Policy on Personal Data Protection and Processing of Realnoe Vremya

Limited Liability Company

1. General Provisions

1.1. This Policy on Personal Data Protection and Processing of Realnoe Vremya Limited Liability Company (hereinafter referred to as the Policy) has been developed in compliance with the requirements of Paragraph 2 of Part 1 of Article 18.1 of the Federal Law as of 27.07.2006 No. 152-FL On Personal Data (hereinafter referred to as the Law on Personal Data) in order to ensure the protection of the rights and freedoms of an individual and citizen when processing their personal data, including the protection of the rights to privacy, personal and family secrets.

1.2. The Policy applies to all personal data processed by Realnoe Vremya Limited Liability Company (hereinafter referred to as the Operator, Realnoe Vremya LLC) Taxpayer ID 1658157531, address: 2 Akademicheskaya Street, office 510, Kazan, phone +7 (843) 222-90-80, e-mail: info@realnoevremya.ru.

1.3. The Policy applies to relations in personal data processing that the Operator had both before and after the approval of this Policy.

1.4. In pursuance of the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in the public domain on the Internet on the website of Realnoe Vremya online newspaper: https://realnoevremya.ru/, whose founder is the Operator.

1.5. Key concepts used in the Policy:

personal data is any information related to a directly or indirectly identified or determined individual (subject of personal data);

personal data operator (operator) is a government agency, municipal agency, legal entity or individual that independently or jointly with other persons organises and (or) carries out the processing of personal data as well as determines the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;

personal data processing is any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools. Among other things personal data processing includes:

• collection;
• recording;
• systematisation;
• accumulation;
• storage;
• clarification (updating, modification);
• retrieval;
• use;
• transfer (distribution, provision, access);
• depersonalisation;
• blocking;
• deletion;
• destruction;

automated personal data processing is processing of personal data using computer technology;

personal data dissemination is actions aimed at disclosing personal data to an indefinite number of persons;

personal data provision is actions aimed at disclosing personal data to a specific person or a specific group of persons;

personal data blocking is temporary cessation of processing of personal data (except for cases where processing is necessary to clarify personal data);

personal data destruction is actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which tangible media of personal data are destroyed;

personal data depersonalisation is actions as a result of which it becomes impossible to determine the ownership of personal data by a specific subject of personal data without the use of additional information;

personal data information system is a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

1.6. Basic rights and obligations of the Operator.

1.6.1. The Operator has the right to:

1) Independently determine the composition and list of measures necessary and sufficient to ensure the fulfilment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
2) Assign personal data processing to another person with the consent of the personal data subject, unless otherwise provided by federal law on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data stipulated by the Law on Personal Data, maintain the confidentiality of personal data and take the necessary measures aimed at ensuring the fulfilment of the obligations stipulated by the Law on Personal Data;
3) If the personal data subject revokes the consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Law on Personal Data.

1.6.2. The Operator is obliged to:

1) Organise personal data processing in accordance with the requirements of the Law on Personal Data;
2) Respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
3) Notify the authorised body for the protection of the rights of personal data subjects (the Federal Service for Communications, Information Technology and Mass Media (Roskomnadzor)) at the request of this body of the necessary information within 10 working days from the date of receipt of such a request. This period may be extended, but not more than by five working days. To do this, the Operator must send Roskomnadzor a reasoned notice indicating the reasons for the extension of the period for providing the requested information;
4) Ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it of computer incidents that entailed the illegal transfer (provision, distribution, access) of personal data in a manner determined by the federal executive body authorised in security.

1.7. Basic rights of the personal data subject. The personal data subject has the right to:

1) Receive information regarding the processing of their personal data, except for cases stipulated by federal laws. The information is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data related to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
2) Demand that the operator clarify his personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing and also take measures provided by law to protect their rights;
3) Provide preliminary consent to personal data processing for the purpose of promoting goods, works and services on the market;
4) Appeal to Roskomnadzor or in court against illegal actions or inaction of the Operator when processing their personal data.

1.8. Compliance with the requirements of this Policy is monitored by an authorised person responsible for organising personal data processing for the Operator.

1.9. Liability for violation of the requirements of the legislation of the Russian Federation and regulatory acts of Realnoe Vremya LLC in processing and protecting personal data is determined in accordance with the legislation of the Russian Federation.

2. Purposes of Personal Data Collection

2.1. The processing of personal data is limited to achieving specific, predetermined and legitimate purposes.

2.2. Only personal data that meet the purposes of their processing are subject to processing.

2.3. The Operator processes personal data for the following purposes:

• carrying out its activities in accordance with the charter of Realnoe Vremya LLC, including the conclusion and execution of contracts with counterparties;
• compliance with labour legislation within the framework of labour and other directly related relations;
• implementation of an access control system.

3. Legal Grounds for Personal Data Processing

3.1. The legal basis for processing personal data is a set of regulatory legal acts, pursuant to which and in accordance with which the Operator processes personal data, including:

• The Constitution of the Russian Federation;
• The Civil Code of the Russian Federation;
• The Labour Code of the Russian Federation;
• The Tax Code of the Russian Federation;
• Federal Law as of 08.02.1998 N 14-FL On Limited Liability Companies;
• Federal Law as of 06.12.2011 N 402-FL On Accounting;
• Federal Law as of 15.12.2001 N 167-FL On Compulsory Pension Insurance in the Russian Federation;
• Other regulatory legal acts governing relations related to the activities of the Operator.

3.2. The legal basis for processing personal data also includes:

• The charter of Realnoe Vremya LLC;
• Agreements concluded between the Operator and personal data subjects;
• The consent of personal data subjects to the processing of their personal data.

4. Amount and Categories of Processed Personal Data,

Categories of Personal Data Subjects

4.1. The content and amount of personal data processed must correspond to the stated purposes of processing provided for in Section 2 of this Policy. The personal data processed must not be excessive in relation to the stated purposes of their processing

4.2. The Operator may process personal data of the following categories of personal data subjects.

4.2.1. Candidates for employment with the Operator – for the purposes of enforcing labour legislation within labour and other relations directly related to it, implementation of the access control system

4.2.2. Employees and former employees of the Operator – for the purposes of implementing labour legislation within the framework of labour and other relations directly related to it, implementation of the access control system.

4.2.3. Family members of the Operator's employees – for the purposes of implementing labour legislation within the framework of labour and other relations directly related to it

4.2.4. Clients and contractors of the Operator (individuals) – for the purposes of carrying out their activities in accordance with the charter of Realnoe Vremya LLC, implementation of the access control system:

4.2.5. Representatives (employees) of clients and contractors of the Operator (legal entities) – for the purposes of carrying out their activities in accordance with the charter of Realnoe Vremya LLC, implementation of the access control system.

4.3. The processing of biometric personal data (information that characterises the physiological and biological characteristics of a person, on the basis of which his identity can be established) by the Operator is carried out in accordance with the legislation of the Russian Federation.

4.4. The Operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, except for cases stipulated by the legislation of the Russian Federation.

5. Terms and Conditions for Processing Personal Data

5.1. The Operator processes personal data in accordance with the requirements of the legislation of the Russian Federation

5.2. Personal data is processed with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases stipulated by the legislation of the Russian Federation.

5.3. The Operator processes personal data for each purpose of their processing in the following ways:

• Non-automated processing of personal data;
• Automated processing of personal data with or without the transfer of the received information via information and telecommunications networks;
• Mixed processing of personal data.

5.4. Only the Operator's employees whose job responsibilities include the processing of personal data are allowed to process personal data.

5.5. Personal data shall be processed for each processing purpose specified in paragraph 2.3 of the Policy by:

• Obtaining personal data orally and in writing directly from personal data subjects;
• Entering personal data into the Operator's journals, registers and information systems;
• Using other methods of processing personal data.

5.6. Disclosure of personal data to third parties and its distribution without the consent of the personal data subject is prohibited, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the personal data subject for distribution is drawn up separately from other consents of the personal data subject to the processing of their personal data. The requirements for the content of consent to the processing of personal data permitted by the personal data subject for distribution are approved by Order of Roskomnadzor as of 24.02.2021 No. 18.

5.7. The transfer of personal data to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia and other authorised executive bodies and organisations is carried out in accordance with the requirements of the legislation of the Russian Federation.

5.8. The Operator shall take the necessary legal, organisational and technical measures to protect personal data from unauthorised or accidental access, destruction, modification, blocking, distribution and other unauthorised actions, including:

• Determines threats to the security of personal data during their processing;
• Adopts local regulations and other documents governing relations in processing and protecting personal data;
• Installs software protection tools;
• Appoints persons responsible for ensuring the security of the Operator's personal data;
• Creates the necessary conditions for working with personal data;
• Organises the accounting of documents containing personal data;
• Organizes work with information systems in which personal data is processed;
• Stores personal data in conditions that ensure their safety and exclude unauthorized access to them.
• Organises training for the Operator's employees processing personal data.

5.9. The operator stores personal data in a form that allows the subject of personal data to be identified, no longer than required by each purpose of processing personal data, unless the storage period for personal data is established by federal law or an agreement

5.9.1. Personal data on paper media are stored in Realnoe Vremya LLC for the storage periods of documents for which these periods are provided for by the legislation on archival affairs in the Russian Federation (Federal Law as of 22.10.2004 No. 125-FL On Archival Affairs in the Russian Federation, the List of standard management archival documents generated in the course of activities of state bodies, local governments and organisations, indicating the periods of their storage (approved by Order of Rosarchive as of 20.12.2019 No. 236)).

5.9.2. The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper media.

5.10. The operator stops processing personal data in the following cases:

• The fact of their illegal processing is detected. The term is within three working days from the date of detection;
• The purpose of their processing has been achieved;
• The consent of the subject of personal data to the processing of the said data has expired or has been revoked, when, according to the Law on Personal Data, the processing of these data is allowed only with consent.

5.11. Upon achieving the goals of personal data processing as well as in the event of the personal data subject's withdrawal of consent to their processing, the Operator shall stop processing these data, unless:

• Otherwise provided by the agreement to which the personal data subject is a party, beneficiary or guarantor;
• The Operator shall not have the right to carry out processing without the consent of the personal data subject on the grounds stipulated by the Personal Data Law or other federal laws;
• Otherwise provided by another agreement between the Operator and the personal data subject.

5.12. If the personal data subject applies to the Operator with a request to stop processing personal data within a period not exceeding 10 working days from the date of receipt by the Operator of the relevant request, the processing of personal data shall be terminated, except for cases stipulated by the Personal Data Law. The specified period may be extended, but not more than by five working days. To do this, the Operator must send the personal data subject a reasoned notice indicating the reasons for the extension of the period.

5.13. When collecting personal data, including via the Internet information and telecommunications network, the Operator ensures the recording, systematisation, accumulation, storage, clarification (update, change), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.

6. Updating, Correcting, Deleting, Destroying

Personal Data, Responding to Requests from Subjects for Access

to Personal Data

6.1. Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of personal data processing as well as other information specified in Part 7 of Article 14 of the Law on Personal Data are provided by the Operator to the personal data subject or his representative within 10 working days from the date of the request or receipt of the request from the personal data subject or his representative. This period may be extended, but not more than by five working days. To do this, the Operator should send the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information.

The information provided does not include personal data related to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data.

The request must contain:

• The number of the main document certifying the identity of the personal data subject or his representative, information on the date of issue of the said document and the body that issued it;
• Information confirming the participation of the personal data subject in relations with the Operator (agreement number, date of conclusion of the agreement, conventional verbal designation or information otherwise confirming the fact of processing of personal data by the Operator);
• Signature of the personal data subject or his representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator provides the information specified in Part 7 of Article 14 of the Law on Personal Data to the personal data subject or his representative in the form in which the relevant request or appeal was sent, unless otherwise specified in the request or appeal.

If the request of the personal data subject does not reflect all the necessary information in accordance with the requirements of the Law on Personal Data or the subject does not have the right to access the requested information, then a reasoned refusal is sent to them.

The right of the personal data subject to access his personal data may be limited in accordance with Part 8 of Article 14 of the Law on Personal Data, including if the access of the personal data subject to his personal data violates the rights and legitimate interests of third parties.

6.2. In the event that inaccurate personal data is discovered when the personal data subject applies data or their representative or at their request or at the request of Roskomnadzor, the Operator blocks the personal data related to this personal data subject from the moment of such request or receipt of the said request for the verification period if the blocking of the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

In the event that the fact of inaccuracy of personal data is confirmed, the Operator, clarifies the personal data within seven working days from the date of submission of such information on the basis of information provided by the personal data subject or their representative or Roskomnadzor or other necessary documents and removes the blocking of the personal data.

6.3. In the event that unlawful processing of personal data is detected upon request (request) from the personal data subject or their representative or Roskomnadzor, the Operator blocks the unlawfully processed personal data related to this personal data subject from the moment of such request or receipt of the request.

6.4. If the Operator, Roskomnadzor or another interested party discovers an unlawful or accidental transfer (provision, distribution) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator shall:

• notify Roskomnadzor of the incident that has occurred, the alleged causes that resulted in a violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects and the measures taken to eliminate the consequences of the incident and also provide information about the person authorised by the Operator to interact with Roskomnadzor on issues related to the incident within 24 hours;
• notify Roskomnadzor of the results of the internal investigation of the identified incident and provide information about the persons whose actions caused it (if any) within 72 hours.

6.5. Procedure for the destruction of personal data by the Operator.

6.5.1. Conditions and terms for the destruction of personal data by the Operator:

• Achievement of the purpose of processing personal data or the loss of the need to achieve this purpose – within 30 days;
• Reaching the maximum storage periods for documents containing personal data – within 30 days;
• Provision by the personal data subject (his/her representative) of confirmation that the personal data were obtained illegally or are not necessary for the stated purpose of processing – within seven working days;
• Withdrawal by the personal data subject of consent to the processing of his/her personal data, if their preservation for the purpose of their processing is no longer required – within 30 days.

6.5.2. Upon achieving the purpose of processing personal data as well as in the event of withdrawal by the personal data subject of consent to their processing, personal data are subject to destruction – on paper – destroyed by shredding; – in electronic form – erased from the information carriers or the carriers on which the information is stored are physically destroyed, unless:

• Otherwise provided by the agreement to which the personal data subject is a party, beneficiary or guarantor;
• The operator has no right to carry out processing without the consent of the personal data subject on the grounds stipulated by the Personal Data Law or other federal laws;
• Unless otherwise provided by another agreement between the Operator and the subject of personal data.

6.5.3. The destruction of personal data is carried out by a commission created by order of the director of Realnoe Vremya LLC.

6.6. This Policy will reflect any changes in the processing of personal data by the Operator. The Policy is valid indefinitely until it is replaced by a new version.