Privacy policy
Personal Data Policy of JSC "Sky Atlas"
The policy is based on the recommendations of ROSKOMNADZOR (Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications) on the preparation of a document defining the operator's Policy on personal data processing, in accordance with the procedure established by the federal law concerning personal data.
1. BASIC TERMS AND DEFINITIONS
Personal data – any information related directly or indirectly to an identified or identifiable individual (hereinafter subject of personal data);
Personal data operator (hereinafter operator) – a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and/or performs the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data to be processed;
Processing of personal data – any action (operation) or a set of actions (operations) performed with or without the use of automation tools. Processing of personal data includes: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction;
Automated processing of personal data – processing of personal data using computer technology;
Dissemination of personal data – actions aimed at disclosure of personal data to an indefinite circle of persons;
Provision of personal data – actions aimed at disclosure of personal data to a certain person or a certain group of persons;
Blocking of personal data – temporary termination of processing of personal data (except for cases when processing is necessary to clarify personal data);
Destruction of personal data – actions that make it impossible to restore the content of personal data in the personal data information system and/or as a result of which the material carriers of personal data are destroyed;
Depersonalization of personal data – actions that make it impossible to determine whether personal data belongs to a specific personal data subject without using additional information;
Personal data information system – a set of personal data contained in databases and information technologies and technical means that ensure their processing;
Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to the authority of a foreign state, a foreign individual or a foreign legal entity.
2. THE GENERAL PROVISIONS
2.1 Rights of the personal data subject
2.1.1 The right of the personal data subject to access their personal data
2.1.1.1 The subject of personal data has the right to receive information. The subject of personal data has the right to demand from Sky Atlas JSC (hereinafter referred to as the operator) clarification of its personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as to take legal measures to protect their rights.
2.1.1.2 In the case the information specified is provided to the personal data subject by the operator in an accessible form, and it should not contain personal data related to other personal data subjects, except in cases where there are legal grounds for disclosure of such personal data.
2.1.1.3 The information can be provided to the personal data subject or representative by the operator when contacting or receiving a request from the personal data subject or representative. The request must contain the number of the main identity document of the personal data subject or his/her representative, information about the date of issue of the specified document and the issuing authority, information confirming the participation of the personal data subject in relations with the operator (contract number, date of conclusion of the contract, conditional verbal designation or information otherwise confirming the processing of personal data by the operator, the signature of the personal data subject or its representative. The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
2.1.1.4 In some cases the information specified in sections of this Policy and process personal data has been provided for review to the personal data subject on his request, the data subject shall have the right to reapply to the operator or send him a second request to obtain the information specified in exact parts of this Policy, and acquaintance with such personal data not earlier than thirty days after the initial treatment or the initial request, unless a shorter period is not set by Federal law.
2.1.1.5 The personal data subject has the right to receive information concerning the processing of his/her personal data, including information:
- confirmation of personal data processing by the operator;
- legal grounds and purposes of personal data processing;
- methods of personal data processing used by the operator;
- name and location of the operator, information about persons (except for employees of the operator) who have access to personal data/to whom personal data may be disclosed on the basis of an agreement with the operator or on the basis of a Federal law;
- processed personal data related to the relevant personal data subject, the source of their receipt, unless a different procedure for submitting such data is provided for by Federal law;
- terms and time of processing of personal data, including the terms of their storage;
- procedure for the exercise by a personal data subject of the rights provided for by Federal law concerning personal data;
- information about cross-border data transfers which have been made or are expected to be made;
- name or surname, first name, patronymic name and address of the person who processes personal data on behalf of the operator, if the processing is or will be entrusted to such person;
- other information provided by federal law concerning personal data.
2.1.1.6 The right of a personal data subject to access their personal data may be restricted in accordance with Federal laws, including:
- the processing of personal data, including personal data obtained as a result of operational search, counterintelligence and intelligence activities, is carried out for the purposes of national defense, state security and law enforcement;
- the processing of personal data by bodies that detention of the personal data subject on suspicion of committing a crime or presenting the subject of personal data accusation on criminal case or applying to the subject of personal data a preventive punishment to a charge;
- personal data is processed in accordance with the legislation on countering the legalization of proceeds from crime and the financing of terrorism;
- the personal data subject's access to their personal data violates the rights and legitimate interests of third parties;
- personal data is processed in cases stipulated by the legislation of the Russian Federation on transport security in order to ensure the stable and safe functioning of the transport complex, protect the interests of individuals, society and the state in the transport complex from acts of unlawful interference.
2.1.2 Rights of personal data subjects when processing their personal data for the purpose of promoting goods, works, and services.
2.1.2.1 The processing of personal data for the purpose of promoting goods, works, and services on the market by making direct contacts with potential consumers via communication means is allowed only with the prior consent of the personal data subject. This processing of personal data is considered to be carried out without the prior consent of the personal data subject, if the operator does not prove that such consent was obtained.
2.1.3 Rights of personal data subjects when making decisions based solely on automated processing of their personal data.
2.1.3.1 The decision that generates legal consequences for a personal data subject or otherwise affects their rights and legitimate interests may be made on the basis of exclusively automated processing of their personal data only with the written consent of the personal data subject or in cases provided by federal laws that also establish measures to ensure compliance with the rights and legitimate interests of the personal data subject.
2.1.3.2 The operator explains to the personal data subject the procedure for making a decision based solely on automated processing of their personal data and the possible legal consequences of such a decision, provides an opportunity to object to such a decision, and also explains the procedure for protecting the personal data subject's rights and legitimate interests.
2.1.3.3 The operator considers the objection specified in clause 2.1.3.3 of this Policy within thirty days from the date of its receipt and notifies the personal data subject of the results of consideration of such objection.
2.1.4 Right to appeal against the operator's actions or omissions
2.1.4.1 If the data subject considers that the operator processes personal data in violation of Federal law on personal data or otherwise violates his/her rights and freedoms, the data subject may appeal the acts or omissions of the operator in authorised body on protection of the rights of subjects of personal data or judicially.
2.1.4.2 The subject of personal data has the right to protect their rights and legitimate interests, including compensation for damages and/or compensation for non-pecuniary damage in court.
2.2. Operator's responsibilities
2.2.1. Obligations of the operator when collecting personal data
2.2.1.1. When collecting personal data, the operator provides the personal data subject with information upon request.
2.2.1.2. If the provision of personal data is mandatory in accordance with federal laws, the operator explains to the personal data subject the legal consequences of refusing to provide his/her personal data.
2.2.1.3. If personal data is not received from the personal data subject, the operator, except for the cases provided for in clause 2.2.1.4 of this Policy, before processing such personal data, provides the personal data subject with the following information:
- name or surname, first name, patronymic name and address of the operator or its representative;
- purpose of personal data processing and its legal basis;
- intended users of personal data;
- the rights of the personal data subject established by federal law concerning personal data;
- the source of receiving personal data.
2.2.1.4. The operator is to be released from the obligation to provide the personal data subject with the information provided for in clause 2.2.1.3 of this Policy, in cases:
- the personal data subject is notified of the processing of his personal data by the relevant operator;
- personal data is obtained by the operator on the basis of Federal laws or in connection with the performance of a contract to which the personal data subject is a party or beneficiary or guarantor;
- personal data is made publicly available by the personal data subject or obtained from a publicly available source;
- the operator processes personal data for statistical or other research purposes, or for scientific or other creative activities, provided that the rights and legitimate interests of the personal data subject are not violated;
- providing the personal data subject with the information provided for in clause 2.2.1.3 of this Policy violates the rights and legitimate interests of third parties.
2.2.1.5. While collecting personal data, including throughout the Internet, the operator shall provide recording, systematization, accumulation, storage, clarification (updating, changing), extraction of personal data of Russian citizens using databases located on the territory of the Russian Federation, except the cases specified in paragraphs of Federal law concerning personal data.
3. THE PURPOSES OF PERSONAL DATA COLLECTION
3.1. The processing of personal data must be limited to the achievement of specific, pre-defined and legitimate goals. Processing of personal data which is incompatible with the purposes of personal data collection is not allowed.
3.2. The purposes of personal data processing may arise in cases of the analysis of legal acts regulating the operator's activities, the goals of the activities actually carried out by the operator, as well as the activities provided for in the operator's constituent documents, and the operator's specific business processes in specific personal data information systems (by the operator's structural divisions and their procedures in relation to certain categories of personal data subjects).
3.3. Personal data is processed by the operator for the following purposes:
- compliance with the requirements of the legislation of the Russian Federation;
- carrying out business activities and making transactions in accordance with the operator's regulations;
- conclusion of any contracts with personal data subjects and their further execution;
- providing personal data subjects with information about services provided by the operator, new products and services;
- informing customers about offers for the operator's products and services;
- conducting personnel work and organizing accounting of the operator's employees;
- regulation of labor and other relations directly related to them;
- recruitment and selection of job candidates;
- generating statistical reports for the operator's needs;
- implementation of administrative and economic activities by the operator;
- providing the operator's employees and their families with additional guarantees and compensation, including voluntary health insurance and other types of social security;
- achieving the goals stipulated by the legislation of the Russian Federation and performing the functions, powers and duties assigned to the operator by the legislation of the Russian Federation.
4. THE LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
4.1. The legal basis for the processing of personal data is a set of legal acts, in accordance with which the operator processes personal data.
4.2. The legal grounds for processing personal data are:
- Russian Constitution;
- Civil Code of the Russian Federation of 30.11.1994;
4.3. Additionally, the processing of personal data is possible in the following cases:
4.3.1. the processing of personal data is necessary to protect the life, health or other vital interests of the personal data subject, if obtaining the consent of the personal data subject is not possible;
4.3.2. the processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant goals, provided that the rights and/or freedoms of the personal data subject are not violated;
4.3.3. personal data is processed for statistical or other research purposes, with the exception of the purposes specified in article 15 of federal law in cases of mandatory depersonalization of personal data;
4.3.4. processing of personal data is carried out, access unlimited number of persons to which is provided by the subject of personal data at his/her request;
4.3.5. personal data that is subject to publication or mandatory disclosure in accordance with Federal laws is processed.
4.4. The processing of personal data is possible if the personal data subject gives a consent to the processing of personal data.
4.4.1. The personal data subject makes a decision to provide his / her personal data and consents to their processing freely, at his / her own will and in his / her own interest. Consent to the processing of personal data must be specific, informed and conscious.
4.4.2. Consent to the processing of personal data may be given by the subject of personal data or his/her representative in any form that allows confirming the fact of its receipt, unless otherwise established by Federal laws. If the consent to the processing of personal data is obtained from the representative of the personal data subject, the authority of this representative to give consent on behalf of the personal data subject is checked by the operator.
4.4.3. Consent to the processing of personal data may be revoked by the personal data subject. If the personal data subject withdraws consent to the processing of personal data, the operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in Federal law concerning personal data.
5. CATEGORIES OF PERSONAL DATA SUBJECTS
5.1 The content and volume of personal data processed correspond to the stated purposes of processing. The personal data processed is not redundant in relation to the stated purposes of their processing.
The categories of personal data subjects may include:
- individuals who are candidates for vacant positions;
- individuals who are employees of the operator and their close relatives;
- former employees of the operator;
- individuals who perform work on the provision of services and have concluded a civil contract with the operator;
- individuals who are members of the operator's management bodies;
- individuals representing the interests of the operator's clients (representatives of organizations that enter into contracts with the operator);
- individuals who are clients of the operator;
- individuals who have purchased or intend to purchase the operator's services or third-party services through the intermediary of the operator;
- individuals who are not related to the operator's Clients and who have entered into or intend to enter into contractual relations with the operator in connection with the operator's administrative and economic activities;
- individuals whose personal data is made publicly available by them, and processing it does not violate their rights and meets the requirements established by the legislation on personal data;
- other individuals who have expressed their agreement to the processing of their personal data by the operator;
- individuals whose personal data processing is necessary for the operator to achieve the goals stipulated by the legislation of the Russian Federation or to perform and fulfill the functions, powers and duties assigned to the operator by the legislation of the Russian Federation.
6. PROCEDURE AND CONDITIONS FOR PROCESSING PERSONAL DATA
6.1. Processing of personal data is carried out in the form of automated processing, processing without the use of automation tools, as well as in the form of mixed processing of personal data.
6.2. Personal data is processed legally and properly.
6.3. The processing of personal data must be limited to the achievement of specific, pre-defined and legitimate goals. Processing of personal data that is incompatible with the purposes of personal data collection is not allowed.
6.4. It is not allowed to combine databases containing personal data that are processed for purposes that are incompatible with each other.
6.5. Only personal data that meets the purposes of processing are subject to processing.
6.6. The content and volume of personal data processed correspond to the stated purposes of processing. The personal data processed is not redundant in relation to the stated purposes of their processing.
6.7. When processing personal data, the accuracy of personal data, its sufficiency, and, if necessary, its relevance to the purposes of personal data processing are ensured. The operator takes the necessary measures or ensures that they are taken to delete or clarify incomplete or inaccurate data.
6.8. Storage of personal data is carried out in a form that allows to determine the subject of personal data, no longer than the purposes of processing personal data require, if the period of storage of personal data is not established by Federal laws. The processed personal data is destroyed or depersonalized when the processing goals are achieved or when it is no longer necessary to achieve these goals, unless it is not provided by Federal laws.
6.9. The operator reserves the right, but is not obligated to process personal data in the form of actions or a set of actions with personal data performed using automation tools or without their use.
6.10. Personal data is stored and processed by the operator for the period necessary to achieve the purposes of personal data processing. Performing all the functions, powers and duties assigned to the operator by the legislation of the Russian Federation. For the execution of contracts to which the personal data subject is a party, beneficiary or guarantor. Protection of the operator's rights and legitimate interests, including taking into account the Statute of limitations.
6.11. Personal data may be transferred to the third parties only with the consent of the personal data subject, otherwise it is provided by Federal laws or an agreement.
6.12. The operator has the right to transfer personal data to state bodies, investigation and inquiry bodies, and other authorized bodies on the grounds provided for by the current legislation of the Russian Federation.
6.13. In the case of an order to process personal data of subjects, the contract must contain information about compliance with the requirements for confidentiality of personal data established by Article 7 of the Federal law concerning personal data.
6.14. The condition for ending the processing of personal data may include: the achievement of the objectives of processing personal data; the expiration date of the consent of the subject of personal data; identifying illegal processing of personal data.
6.15. While collecting personal data, including throughout the Internet, the operator shall provide recording, systematization, accumulation, storage, clarification (updating, changing), extraction of personal data of Russian citizens using databases located on the territory of the Russian Federation, except the cases specified in paragraphs of Federal law concerning personal data.
7. THE PROCEDURE FOR UPDATING, CORRECTION, DELETION AND DESTRUCTION OF PERSONAL DATA
7.1 If illegal processing of personal data is detected when the personal data subject or his/her representative applies, or at the request of the personal data subject or representative or the authorized body for the protection of the rights of personal data subjects, the operator blocks the unlawfully processed personal data related to this personal data subject, or ensures their blocking (if the personal data is processed by another person acting on behalf of the operator) from the moment of such request or receipt of the specified request for the verification period.
7.2 If the fact of inaccuracy of personal data is confirmed, the operator, based on the information provided by the personal data subject or his representative should clarify the personal data or ensure its clarification (the procedure is done within seven working days from the date of submission of such information and removes the blocking of personal data).
7.3 In cases if illegal processing of personal data is detected by the operator or a person acting on behalf of the operator, the operator stops the illegal processing of personal data or ensures the termination of illegal processing of personal data by a person acting on behalf of the operator. (within a period not exceeding three business days from the date of this detection).
7.3.1 If it is impossible to ensure the legality of personal data processing, the operator destroys such personal data or ensures their destruction within a period not exceeding ten working days from the date of detection of illegal processing of personal data.
7.3.2 The operator notifies the personal data subject or his/her representative about the elimination of violations or destruction of personal data.
7.4 In the case of achieving the purpose of processing personal data, the operator stops the processing of the personal data or arrange for its termination and destroys the personal data or arrange for their destruction within a period not exceeding thirty days from the date of achievement of the purpose of personal data processing.
7.5 In case of revocation the personal data subject consent to the processing of personal data, the operator stops processing and destroys the personal data/ arranges for their destruction (in the case that the preservation of personal data no longer required for any purposes of processing of personal data).
7.6 If it is not possible to destroy personal data within the period specified in clauses of this Policy, the operator blocks the personal data or ensures their blocking and ensures the destruction of personal data within a period of no more than six months, unless another period is established by Federal laws.
8. RESTRICTIONS ON THE VALIDITY OF THIS POLICY
The Policy does not apply to relationships that arise when:
- processing of personal data by individuals exclusively for personal and family needs, if the rights of personal data subjects are not violated;
- organization of storage, accounting and use of documents containing personal data of the Archive Fund of the Russian Federation and other archival documents in accordance with the legislation of the Russian Federation;
- processing of personal data classified as a state secret in accordance with the established procedure.
9. FINAL PROVISION
9.1 This policy, as well as all the changes and additions to it, are accepted and approved by the General Director and are valid until they are replaced by a new One.
9.2 The operator, as well as its officials and employees, bear civil, administrative and other liability for non-compliance with the principles and conditions for processing personal data of individuals, as well as for disclosure or illegal use of personal data in accordance with the legislation of the Russian Federation.
9.3 The policy is publicly available and must be posted on the operator's official website or otherwise unrestricted access is provided.