1.Personal Data Processing Policy

1. General provisions

1.1 The Policy of personal data processing in LLC "KKI-Ageevskiy" (hereinafter - the Policy) defines the basic principles, purposes, conditions and methods of personal data processing, lists of subjects and personal data processed in LLC "KKI-Ageevskiy", functions of LLC "KKI-Ageevskiy" in the processing of personal data, rights of personal data subjects, as well as requirements for personal data protection implemented in LLC "KKI-Ageevskiy".

1.2 The Policy is developed taking into account the requirements of the Constitution of the Russian Federation, legislative and other regulatory legal acts of the Russian Federation in the field of personal data.

1.3 The provisions of the Policy serve as a basis for the development of local normative acts regulating the issues of personal data processing of employees of LLC "KKI "Ageevskiy" and other subjects of personal data in LLC "KKI "Ageevskiy".

1.4 The Policy is the basis for the development by subsidiaries and organizations of KKI Ageevskiy LLC of local normative acts regulating the personal data processing policy of these organizations.

2. Legislative and other regulatory legal acts of the Russian Federation, in accordance with which the Personal Data Processing Policy of KKI Ageevskiy LLC is determined

2.1 The policy of personal data processing at KKI Ageevskiy LLC is determined in accordance with the following regulatory legal acts:

● Labor Code of the Russian Federation;
Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
Presidential Decree No. 188 of March 06, 1997 "On Approval of the List of Confidential Information";
Resolution of the Government of the Russian Federation No. 687 of September 15, 2008 "On Approval of the Regulation on the Specifics of Personal Data Processing Performed Without the Use of Automation";
● Resolution of the Government of the Russian Federation No. 512 of July 6, 2008 "On Approval of the Requirements to the Material Carriers of Biometric Personal Data and Technologies of Storage of Such Data Outside the Information Systems of Personal Data";
● Resolution of the Government of the Russian Federation No. 1119 dated November 1, 2012 "On Approval of the Requirements for Protection of Personal Data when Processing in Personal Data Information Systems";
Order of the Federal Service for Technical and Export Control of Russia No. 55, Federal Security Service of Russia No. 86, Ministry of Information and Communications of Russia No. 20 dated February 13, 2008. "On Approval of the Procedure for Classification of Personal Data Information Systems";
● Order of the Federal Service for Technical and Export Control of the Russian Federation No. 21 of February 18, 2013 "On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data when Processing in Personal Data Information Systems";
● Roskomnadzor Order No. 996 of September 05, 2013 "On Approval of Requirements and Methods for Personal Data Anonymization";
● other regulatory legal acts of the Russian Federation and regulatory documents of the authorized public authorities.

2.2 In order to implement the provisions of the Policy, KKI Ageevskiy LLC develops relevant local regulations and other documents, including:

● Regulations on personal data processing at KKI Ageyevsky LLC;
● regulations on ensuring the security of personal data during their processing in the personal data information systems of KKI Ageyevsky LLC;
a list of positions of structural subdivisions of the administration of KKI Ageyevsky LLC, its branches and representative offices, which are subject to personal data processing;
regulations on personal data processing of structural subdivisions of the administration of KKI-Ageyevsky LLC, its branches and representative offices;
● other local normative acts and documents regulating the issues of personal data processing at LLC "KKI "Ageevskiy".

3. basic terms and definitions used in the local normative acts of LLC "KKI "Ageevskiy" regulating the issues of personal data processing

Personal data - any information related to a directly or indirectly defined or identifiable natural person (subject of personal data).

Information - information (messages, data) regardless of the form of its presentation.

Operator - a state authority, municipal authority, legal or natural person, independently or jointly with other persons organizing and (or) carrying out processing of personal data, as well as determining the purposes of personal data processing, composition of personal data subject to processing, actions (operations) performed with personal data.

Processing of personal data - any action (operation) or set of actions (operations) performed with or without the use of automation means with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

Automated processing of personal data - processing of personal data by means of computer equipment.

Provision of personal data - actions aimed at disclosure of personal data to a certain person or a certain circle of persons.

Dissemination of personal data - actions aimed at disclosure of personal data to an indefinite number of persons.

Cross-border transfer of personal data - transfer of personal data to the territory of a foreign country to a foreign government authority, a foreign individual or a foreign legal entity.

Blocking of personal data - temporary cessation of personal data processing (except for cases when processing is necessary to clarify personal data).

Destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which material carriers of personal data are destroyed.

Personal data depersonalization - actions as a result of which it becomes impossible to determine the belonging of personal data to a particular subject of personal data without using additional information.

Personal data information system - a set of personal data contained in databases and information technologies and technical means ensuring their processing.

4. Principles and objectives of personal data processing

4.1 KKI-Ageyevsky LLC, being a personal data controller, processes personal data of KKI-Ageyevsky LLC employees and other subjects of personal data who do not have labor relations with KKI-Ageyevsky LLC.

4.2 Personal data processing in LLC "KKI-Ageyevsky" is carried out taking into account the need to ensure the protection of rights and freedoms of LLC "KKI-Ageyevsky" employees and other subjects of personal data, including the protection of the right to privacy, personal and family secrecy, based on the following principles:

● the processing of personal data is carried out in LLC "KKI "Ageevskiy" on a lawful and fair basis;
● the processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes;
● personal data processing incompatible with the purposes of personal data collection is not allowed;
● databases containing personal data processed for incompatible purposes may not be merged;
● only personal data that meet the purposes of their processing shall be processed;
● the content and scope of processed personal data corresponds to the stated purposes of processing. The personal data processed may not be redundant in relation to the stated purposes of their processing;
● when processing personal data, the accuracy of personal data, their sufficiency and, where necessary, relevance to the purposes of personal data processing are ensured. KKI-Ageevskiy LLC takes the necessary measures or ensures that they are taken to delete or clarify incomplete or inaccurate personal data;
● personal data is stored in a form that allows identification of the subject of personal data for no longer than required by the purposes of personal data processing, unless the period of personal data storage is established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor;
● Personal data processed shall be destroyed or depersonalized upon achievement of the processing purposes or in case of loss of necessity to achieve these purposes, unless otherwise provided for by federal law.

4.3 Personal data is processed at LLC "KKI Ageevskiy" in order to:

● ensuring compliance with the Constitution of the Russian Federation, legislative and other normative legal acts of the Russian Federation, local normative acts of LLC "KKI "Ageevskiy";
to fulfill the functions, powers and duties assigned by the legislation of the Russian Federation to LLC KKI Ageevskiy, including the provision of personal data to government authorities, the Pension Fund of the Russian Federation, the Social Insurance Fund of the Russian Federation, the Federal Compulsory Medical Insurance Fund, as well as to other state bodies;
regulating labor relations with the employees of KKI Ageyevsky LLC (assistance in employment, training and promotion, ensuring personal safety, controlling the quantity and quality of work performed, ensuring the safety of property);
providing employees of KKI Ageyevsky LLC and their family members with additional guarantees and compensations, including non-state pension coverage, voluntary medical insurance, medical care and other types of social security;
● protection of life, health or other vital interests of personal data subjects;
preparation, conclusion, execution and termination of contracts with counterparties;
● Ensuring access and intra-object regimes at the facilities of KKI Ageyevsky LLC;
Formation of reference materials for internal information support of KKI Ageyevsky LLC, its branches and representative offices, as well as subsidiary companies and organizations of KKI Ageyevsky LLC;
execution of judicial acts, acts of other bodies or officials subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;
● exercising the rights and legitimate interests of KKI Ageyevsky LLC within the framework of activities provided for by the Charter and other local normative acts of KKI Ageyevsky LLC, or third parties, or to achieve socially important goals;
● for other lawful purposes.

5. List of subjects whose personal data are processed at KKI Ageyevsky LLC

5.1 Personal data of the following categories of subjects are processed at KKI Ageyevsky LLC:

● employees of structural subdivisions of the administration of LLC "KKI "Ageyevsky", its branches and representative offices;
● other subjects of personal data (to ensure the realization of the processing purposes specified in Section 4 of the Policy).

6. List of personal data processed at KKI Ageyevsky LLC

6.1 The list of personal data processed by LLC "KKI-Ageyevsky" is determined in accordance with the legislation of the Russian Federation and local regulations of LLC "KKI-Ageyevsky" taking into account the purposes of personal data processing specified in section 4 of the Policy.

6.2 Special categories of personal data concerning race, nationality, political views, religious or philosophical beliefs, intimate life are not processed in LLC "KKI "Ageevskiy".

7. Functions of LLC "KKI-Ageyevsky" when processing personal data

7.1 When processing personal data, KKI Ageyevsky LLC:

● takes measures necessary and sufficient to ensure compliance with the requirements of the legislation of the Russian Federation and local regulations of LLC "KKI "Ageyevsky" in the field of personal data;
takes legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions in relation to personal data;
● appoints a person responsible for the organization of personal data processing at KKI Ageyevsky LLC;
● issues local normative acts determining the policy and issues of personal data processing and protection at LLC KKI Ageyevsky;
● familiarizes employees of LLC KKI Ageevskiy, its branches and representative offices who directly process personal data with the provisions of the legislation of the Russian Federation and local normative acts of LLC KKI Ageevskiy in the field of personal data, including requirements to personal data protection, and trains these employees;
Publish or otherwise provide unrestricted access to this Policy;
● informs subjects of personal data or their representatives in accordance with the established procedure about the availability of personal data relating to the respective subjects, provides an opportunity to familiarize themselves with this personal data upon application and (or) receipt of requests from these subjects of personal data or their representatives, unless otherwise provided for by the legislation of the Russian Federation;
● terminates processing and destroys personal data in cases stipulated by the Russian Federation legislation in the field of personal data;
● performs other actions provided for by the legislation of the Russian Federation in the field of personal data.

8. Conditions of personal data processing at KKI Ageevskiy LLC

8.1 Personal data processing in LLC "KKI "Ageevskiy" is carried out with the consent of the subject of personal data to the processing of his/her personal data, unless otherwise provided for by the legislation of the Russian Federation in the field of personal data.

8.2 KKI Ageyevsky LLC shall not disclose or distribute personal data to third parties without the consent of the subject of personal data, unless otherwise provided for by federal law.

8.3 KKI Ageyevsky LLC has the right to entrust the processing of personal data to another person with the consent of the subject of personal data on the basis of a contract concluded with this person. The agreement shall contain a list of actions (operations) with personal data to be performed by the person processing personal data, the purposes of processing, the obligation of such person to maintain confidentiality of personal data and ensure security of personal data during their processing, as well as requirements for protection of processed personal data in accordance with Article 19 of the Federal Law "On Personal Data".

8.4 For the purposes of internal information support, LLC "KKI "Ageevskiy" may create internal reference materials, which, with the written consent of the subject of personal data, unless otherwise provided for by the legislation of the Russian Federation, may include his/her surname, name, patronymic, place of work, position, year and place of birth, address, subscriber number, e-mail address, other personal data provided by the subject of personal data.

8.5 Access to personal data processed in LLC "KKI-Ageevskiy" is allowed only to employees of LLC "KKI-Ageevskiy" who hold positions included in the list of positions of structural subdivisions of the administration of LLC "KKI-Ageevskiy", its branches and representative offices, where personal data are processed.

9. List of actions with personal data and methods of their processing

9.1 KKI Ageevskiy LLC collects, records, systematizes, accumulates, stores, clarifies (updates, changes), extracts, uses, transfers (distributes, provides, accesses), depersonalizes, blocks, deletes and destroys personal data.

9.2 Personal data processing in LLC "KKI "Ageevskiy" is carried out by the following methods:

● non-automated processing of personal data;
● automated processing of personal data with or without transmission of the received information via information and telecommunication networks;
● mixed processing of personal data.

10. Rights of personal data subjects

10.1 Personal data subjects have the right to:

● full information about their personal data processed at LLC "KKI "Ageevskiy";
access to their personal data, including the right to receive a copy of any record containing their personal data, except as provided for by federal law, as well as access to medical data relating to them with the assistance of a medical specialist of their choice;
● clarification of their personal data, blocking or destruction if the personal data are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
● withdrawal of consent to the processing of personal data;
● taking measures provided for by law to protect their rights;
● appealing against an action or inaction of LLC "KKI "Ageevskiy", carried out in violation of the requirements of the legislation of the Russian Federation in the field of personal data, to the authorized body for the protection of the rights of personal data subjects or to the court;
● Exercise other rights provided for by the legislation of the Russian Federation.

11 Measures taken by LLC "KKI-Ageyevsky" to ensure fulfillment of the obligations of the operator in the processing of personal data

11.1 Measures necessary and sufficient to ensure the fulfillment by LLC "KKI "Ageyevsky" of the obligations of the operator stipulated by the legislation of the Russian Federation in the field of personal data include:
Appointment of a person responsible for the organization of personal data processing at KKI Ageyevsky LLC;
Adoption of local regulations and other documents in the field of personal data processing and protection;
● organization of training and methodological work with the employees of the structural subdivisions of the administration of LLC KKI Ageevskiy, its branches and representative offices who hold positions included in the list of positions of the structural subdivisions of the administration of LLC KKI Ageevskiy, its branches and representative offices, where personal data is processed;
● obtaining consents of personal data subjects for the processing of their personal data, except for cases stipulated by the legislation of the Russian Federation;
Separating personal data processed without the use of automation from other information, in particular, by recording them on separate material carriers of personal data in special sections;
ensuring separate storage of personal data and their material carriers, which are processed for different purposes and contain different categories of personal data;

● prohibition of personal data transmission via open communication channels, computer networks outside the controlled area, the EHR of KKI-Ageevskiy LLC and the Internet without applying the personal data security measures established at KKI-Ageevskiy LLC (except for publicly available and (or) anonymized personal data);
● storage of tangible carriers of personal data in compliance with the conditions ensuring safety of personal data and excluding unauthorized access to them;
internal control over compliance of personal data processing with the Federal Law "On Personal Data" and regulatory legal acts adopted in accordance with it, personal data protection requirements, this Policy, local regulations of LLC "KKI "Ageevskiy";
● other measures stipulated by the legislation of the Russian Federation in the field of personal data.

11.2 Measures to ensure the security of personal data during their processing in personal data information systems shall be established in accordance with local regulations of KKI Ageevskiy LLC regulating the issues of ensuring the security of personal data during their processing in personal data information systems of KKI Ageevskiy LLC.

12. Control over compliance with the legislation of the Russian Federation and local regulatory acts of LLC KKI Ageyevsky in the field of personal data, including requirements to the protection of personal data

12.1 Control over compliance by structural subdivisions of the administration of LLC KKI Ageevskiy, its branches and representative offices with the legislation of the Russian Federation and local normative acts of LLC KKI Ageevskiy in the field of personal data, including requirements to the protection of personal data, is carried out in order to verify compliance of personal data processing in structural subdivisions of the administration of LLC KKI Ageevskiy, its branches and representative offices with the legislation of the Russian Federation and local normative acts of the LLC

12.2 Internal control over compliance by structural subdivisions of the administration of LLC KKI Ageevskiy, its branches and representative offices with the legislation of the Russian Federation and local normative acts of LLC KKI Ageevskiy in the field of personal data, including requirements to personal data protection, shall be exercised by the person responsible for organization of personal data processing in LLC KKI Ageevskiy.

12.3 Internal control of compliance of personal data processing with the Federal Law "On Personal Data" and regulations adopted in accordance with it, requirements to personal data protection, this Policy, local regulations of LLC "KKI-Ageyevsky" is carried out by the relevant service of LLC "KKI-Ageyevsky".

12.4 Personal responsibility for compliance with the requirements of the legislation of the Russian Federation and local normative acts of KKI Ageevskiy LLC in the field of personal data in the structural subdivision of the administration of KKI Ageevskiy LLC, its branch and representative office, as well as for ensuring confidentiality and security of personal data in these subdivisions of KKI Ageevskiy LLC rests with their managers.