Personal Data Processing Policy

1. General provisions

1.1. This Policy of Gorny Gid Limited Liability Company (Gorny Gid LLC) with regard to the processing of personal data (hereinafter the Policy) has been developed in pursuance of the requirements of clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter the Personal Data Law) for the purpose of ensuring the protection of the rights and freedoms of the individual and the citizen in the processing of their personal data, including the protection of the rights to the inviolability of private life and to personal and family secrets.
1.2. The Policy applies to all personal data processed by Gorny Gid Limited Liability Company (hereinafter the Operator, Gorny Gid LLC).
1.3. The Policy extends to relations in the field of the processing of personal data which arose for the Operator both before and after the approval of this Policy.
1.4. In pursuance of the requirements of part 2 of Article 18.1 of the Personal Data Law, this Policy is published for open access on the Internet information and telecommunications network on the Operator’s site.
1.5. The main terms used in the Policy:

personal data — any information relating to a directly or indirectly identified or identifiable natural person (a personal data subject);
personal data operator (operator) — a state body, a municipal body, a legal entity or a natural person which, alone or jointly with other persons, organises and (or) carries out the processing of personal data, and also determines the purposes of the processing of personal data, the composition of the personal data to be processed and the actions (operations) performed with the personal data;
processing of personal data — any action (operation) or set of actions (operations) performed on personal data with or without the use of means of automation. The processing of personal data includes, among other things:

  • collection;
  • recording;
  • systematisation;
  • accumulation;
  • storage;
  • clarification (updating, alteration);
  • extraction;
  • use;
  • transfer (dissemination, provision, access);
  • depersonalisation;
  • blocking;
  • deletion;
  • destruction;
    automated processing of personal data — the processing of personal data by means of computer technology;
    dissemination of personal data — actions aimed at disclosing personal data to an indefinite range of persons;
    provision of personal data — actions aimed at disclosing personal data to a specific person or a specific range of persons;
    blocking of personal data — the temporary cessation of the processing of personal data (except where the processing is necessary in order to clarify the personal data);
    destruction of personal data — actions as a result of which it becomes impossible to restore the content of the personal data in a personal data information system and (or) as a result of which the material carriers of the personal data are destroyed;
    depersonalisation of personal data — actions as a result of which it becomes impossible, without the use of additional information, to establish that personal data belongs to a specific personal data subject;
    personal data information system — the body of personal data contained in databases together with the information technologies and technical means that ensure its processing;
    cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, to a foreign natural person or to a foreign legal entity.

1.6. The main rights and obligations of the Operator.
1.6.1. The Operator has the right:

  1. to determine independently the composition and the list of the measures necessary and sufficient to ensure performance of the obligations provided for by the Personal Data Law and by the regulatory legal acts adopted in accordance with it, unless the Personal Data Law or other federal laws provide otherwise;
  2. to entrust the processing of personal data to another person with the consent of the personal data subject, unless federal law provides otherwise, on the basis of a contract concluded with that person. A person carrying out the processing of personal data on the Operator’s instructions is obliged to observe the principles and rules for the processing of personal data provided for by the Personal Data Law;
  3. where the personal data subject withdraws consent to the processing of personal data, the Operator has the right to continue processing the personal data without the personal data subject’s consent if the grounds specified in the Personal Data Law are present.

1.6.2. The Operator is obliged:

  1. to organise the processing of personal data in accordance with the requirements of the Personal Data Law;
  2. to reply to applications and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
  3. to provide the authorised body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) with the necessary information at that body’s request within 30 days of the date on which the request is received.

1.7. The main rights of the personal data subject. The personal data subject has the right:

  1. to receive information concerning the processing of their personal data, except in the cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data. The list of the information and the procedure for obtaining it are established by the Personal Data Law;
  2. to require the operator to clarify their personal data, or to block or destroy it, where the personal data is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of the processing, and also to take the measures provided for by law to protect their rights;
  3. to make prior consent a condition of the processing of personal data for the purposes of promoting goods, work and services on the market;
  4. to appeal to Roskomnadzor or through the courts against unlawful acts or omissions of the Operator in the processing of their personal data.

1.8. Compliance with the requirements of this Policy is monitored by the authorised person responsible for organising the processing of personal data at the Operator.

1.9. Liability for breach of the requirements of the legislation of the Russian Federation and of the internal regulations of Gorny Gid LLC in the field of the processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2. Purposes of the collection of personal data
2.1. The processing of personal data is limited to the achievement of specific, pre-defined and lawful purposes. The processing of personal data which is incompatible with the purposes of the collection of personal data is not permitted.
2.2. Only personal data which answers the purposes of its processing is subject to processing.
2.3. The Operator processes personal data for the following purposes:

  • ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation;
  • carrying on its activity in accordance with the articles of association of Gorny Gid LLC;
  • keeping personnel records;
  • assisting employees in finding employment, obtaining education and gaining promotion, ensuring the personal safety of employees, monitoring the quantity and quality of the work performed and ensuring the safekeeping of property;
  • attracting and selecting candidates for work with the Operator;
  • arranging the individual (personalised) registration of employees in the compulsory pension insurance system;
  • completing the required reporting forms and submitting them to executive authorities and other authorised organisations;
  • conducting civil-law relations;
  • keeping accounting records.

2.4. The processing of employees’ personal data may be carried out solely for the purposes of ensuring compliance with laws and other regulatory legal acts.

3. Legal grounds for the processing of personal data
3.1. The legal grounds for the processing of personal data are the body of regulatory legal acts in pursuance of and in accordance with which the Operator carries out the processing of personal data, including:

  • the Constitution of the Russian Federation;
  • the Civil Code of the Russian Federation;
  • the Labour Code of the Russian Federation;
  • the Tax Code of the Russian Federation;
  • Federal Law No. 14-FZ of 8 February 1998 “On Limited Liability Companies”;
  • Federal Law No. 402-FZ of 6 December 2011 “On Accounting”;
  • Federal Law No. 167-FZ of 15 December 2001 “On Compulsory Pension Insurance in the Russian Federation”;
  • other regulatory legal acts governing relations connected with the Operator’s activity;
  • the Operator’s constitutive documents;
  • contracts concluded between the Operator and personal data subjects;
  • consent to the processing of personal data given by personal data subjects.

4. The volume and categories of the personal data processed, and the categories of personal data subjects
4.1. The volume and category of the personal data processed, and the categories of personal data subjects, are determined in accordance with the legislation of the Russian Federation and other regulatory legal acts, and having regard to the statutory objects of Gorny Gid LLC.
4.2. The Operator processes the personal data of the following categories of personal data subject:

  • the Operator’s employees;
  • employees’ relatives;
  • candidates for vacant positions with the Operator.

4.3. The Operator does not process special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs, state of health or intimate life.
4.4. The Operator does not process biometric personal data (information which characterises a person’s physiological and biological features and on the basis of which their identity can be established).

5. Procedure and conditions for the processing of personal data
5.1. The Operator processes personal data in accordance with the requirements of the Constitution of the Russian Federation, the Personal Data Law, other federal laws and regulatory legal acts of the Russian Federation, and this Policy.
5.2. Personal data is processed with the consent of the personal data subject to the processing of their personal data, except in the cases provided for by the Personal Data Law.
5.3. In processing personal data the Operator ensures that it is accurate and sufficient and, where necessary, up to date in relation to the purposes of the processing of personal data.
5.4. The Operator takes, or ensures that there are taken, the measures necessary to delete or clarify incomplete or inaccurate data.
5.5. Personal data is stored in a form which makes it possible to identify the personal data subject for no longer than the purposes of the processing of personal data require, unless the storage period for the personal data is established by federal law or by a contract to which the personal data subject is a party, beneficiary or guarantor.
5.6. Personal data which has been processed is subject to destruction or depersonalisation once the purposes of the processing have been achieved, or where the need to achieve those purposes has fallen away, unless federal law provides otherwise.
5.7. Personal data may be processed with or without the use of means of automation.
5.8. The Operator takes, or ensures that there are taken, the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access to it, and against its destruction, alteration, blocking, copying, provision and dissemination, and against other unlawful acts in relation to personal data.
5.9. The Operator undertakes not to disclose personal data to third parties and not to disseminate it without the consent of the personal data subject, unless federal law provides otherwise.

6. Updating, correction, deletion and destruction of personal data, and replies to requests from personal data subjects
6.1. Where inaccurate personal data is identified on an application by the personal data subject or their representative, or on an application by the authorised body for the protection of the rights of personal data subjects, the Operator blocks that personal data from the moment of such application or of receipt of the said request, for the period of the check, provided that blocking the personal data does not infringe the rights and lawful interests of the personal data subject or of third parties.
6.2. Where unlawful processing of personal data carried out by the Operator is identified on an application by the personal data subject or their representative, or on an application by the authorised body for the protection of the rights of personal data subjects, the Operator blocks that personal data from the moment of such application or of receipt of the said request.
6.3. Where the fact that the personal data is inaccurate is confirmed, the Operator, on the basis of the information supplied by the personal data subject or their representative or by the authorised body for the protection of the rights of personal data subjects, or of other necessary documents, clarifies the personal data and lifts the blocking.
6.4. Where unlawful processing of personal data carried out by the Operator is identified, the Operator is obliged to stop the unlawful processing of personal data within a period not exceeding seven working days from the date of that identification.
6.5. Where the personal data subject withdraws consent to the processing of personal data, the Operator is obliged to stop processing the personal data within a period not exceeding seven working days from the date on which the said withdrawal is received, unless the contract between the Operator and the personal data subject provides otherwise.

Privacy Policy