Personal Data Processing Policy of RC Insurance Broker LLC

1. GENERAL

1.1. This Personal Data Processing Policy (the «Policy») has been drawn up in accordance with clause 2 of article 18.1 of Federal Law of the Russian Federation No. 152-ФЗ dated 27 July 2006 «On Personal Data», the Labour Code of the Russian Federation, the Constitution of the Russian Federation, the Civil Code of the Russian Federation, and shall apply to all personal data processed by RC Insurance Broker LLC (the «Operator»).

1.2. The purpose of this Policy is to define the categories of personal data processed by the Operator, and the basic principles that the Operator is guided by when processing personal data.

1.3. The provisions of this Policy are binding on all employees of the Operator, organizations receiving or providing personal data to the Operator, and individuals having contractual relationship with the Operator.

1.4. The following terms are used in this Policy:

personal data means any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
personal data operator (operator) means a government authority, municipal authority, legal entity or individual who independently or in cooperation with other persons arranges and (or) carries out personal data processing, and establishes the purposes of personal data processing, the composition of personal data to be processed, activities (operations) involving personal data;
personal data processing means any personal data activity (operation) or a set of personal data activities (operations) performed with or without use of automation facilities, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data;
automated personal data processing means processing of personal data by means of computer equipment;
dissemination of personal data means actions aimed at disclosure of personal data to the public;
provision of personal data means actions aimed at disclosure of personal data to a certain person or a certain group of persons;
blocking of personal data means temporary cessation of personal data processing (except for cases where processing is necessary to clarify personal data);
destruction of personal data means actions, as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which tangible media with personal data are destroyed;
depersonalization of personal data means actions as a result of which it becomes impossible to determine, without the use of additional information, the belonging of personal data to a particular personal data subject;
personal data information system means a set of personal data contained in personal data bases and information technologies and facilities ensuring its processing;
cross-border personal data transfer means the transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual or a foreign legal entity.
confidentiality of personal data – means the obligation of the Operator and other persons, who have access to personal data, not to disclose to third parties and not to disseminate personal data without the consent of the personal data subject, except as otherwise provided by federal law.

1.5. Personal data subjects or their legal representatives are entitled:

to receive full information about their personal data and the processing (including automated processing) of such data;
to have free and no-charge access to their personal data, including the right to receive copies of any record containing the subject's personal data, except in cases provided for by the federal laws of the Russian Federation;
to demand the exclusion or correction of incorrect or incomplete personal data, as well as data processed in breach of Russian law;
in the event of refusal of the Operator or its authorized person to exclude or correct the subject's personal data, to declare his disagreement in writing, providing the relevant substantiation;
to demand that the Operator or its authorized person notify all persons, to whom incorrect or incomplete personal data of the subject was previously communicated, about all modifications made to it or exclusions from it;
to appeal in court against any unlawful acts or omissions committed by the Operator or its authorized person when processing and protecting the subject's personal data.

1.6. Personal data subjects or their legal representatives are obliged:

to provide the Operator with personal data that corresponds to reality;
to timely notify the Operator of any changes in personal data.

1.7. The Operator is entitled to process personal data provided that there are legal grounds, the processing processes align with the stated purposes of processing and the requirements of the laws of the Russian Federation, the provisions of this Policy and other local regulations of the Operator.

1.8. The Operator is obliged:

to ensure at its own expense the protection of personal data from unlawful use or loss in the manner set out in law of the Russian Federation;
to provide the personal data subject, at his request, with information related to the processing of his personal data, or to lawfully give refusal on legal grounds;
to provide the subject with free and no-charge access to his personal data, including the right to receive copies of any record containing the subject's personal data, except in cases provided for by the laws of the Russian Federation;
at the request of the personal data subject, to update personal data being processed, to block or delete personal data if it is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
to keep a Register of Personal Data Subjects' Requests, in which requests of personal data subjects to obtain personal data, as well as the facts of providing personal data at these requests must be recorded;
to notify the personal data subject about the processing of personal data, unless the personal data was received from the personal data subject;
in case the purpose of personal data processing is achieved, to promptly stop processing of personal data and destroy the relevant personal data within a period not exceeding thirty days from the date of achievement of the purpose of personal data processing, except as otherwise provided by the federal laws of the Russian Federation, and to notify the personal data subject or his legal representative, and if the request or enquiry was sent by the authorized agency protecting the rights of personal data subjects, the said agency as well;
in case the personal data subject withdraws his consent to the processing of his personal data, to stop the processing of personal data and destroy personal data within a period not exceeding ten days from the date of receipt of the said withdrawal, except as otherwise provided by an agreement between the Operator and the personal data subject; the said period may be extended, but no more than for five business days in case the Operator gives a reasoned notice to the personal data subject specifying the reasons for extending the period of providing the requested information;
where it is not possible to destroy personal data within the period defined by law, the Operator shall block personal data or ensure its blocking (if personal data processing is carried out by another person acting on behalf of the Operator) and ensure destruction of personal data within a period not exceeding six months, unless another period is set out by the federal laws;
to provide personal data of the subject only to authorized persons and only to the extent necessary for them to perform their employment duties in accordance with this Regulation and the laws of the Russian Federation;
to report computer incidents related to the leakage of personal data via GosSOPKA;
to accumulate, store, retrieve personal data of citizens of the Russian Federation on servers located in the territory of the Russian Federation, except for cases provided by law;
to respond to an enquiry of the Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications (Roskomnadzor) within 10 business days.

1.9. In accordance of part 3.1 of article 21 of Federal Law No. 152-ФЗ dated 27.07.2006 «On Personal Data», in the event that the fact of unlawful or accidental transfer (provision, dissemination, access) of personal data is established and this results in infringement of rights of the personal data subjects, the operator is obliged, upon detection of such incident by the operator, the authorized agency protecting the rights of personal data subjects or other person concerned, to notify the authorized agency protecting the rights of personal data subjects:

1) within twenty-four hours about an incident that occurred, about hypothetical causes of the infringement on the rights of the personal data subjects and hypothetical prejudice to the rights of the personal data subjects, about the measures taken to eliminate the consequences of such incident, and to provide information about the person authorized by the operator to interact with the agency authorized to protect the rights of the personal data subjects on issues related to the detected incident;

2) within seventy-two hours about the findings of the internal investigation of the detected incident, and to provide information about the persons whose actions caused the detected incident (if any).

2. PURPOSES OF PERSONAL DATA PROCESSING

2.1. For each category of personal data, the Operator has defined and approved particular purposes of processing. Processing of personal data incompatible with the approved purposes is not allowed.

2.2. Personal data shall be processed by the Operator for the following purposes:

Recruitment of personnel to fill vacant positions, evaluation of an applicant for the position based on the conditions for the vacancy.
Maintaining personnel records, fulfilment of employer's obligations stipulated by employment contracts and the laws of the Russian Federation, recording of information necessary to maintain labour relations between the employee and the employer in accordance with the laws of the Russian Federation, responses to requests from government authorities and the Operator's employees, including former employees.
Ensuring compliance with labour, labour protection, tax and levy requirements set out in the laws of the Russian Federation and requirements set out by other regulations.
Attaching employees to the payroll project, issuing bank cards.
Issuing permanent passes for employees, identifying their identity when they are exercising the right to have access to the site, granting access to the Operator's site.
Executing the necessary documentation for business trips, purchasing the tickets, reserving the hotels, reimbursing the travel expenses, assisting in obtaining visas for employees.
Issuing powers of attorney, identifying the subjects on the basis of a power of attorney.
Accounting and tax accounting, submitting the statements to government authorities.
Providing access to information resources, authenticating the employees in corporate resources.
Providing employees with taxi.
Providing employees with business cards.
Vendor verification, contracting, fulfilment of contractual obligations.
Arranging the AML/CTF (anti-money laundering and counter-terrorism financing) training for personnel.
Organizing seminars, drawing up a list of participants, information mailings (invitations to seminars and mailing of seminar materials).
Attaching employees and their relatives to a corporate motor insurance contract.
Attaching employees to a corporate voluntary health insurance, accident and sickness insurance, foreign travel insurance contracts, and attaching employees' relatives to a corporate voluntary health insurance contract.
Preparing, signing, fulfilment and termination of contracts with customers and counterparties, keeping records of information in compliance with the requirements of the laws of the Russian Federation.
Fulfilling the obligations related to the identification of customers, customers’ representatives, beneficiaries and beneficial owners, which are imposed by the laws of the Russian Federation on non-credit financial institutions.
Fulfilling the obligations under contracts with customers, arranging insurance, settling the insurance claims.

2.3. Processed personal data is subject to destruction or depersonalization on expiry of the storage period, achievement of the processing purposes or if there is no further need to achieve these purposes, except as otherwise provided by law.

3. LEGAL GROUNDS FOR THE PROCESSING OF PERSONAL DATA

3.1. Processing of personal data of the categories listed below shall be carried out, among other things, in compliance with the requirements of the Tax Code of the Russian Federation, Federal Law No. 402-ФЗ «On Accounting», Federal Law No. 125-ФЗ «On Archiving in the Russian Federation», articles 86-90 of the Labour Code of the Russian Federation and other regulations of the Russian Federation, within the scope of the exercise and fulfilment of the functions, powers and obligations imposed on the Operator by the laws of the Russian Federation.

3.2. Processing of personal data of Applicants for a position shall be carried out on the basis of labour laws, consent of the PD subject to processing of his PD, contracts with recruitment agencies and recruitment websites, which evidences the existence of consent, or other legal grounds for transferring PD to the Operator.

3.3. Personal data of Employees shall be processed on the basis of labour, pension and tax laws of the Russian Federation, state social assistance and social insurance laws of the Russian Federation, consent of the PD subject to the processing of his PD, a contract to which the PD subject is a party and beneficiary.

3.4. Personal data of employees’ relatives shall be processed on the basis of labour and tax laws of the Russian Federation, state social assistance laws of the Russian Federation, consent of the PD subject to the processing of his PD.

3.5. Personal data of employees who resigned or were dismissed shall be processed on the basis of labour and tax laws, archiving laws of the Russian Federation, consent of the PD subject to the processing of his PD.

3.6. Personal data of relatives of employees who resigned or were dismissed shall be processed on the basis of labour and tax laws of the Russian Federation, and state social assistance laws of the Russian Federation.

3.7. Personal data of visitors to the Operator's site shall be processed on the basis of the PD subject's consent to the processing of his PD, exercise of the rights and legitimate interests of the Operator (ensuring the security of the site, taking security measures).

3.8. Personal data of counterparties’ representatives shall be processed on the basis of contracts with counterparties, which evidence the consent or other legal grounds for transferring PD to the Operator, the consent of the PD subject to processing of his PD, the law of the Russian Federation «On Countering the Legalization (Laundering) of Criminally Obtained Incomes and Terrorist Financing».

3.9. Personal data of Counterparties who are individuals shall be processed on the basis of contracts to which the PD subject is a party and beneficiary, and tax laws of the Russian Federation.

3.10. Personal data of customers’ representatives shall be processed on the basis of contracts with customers, which evidence the consent or other legal grounds for transferring PD to the Operator, the law of the Russian Federation «On Countering the Legalization (Laundering) of Criminally Obtained Incomes and Terrorist Financing», the insurance laws of the Russian Federation.

3.11. Personal data of customers who are individuals shall be processed on the basis of contracts with customers, which evidence the consent or other legal grounds for transferring PD to the Operator, the law of the Russian Federation «On Countering the Legalization (Laundering) of Criminally Obtained Incomes and Terrorist Financing», insurance laws of the Russian Federation.

3.12. Personal data of individuals (vehicle owners, persons authorized to drive the insured vehicle) shall be processed on the basis of consent of the PD to processing of his PD, exercise of the rights and legitimate interests of the Operator or third parties, insurance laws of the Russian Federation.

4. SCOPE AND CATEGORIES OF PROCESSED PERSONAL DATA, CATEGORIES OF THE PERSONAL DATA SUBJECTS

4.1. The Operator will process personal data of the following categories of subjects:

Applicants for a position
Employees
Employees’ relatives
Employees who resigned or were dismissed
Relatives of employees who resigned or were dismissed
Counterparties’ representatives
Counterparties who are individuals
Visitors of the Operator's site
Individuals
Customers who are individuals
Customers’ representatives

4.2. Personal data of applicants for a position shall include the following information:

surname, first name, patronymic (middle name);
sex;
date of birth;
place of residence details;
photo;
employment history;
key skills;
information about previous jobs (commencement date, end date, organization, position, reason for resignation/dismissal);
education details (type; name of educational institution; year of graduation from educational institution; qualification according to the education document, field of study, major according to the education document);
advanced training (training commencement date; training end date; type of advanced training; name of educational institution);
professional development (development commencement date; development end date of retraining; major);
foreign language proficiency;
nationality;
telephone number;
e-mail.

4.3. Personal data of employees shall include:

surname, first name, patronymic (middle name);
employee ID;
INN (Tax Identification Number);
SNILS (Individual Insurance Account Number);
sex;
date of birth;
place of birth;
nationality;
foreign language proficiency;
information about education, advanced training;
marital status and family composition;
passport details (series, number, date of issue, issuing authority);
residence address;
registered address;
telephone number;
e-mail;
military registration details;
employment history;
information about business trips;
bank account number;
photo;
vehicle details;
data contained in a copy of a vehicle certificate of title and/or vehicle registration certificate;
driving license details;
extract from medical history if disabled persons are attached to corporate voluntary health insurance programs, including medical history;
data contained in the certificate of birth or adoption of a child (surname, first name, patronymic (middle name), nationality, ethnic origin);
data contained in a marriage registration document (surname, first name, patronymic (middle name), nationality, ethnic origin, date of birth, date of marriage registration);
data contained in a document on guardianship or custody of a child (surname, first name, patronymic (middle name), residence address);
other information that can identify a person and are necessary for the performance of employment duties.

4.4. Personal data of employees’ relatives shall include:

degree of kinship;
surname, first name, patronymic (middle name);
date of birth;
nationality;
details of identity document (name, series and number, date of issue of the document, name of the issuing authority, subdivision code);
actual residence address;
registered address;
telephone number;
e-mail;
vehicle details;
driving license details;
extract from medical history if disabled persons are attached to corporate voluntary health insurance programs, including medical history;
data contained in the certificate of birth or adoption of a child (surname, first name, patronymic (middle name) of the child; mother's and father’s surname, first name, patronymic (middle name), nationality, ethnic origin);
data contained in a marriage registration document (surname, first name, patronymic (middle name), nationality, ethnic origin, date of birth, date of marriage registration);
data contained in a document on guardianship or custody of a child (surname, first name, patronymic (middle name) of the child);
data contained in a certificate of a child's disability (surname, first name, patronymic (middle name), date of birth, disability details);
data contained in a certificate issued by a child’s educational institution (surname, first name, patronymic (middle name), education details);

4.5. Personal data of employees who resigned or were dismissed:

surname, first name, patronymic (middle name);
employee ID;
INN (Tax Identification Number);
SNILS (Individual Insurance Account Number);
sex;
date of birth;
place of birth;
nationality;
foreign language proficiency;
information about education, advanced training;
marital status and family composition;
passport details (series, number, date of issue, issuing authority);
foreign travel passport details (series, number, date of issue, term of validity, issuing authority);
residence address;
registered address;
telephone number;
e-mail;
military registration details;
employment history;
information about business trips;
bank account number;
income details;
details of issued visas;
data contained in the certificate of birth or adoption of a child (surname, first name, patronymic (middle name), nationality, ethnic origin);
data contained in a marriage registration document (surname, first name, patronymic (middle name), nationality, ethnic origin, date of birth, date of marriage registration);
data contained in a document on guardianship or custody of a child (surname, first name, patronymic (middle name), residence address).

4.6. Personal data of relatives of employees who resigned or were dismissed:

degree of kinship;
surname, first name, patronymic (middle name);
date of birth;
data contained in the certificate of birth or adoption of a child (surname, first name, patronymic (middle name) of the child, place of birth of the child; mother's and father’s surname, first name, patronymic (middle name), nationality, ethnic origin);
data contained in a marriage registration document (surname, first name, patronymic (middle name), nationality, ethnic origin, date of birth, date of marriage registration);
data contained in a document on guardianship or custody of a child (surname, first name, patronymic (middle name) of the child);
data contained in a certificate of a child's disability (surname, first name, patronymic (middle name), date of birth, disability details);
data contained in a certificate issued by a child’s educational institution (surname, first name, patronymic (middle name), education details);

4.7. Personal data of relatives of visitors of the Operator's site:

surname, first name, patronymic (middle name);
vehicle number plate and model.

4.8. Personal data of counterparties’ representatives:

surname, first name, patronymic (middle name);
name of present employer;
position:
telephone number;
e-mail;
nationality;
INN (Tax Identification Number);
details of identity document (name, series and number, date of issue of the document, name of the issuing authority, subdivision code);
registered address;
date of birth;

4.9. Personal data of counterparties who are individuals:

surname, first name, patronymic (middle name);
series and number of the certificate of registration of an individual entrepreneur;
OGRNIP (Primary State Registration Number of the Individual Entrepreneur);
tax residence;
INN (Tax Identification Number);
SNILS (Individual Insurance Account Number);
sex;
payout amount;
details of identity document (name, series and number, date of issue of the document, name of the issuing authority, subdivision code);
nationality;
date of birth;
bank account number;
registered address;
telephone number;
e-mail.

4.10. Personal data of customers’ representatives:

beneficial owners;
surname, first name, patronymic (middle name);
name of present employer;
position:
e-mail;
telephone number;
date and place of birth;
marital status;
nationality;
details of identity document: document name, series and number, date of issue of the document, name of the issuing authority, and subdivision code;
migration card details: card number, date of commencement of stay and final date of stay in the Russian Federation;
details of the document evidencing the right of a foreign citizen or stateless person to stay (reside) in the Russian Federation: document series (if any) and number, commencement date of the right to stay (reside), expiry date of the right to stay (reside), if the presence of the above details is stipulated by the laws of the Russian Federation;
place of permanent/temporary registration;
place of actual residence;
INN (Tax Identification Number);
SNILS (Individual Insurance Account Number);
information on business reputation;
information on the sources of origin of funds and (or) other property;
financial information;
details of close relatives (surname, first name, patronymic (middle name), permanent and temporary residence and registered addresses nationality, name of present employer);
education details;
employment history;
information on property status;

4.11. Personal data of customers who are individuals (individual entrepreneurs):

surname, first name, patronymic (middle name);
date and place of birth;
marital status;
nationality;
details of identity document: document name, series and number, date of issue of the document, name of the issuing authority, and subdivision code;
migration card details: card number, date of commencement of stay and final date of stay in the Russian Federation;
details of the document evidencing the right of a foreign citizen or stateless person to stay (reside) in the Russian Federation: document series (if any) and number, commencement date of the right to stay (reside), expiry date of the right to stay (reside), if the presence of the above details is stipulated by the laws of the Russian Federation;
place of permanent/temporary registration;
place of actual residence;
INN (Tax Identification Number);
SNILS (Individual Insurance Account Number);
e-mail;
telephone number;
information on business reputation;
information on the sources of origin of funds and (or) other property;
financial information;
details of close relatives (surname, first name, patronymic (middle name), permanent and temporary residence and registered addresses, nationality, name of present employer);
education details;
employment history;
information on property status.

4.12. Individuals (vehicle owners, persons authorized to drive the insured vehicle):

surname, first name, patronymic (middle name);
date of birth;
details of identity document (name, series and number, date of issue of the document, name of the issuing authority, subdivision code);
actual residence address;
registered address;
telephone number;
e-mail;
vehicle details;
driving license details.

5. PERSONAL DATA PROCESSING PROCEDURE AND CONDITIONS

5.1. The Operator receives all personal data directly from the personal data subject, from his representative or from the person who entrusted the Operator with the processing of personal data, except as otherwise provided by the laws of the Russian Federation.

5.2. Personal data shall be processed with the consent of the personal data subject, except as otherwise provided by the laws of the Russian Federation. Consent may be expressed in various forms that allow confirming the fact of its receipt, in particular, in implicative actions, in writing in the form of a separate document, or as part of any document signed by the subject. Consent may be given by the subject's representative, if he gives evidence of his authorization.

5.3. Consent to the processing of personal data may be withdrawn by the personal data subject. In cases stipulated by the laws of the Russian Federation, the processing of personal data may be continued even after the subject's withdrawal of consent to processing.

5.4. When making decisions affecting the subject's interests, the Operator shall never rely on the subject's personal data obtained solely as a result of its automated processing or electronic receipt.

5.5. Personal data shall not be used for the purpose of causing property and/or moral damage to citizens, hindering the exercise of rights and freedoms of citizens of the Russian Federation.

5.6. Access to personal data shall be granted to the Operator's employees who need personal data in connection with the performance of their job duties.

5.7. Personal data of the Operator's employees may be transferred to third parties only with the written consent of the subject, except as otherwise provided by the laws of the Russian Federation.

5.8. The Operator may transfer personal data to enquiry and investigation agencies, other authorised agencies on the grounds stipulated by applicable law of the Russian Federation.

5.9. The Operator may create publicly available sources of personal data, which may include personal data of the personal data subject with his written consent.

5.10. Transfer of the subject's personal data for business purposes without his written consent is not allowed.

5.11. If it is necessary for the Operator to transfer personal data to third parties, such transfer shall be carried out only after the Operator and such third party have signed a consent to the transfer of personal data to the third party, except as otherwise provided by the laws of the Russian Federation.

5.12. Personal data shall be processed both using and not using computer equipment.

5.13. The time frames for personal data processing by the Operator shall be generally determined in accordance with the time frames set out in Federal Law No. 152-ФЗ dated 27.07.2006 «On Personal Data»; the term of the relevant contract; the time frames stipulated in the personal data processing assignment; the term of validity of documents that is set out by the order of the Federal Archival Agency (Rosarkhiv) dated 06.10.2000 «List of Standard Management Documents Formed in the Activities of Organizations, with Indication of Storage Periods», article 79 of the Labour Code of the Russian Federation, article 17 of Law No. 125-ФЗ dated 22.10.2004 «On Archiving in the Russian Federation’; the term of validity of the consent given by the personal data subject for its processing; as well as other requirements of the laws of the Russian Federation.

5.14. Personal data, when processed without the use of automation facilities, shall be separated from other information, in particular, by recording it on separate tangible media of personal data (the «tangible media»), in special sections or in the margins of forms.

5.15. When recording personal data on the tangible media, it is not allowed to record on one tangible media the personal data the purposes of processing of which are obviously incompatible. To process different categories of personal data without the use of automation facilities, a separate tangible medium shall be used for each category of personal data.

5.16. Persons processing personal data without the use of automation facilities shall be informed about the fact of processing by them of personal data, the processing of which is carried out by the operator without the use of automation facilities, categories of processed personal data, and about the special aspects and rules of such processing.

5.17. When using standard forms of documents to be filled out by the personal data subject by his own hand, the nature of information in which presupposes or allows the inclusion of personal data (the «standard form») in them, the following conditions shall be observed:

the standard form or related documents (filling-out instructions, cards, registers and logs) shall contain information on the purpose of personal data processing carried out without the use of automation facilities, the operator's name and address, the personal data subject's name, surname, patronymic (middle name) and address, the source of personal data, the time frames for personal data processing, the list of actions with personal data to be performed in the course of its processing, a general description of personal data processing methods used by the operator;
the standard form shall have a field in which the personal data subject may mark his consent to the processing of personal data that will be carried out without the use of automation facilities, if it is necessary to obtain written consent to personal data processing;
the standard form shall be drawn up in such a way that each of the personal data subjects contained in the document has the opportunity to familiarize himself with his personal data contained in the document, without infringing on the rights and legitimate interests of other personal data subjects;
the standard form shall exclude the merging of fields intended for entering personal data the purposes of processing of which are obviously incompatible.

5.18. Personal data shall be destroyed on achievement of the processing purposes, if there is no further need to achieve them, on expiry of the storage period, on establishment of the fact of unlawful processing or at the request of the person who entrusted the processing of personal data within a period not exceeding thirty days from the date of achievement of the personal data processing purposes, or on receipt of a letter of withdrawal of the processing assignment. Destruction shall be carried out in the presence of a commission. A certificate of destruction shall be drawn up following the destruction.

5.19. The Operator shall conduct an internal audit of personal data handling on a regular basis at least once a year.

6. PERSONAL DATA PROTECTION

6.1. The Operator shall ensure protection of the subject's personal data from unlawful or accidental access, destruction, modification, blocking, copying, dissemination of personal data, and from other unlawful actions.

6.2. Personal data protection shall be ensured by the Operator in the manner set out in applicable law of the Russian Federation and local regulations of the Operator by taking a set of organizational and technical measures ensuring its security.

6.3. All protection measures related to the collection, processing, storage and transfer of the subject's personal data apply to both paper-based and electronic (automated) data media.

7. UPDATING, CORRECTION, DELETION AND DESTRUCTION OF PERSONAL DATA

7.1. The Operator may enter, supplement, modify, block or delete personal data in accordance with the Federal Laws of the Russian Federation.

7.2. At the request of the personal data subject, the Operator is obliged:

to provide information on the possession of the subject's personal data by the Operator;
to provide an opportunity to familiarize with the subject's personal data (exclusion: Federal Law No. 152, article 14, part 5);
to clarify inaccurate or modified personal data;
to block or destroy personal data if it is illegally obtained, is not needed for the stated processing purpose, or if the subject's consent has been withdrawn.

7.3. The personal data subject's request must be sent to the Operator in hard copy and contain the number of the main identity document of the personal data subject or his legal representative, information on the date of issue of the said document and the issuing authority, and the handwritten signature of the personal data subject or his legal representative. The standard form of the request is given in Annex 1 to this Policy.

7.4. The request may be sent electronically and signed with an electronic digital signature in accordance with the laws of the Russian Federation to the e-mail address: info@rc-ib.ru.

7.5. On receipt of the request/enquiry from the subjects, the Operator's responsible officer shall register such request in the register of subjects’ requests.

7.6. A response or reasoned refusal shall be sent within 10 days from the date of receipt of the request from the personal data subject. Such response must contain concrete and exhaustive information concerning the substance of the matter.

7.7. Termination of processing, destruction of documents containing personal data shall be carried out:

at the written request of the personal data subject;
if a data leakage is detected;
achievement of the purposes of its processing according to the file and document register.

7.8. The personal data subject's consent to the processing of personal data, which is allowed by the personal data subject for dissemination, shall cease to be effective from when the operator receives the request specified in part 12 of article 10.1. of Law No. 519-ФЗ «On Amendments to the Federal Law «On Personal Data» dated 30.12.2020.

8. FINAL PROVISIONS

8.1. This Policy shall enter into force upon its approval by the Operator and shall be valid perpetually.

8.2. The Operator shall have the right to amend this Policy. When making amendments, the date of the last update must be specified in the heading of the Policy. The revised version of the Policy shall enter into force upon its approval by the Operator and shall be valid perpetually.

8.3. In accordance with part 2 of article 18.1 of Law No. 152-ФЗ, the Operator must ensure unrestricted access to this Policy and post it on the Company's official website.

8.4. The law of the Russian Federation shall apply to this Policy and the relationships between the personal data subjects and the Operator.

9. FEEDBACK

9.1. E-mail: info@rc-ib.ru

9.2. Postal address: 11, Gogolevsky Blvd, Moscow, 119019

9.3. Contact phone number: +7 495 258-55-54

Request for information relating to the processing of personal data