via the Internet.

List of actions performed by the Operator with personal data of visitors for this purpose: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), blocking, deletion, destruction.

Processing of personal data of visitors for this purpose is carried out subject to obtaining prior consent to such processing.

Without the personal data subject’s consent, the Operator does not disclose or distribute personal data of visitors for this purpose to third parties, unless otherwise provided by Russian Federation legislation.

With the visitors’ consent, the Operator may transfer their personal data within the country for this purpose to LLC “Yandex” (INN 7736207543), address: 16 Lvova Tolstogo St., Moscow, 119021, when using the “Yandex Metrica” software tool.

The visitors’ consent must be specific, subject‑oriented, informed, conscious, and unambiguous, i.e., it must contain information allowing an unambiguous conclusion about the purposes and methods of processing, specifying the actions performed with personal data and the scope of data being processed.

The Operator does not carry out cross‑border transfer of personal data of visitors for this purpose.

The periods for processing and storing personal data of visitors for this purpose are established from the moment the visitors’ personal data are received until the purpose of processing is achieved — maintaining statistics on Website visits.

1. PROCEDURE FOR PROCESSING VISITORS’ PERSONAL DATA USING COOKIE FILES

Cookie files transmitted to the personal data subject’s technical devices may be used to provide the personal data subject with personalized Website features, personalized advertising displayed to the personal data subject, for statistical and research purposes, and to improve Website performance.

The personal data subject acknowledges that the equipment and software they use to browse websites on the Internet may have the functionality to prohibit operations with cookie files (for any websites or for specific websites) as well as to delete previously received cookie files.

The Operator may establish that provision of certain Website features is possible only if the personal data subject allows the reception and acceptance of cookie files.

The structure of the cookie file, its content, and technical parameters are determined by the Operator and may be changed without prior notice to the personal data subject.

Counters placed on the Website or application may be used to analyze the personal data subject’s cookie files, collect and process statistical information about Website usage, and ensure the overall functionality of the Website or its individual features. The technical parameters of the counters are determined by the Operator and may be changed without prior notice to personal data subjects.

The Operator uses the “Yandex Metrica” software tool, the functionality of which allows identifying a unique Website visitor and forming information about their preferences and behavior on the Website.

1. PROCEDURE FOR COLLECTING AND STORING PERSONAL DATA

When collecting personal data, including via the Internet telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located in the territory of