1. General Provisions

 

1.1. This Personal Data Processing Policy (hereinafter referred to as the PD Processing Policy) of Laggar Pro LLC (hereinafter referred to as the Operator), TIN, located at the address: Russia, Nizhny Novgorod, st. Yablonevaya, house 26., developed in accordance with the Constitution of the Russian Federation, the Labor Code of the Russian Federation, the Civil Code of the Russian Federation, Federal Law of July 27, 2006 No. 149-FZ "On Information, Information Technologies and Information Protection", Federal Law 27 July 2006 No. 152-FZ "On personal data", Resolution of the Government of the Russian Federation dated 01.11.2012 No. 1119 "On approval of requirements for the protection of personal data when processing them in personal data information systems", other federal laws and regulations.

1.2. The policy was developed taking into account the requirements of the Constitution of the Russian Federation, legislative and other regulatory legal acts of the Russian Federation in the field of personal data.

1.3. The PD processing policy has been developed to ensure the protection of the rights and freedoms of the subject of personal data when processing his personal data (hereinafter referred to as PD).

1.4. The provisions of the Policy serve as the basis for the development of local regulations governing the processing of personal data of employees of Laggar Pro LLC and other subjects of personal data in Laggar Pro LLC.

 

 

2. Purposes of processing personal data

 

Personal data is processed by the Operator for the following purposes:

1) the implementation and implementation of the functions, powers and duties assigned by the legislation of the Russian Federation to the Operator, in particular:

• compliance with the requirements of legislation in the field of labor and taxation;

• maintenance of current accounting and tax accounting, formation, production and timely submission of accounting, tax and statistical reporting;

• compliance with the requirements of the legislation to determine the procedure for processing and protecting personal data of citizens who are clients or contractors of Laggar Pro LLC (hereinafter referred to as the subjects of personal data).

2) exercising the rights and legitimate interests of Laggar Pro LLC in the framework of the activities provided for by the Charter and other local regulations of Laggar Pro LLC, or third parties, or achieving socially significant goals;

3) for other legal purposes.

 

​

3. Legal basis for the processing of personal data

 

PD processing is carried out on the basis of the following federal laws and regulations:

1. The Constitution of the Russian Federation;

2. Labor Code of the Russian Federation;

3. Federal Law of July 27, 2006 No. 152-FZ "On Personal Data";

4. Federal Law "On Information, Information Technologies and Information Protection" dated July 27, 2006 N 149-FZ.

5. Regulations on the specifics of personal data processing carried out without the use of automation tools. Approved by the Resolution of the Government of the Russian Federation dated September 15, 2008 No. 687.

6. Resolution of November 1, 2012 N 1119 on the approval of requirements for the protection of personal data when processing them in personal data information systems.

7. Order of FSTEC of Russia No. 55, FSB of Russia No. 86, Ministry of Information Technologies and Communications of Russia No. 20 dated February 13, 2008 "On approval of the Procedure for classifying information systems of personal data";

8. Order of the FSTEC of Russia dated February 18, 2013 No. 21 "On approval of the composition and content of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems";

9. Roskomnadzor order of September 5, 2013 No. 996 "On approval of requirements and methods for anonymization of personal data";

10. Order of the Federal Tax Service of November 17, 2010 No. ММВ-7-3 / 611 "On approval of the form of information on the income of individuals and recommendations for filling it out, the format of information on the income of individuals in electronic form, reference books".

11. Other regulatory legal acts of the Russian Federation and regulatory documents of authorized government bodies.

 

 

4. List of actions with personal data

 

When processing PD, the Operator will carry out the following actions with PD: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

 

 

5. The composition of the processed personal data

 

5.1. The following PD subjects are subject to processing by the Operator:

• Operator's employees;

• Operator's clients;

• contractors of the Operator;

• individuals who have contacted the Operator in the manner prescribed by the Federal Law "On the Procedure for Considering Applications of Citizens of the Russian Federation".

5.2. The composition of PD for each of the categories of subjects listed in clause 5.1 of this Regulation is determined in accordance with the regulatory documents listed in section 3 of this Regulation, as well as the regulatory documents of the Institution issued to ensure their implementation.

5.3. In the cases provided for by the current legislation, the subject of personal data decides to provide his PD to the Operator and agrees to their processing freely, of his own free will and in his own interest.

5.4. The operator ensures that the content and volume of the processed PD corresponds to the stated processing goals and, if necessary, takes measures to eliminate their redundancy in relation to the stated processing goals.

5.5. The processing of special categories of personal data concerning race, nationality, political views, religious or philosophical beliefs, intimate life is not carried out in Laggar Pro LLC.

 

​

6. Processing of personal data

​​

6.1. The processing of personal data in Laggar Pro LLC is carried out in the following ways:

• non-automated processing of personal data;

• automated processing of personal data with or without transmission of the information received via information and telecommunication networks;

• mixed processing of personal data.

 

​

7. Ensuring the protection of personal data during their processing by the Operator

 

The operator takes measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data" and the regulatory legal acts adopted in accordance with it. The operator independently determines the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Federal Law of July 27, 2006 No. 152 "On Personal Data", Government Decree of September 15, 2008 No. 687 "On Approval of the Regulation on the Peculiarities of Personal Data Processing carried out without the use of automation tools ", by the Government decree of November 01, 2012 No. 1119" On approval of the requirements for the protection of personal data during their processing in personal data information systems ", by the FSTEC order of February 18, 2013 No. 21" On the approval of the composition and content organizational and technical measures to ensure the security of personal data during their processing in personal data information systems ", and other regulatory legal acts, unless otherwise provided by federal laws. These measures include:

– appointment by the Operator of a person responsible for organizing the processing of personal data;

– the publication by the Operator of documents defining the operator's policy regarding the processing of personal data, local acts on the processing of personal data, as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation, eliminating the consequences of such violations;

– application of legal, organizational and technical measures to ensure the security of personal data;

– implementation of internal control and (or) audit of the compliance of personal data processing with the Federal Law "On Personal Data" and the regulatory legal acts adopted in accordance with it, requirements for the protection of personal data, the Operator's policy regarding the processing of personal data, local acts of the Operator;

– determination of the assessment of harm that may be caused to subjects of personal data in case of violation of the Federal Law "On Personal Data", the ratio of this harm and the measures taken by the operator aimed at ensuring the fulfillment of the obligations provided for by the Federal Law "On Personal Data";

– familiarization of the Operator's employees who directly process personal data with the provisions of the legislation of the Russian Federation on personal data, including the requirements for the protection of personal data, documents defining the Operator's policy regarding the processing of personal data, local acts on the processing of personal data, and (or ) training of the specified employees.

7.2. When processing personal data, the operator takes the necessary legal, organizational and technical measures or ensures their adoption to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other illegal actions in regarding personal data.

 

​

8. The right of the subject of personal data to access his personal data

 

8.1. The PD subject has the right to demand that the Operator clarify his personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as take measures provided by law to protect their rights.

8.2. Information is provided to the subject of personal data or his representative by the operator when contacting or upon receiving a request from the subject of personal data or his representative. The request must contain the number of the main document proving the identity of the subject of personal data or his representative, information on the date of issue of the said document and the issuing authority, information confirming the participation of the subject of personal data in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator, the signature of the subject of personal data or his representative. The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

8.3. The operator has the right to refuse the subject of personal data to fulfill a repeated request. Such a refusal must be motivated. The Operator is responsible for providing evidence of the validity of the refusal to fulfill the repeated request.

8.4. The subject of personal data has the right to receive information regarding the processing of his personal data, including containing:

– confirmation of the fact of personal data processing by the Operator;

– legal grounds and purposes of personal data processing;

– the purposes and methods of processing personal data used by the Operator;

– the name and location of the Operator, information about persons (with the exception of the operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the operator or on the basis of federal law;

– processed personal data relating to the relevant subject of personal data, the source of their receipt, unless another procedure for submitting such data is provided for by federal law;

– terms of processing personal data, including the terms of their storage;

– the procedure for the exercise by the subject of personal data of the rights provided for by the Federal Law "On Personal Data";

– information on the performed or expected cross-border data transfer;

– name or surname, first name, patronymic and address of the person who processes personal data on behalf of the Operator, if the processing is entrusted or will be entrusted to such a person.

8.5. If the subject of personal data believes that the operator is processing his personal data in violation of the requirements of the Federal Law "On Personal Data" or otherwise violates his rights and freedoms, the subject of personal data has the right to appeal against the actions or inaction of the operator to the body authorized to protect the rights of subjects personal data, or in court.

8.6. The subject of personal data has the right to protect his rights and legitimate interests, including compensation for damages and (or) compensation for moral damage in court.