Privacy policy

Policy of the Autonomous Non-profit Organization "Center for Entrepreneurship and Export Development of the Orenburg Region" regarding the processing of personal data

1. General provisions

1.1. ""This Policy of the Autonomous Non—Profit Organization Center for Entrepreneurship Support and Export Development of the Orenburg Region regarding the processing of personal data (hereinafter referred to as the Policy) has been developed in compliance with the requirements of paragraph 2 of Part 1 of Article 18.1 of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as the Personal Data Law) in order to ensure the protection of human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy, personal and family secrets, and defines the general conditions for processing users' personal data on websites, as well as establishes procedures aimed at preventing violations of the legislation of the Russian Federation.

1.2. The Policy applies to the processing of personal data processed by the Autonomous Non—profit Organization "Center for Entrepreneurship and Export Development of the Orenburg Region" (hereinafter referred to as the operator, center) on the Center's websites: https://travel.orb.ru; http://go-orenburg.localhost:8081; https://orbexport.ru; https://investinorenburg.ru; https://mb-orb.ru; https://мойбизнес56.рф; https://crm-mb-orb.ru (hereinafter referred to as the operator's website), also in cases where personal data subjects contact the e–mail addresses, phone numbers indicated on the operator's website, or through feedback forms to the operator.

1.3. The Policy applies to the relations in the field of personal data processing that arose with the operator both before and after the approval of this Policy.

1.4. In compliance with the requirements of part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in free access on the "Internet" information and telecommunications network on the operator's website.

1.5. The concepts are used in the meaning established by Federal Law No. 152-FZ of 27.07.2006 "On Personal Data". For the purposes of the Operator's Policy, the following concepts are also used:

A user is a personal data subject whose personal data is subject to processing as part of the use of the operator's website, including event visitors, operator employees, and job seekers.;

event visitor — an individual who attended an event organized by the center and/or its partner;

An employee is an individual who has entered into an employment relationship with the center.;

An applicant is an individual applying for a specific position or a vacant position in the center.;

personal data — any information relating directly or indirectly to a specific or identifiable natural person (personal data subject);

personal data processing is any action (operation) or set of actions (operations) with personal data performed with or without automation tools, including: collection; recording; systematization; accumulation; storage; clarification (updating, modification); extraction; use; transfer (distribution, provision, access); depersonalization; blocking; deletion; destruction;

dissemination of personal data — actions aimed at disclosing personal data to an unspecified group of people;

providing personal data is an action aimed at disclosing personal data to a specific person or a specific group of people.;

Personal data storage is a process involving finding personal data in a systematic form at the disposal of the center.

blocking of personal data is the temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data);

destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed;

personal data information system is a set of personal data contained in databases and information technologies and technical means that process them.;

Depersonalization of personal data is an action that makes it impossible to determine whether personal data belongs to a specific personal data subject without using additional information.;

The personal data Information system (ISPs) is a set of personal data contained in databases and information technologies and technical means that process them.;

Cookies are small text files that are stored on the device used by the user to work with the relevant website (personal computer, smartphone, tablet computer, etc.).

Other concepts used in this Policy are used in the meanings defined by the legislation of the Russian Federation.

1.6. Basic rights and obligations of the operator.

1.6.1. The Operator has the right to:

1) independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;

2) entrust the processing of personal data to another person with the user's consent, unless otherwise provided by federal law, on the basis of a contract (agreement) concluded with this person. The person who processes personal data on behalf of the operator is obliged to comply with the principles and rules of personal data processing provided for by the Law on Personal Data, to respect the confidentiality of personal data, and to take the necessary measures to ensure compliance with the obligations provided for by the Law on Personal Data.;

3) if the user withdraws consent to the processing of personal data, the operator has the right to continue processing personal data without the user's consent if there are grounds specified in the Law on Personal Data.

1.6.2. The Operator is obliged to:

1) organize the processing of personal data in accordance with the requirements of the Law on Personal Data;

2) when collecting personal data, provide the user, at his request, with the information provided for in part 7 of Article 14 of the Law on Personal Data.;

3) respond to user requests and requests from the authorized body for the protection of the rights of personal data subjects (hereinafter referred to as Roskomnadzor) and provide them with information related to the processing of personal data in accordance with the procedure established by the Law on Personal Data;

4) if, in accordance with the Law on Personal Data, the provision of personal data and (or) the operator's consent to the processing of personal data is mandatory, the operator is obliged to explain to the user the legal consequences of refusing to provide his personal data and (or) consent to their processing;

5) provide, with the exception of cases provided for by the Law on Personal Data, information to the user prior to the start of processing such personal data, including the name and address of the operator, the purpose of processing personal data and its legal justification, a list of personal data, intended users of personal data, the rights of the personal data subject established by this Policy and the source of personal data, if the personal data is not received from the personal data subject;

6) to provide the necessary information to the authorized body for the protection of the rights of personal data subjects at the request of this body within 10 working days from the date of receipt of such request. This period may be extended, but not for more than five working days. To do this, the operator must send a reasoned notification to Roskomnadzor indicating the reasons for extending the deadline for providing the requested information.;

7) in accordance with the procedure established by the federal executive governmental body authorized in the field of security, to ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it about computer incidents that have resulted in the unlawful transfer (provision, dissemination, access) of Personal Data;

8) take the necessary legal, organizational and technical measures or ensure their adoption to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions with respect to personal data;

9) appoint a Person responsible for the organization of personal data processing;

10) comply with other requirements of the legal acts of the Russian Federation in connection with the processing of personal data.

1.7. The User has the right to:

1) to receive information concerning the processing of his personal data, except in cases provided for by federal laws. The information is provided to the user by the operator in an accessible form, and it should not contain personal data related to other users, except in cases where there are legitimate grounds for the disclosure of such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;

2) require the operator to clarify his personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing personal data, as well as to take measures provided by law to protect their rights.;

3) give prior consent to the processing of personal data in order to promote goods, works and services on the market;

4) to demand the termination of the processing of personal data in cases prescribed by law;

5) to demand the termination of the transfer (distribution, provision, access) of personal data previously authorized by the user for distribution;

6) the exercise of other rights provided for by the legal acts of the Russian Federation in connection with the Processing of personal data.

1.8. Control over the fulfillment of the requirements of this Policy is carried out by the person authorized by the operator responsible for organizing the processing of personal data by the operator.

1.9. Responsibility for violation of the requirements of the legislation of the Russian Federation and local acts of the center in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.3

1.10 Legal basis of personal data processing:

the processing of personal data is carried out with the consent of the personal data subject to the processing of his personal data;

The processing of personal data is necessary for the performance of an agreement to which the personal data subject is a party or beneficiary or guarantor, as well as for the conclusion of an agreement on the initiative of the personal data subject or an agreement under which the personal data subject will be the beneficiary or guarantor. An agreement concluded with a personal data subject may not contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing personal data of minors, unless otherwise provided for by the legislation of the Russian Federation, as well as provisions allowing inaction of the personal data subject as a condition for concluding the agreement.;

personal data is processed for statistical or other research purposes, with the exception of the purposes specified in Article 15 of the Federal Law "On Personal Data", subject to mandatory depersonalization of personal data.;

The processing of personal data is carried out on the basis of concluded employment contracts, a service agreement with individual performers.;

personal data is processed to fulfill the duties of the operator for the military registration of employees in accordance with paragraph 6 of Part 1 of Article 8 of Federal Law No. 61-FZ dated 05/31/1996 "On Defense".;

personal data is processed in the performance of the operator's duty to inform about the conclusion of an employment or civil law contract for the performance of work (provision of services) with a citizen who held positions of state or municipal service, to the representative of the employer (employer) of a state or municipal employee at his last place of service in accordance with the procedure established by regulatory legal acts of the Russian Federation, in accordance with Part 4 of Article 12 of Federal Law No. 273-FZ of December 25, 2008
"On combating corruption";

1.11. The processing of personal data in the Center is carried out in accordance with the following regulatory legal acts:

The Constitution of the Russian Federation of December 12, 1993 (Articles 2, 17-24, 41);

The Civil Code of the Russian Federation (Parts 1, 2, 4);

The Labor Code of the Russian Federation (Chapter 14 (Articles 86-90));

The Tax Code of the Russian Federation;

Federal Law of the Russian Federation No. 149-FZ dated July 27, 2006 "On Information, Information Technologies and Information Protection";

Federal Law of the Russian Federation No. 209-FZ dated July 24, 2007 "On the Development of Small and Medium-sized Businesses in the Russian Federation";

Federal Law No. 273-FZ dated December 25, 2008 "On Combating Corruption" (Part 2 of Article 12);

Federal Law No. 61-FZ dated 05/31/1996 "On Defense" (Clause 6, Part 1, Article 8);

Federal Law No. 59-FZ dated 05/02/2006 "On the Procedure for Considering Appeals from Citizens of the Russian Federation";

Decree of the President of the Russian Federation No. 188 dated March 06, 1997 "On Approval of the List of Confidential Information";

Decree of the Government of the Russian Federation No. 1119 dated November 01, 2012 "On Approval of Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems";

Resolution of the Government of the Russian Federation No. 687 dated September 15, 2008 "On Approval of the Regulation on the Specifics of Personal Data Processing carried out without the use of Automation tools";

FSTEC of Russia Order No. 21 dated 02/18/2013 "On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data during their Processing in Personal Data Information Systems";

By Order of Roskomnadzor dated September 5, 2013 No. 996 "On approval of requirements and methods for depersonalization of personal data";

By Order of the Federal Archive of December 20, 2019 No. 236 "On approval of the List of standard management archival documents formed in the course of the activities of state bodies, local governments and organizations, indicating the terms of their storage."

The Charter of the Center and other regulatory legal acts regulating relations related to the processing and protection of personal data.

2. Purposes of processing and categories of personal data being processed, categories of users and other conditions of personal data processing

2.1. The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Excessive processing of personal data and/or incompatible with the purposes of personal data collection is not allowed.

2.2. Only personal data that meets the purposes of their processing is subject to processing.

2.3. For each of the purposes of personal data processing specified in clause 2.6 of this Policy, established by this Policy, the Operator processes exclusively general categories of personal data.

2.3.1. The operator does not process:

information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity (biometric personal data);

special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, with the exception of cases provided for by the legislation of the Russian Federation.

2.3.2. For each of the purposes of personal data processing specified in clause 2.6 of this Policy, the Operator has established the following list of actions performed by the operator in relation to personal data: collection; recording; systematization; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); depersonalization; blocking; deletion; destruction.

2.4. The Operator does not verify the accuracy of information containing personal data provided by the user on the operator's website. However, the operator assumes that the user provides reliable and sufficient information containing his personal data and keeps this information up to date.

2.5. The Operator transfers personal data to courts, law enforcement, supervisory authorities and other authorized authorities, and their officials if there are grounds provided for by legal acts of the Russian Federation.

2.6. List of purposes of personal data processing and categories of personal data being processed, categories of users and other conditions of personal data processing:

2.6.1. Purpose: Maintaining personnel and accounting records

a) A list of personal data: surname, first name, patronymic; date of birth; year of birth; month of birth; place of birth; marital status; degree of kinship; income; gender; address of residence; registration address; phone number; SNILS; INN; nationality; identity document data; current account number; personal account number; profession; position; e-mail address; information about work (including work experience, current employment data, indicating the name and current account of the organization); attitude to military duty, information about military registration; information about education; driver's license data; state awards, other awards and distinctions; information on professional retraining and (or) advanced training; information on an employment contract; information on annual paid vacations, study vacations and vacations without pay; information on proficiency in foreign languages and languages of the peoples of the Russian Federation; information on changes in last name, first name, patronymic; information on academic degree, academic title; salary; certificates of state registration of acts of civil status; degree of kinship, surnames, first names, patronymics, dates of birth of close relatives (father, mother, brothers, sisters and children), as well as husband (wife).

b) Categories of subjects whose personal data is being processed: employees; applicants; relatives of employees; dismissed employees; students; students; legal representatives.

c) Methods of their processing and storage: a mixed method of processing (automated and non-automated), storage is carried out on paper and electronic media on the Operator's territory, in databases on a dedicated server on the Operator's territory.