1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy (hereinafter — the Policy) is aimed at protecting the rights and freedoms of individuals whose personal data is processed by LLC "Aspro" (hereinafter — the Operator).
1.2. The Policy was developed in accordance with clause 2, part 1, article 18.1 of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter — the Federal Law "On Personal Data").
1.3. The Policy contains information subject to disclosure in accordance with part 1, article 14 of the Federal Law "On Personal Data" and is a publicly available document.
2. OPERATOR INFORMATION
2.1. The Operator conducts its activities at the address: 454021, Chelyabinsk Region, Chelyabinsk, ul. Molodogvardeytsev, 31, floor 8.
2.2. Vakhrusheva Anna Alexandrovna (phone +7 (495) 120-10-32) is appointed as the person responsible for organizing the processing of personal data.
2.3. The database containing personal data of citizens of the Russian Federation is located at: 454021, Chelyabinsk Region, Chelyabinsk, ul. Molodogvardeytsev, 31, floor 8.
3. PERSONAL DATA PROCESSING INFORMATION
3.1. The Operator processes personal data on a lawful and fair basis to perform functions, powers, and obligations established by law, and to exercise the rights and legitimate interests of the Operator, its employees, and third parties.
3.2. The Operator obtains personal data directly from the data subjects.
3.3. The Operator processes personal data using both automated and non-automated methods, with and without the use of computing devices.
3.4. Processing activities include collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction.
3.5. Databases containing personal data of citizens of the Russian Federation are located within the territory of the Russian Federation.
4. PROCESSING OF EMPLOYEES' PERSONAL DATA
4.1. The Operator processes employees' personal data within the legal framework governed by the Labor Code of the Russian Federation of December 30, 2001, No. 197-FZ, including Chapter 14 thereof regarding the protection of employees' personal data.
4.2. The Operator processes employees' personal data for the purpose of fulfilling employment contracts, complying with Russian law, and for the following purposes:
— maintaining HR records;
— maintaining accounting records;
— performing functions, powers, and obligations imposed by Russian law, including providing personal data to government authorities, the Pension Fund of the Russian Federation, the Social Insurance Fund of the Russian Federation, the Federal Compulsory Medical Insurance Fund, and other government bodies;
— complying with occupational health and safety requirements and ensuring the personal safety of LLC "Aspro" employees and the preservation of property;
— monitoring the quantity and quality of work performed;
— opening personal bank accounts for LLC "Aspro" employees for payroll transfers;
— organizing training for LLC "Aspro" employees;
— publishing information on the website, internal directories, and organizational address books;
— ensuring access control to the Operator's premises.
4.3. The Operator does not make decisions affecting employees' interests based on their personal data obtained electronically or exclusively through automated processing.
4.4. The Operator protects employees' personal data using its own resources in accordance with the Labor Code of the Russian Federation, the Federal Law "On Personal Data," and other federal laws.
4.5. The Operator familiarizes employees and their representatives, against signature, with documents establishing the procedure for processing employees' personal data, as well as their rights and obligations in this area.
4.6. The Operator grants access to employees' personal data only to authorized persons who are entitled to receive only the data necessary for the performance of their functions.
4.7. The Operator obtains all employees' personal data from the employees themselves. If data can only be obtained from a third party, the Operator notifies the employee in advance and obtains their written consent. The Operator informs the employee of the purposes, sources, and methods of obtaining data, the nature of the data to be obtained, and the consequences of refusal to give written consent.
4.8. The Operator processes employees' personal data with their written consent, provided for the duration of the employment contract.
4.9. The Operator processes employees' personal data for the duration of the employment contract. The Operator processes the personal data of former employees for the period established by clause 5, part 3, article 24 of the Tax Code of the Russian Federation of July 31, 1998, No. 146-FZ, part 1, article 29 of Federal Law No. 402-FZ "On Accounting" of December 6, 2011, and other regulatory legal acts.
4.10. The Operator may process special categories of employees' personal data (health information related to their ability to perform work functions) pursuant to clause 2.3, part 2, article 10 of the Federal Law "On Personal Data."
4.11. The Operator does not process employees' biometric personal data.
4.12. The Operator does not obtain data on employees' membership in public associations or trade union activities, except as provided by the Labor Code of the Russian Federation or other federal laws.
4.13. The Operator processes the following employees' personal data:
— Last name, first name, patronymic;
— Type, series, and number of identity document;
— Date of issue of identity document and information about the issuing authority;
— Year of birth;
— Month of birth;
— Date of birth;
— Address;
— Contact phone number;
— Taxpayer Identification Number (TIN);
— State pension insurance certificate number (SNILS);
— Income;
— Position;
— Place of birth;
— Marital status;
— Education;
— Profession;
— Employee number;
— Work experience;
— Military registration information;
— Email address;
— Mandatory pension insurance contributions;
— Mandatory medical insurance contributions;
— Tax deductions;
— Retirement;
— Temporary disability.
4.14. The Operator does not disclose an employee's personal data to third parties without the employee's written consent, except where necessary to prevent a threat to the employee's life or health, or in other cases provided by the Labor Code of the Russian Federation, the Federal Law "On Personal Data," or other federal laws.
4.15. The Operator does not disclose employees' personal data for commercial purposes without written consent.
4.16. The Operator transfers employees' personal data to their representatives in accordance with the Labor Code of the Russian Federation, the Federal Law "On Personal Data," and other federal laws, and limits such information to only the data necessary for the representatives to perform their functions.
4.17. The Operator warns persons receiving an employee's personal data that such data may only be used for the purposes for which it was provided, and requires confirmation that this rule has been observed.
4.18. In accordance with the procedure established by law and pursuant to article 7 of the Federal Law "On Personal Data," for the purposes of personal data processing and with employees' consent, the Operator provides employees' personal data to or entrusts its processing to the following parties:
— Government authorities (Pension Fund, Federal Tax Service, Social Insurance Fund, etc.);
— Bank (within the framework of a payroll project).
4.19. An employee may have free access to information about their personal data and its processing. An employee may obtain a copy of any record containing their personal data, except in cases provided by federal law.
4.20. An employee may access medical records reflecting their health status with the assistance of a medical professional of their choice.
4.21. An employee may designate a representative to protect their personal data.
4.22. An employee may request the exclusion or correction of their incorrect or incomplete personal data, as well as data processed in violation of the Labor Code of the Russian Federation, the Federal Law "On Personal Data," or other federal laws. If the Operator refuses to exclude or correct an employee's personal data, the employee may file a written statement of disagreement with justification. An employee may supplement evaluative personal data with a statement expressing their own point of view.
4.23. An employee may request that all persons previously provided with their incorrect or incomplete personal data be notified of all exclusions, corrections, or additions made thereto.
4.24. An employee may appeal to a court any unlawful actions or inaction of the Operator in the processing and protection of their personal data.
5. PROCESSING OF JOB APPLICANTS' PERSONAL DATA
5.1. The Operator processes personal data of candidates for vacant positions (hereinafter — applicants).
5.2. The Operator processes applicants' personal data for the purpose of:
— making decisions on hiring or refusing to hire.
5.3. The Operator processes applicants' personal data with their written consent, provided for the period necessary to make a hiring decision. Exceptions include cases where a recruitment agency acts on behalf of the applicant under a corresponding agreement, and where the applicant independently posts their resume publicly on the internet.
5.4. The Operator processes applicants' personal data for the period necessary to make a hiring decision. In the event of a refusal, the Operator ceases processing within 30 days in accordance with part 4, article 21 of the Federal Law "On Personal Data." If the applicant has consented to being placed in a talent pool, the Operator may continue processing for the period specified in the consent.
5.5. The Operator does not process special categories or biometric personal data of applicants.
5.6. The Operator processes the following applicants' personal data:
— Last name, first name, patronymic;
— Address;
— Contact phone number;
— Email address;
— Position.
6. PROCESSING OF CLIENTS' PERSONAL DATA
6.1. The Operator processes personal data of clients within the framework of legal relations governed by Part Two of the Civil Code of the Russian Federation of January 26, 1996, No. 14-FZ (hereinafter — clients).
6.2. The Operator processes clients' personal data for the purpose of complying with Russian law, and also for the purpose of:
— entering into and fulfilling obligations under contracts with clients;
— conducting activities provided for by the founding documents of LLC "Aspro";
— informing about new products, special promotions, and offers;
— issuing discount cards.
6.3. The Operator processes clients' personal data with their consent, provided for the duration of the contracts concluded with them. In cases provided by the Federal Law "On Personal Data," consent is provided in writing. In other cases, consent is deemed obtained upon conclusion of a contract or upon performance of conclusive actions.
6.4. The Operator transfers clients' personal data to one or more third parties, the list of which is available at https://aspro.ru/company/partners/ for the purpose of providing information about the possibility of rendering services/works related to the use of 1C-Bitrix and/or Aspro software products.
6.5. The Operator processes clients' personal data for the duration of the contracts concluded with them. The Operator may continue processing clients' personal data after contract expiration for the period established by clause 5, part 3, article 24 of the Tax Code of the Russian Federation, part 1, article 29 of the Federal Law "On Accounting," and other regulatory legal acts.
6.6. The Operator processes the following clients' personal data:
— Last name, first name, patronymic;
— Address;
— Contact phone number;
— Email address;
— Position.
7. PERSONAL DATA SECURITY
7.1. The Operator appoints a person responsible for organizing personal data processing to fulfill the obligations provided by the Federal Law "On Personal Data" and related regulatory legal acts.
7.2. The Operator implements a set of legal, organizational, and technical measures to ensure the security of personal data, to maintain confidentiality, and to protect it from unlawful actions:
— ensures unrestricted access to the Policy, a copy of which is kept at the Operator's location and may be published on the Operator's website (if applicable);
— pursuant to the Policy, approves and enforces the "Personal Data Processing Regulations" and other local acts;
— familiarizes employees with the provisions of personal data legislation, and with the Policy and Regulations;
— grants employees access to personal data processed in the Operator's information system, as well as to physical data carriers, only for the performance of work duties;
— establishes access rules for personal data processed in the Operator's information system, and ensures registration and logging of all actions with such data;
— assesses potential harm to personal data subjects in the event of a violation of the Federal Law "On Personal Data";
— identifies threats to the security of personal data during processing in the Operator's information system;
— applies organizational and technical measures and uses information protection tools necessary to achieve the established level of personal data security;
— detects facts of unauthorized access to personal data and takes response measures, including recovery of personal data modified or destroyed as a result of unauthorized access;
— assesses the effectiveness of personal data security measures prior to the commissioning of the Operator's information system;
— conducts internal monitoring of compliance with the Federal Law "On Personal Data," related regulatory acts, personal data protection requirements, the Policy, Regulations, and other local acts, including monitoring of security measures and their effectiveness during processing in the Operator's information system.
8. RIGHTS OF PERSONAL DATA SUBJECTS
8.1. A personal data subject has the right to:
— receive personal data relating to them and information regarding its processing;
— request clarification, blocking, or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated processing purpose;
— withdraw their consent to the processing of personal data;
— protect their rights and legitimate interests, including the right to claim damages and compensation for non-pecuniary harm in court;
— appeal the Operator's actions or inaction to the authorized body for the protection of personal data subjects' rights or through judicial proceedings.
8.2. To exercise their rights and legitimate interests, personal data subjects may contact the Operator directly or submit a request personally or through a representative by email or postal mail at the addresses indicated in the Contacts section. The request must contain the information specified in part 3, article 14 of the Federal Law "On Personal Data."