Personal data processing policy
1. GENERAL PROVISIONS
This Personal Data Processing Policy has been developed in compliance with Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data". This law is referred to as FZ-152 throughout this document.
This policy defines the procedures for processing personal data and the measures to ensure the security of such data at AgroBroker JSC (Joint Stock Company), OGRN 1217700615110 and TIN 9731086673. The purpose of these measures is to protect the rights and freedoms of individuals and citizens when their personal data is processed, including the right to privacy and personal and family secrecy.
Some key terms used in this policy include:
- Automated processing of personal data: the use of computer technology to process personal data.
- Blocking of personal data: temporarily stopping the processing of personal information, except in cases where it is necessary to verify the accuracy of the data.
"Personal data information system" is a set of personal information contained in databases and information technologies and technical means that ensure its processing.
"Depersonalization of personal data" is a process that makes it impossible to identify the identity of the personal data without using additional information.
"Processing of personal data" includes any action or set of actions performed with personal data, such as collection, recording, storage, updating, use, transfer, depersonalization, and destruction.
An "operator" is a state body, municipal body, legal entity, or individual who independently or jointly processes personal data.
Any information that relates directly or indirectly to an identifiable individual (the subject of personal data) is referred to as "personal data".
The provision of personal data refers to actions aimed at disclosing this information to a specific person or a group of people.
Dissemination of personal data includes actions that involve sharing this information with an unspecified group of individuals. This can include transferring data to another country, publishing it in the media or making it available online.
Cross-border transfer of personal data is when this information is sent to another country's authorities, individuals or organizations.
Destruction of personal data means removing this information from any system or storage medium.
Actions that result in the impossibility of restoring the content of personal data in a personal data information system or the destruction of material carriers of personal data.
The operator is obligated to publish or otherwise make this Personal Data Processing Policy available to all users in accordance with Part 2 of Article 18.1 of FZ-152.
2. Principles and Conditions of Personal Data Processing
2.1 Principles of Personal Data Processing
The processing of personal data by the operator is based on the following principles:
- Legality and fairness;
- Restrictions on the processing of personal data to achieve specific and legitimate goals;
- Prevention of processing personal data incompatible with the purpose of collection;
- Avoidance of consolidation of databases containing personal data processed for incompatible purposes.
· Processing only those personal data that are necessary for the purposes of its processing;
· Ensuring that the content and amount of processed personal data are consistent with the stated purposes of the processing;
· Preventing the processing of excessive personal data in relation to the specified purposes of processing;
· Maintaining the accuracy, completeness, and relevance of personal data in relation to the objectives of personal data processing;
· Destruction or anonymization of personal data when the objectives of processing are achieved or when there is no longer a need to achieve those goals, unless it is prohibited by federal law, in order to prevent violations of personal information.
2.2. Conditions for processing personal data
The company processes personal data if any of the following conditions apply:
- The processing of personal data has the consent of the individual whose data is being processed;
- The data processing is necessary to fulfill the purposes set out in an international agreement of the Russian Federation or in a law;
- Data processing is required to carry out the functions, authorities, and responsibilities assigned to the company by laws of the Russian Federation.
- The company needs to process data to administer justice, execute a court order, or implement a decision made by another government agency or official in accordance with Russian law on enforcement proceedings.
· The processing of personal data is necessary for the performance of an agreement, either by the beneficiary or the guarantor under which the person whose data is being processed is involved, as well as for concluding an agreement at the initiative of the person whose personal data is involved or an agreement where the person will be a beneficiary or guarantor.
· The processing of personal data is also necessary to exercise rights and legitimate interests of the controller or third parties, or to achieve socially significant objectives, provided that the rights and freedom of the data subject are not violated.
· Personal data is processed when access to it is provided to an unlimited number of people by the data subject or at their request (hereafter referred to as publicly accessible personal data).
· Processing of personal data that is subject to publication or mandatory disclosure in accordance with federal law takes place.
2.3 Confidentiality of Personal Data
The operator and other individuals who have access to personal data must not disclose or share such information with third parties without the permission of the individual whose data is being shared, unless otherwise required by federal law.
2.4 Publicly Available Sources of Personal Data
To provide information, the Operator may create publicly accessible sources of personal data for individuals, including directories and address books. With the individual's written consent, publicly accessible sources may include their last name, first name, middle initial, date and place of birth, occupation, contact phone number, email address, and other personal details provided by the individual.
The individual's personal data can be removed from publicly accessible sources at any time upon the individual's request, the authority responsible for protecting personal data rights, or by court order.
2.5 Special categories of personal data
The Operator may process special categories of personal data, such as race, nationality, political opinions, religious or philosophical beliefs, health information, and intimate life, in the following cases:
- If the subject of the data has given their written consent for the processing of their personal data.
- If personal data is publicly available and the subject has not objected to its use.
- In accordance with the laws on state social assistance, labour legislation, and legislation on pensions and labor pensions.
- When processing is necessary to protect the life, health, or other vital interests of the subject or others, and obtaining consent is not possible.
The processing of personal data is done for medical and preventive purposes, to establish a medical diagnosis and provide medical and social services. This processing is done by people who are professionally engaged in medical activities and are obligated to maintain medical confidentiality in accordance with Russian law.
Personal data can also be processed to establish or enforce the rights of individuals or third parties, or in connection with legal proceedings. Additionally, personal data may be processed in accordance with laws on compulsory insurance and insurance regulations.
The processing of special categories of personal data, as described in paragraph 4 of Article 10 of the FZ-152, must be terminated immediately if the reasons for processing have been removed, unless otherwise specified by federal law.
Personal data related to criminal records can only be processed by the operator in specific cases and according to the procedures determined by federal legislation.
2.6 Biometric Personal Data
Information that identifies a person's physiological and biological characteristics, on the basis of which their identity can be determined - biometric personal data - may be processed by the operator only with the written consent of the individual whose data is being processed.
2.7 Assignment of Personal Data Processing to Another Person
The operator may assign the processing of personal information to another person with the consent of the person whose data is being processed, unless otherwise specified by federal law. This assignment must be based on an agreement between the operator and the other person. If personal data is processed on behalf of the operator, the other person is obligated to comply with all principles and rules for personal data processing as outlined in FZ-152 and this policy.
2.8. Processing of Personal Data of Citizens of the Russian Federation
According to Article 2 of Federal Law No. 242-FZ of July 21, 2014 "On Amendments to Certain Legislative Acts of the Russian Federation Regarding Clarification of the Procedure for Processing Personal Data in Information and Telecommunication Networks", when collecting personal information, including via the Internet, the operator must ensure the recording, systematization, accumulation, storage, and updating (updating, changing) of personal information of citizens of the Russian Federation using databases located in Russia, except in the following cases:
- The processing of personal information is necessary to achieve goals specified in an international agreement of the Russian Federation or law, to fulfill the functions and powers assigned to the operator under Russian legislation.
The processing of personal data is necessary for various purposes, including:
- The administration of justice and the execution of judicial acts, as well as acts of other bodies and officials carried out in accordance with Russian legislation on enforcement proceedings.
- The exercise of powers by federal executive authorities, state extra-budgetary funds, and regional and local governments, as well as the provision of services by organizations involved in state and municipal service provision, as provided for in the Federal Law No. 210-FZ. This includes the registration of individuals on the unified state and municipal services portal and regional portals.
The processing of personal data is necessary for the professional activities of journalists and (or) legitimate activities of mass media, scientific, literary, or other creative works, provided that the rights and legitimate interests of individuals whose data are processed are not violated.
2.9 Cross-border Transfer of Personal Data
The operator must ensure that the country to which the transfer of personal data will be made has adequate protection for the rights of individuals before the transfer begins. If the country does not adequately protect these rights, the transfer may only occur in the following circumstances:
- if the individual giving their personal data has given written consent to the transfer;
- if they are a party to a contract that includes the transfer.
3. Rights of the Personal Data Subject
3.1 Consent to the Processing of Personal Data
The subject of personal data freely decides on the provision of their personal data and gives their consent to their processing, of their own free will and in their own interest. Consent to the processing of personal data can be given by the subject or their representative in any form that confirms the fact of receipt, unless otherwise provided for by federal law.
3.2. Rights of the Personal Data Subject
The personal data subject has the right to request information from the operator regarding the processing of their personal data, unless this right is restricted in accordance with relevant federal laws. They also have the right to demand that the operator clarify, block, or delete their personal data if it is incomplete, outdated, incorrect, illegally obtained, or not necessary for the specified purpose of processing. Additionally, they have the right to take legal measures to protect their rights, such as requesting the operator to take action.
Processing of personal data to promote goods, works, or services on the market through direct contact with the personal data subject (potential consumers) using communication means, as well as for political purposes, is only permitted with the prior consent of the personal data subject.
The operator is obligated to immediately cease, upon request from the personal data subject, any processing of their personal data for the aforementioned purposes.
It is forbidden to make decisions solely based on automated processing of personal data, which would generate legal consequences for the individual or otherwise affect their rights and legitimate interests, unless provided for by federal law or with the explicit consent of the individual.
In the event that the individual believes that the operator is processing their personal data in violation of the requirements of the FZ-152 (Federal Law on Personal Data) or otherwise infringes their rights and freedoms, they have the right to file a complaint against the operator's actions or inaction with the authorized body for the protection of personal data rights or in court.
The subject of personal data has the right to protect their rights and legitimate interests, including the right to compensation for any damages and/or moral damages they may have suffered.
4. Ensuring the Security of Personal Data
The Operator ensures the security of personal data by implementing legal, organizational, and technical measures necessary to comply with the requirements of the federal legislation on personal data protection.
5. Final Provisions
Other rights and obligations of the Operator related to the processing of personal data are defined by the legislation of the Russian Federation on personal data. Employees of the Operator who violate the rules for processing and protecting personal data may be subject to material, disciplinary, administrative, civil, or criminal liability in accordance with procedures established by federal laws.
This Personal Data Processing Policy has been developed in compliance with Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data". This law is referred to as FZ-152 throughout this document.
This policy defines the procedures for processing personal data and the measures to ensure the security of such data at AgroBroker JSC (Joint Stock Company), OGRN 1217700615110 and TIN 9731086673. The purpose of these measures is to protect the rights and freedoms of individuals and citizens when their personal data is processed, including the right to privacy and personal and family secrecy.
Some key terms used in this policy include:
- Automated processing of personal data: the use of computer technology to process personal data.
- Blocking of personal data: temporarily stopping the processing of personal information, except in cases where it is necessary to verify the accuracy of the data.
"Personal data information system" is a set of personal information contained in databases and information technologies and technical means that ensure its processing.
"Depersonalization of personal data" is a process that makes it impossible to identify the identity of the personal data without using additional information.
"Processing of personal data" includes any action or set of actions performed with personal data, such as collection, recording, storage, updating, use, transfer, depersonalization, and destruction.
An "operator" is a state body, municipal body, legal entity, or individual who independently or jointly processes personal data.
Any information that relates directly or indirectly to an identifiable individual (the subject of personal data) is referred to as "personal data".
The provision of personal data refers to actions aimed at disclosing this information to a specific person or a group of people.
Dissemination of personal data includes actions that involve sharing this information with an unspecified group of individuals. This can include transferring data to another country, publishing it in the media or making it available online.
Cross-border transfer of personal data is when this information is sent to another country's authorities, individuals or organizations.
Destruction of personal data means removing this information from any system or storage medium.
Actions that result in the impossibility of restoring the content of personal data in a personal data information system or the destruction of material carriers of personal data.
The operator is obligated to publish or otherwise make this Personal Data Processing Policy available to all users in accordance with Part 2 of Article 18.1 of FZ-152.
2. Principles and Conditions of Personal Data Processing
2.1 Principles of Personal Data Processing
The processing of personal data by the operator is based on the following principles:
- Legality and fairness;
- Restrictions on the processing of personal data to achieve specific and legitimate goals;
- Prevention of processing personal data incompatible with the purpose of collection;
- Avoidance of consolidation of databases containing personal data processed for incompatible purposes.
· Processing only those personal data that are necessary for the purposes of its processing;
· Ensuring that the content and amount of processed personal data are consistent with the stated purposes of the processing;
· Preventing the processing of excessive personal data in relation to the specified purposes of processing;
· Maintaining the accuracy, completeness, and relevance of personal data in relation to the objectives of personal data processing;
· Destruction or anonymization of personal data when the objectives of processing are achieved or when there is no longer a need to achieve those goals, unless it is prohibited by federal law, in order to prevent violations of personal information.
2.2. Conditions for processing personal data
The company processes personal data if any of the following conditions apply:
- The processing of personal data has the consent of the individual whose data is being processed;
- The data processing is necessary to fulfill the purposes set out in an international agreement of the Russian Federation or in a law;
- Data processing is required to carry out the functions, authorities, and responsibilities assigned to the company by laws of the Russian Federation.
- The company needs to process data to administer justice, execute a court order, or implement a decision made by another government agency or official in accordance with Russian law on enforcement proceedings.
· The processing of personal data is necessary for the performance of an agreement, either by the beneficiary or the guarantor under which the person whose data is being processed is involved, as well as for concluding an agreement at the initiative of the person whose personal data is involved or an agreement where the person will be a beneficiary or guarantor.
· The processing of personal data is also necessary to exercise rights and legitimate interests of the controller or third parties, or to achieve socially significant objectives, provided that the rights and freedom of the data subject are not violated.
· Personal data is processed when access to it is provided to an unlimited number of people by the data subject or at their request (hereafter referred to as publicly accessible personal data).
· Processing of personal data that is subject to publication or mandatory disclosure in accordance with federal law takes place.
2.3 Confidentiality of Personal Data
The operator and other individuals who have access to personal data must not disclose or share such information with third parties without the permission of the individual whose data is being shared, unless otherwise required by federal law.
2.4 Publicly Available Sources of Personal Data
To provide information, the Operator may create publicly accessible sources of personal data for individuals, including directories and address books. With the individual's written consent, publicly accessible sources may include their last name, first name, middle initial, date and place of birth, occupation, contact phone number, email address, and other personal details provided by the individual.
The individual's personal data can be removed from publicly accessible sources at any time upon the individual's request, the authority responsible for protecting personal data rights, or by court order.
2.5 Special categories of personal data
The Operator may process special categories of personal data, such as race, nationality, political opinions, religious or philosophical beliefs, health information, and intimate life, in the following cases:
- If the subject of the data has given their written consent for the processing of their personal data.
- If personal data is publicly available and the subject has not objected to its use.
- In accordance with the laws on state social assistance, labour legislation, and legislation on pensions and labor pensions.
- When processing is necessary to protect the life, health, or other vital interests of the subject or others, and obtaining consent is not possible.
The processing of personal data is done for medical and preventive purposes, to establish a medical diagnosis and provide medical and social services. This processing is done by people who are professionally engaged in medical activities and are obligated to maintain medical confidentiality in accordance with Russian law.
Personal data can also be processed to establish or enforce the rights of individuals or third parties, or in connection with legal proceedings. Additionally, personal data may be processed in accordance with laws on compulsory insurance and insurance regulations.
The processing of special categories of personal data, as described in paragraph 4 of Article 10 of the FZ-152, must be terminated immediately if the reasons for processing have been removed, unless otherwise specified by federal law.
Personal data related to criminal records can only be processed by the operator in specific cases and according to the procedures determined by federal legislation.
2.6 Biometric Personal Data
Information that identifies a person's physiological and biological characteristics, on the basis of which their identity can be determined - biometric personal data - may be processed by the operator only with the written consent of the individual whose data is being processed.
2.7 Assignment of Personal Data Processing to Another Person
The operator may assign the processing of personal information to another person with the consent of the person whose data is being processed, unless otherwise specified by federal law. This assignment must be based on an agreement between the operator and the other person. If personal data is processed on behalf of the operator, the other person is obligated to comply with all principles and rules for personal data processing as outlined in FZ-152 and this policy.
2.8. Processing of Personal Data of Citizens of the Russian Federation
According to Article 2 of Federal Law No. 242-FZ of July 21, 2014 "On Amendments to Certain Legislative Acts of the Russian Federation Regarding Clarification of the Procedure for Processing Personal Data in Information and Telecommunication Networks", when collecting personal information, including via the Internet, the operator must ensure the recording, systematization, accumulation, storage, and updating (updating, changing) of personal information of citizens of the Russian Federation using databases located in Russia, except in the following cases:
- The processing of personal information is necessary to achieve goals specified in an international agreement of the Russian Federation or law, to fulfill the functions and powers assigned to the operator under Russian legislation.
The processing of personal data is necessary for various purposes, including:
- The administration of justice and the execution of judicial acts, as well as acts of other bodies and officials carried out in accordance with Russian legislation on enforcement proceedings.
- The exercise of powers by federal executive authorities, state extra-budgetary funds, and regional and local governments, as well as the provision of services by organizations involved in state and municipal service provision, as provided for in the Federal Law No. 210-FZ. This includes the registration of individuals on the unified state and municipal services portal and regional portals.
The processing of personal data is necessary for the professional activities of journalists and (or) legitimate activities of mass media, scientific, literary, or other creative works, provided that the rights and legitimate interests of individuals whose data are processed are not violated.
2.9 Cross-border Transfer of Personal Data
The operator must ensure that the country to which the transfer of personal data will be made has adequate protection for the rights of individuals before the transfer begins. If the country does not adequately protect these rights, the transfer may only occur in the following circumstances:
- if the individual giving their personal data has given written consent to the transfer;
- if they are a party to a contract that includes the transfer.
3. Rights of the Personal Data Subject
3.1 Consent to the Processing of Personal Data
The subject of personal data freely decides on the provision of their personal data and gives their consent to their processing, of their own free will and in their own interest. Consent to the processing of personal data can be given by the subject or their representative in any form that confirms the fact of receipt, unless otherwise provided for by federal law.
3.2. Rights of the Personal Data Subject
The personal data subject has the right to request information from the operator regarding the processing of their personal data, unless this right is restricted in accordance with relevant federal laws. They also have the right to demand that the operator clarify, block, or delete their personal data if it is incomplete, outdated, incorrect, illegally obtained, or not necessary for the specified purpose of processing. Additionally, they have the right to take legal measures to protect their rights, such as requesting the operator to take action.
Processing of personal data to promote goods, works, or services on the market through direct contact with the personal data subject (potential consumers) using communication means, as well as for political purposes, is only permitted with the prior consent of the personal data subject.
The operator is obligated to immediately cease, upon request from the personal data subject, any processing of their personal data for the aforementioned purposes.
It is forbidden to make decisions solely based on automated processing of personal data, which would generate legal consequences for the individual or otherwise affect their rights and legitimate interests, unless provided for by federal law or with the explicit consent of the individual.
In the event that the individual believes that the operator is processing their personal data in violation of the requirements of the FZ-152 (Federal Law on Personal Data) or otherwise infringes their rights and freedoms, they have the right to file a complaint against the operator's actions or inaction with the authorized body for the protection of personal data rights or in court.
The subject of personal data has the right to protect their rights and legitimate interests, including the right to compensation for any damages and/or moral damages they may have suffered.
4. Ensuring the Security of Personal Data
The Operator ensures the security of personal data by implementing legal, organizational, and technical measures necessary to comply with the requirements of the federal legislation on personal data protection.
5. Final Provisions
Other rights and obligations of the Operator related to the processing of personal data are defined by the legislation of the Russian Federation on personal data. Employees of the Operator who violate the rules for processing and protecting personal data may be subject to material, disciplinary, administrative, civil, or criminal liability in accordance with procedures established by federal laws.
