Personal Data Processing Policy of Ozon IPJSC
Personal Data Processing Policy of Ozon IPJSC
1. Purpose and scope
1.1. This Personal Data
Processing Policy of Ozon IPJSC (OGRN 1253900010374,
INN 3900045916, 29A Oktyabrskaya Street, Office 1, Kaliningrad
urban district, Kaliningrad Region, 236006, Russia) (the “Company”) (the
“Policy”) establishes the Company’s position and intentions regarding the
processing and protection of personal data. It is designed to uphold and
safeguard the rights and freedoms of every individual, with a specific focus on
the rights to privacy, personal and family confidentiality, and the protection
of one’s honor and good name.
1.2. The Policy is binding on
the managers and employees of all structural divisions, branches, and
representative offices of the Company.
1.3. The Policy applies to all
personal data subjects’ information processed by the Company with or without
the use of automation tools.
1.4. Any personal data subject
has the right to access this Policy, including via the Internet.
1.5. The Company updates this
Policy from time to time and reserves the right to amend its terms unilaterally
at any time. The Company recommends that personal data subjects regularly
review the content of this Policy for any changes.
Unless otherwise stipulated
herein, any amendments to this Policy take effect from the date specified in
the updated version.
1.6. In all matters not
expressly provided for by this Policy, the Company shall be guided by the
applicable laws of Russia.
2. Terms and definitions
2.1. Personal Data –
Any information relating to a directly or indirectly identified or identifiable
individual (the “personal data subject”).
Such information includes, but is not limited to: full name; year,
month, date, and place of birth; address; information on marital, social, and
property status; education; profession; income; as well as any other
information which, taken together, allows for the identification of the
personal data subject.
2.2. Processing of Personal
Data – Any action (operation) or set of actions (operations) performed
on personal data, with or without the use of automation tools. These actions
(operations) include collection, recording, systematization, accumulation,
storage, changing), retrieval, use, transfer (dissemination, provision,
access), depersonalization, blocking, deletion, and destruction of personal
data.
2.3. Personal Data Subject –
An individual whose personal data are being processed.
2.4. Data Controller –
A person that, independently or jointly with others, organizes and/or carries
out the processing of personal data, and who determines the purposes of
processing, the composition of the personal data to be processed, and the
actions (operations) performed on the data. For the purposes of this Policy,
the Company is the Data Controller when it processes personal data, unless
otherwise expressly stated herein.
2.5. Data Processor –
A person that processes personal data on behalf of the Data Controller under a
contract, acting on behalf of, and/or in the interests of, the Data Controller.
The Data Controller bears liability to the personal data subject for the
actions or omissions of the Data Processor. The Data Processor, in turn, is
liable to the Data Controller.
2.6. Other terms used in this
Policy shall have the meanings ascribed to them by the applicable laws of
Russia, unless otherwise expressly defined in this Policy.
3. Procedure and conditions for personal data processing
3.1 The Company understands the
security of personal data as their protection from unauthorized or accidental
access, destruction, modification, blocking, copying, disclosure,
dissemination, and other wrongful acts, and implements the necessary legal,
organizational, and technical measures to protect personal data.
3.2. The Company processes and
protects personal data in compliance with the Constitution of Russia, Federal
Law No. 152-FZ On Personal Data, other laws and regulations of Russia
that define instances and aspects of personal data processing, as well as
regulations and guidelines of the Government of Russia, the Ministry of Digital
Development, Communications and Mass Media, the Federal Service for Supervision
of Communications, Information Technology, and Mass Media, the Federal Service
for Technical and Export Control, and the Federal Security Service.
3.3. When processing personal
data, the Company shall adhere to the following principles:
- processing personal data lawfully and fairly;
- limiting personal data processing to the achievement of specific, predetermined, and lawful purposes;
- preventing processing of personal data which is incompatible with the purposes of personal data collection;
- preventing integration of databases that contain personal data intended for incompatible processing purposes;
- ensuring consistency of processed personal data content and scope with the stated purposes of processing;
- limited personal data processing to what it is necessary for the stated purposes of processing;
- ensuring the accuracy, sufficiency, and, where necessary, relevance of personal data in relation to the processing purposes, and undertaking measures to delete or clarify incomplete or inaccurate data;
- processing personal data transparently by providing the data subject with relevant information concerning the processing of their personal data;
- storing personal data in a form that allows for the identification of the data subject for no longer than required by the stated processing purposes.
- when operating on the Internet as the owner of websites and online services;
- when formalizing and administering labor and other directly related relationships within the Company;
- when conducting ordinary business activities as a legal entity (acting as a holding company or head office, or performing other similar corporate management activities).
3.5. The Company processes
personal data when at least one of the following legal bases exists, for the
specified retention periods:
Legal basis for personal data processing | Data processing and retention period |
|---|---|
The personal data subject has given consent to the processing of their personal data | For the duration of the consent validity period |
Processing is required for the purposes stipulated by an international treaty of Russia or by law, or for the discharge of functions, powers, and obligations assigned to the data controller by the laws of Russia | For the period stipulated by the relevant international treaties or laws |
Processing of personal data subject to mandatory publication or disclosure pursuant to the federal law | For the period stipulated by the relevant laws |
Processing is required to enforce a judgement of any court, body or official, which judgement is to be enforced under Russian laws governing enforcement procedures | For the period necessary to enforce the relevant judgement |
Processing is required in connection with an individual’s involvement in constitutional, civil, administrative, or criminal proceedings, or in arbitration court proceedings | For the duration of an individual’s involvement in the relevant proceedings, including any periods for appealing (challenging) court judgements, unless a longer processing period is established by applicable Russian laws |
Processing is required for the purposes of a contract to which the personal data subject is a party, beneficiary or guarantor, or for entering into a contract initiated by them or a contract under which they will be a beneficiary or guarantor | For the term of such contract, except where a longer processing period is established by the applicable Russian laws or the contract itself |
Processing is required to protect the life, health, or any other vital interests of the personal data subject where their consent cannot be obtained | Until it becomes possible to obtain the personal data subject’s consent or until the grounds threatening the personal data subject's life, health, or other vital interests cease to exist, whichever occurs first |
Processing is required for the exercise of rights and legitimate interests of the data controller or third parties, provided the personal data subject’s rights and freedoms are not infringed | For the period necessary to exercise the rights and protect legitimate interests The Company determines the specific retention period in accordance with this Policy’s provisions, its internal regulations and by-laws, data processing principles, and requirements of the applicable laws of Russia, including those concerning the cessation of processing upon achievement of specific, predetermined, and lawful processing purposes |
Legal basis for personal data processing
The personal data subject has given consent to the processing of their personal data
Data processing and retention period
For the duration of the consent validity period
Legal basis for personal data processing
Processing is required for the purposes stipulated by an international treaty of Russia or by law, or for the discharge of functions, powers, and obligations assigned to the data controller by the laws of Russia
Data processing and retention period
For the period stipulated by the relevant international treaties or laws
Legal basis for personal data processing
Processing of personal data subject to mandatory publication or disclosure pursuant to the federal law
Data processing and retention period
For the period stipulated by the relevant laws
Legal basis for personal data processing
Processing is required to enforce a judgement of any court, body or official, which judgement is to be enforced under Russian laws governing enforcement procedures
Data processing and retention period
For the period necessary to enforce the relevant judgement
Legal basis for personal data processing
Processing is required in connection with an individual’s involvement in constitutional, civil, administrative, or criminal proceedings, or in arbitration court proceedings
Data processing and retention period
For the duration of an individual’s involvement in the relevant proceedings, including any periods for appealing (challenging) court judgements, unless a longer processing period is established by applicable Russian laws
Legal basis for personal data processing
Processing is required for the purposes of a contract to which the personal data subject is a party, beneficiary or guarantor, or for entering into a contract initiated by them or a contract under which they will be a beneficiary or guarantor
Data processing and retention period
For the term of such contract, except where a longer processing period is established by the applicable Russian laws or the contract itself
Legal basis for personal data processing
Processing is required to protect the life, health, or any other vital interests of the personal data subject where their consent cannot be obtained
Data processing and retention period
Until it becomes possible to obtain the personal data subject’s consent or until the grounds threatening the personal data subject's life, health, or other vital interests cease to exist, whichever occurs first
Legal basis for personal data processing
Processing is required for the exercise of rights and legitimate interests of the data controller or third parties, provided the personal data subject’s rights and freedoms are not infringed
Data processing and retention period
For the period necessary to exercise the rights and protect legitimate interests
The Company determines the specific retention period in accordance with this Policy’s provisions, its internal regulations and by-laws, data processing principles, and requirements of the applicable laws of Russia, including those concerning the cessation of processing upon achievement of specific, predetermined, and lawful processing purposes
3.6. The Company is entitled to
engage Data Processors for the processing of personal data based on agreements
concluded with them. This means the Company delegates a portion of its
functions to a specifically designated person, which acts on behalf of or in
the interests of the Company.
The Company engages such persons
when it lacks the necessary expertise or resources to achieve a specific
outcome (for instance, when the Company requires additional computational power
to operate its websites and online services, it may rent dedicated servers from
a third party in the absence of its own servers) or when it is more efficient
in terms of its own labor costs and quality of operations to outsource certain
functions (for example, if the number of users of the Company's websites and
online services increases sharply, it may need to engage a third party to
provide customer contact center services).
Data processors are obligated to
adhere to the principles and rules of personal data processing stipulated by
Federal Law No. 152-FZ On Personal Data (including Article 18.1 and
Part 5 of Article 18), other laws and regulations. For each data
processor, the agreement shall specify:
- the list of personal data to be processed;
- processing purposes;
- the list of actions (operations) to be performed with the personal data by the data processor;
- the data processor’s obligations to maintain confidentiality and ensure the security of personal data during their processing, along with a list of measures to be implemented by the data processor to protect the personal data it processes, including the requirement to notify the Company of any personal data incidents;
- the obligation to provide the Company, upon its request and for the duration of the personal data processing engagement, with documents and other information confirming the implementation of measures and compliance with the requirements established by Federal Law No. 152-FZ On Personal Data for the purpose of fulfilling the engagement.
3.7. Where a corresponding legal
basis established by the Russian laws exists, the Company is entitled to
transfer personal data to third parties without engaging such parties to
process the personal data.
Such persons include, for
example, banks processing settlements with the Company’s counterparties;
carriers and freight forwarders delivering cargo according to their own rules;
the Company’s counterparties receiving data on its representatives’ powers of
attorney; and state authorities requesting personal data within their
authority, etc.
Such persons do not process
personal data on the Company’s behalf or in its interests, as they have their
own purposes and legal grounds for such processing (for instance, banks accept
payment documents to comply with banking regulations, and the Company has no
right to intervene in their activities).
3.8. A cross-border transfer of
personal data occurs when the Company discloses personal data to a foreign
recipient located outside Russia, including transfers made without engaging the
recipient as a data processor. Such transfers require both a valid legal basis
for the personal data processing and prior notification to the Federal Service
for Supervision of Communications, Information Technology, and Mass Media of
Russia as required by Article 22 of Federal Law No. 152-FZ On
Personal Data.
3.9. Unless Russian laws specify
otherwise, the Company shall cease processing personal data (for all stated
purposes) and destroy them in the following cases:
- upon the liquidation of the Company;
- upon the reorganization of the Company resulting in the termination of its operations;
- when the legal grounds for processing cease to exist and/or the processing purposes have been accomplished.
3.10. In certain circumstances,
as described below, the Company automatically collects and processes personal
data through analytics programs used on its websites and online services. The
Company uses cookies to work with such data.
Cookies are small text files
containing certain information that are downloaded to a user's device (PC,
smartphone, etc.) when visiting a web page.
Cookies enable websites to
recognize user devices, determine user preferences, and collect statistics on
how users interact with websites to improve the user experience or to resolve
various errors or bugs that may occur from time to time. The list of purposes
for which cookies are required is not exhaustive and depends on the specific
website that the user visits or otherwise uses.
In particular, the following cookies
may be used on the Company’s websites:
Category | Description and purpose |
|---|---|
Technical cookies | These cookies are essential for the proper functioning of the Company’s websites and online services.
They enable users to navigate these websites and services, view various sections, fill out forms, and select checkboxes. |
Analytical cookies | These cookies collect information about how frequently users visit the Company’s websites and online services, which sections they view, which links they click, and how they generally navigate these websites and services. |
Preference cookies | These cookies remember the settings and choices users make on the Company’s websites and online services (language, region, search queries, etc.), thereby providing users with a personalized experience when using these websites and services. |
Marketing cookies | These cookies collect information about user activities both on the Company’s websites and online services and on third-party sites to display the most relevant advertisements to users, evaluate the effectiveness of such advertising, and limit the number of ad impressions for these users on the Company’s websites and services. |
Category
Technical cookies
Description and purpose
These cookies are essential for the proper functioning of the Company’s websites and online services.
They enable users to navigate these websites and services, view various sections, fill out forms, and select checkboxes.
Category
Analytical cookies
Description and purpose
These cookies collect information about how frequently users visit the Company’s websites and online services, which sections they view, which links they click, and how they generally navigate these websites and services.
Category
Preference cookies
Description and purpose
These cookies remember the settings and choices users make on the Company’s websites and online services (language, region, search queries, etc.), thereby providing users with a personalized experience when using these websites and services.
Category
Marketing cookies
Description and purpose
These cookies collect information about user activities both on the Company’s websites and online services and on third-party sites to display the most relevant advertisements to users, evaluate the effectiveness of such advertising, and limit the number of ad impressions for these users on the Company’s websites and services.
Users may independently restrict or
completely disable the installation of cookies through their web browser
settings. However, without technical cookies, the Company's websites and online
services may not function correctly, and some features may become unavailable.
When using cookies, the Company does not
intend to identify specific users of its websites and online services.
3.11. When processing personal data, the
Company shall:
- implement measures necessary and sufficient to ensure compliance with Russian laws and the Company’s internal regulations and by-laws concerning personal data;
- implement legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, disclosure, dissemination, and other wrongful acts;
- designate an individual responsible for organizing the processing of personal data within the Company;
- issue internal regulations establishing the Company’s personal data processing policies, by-laws concerning personal data processing matters, and by-laws defining procedures aimed at preventing and identifying violations of Russian laws and remedying their consequences;
- ensure that employees of the Company, its branches, representative offices, and structural units who are directly involved in processing personal data are familiarized with the provisions of Russian laws and the Company’s internal regulations and by-laws concerning personal data, including data protection requirements, and provide training to such employees;
- provide regular mandatory training to employees on personal data;
- perform internal control and/or audits to verify compliance of personal data processing with Russian laws, applicable regulations, other personal data protection requirements, this Policy and the Company’s internal regulations and by-laws concerning personal data;
- publish this Policy or otherwise ensure unrestricted access thereto;
- cease processing personal data and destroy it in cases stipulated by Russian laws;
- perform other actions prescribed by Russian laws concerning personal data.
4. Rights of personal data subjects
An individual whose personal
data are processed by the Company has the right to:
- withdraw previously granted consent to the processing of personal data*;
- receive information related to the processing of their personal data;
- request the rectification, blocking, or destruction of their personal data if the data are incomplete, outdated, inaccurate, unlawfully obtained, or are not necessary for the stated processing purpose, as well as to demand the cessation of processing if the purpose has been achieved by the Company.
Unless otherwise stipulated by a
relevant document between the Company and the data subject (such as a contract
or data processing consent), the personal data subject may exercise these
rights by:
- sending a request in writing, with a handwritten signature, to: 29A Oktyabrskaya Street, Office 1, Kaliningrad urban district, Kaliningrad Region, 236006, Russia; or
- sending an electronic request with a qualified electronic signature to: pdn@ozon.ru.
- full name of the personal data subject;
- number of the primary identity document of the personal data subject or their representative, details of the date of issue and the issuing authority of said document, OR other data allowing for the unambiguous identification of the personal data subject;
- information confirming the personal data subject’s involvement in a relationship with the Company, OR information otherwise confirming the fact of personal data processing by the Company;
- signature of the data subject or their representative.
5. Information on implemented personal data protection requirements
When processing personal data,
the Company implements the necessary legal, organizational, and technical
measures to protect personal data from unauthorized or accidental access,
destruction, modification, blocking, copying, disclosure, dissemination, and
other wrongful acts. The Company regularly reviews and updates the implemented
measures to ensure the highest level of security for the processed personal
data – such measures are described in this Policy and the Company's
internal regulations and by-laws.
These measures include, but are
not limited to:
- developing threat models;
- identifying threats to the security of personal data during their processing in personal data information systems;
- implementing organizational and technical measures for ensuring the security of personal data during their processing in personal data information systems, necessary to fulfill personal data protection requirements, the implementation of which achieves the levels of personal data security established by the Russian Government;
- using information security tools duly assessed for compliance;
- assessing the effectiveness of the implemented personal data security measures prior to commissioning personal data information systems;
- identifying incidents of unauthorized access to personal data and taking responsive measures;
- restoring personal data that have been modified or destroyed due to unauthorized access;
- establishing rules for access to personal data processed in the personal data system, and ensuring the logging and recording of all actions performed with personal data in the personal data system;
- monitoring the implemented personal data security measures and the security level of personal data information systems;
- maintaining an inventory of machine-readable data media;
- implementing access control and internal security regimes on the Company’s premises;
- locating personal data processing hardware within a protected area;
- maintaining physical security and alarm systems in a constant state of readiness;
- monitoring user actions and conducting investigations into violations of personal data security requirements.
Annex No. 1
Operating on the Internet as the owner of websites and online services
Purpose of personal data processing | Personal data subject category | Inventory of personal data |
|---|---|---|
Accessing and using the Company’s websites and mobile applications (collectively, the “Websites”), as well as other Company services as permitted by their functional capabilities, including registration and authorization (where applicable), and the use of feedback forms on the Websites and within such services | Users of Company Websites and services. |
|
Advertising | Recipients of advertising who have previously consented to it |
|
Monitoring the quality of using Company Websites and other services, gathering statistics, and conducting other analytics related to Company Websites and other services | Users of Company Websites and services. |
|
Purpose of personal data processing
Accessing and using the Company’s websites and mobile applications (collectively, the “Websites”), as well as other Company services as permitted by their functional capabilities, including registration and authorization (where applicable), and the use of feedback forms on the Websites and within such services
Personal data subject category
Users of Company Websites and services.
Inventory of personal data
- User ID Full name
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Other data voluntarily provided to the Company (e.g., via feedback forms on the Websites or within other Company services);
- Data collected via analytics programs, including technical data about user devices and identifiers (cookies, device geolocation, metadata, etc.)
Purpose of personal data processing
Advertising
Personal data subject category
Recipients of advertising who have previously consented to it
Inventory of personal data
- User ID
- Full name
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Other data voluntarily provided to the Company (as part of consenting to receive advertising) – e.g., specific preferences and interests for personalizing received ads
- Data collected via analytics programs, including technical data about user devices and identifiers (cookies, device geolocation, metadata, etc.)
Purpose of personal data processing
Monitoring the quality of using Company Websites and other services, gathering statistics, and conducting other analytics related to Company Websites and other services
Personal data subject category
Users of Company Websites and services.
Inventory of personal data
- User ID
- Full name
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Other data voluntarily provided to the Company (e.g., via feedback forms on the Websites or within other Company services);
- Data collected via analytics programs, including technical data about user devices and identifiers (cookies, device geolocation, metadata, etc.)
Annex No. 2
Formalizing and administering labor and other directly related relationships within the Company
Purpose of personal data processing | Personal data subject category | Inventory of personal data |
|---|---|---|
Personnel record management, including creation, maintenance, and storage of employee personnel files, employment record books, and other HR documents, as well as maintaining military registration and migration records within the Company | • Employees
• Former employees
• Close relatives of employees, including former ones |
|
Compliance with the applicable Russian labor laws (concerning the calculation and payment of wages, other statutory labor-related payments, leaves, business trips, disciplinary or financial sanctions, etc.). | Employment |
|
Monitoring the scope and quality of work performed | Employment |
|
Providing various guarantees, benefits, and compensations | Employment |
|
Administering staff and internal communications, including via email, phone, and messengers, as well as through employee inclusion in corporate directories | Employment |
|
Enrollment in any form of training, both internally or through external training organizations, platforms, or service providers | Employment |
|
Inclusion in the talent pool, among other things involving subsequent notifications of open vacancies and career-related events | • Employees
• Former employees
• Candidates for vacant positions at the Company |
|
Processing of job application information (CVs) | Candidates for vacant positions at the Company |
|
Purpose of personal data processing
Personnel record management, including creation, maintenance, and storage of employee personnel files, employment record books, and other HR documents, as well as maintaining military registration and migration records within the Company
Personal data subject category
• Employees
• Former employees
• Close relatives of employees, including former ones
Inventory of personal data
- Citizenship
- Full name
- Sex
- Age
- Date and place of birth
- Passport or other ID data
- Information from migration registration documents (for individuals who are not citizens of Russia)
- Residential registration address and actual address of residence
- Contact details (phone number, fax, email, postal address)
- Education details, data from educational, qualification, and professional training documents, information on advanced training, and other similar data
- Marital status, family composition, and details of close relatives which may be required by the Company, including, but not limited to, for providing employee benefits under Russian labor and tax laws
- Military registration details and information from military registration documents (for individuals subject to military registration)
- Information from the employment record book, details of employment history, past workplaces, and income from previous jobs
- INN (taxpayer identification number), SNILS (individual insurance account number)
- Bank details
- Information on hiring, transfers, dismissal, and other events related to the employee’s employment by the Company
- Information on income from the Company
- Information on professional and other personal qualities of an evaluative nature
- Biographical details
- Information on temporary disability and health status
- Photo
- Other data voluntarily provided by the employee /former employee to the Company (e.g., details of individual accomplishments for entry in the employment record book)
Purpose of personal data processing
Compliance with the applicable Russian labor laws (concerning the calculation and payment of wages, other statutory labor-related payments, leaves, business trips, disciplinary or financial sanctions, etc.).
Personal data subject category
Employment
Inventory of personal data
- Citizenship
- Full name
- Passport or other ID data valid for domestic and international use (for business trips abroad)
- Education details, data from educational, qualification, and professional training documents, information on advanced training, and other similar data
- Residential registration address and actual address of residence
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Information from the employment record book, details of employment history, past workplaces, and income from previous jobs
- INN (taxpayer identification number), SNILS (individual insurance account number)
- Bank details
- Information on hiring, transfers, dismissal, and other events related to the employee’s employment by the Company
- Information on income from the Company
- Information on income from previous jobs
- Details of travel documents, hotel bookings, and other information stipulated by law and/or necessary for organizing business trips
- Information on professional and other personal qualities of an evaluative nature
- Biographical details
- Information on temporary disability and health status
- Other data voluntarily provided by the employee to the Company (e.g., details of specific personal circumstances that serve as grounds for the Company to make statutory payments under labor laws)
Purpose of personal data processing
Monitoring the scope and quality of work performed
Personal data subject category
Employment
Inventory of personal data
- Full name
- Contact details (phone number, fax, email, postal address)
- Information on hiring, transfers, dismissal, and other events related to the employee’s employment by the Company
- Information on professional and other personal qualities of an evaluative nature
- Biographical information
Purpose of personal data processing
Providing various guarantees, benefits, and compensations
Personal data subject category
Employment
Inventory of personal data
- Citizenship
- Full name
- Sex
- Age
- Date and place of birth
- Passport or other ID data
- Residential registration address and actual address of residence
- Contact details (phone number, fax, email, postal address)
- Information on hiring, transfers, dismissal, and other events related to the employee’s employment by the Company
- Biographical details
Purpose of personal data processing
Administering staff and internal communications, including via email, phone, and messengers, as well as through employee inclusion in corporate directories
Personal data subject category
Employment
Inventory of personal data
- Full name
- Sex
- Age
- Date of birth
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Information on hiring, transfers, dismissal, and other events related to the employee’s employment by the Company
- Information on professional and other personal qualities of an evaluative nature
- Biographical details
- Photo
Purpose of personal data processing
Enrollment in any form of training, both internally or through external training organizations, platforms, or service providers
Personal data subject category
Employment
Inventory of personal data
- Citizenship
- Full name
- Sex
- Age
- Date and place of birth
- Passport or other ID data
- Residential registration address and actual address of residence
- Contact details (phone number, fax, email, postal address)
- Data from educational, qualification, and professional training documents, information on advanced training, and other similar data
- INN (taxpayer identification number), SNILS (individual insurance account number)
- Information on hiring, transfers, dismissal, and other events related to the employee’s employment by the Company
- Biographical details
Purpose of personal data processing
Inclusion in the talent pool, among other things involving subsequent notifications of open vacancies and career-related events
Personal data subject category
• Employees
• Former employees
• Candidates for vacant positions at the Company
Inventory of personal data
- Citizenship
- Full name
- Sex
- Age
- Date of birth
- Residential registration address and actual address of residence
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Data from educational, qualification, and professional training documents, information on advanced training, and other similar data
- Details of employment history and past workplaces
- Information on hiring, transfers, dismissal, and other events related to the employee’s employment by the Company (if applicable)
- Information on income from the Company (if applicable)
- Information on professional and other personal qualities of an evaluative nature
- Biographical details
Purpose of personal data processing
Processing of job application information (CVs)
Personal data subject category
Candidates for vacant positions at the Company
Inventory of personal data
- Full name
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Other information voluntarily provided by the candidate to the Company and contained in their CV
Annex No. 3
Conducting ordinary business activities as a legal entity (acting as a holding company or head office, or performing other similar corporate management activities)
Purpose of personal data processing | Personal data subject category | Inventory of personal data |
|---|---|---|
Conclusion, performance, and termination of other civil law contracts with third parties | Individuals as parties to civil law contracts |
|
Conclusion, performance, and termination of other civil law contracts with third parties | Representatives of the parties to civil law contracts |
|
Organization of access control and internal security regimes, ensuring visitor safety on the Company’s premises | Visitors to Company premises, including Company employees |
|
Issuance of powers of attorney to Company representatives | Potential representatives of the Company, including Company employees |
|
Compliance with the applicable laws of Russia (concerning accounting and tax accounting, document management and archival storage, submission of relevant information to government authorities, fulfillment of requirements and orders from government authorities, enforcement of court judgements, processing of rights holders’ complaints and inquiries from personal data subjects, consumers, etc.) | All categories of personal data subjects, as listed above, to the extent they are subject to the relevant requirements of Russian laws (e.g., storing personal data as part of a contract for accounting purposes)
Other personal data subjects interacting with the Company in any way within the stated purpose (e.g., when responding to a rights holder’s complaints) |
|
Purpose of personal data processing
Conclusion, performance, and termination of other civil law contracts with third parties
Personal data subject category
Individuals as parties to civil law contracts
Inventory of personal data
- User ID (for contracts concluded using Company Websites or other services)
- Citizenship
- Full name
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Residential registration address and actual address of residence
- Bank details (for non-gratuitous contracts only)
- Sole proprietor registration number and other data contained in the Unified State Register and other open (public) registries (if the individual is registered as a sole proprietor)
- Other data according to terms of the contracts (if required)
Purpose of personal data processing
Conclusion, performance, and termination of other civil law contracts with third parties
Personal data subject category
Representatives of the parties to civil law contracts
Inventory of personal data
- Full name
- Title
- Power of attorney details
Purpose of personal data processing
Organization of access control and internal security regimes, ensuring visitor safety on the Company’s premises
Personal data subject category
Visitors to Company premises, including Company employees
Inventory of personal data
- Citizenship
- Full name
- Contact details (phone number, email, usernames and IDs in messengers, social networks, etc.)
- Passport or other ID data
- Residential registration address and actual address of residence
- Sole proprietor registration number and other data contained in the Unified State Register and other open (public) registries (if the individual is registered as a sole proprietor)
- Details concerning the use of special tax regimes (if the individual is registered as a sole proprietor)
- Actual place of business activity (if such activity is conducted)
- Bank details (if the contemplated business relationship is non-gratuitous in nature)
- Other data requested/obtained by the Company and disclosed/provided during the vetting
Purpose of personal data processing
Issuance of powers of attorney to Company representatives
Personal data subject category
Potential representatives of the Company, including Company employees
Inventory of personal data
- Full name
- Passport or other ID data
- Contact details (phone number, email)
- Photos and videos
Purpose of personal data processing
Compliance with the applicable laws of Russia (concerning accounting and tax accounting, document management and archival storage, submission of relevant information to government authorities, fulfillment of requirements and orders from government authorities, enforcement of court judgements, processing of rights holders’ complaints and inquiries from personal data subjects, consumers, etc.)
Personal data subject category
All categories of personal data subjects, as listed above, to the extent they are subject to the relevant requirements of Russian laws (e.g., storing personal data as part of a contract for accounting purposes)
Other personal data subjects interacting with the Company in any way within the stated purpose (e.g., when responding to a rights holder’s complaints)
Inventory of personal data
- All personal data relating to the specific category of personal data subjects, as listed above, to the extent they are subject to the relevant requirements of Russian laws
- Other data voluntarily provided by personal data subjects to the Company, e.g., within a relevant inquiry or complaint