Personal Data Processing Policy

1. General provisions

1.1. The personal data processing policy (hereinafter referred to as the Policy) was developed in accordance with the Federal Law of the Russian Federation dated July 27, 2006 No. 152-FZ “On Personal Data”, as well as other federal laws and regulations of the Russian Federation defining the cases and features of the processing of personal data and ensuring the security and confidentiality of such information (hereinafter referred to as the Personal Data Legislation).
The legal grounds for the processing of personal data are:
- Constitution of the Russian Federation;
- Labour Code of the Russian Federation;
- Civil Code of the Russian Federation;
- Tax Code of the Russian Federation;
- Federal Law of the Russian Federation dated July 27, 2006 No. 149-FZ “On information, information technologies and information protection”;
- Federal Law of the Russian Federation dated April 1, 1996 No. 27-FZ “On individual (personalized) accounting and the compulsory insurance system”;
- Federal Law of the Russian Federation dated December 29, 2006 No. 255-FZ “On compulsory social insurance in case of temporary disability and in connection with maternity”;
- Federal Law of the Russian Federation dated November 29, 2010 No. 326-FZ “On compulsory health insurance in the Russian Federation”;
- Decree of the Government of the Russian Federation dated November 1, 2012 No. 1119 “On approval of requirements for the protection of personal data when processing personal data in information systems”;
- Regulations on the processing of personal data carried out without the use of automation tools, approved by Decree of the Government of the Russian Federation of September 15, 2008 No. 687;
- Order of the FSTEC of Russia dated February 18, 2013 No. 21 “On approval of the composition and content of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems”;
- Order of Roskomnadzor dated September 05, 2013 No. 996 “On approval of requirements and methods for anonymization of personal data”;
- other regulatory legal acts of the Russian Federation and regulatory documents of authorized government bodies.
1.2. The legal basis for the processing of personal data is also:
- charter of KOBRA JSC;
- agreements concluded between the Operator and data subjects;
- consent of data subjects to the processing of their personal data;
- the operator processes the User’s personal data only if it is sent by the User through the forms located on the website www.kobra.su. By sending his personal data to the Operator, the User expresses his consent to this Policy.
1.3. The policy was developed in order to implement the requirements of the law in the field of processing and ensuring the security of personal data and is aimed at ensuring the protection of the rights and freedoms of man and citizen when processing his personal data at KOBRA JSC.
1.4. The Policy applies to all employees of KOBRA JSC (including employees under employment contracts and employees working under contract agreements), its structural divisions, users of the website www.kobra.su. The requirements of the Policy are also taken into account and presented in relation to other persons if it is necessary for their participation in the process of processing personal data by the operator.
1.5. The Policy uses the following terms and definitions in accordance with their meanings defined by Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data”:
-personal data – any information relating to a directly or indirectly identified or identifiable individual (data subject);
- personal data operator (operator) – a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
- in this Policy, the operator of personal data is understood to be KOBRA JSC;
- processing of personal data – any action (operation) or set of actions (operations) with personal data performed using automation tools or without their use. Processing of personal data includes, inter alia:
- collection;
- recording;
- systematization;
- accumulation;
- storage;
- clarification (update, change);
- extraction;
- use;
- transmission (distribution, provision, access);
- anonymisation;
- blocking;
- deletion;
- destruction.
- automated processing of personal data – processing of personal data using computer technology;
- dissemination of personal data – actions aimed at disclosing personal data to an indefinite number of persons;
- provision of personal data – actions aimed at disclosing personal data to a certain person or a certain circle of persons;
- blocking of personal data – temporary cessation of processing of personal data (except for cases where processing is necessary to clarify personal data);
- destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material media of personal data are destroyed;
- anonymisation of personal data – actions as a result of which it becomes impossible to determine whether personal data relates to a particular data subject without the use of additional information;
- personal data information system – the totality of personal data contained in databases and the information technologies and technical means that ensure their processing;
- cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity;
- user - any visitor to the website www.kobra.su.
1.6. This Policy is publicly available and is posted on the KOBRA JSC website.
1.7. The policy is valid indefinitely after its approval and until it is replaced by a new edition due to objective necessity.

2. Purposes of processing personal data

2.1. KOBRA JSC processes personal data for the purposes of:
- maintaining personnel and accounting records;
- preparation, conclusion and performance of a civil-law contract;
- ensuring access control to the operator’s territory;
- ensuring compliance with the labour legislation of the Russian Federation;
- ensuring the completion of introductory, industrial or pre-diploma internship on the basis of an agreement with an educational institution;
- selection of personnel (applicants) for vacant positions with the Operator;
- provision of additional social guarantees and compensation payments, tax deductions, etc.;
- holding corporate events, posting on the official website, corporate portal, on the page of KOBRA JSC on the social network, in the magazine Vestnik of KOBRA JSC, on information stands of KOBRA JSC, in telephone directories;
- implementation of information and (or) organizational interaction with all users (including information support, sending information messages and advertising information, processing incoming requests and information materials of any nature and preparing a response to them), as well as creating a database of counterparties.
- execution of other powers assigned to KOBRA JSC.

3. Principles and conditions for processing personal data

3.1. Principles of processing personal data.
Processing of personal data at KOBRA JSC is carried out on the basis of the following principles:
- lawfulness and fairness;
- ensuring adequate protection of personal data;
- compliance of the purposes of processing personal data with the goals predetermined and stated when collecting personal data;
- preventing the merging of databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
- preventing the processing of personal data that is excessive in relation to the stated purposes of their processing;
- ensuring the reliability, sufficiency and relevance of personal data in relation to the purposes of processing personal data;
- destruction or anonymisation of personal data upon achievement of the purposes of their processing or in the event of loss of the need to achieve these purposes, unless otherwise provided by federal law.
3.2. Conditions for processing personal data.
KOBRA JSC processes personal data if at least one of the following conditions is present:
- processing of personal data is carried out with the consent of the data subject to the processing of his personal data;
- processing of personal data is necessary to achieve the goals provided for by an international treaty of the Russian Federation or law, to implement and fulfill the functions, powers and responsibilities assigned by the legislation of the Russian Federation to the operator;
- processing of personal data is necessary for the administration of justice, execution of a judicial act, act of another government body or official, subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;
- processing of personal data is necessary for the execution of an agreement to which the data subject is a party or beneficiary or guarantor, as well as for concluding an agreement on the initiative of the data subject or an agreement under which the data subject will be a beneficiary or guarantor;
- processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties or to achieve socially significant goals, provided that the rights and freedoms of the data subject are not violated;
- processing of personal data is carried out, access to an unlimited number of persons is provided by the data subject or at his request (public data);
- processing of personal data subject to publication or mandatory disclosure in accordance with federal law is carried out.
3.3. Confidentiality of personal data.
The operator and other persons who have access to personal data are obliged not to disclose to third parties or distribute data without the consent of the data subject, unless otherwise provided by federal law.
3.4. Period of storage of personal data.
3.4.1. The period for processing personal data begins from the moment it is received by the operator;
3.4.2. The storage of personal data is carried out by the operator in a form that allows identifying the data subject, no longer than required by the purposes of processing personal data, unless the period for storing personal data is established by federal law, an agreement to which the data subject is a party, beneficiary or guarantor.
3.4.3. The processed personal data is subject to:
- regular updating;
- correction, deletion at the request of the data subject or at the initiative of the operator if necessary;
- destruction or anonymisation upon achievement of the processing goals or in the event of loss of the need to achieve these goals, unless otherwise provided by federal law.
3.4.4. Processing of personal data is terminated upon achievement of the purposes of processing, expiration of the consent period or withdrawal of the consent of the data subject, as well as when unlawful processing of personal data is detected. Then the personal data is destroyed within a period not exceeding thirty days from the date of achieving the purpose of processing the personal data.
3.4.5. The operator is obliged to publish or otherwise provide unrestricted access to the document defining its policy regarding the processing of personal data, to information about the implemented requirements for the protection of personal data. An operator collecting personal data using information and telecommunication networks is obliged to publish in the relevant information and telecommunication network a document defining its policy regarding the processing of personal data and information about the implemented requirements for the protection of personal data, as well as provide the ability to access the specified document using the means of the corresponding information and telecommunication network.
3.4.6. When processing personal data, the operator is obliged to take the necessary legal, organizational and technical measures or ensure their adoption to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data.

4. Rights and obligations of data subjects and the operator

4.1. In order to ensure the protection of personal data, subjects have the right:
- receive complete information about their personal data and its processing (including automated);
- exercise access to their personal data free of charge, including the right to receive copies of any record containing the employee’s personal data, except in cases provided for by federal law;
- require the operator to clarify his personal data, block it or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;
- if the operator or a person authorized by him refuses to exclude or correct the personal data of the subject - declare in writing his disagreement, submitting the appropriate4. general justification;
- supplement personal data of an evaluative nature with a statement expressing his own point of view;
- require the operator or a person authorized by him to notify all persons who were previously informed of incorrect or incomplete personal data of the subject about all changes or exceptions made to them;
- appeal to court any unlawful actions or inaction of the operator or a person authorized by him during the processing and protection of the data subject’s personal data;
- The User may opt out of informational messages at any time by emailing the Operator at info@kobra.su.
4.2. To protect personal data of subjects, the operator is obliged to:
- at its own expense, ensure the confidentiality and protection of the data subject’s personal data from unlawful use or loss in the manner established by the legislation of the Russian Federation;
- familiarize the employee or his representatives with this provision and his rights in the field of personal data protection against signature;
- upon request, familiarize the data subject who is not an employee with this Regulation and his rights in the field of personal data protection;
- transfer the data subject’s personal data only in accordance with these Regulations and the legislation of the Russian Federation;
- provide the data subject’s personal data only to authorized persons and only to the extent necessary for them to perform their job duties in accordance with this provision and the legislation of the Russian Federation;
- provide the subject with access to his personal data, including the right to receive copies of any record containing his personal data, except in cases where the personal data subject’s access to his personal data violates the rights and legitimate interests of third parties;
- at the request of the subject or his legal representative, provide him with complete information about his personal data and the processing of this data.
4.3. The data subject is obliged to provide the Company with reliable information about himself. The Company has the right to verify the accuracy of the information provided by the subject by comparing the data provided by the subject with the documents available to the Company.
The provision by the data subject - the employee of forged documents or knowingly false information when concluding an employment contract is grounds for termination of the employment contract in accordance with clause 11 of part one of Article 81 of the Labour Code of the Russian Federation.
If personal data changes, the subject-employee of the Company notifies the Company in writing of such changes within a reasonable period of time, not exceeding 14 days from the date of the changes. This obligation does not apply to changes in personal data, the provision of which requires the appropriate consent of the employee.
4.4. The Operator has the right to send notifications to the User about new products and services, special offers and various events. The User can always refuse to receive information messages by sending a letter to the Operator to info@kobra.su.
4.5. Data about visits and use of the Site, collected using web analytics services, is used to analyze User actions, evaluate traffic, improve the quality of the Site and its content.

5. Scope and categories of personal data processed,
categories of data subjects

5.1. For the purposes specified in these Regulations, the following categories of personal data are processed in relation to employees, as well as citizens applying for positions (professions) in the Company:
- last name, first name, patronymic (including previous last names, first names and (or) patronymics, if they are changed);
- date, month, year of birth;
- place of birth;
- address;
- marital status;
- information about close relatives (full name, degree of relationship, date of birth)
- social status;
- property status;
- information about education;
- information about the profession;
- information about income;
- photos;
- sex;
- citizenship;
- series and number of the passport of a citizen of the Russian Federation;
- date of issue of the passport of a citizen of the Russian Federation;
- information about the institution that issued the passport of a citizen of the Russian Federation;
- telephone number;
- email address;
- information about registration with the tax authority;
- series and number of the health insurance policy;
- number of the insurance certificate of compulsory pension insurance;
- information about military registration;
- information about social benefits;
- job title;
- information about work activity;
- information on advanced training, retraining and certification;
- information about criminal record;
- content of orders for personnel;
- grounds for orders regarding personnel;
- information about the awarding of state awards, the conferment of honorary, military and special titles;
- date of registration at the place of residence (place of stay);
- details of certificates of state registration of acts of civil status and the information contained therein;
- information about academic title, degree;
- information from the conclusions (certificates) of a medical institution about the presence (absence) of the disease;
- details of certificates (documents) confirming existing state and other benefits (guarantees, compensation, benefits), the information contained therein;
- information about the state of health, about injuries (illnesses), disability (disability group, degree of disability, about the cause of illness or disability (as a result of an accident or work activity), about the duration of the established disability), including those received during the period of work in the Company, about assigned (paid) insurance and compensation payments, about undergoing medical examination;
- names of banks and (or) credit organizations with which the data subject has a legal relationship;
- bank account number;
- bank card number;
- other information directly or indirectly related to the identified data subject.
5.2. In relation to citizens who have entered into civil-law contracts with the Company, the following categories of personal data are processed in the Company:
- last name, first name, patronymic;
- date, month, year of birth;
- address;
- photos;
- sex;
- citizenship;
- series and number of the passport of a citizen of the Russian Federation;
- date of issue of the passport of a citizen of the Russian Federation;
- information about the institution that issued the passport of a citizen of the Russian Federation;
- telephone number;
- email address;
- information about registration with the tax authority;
- information about registration as an individual entrepreneur;
- names of banks and (or) credit organizations with which the data subject has a legal relationship;
- bank account number;
- bank card number.
5.3. In relation to Users who contact the Company for the provision of information through the website www.kobra.su of the personal data operator:
- last name, first name, patronymic;
- job title;
- name of the institution/organization;
- telephone number;
- email address.
The Website uses the Yandex Metrica web analytics service. When using the Site, technical data about the visit may be processed, including cookies, IP address, information about the device and browser, operating system, referral source, actions and behavior of the User on the Site pages. The specified data is used to analyze traffic, evaluate the effectiveness and improve the operation of the Site.
Processing method: automated.
5.4. When a personal data subject has a one-time pass to the territory of the Company, the one-time pass indicates the surname, first name, patronymic of the personal data subject, and the state registration number of the vehicle.

6. Ensuring the security of personal data

6.1. When processing personal data, the operator takes all necessary and sufficient legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data.
6.2. To ensure the security of personal data, the operator takes, among other things, the following organizational and technical measures:
- appointment of officials responsible for organizing the processing and protection of personal data;
- adoption of local regulations and other documents in the field of processing and protection of personal data;
- familiarization of data subjects with the requirements of federal legislation and local regulatory acts of the operator on the processing and protection of personal data;
- limiting the number of persons who have access to personal data;
- differentiation of user access to information resources and software and hardware for information processing;
- placement of technical means for processing personal data within the boundaries of the protected area;
- organization of accounting, storage and circulation of information carriers;
- organization of password protection when users access the personal data information system;
- organization of verification of the readiness and effectiveness of the use of information security tools;
- identification of threats to the security of personal data during their processing, formation of threat models based on them;
- detecting facts of unauthorized access to personal data and taking appropriate measures;
- restoration of personal data modified or destroyed due to unauthorized access to it;
- information backup;
- use of anti-virus tools and recovery tools for the personal data protection system;
- control over the measures taken to ensure the security of personal data;
- organization of access control to the operator’s territory, security of premises with technical means for processing personal data;
- other measures aimed at protecting personal data.

7. Final provisions

7.1. Monitoring compliance with the requirements of this Policy is carried out by the person responsible for ensuring the security of personal data.
7.2. The liability of the operator, as well as the operator’s officials with access to personal data, for failure to comply with and violation of the rules governing the processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.