Personal data processing and protection policy ENKA FLEX OFFICES, LLC
1. General terms
1.1. In order to comply with the norms of the current legislation of the Russian Federation in full, ENKA FLEX OFFICES, LLC (hereinafter referred to as the Operator) considers its most important tasks to comply with the principles of legality, fairness and confidentiality in the processing of personal data, as well as to ensure the safety of their processing.
1.2. This personal data processing and protection policy of ENKA FLEX OFFICE LLC (hereinafter referred to as the Policy) is characterized by the following features:
1) developed in order to implement the requirements of the current legislation of the Russian Federation in the field of personal data processing and protection;
2) discloses the methods and principles of personal data processing by the Operator, the rights and obligations of the Operator when processing personal data, the rights of personal data subjects, and also includes a list of measures applied by the Operator to ensure the security of personal data during their processing;
3) is a publicly available document that declares the conceptual basis of the Operator's activities in the processing and protection of personal data.
1.3. Prior to the start of personal data processing, the operator has notified the authorized body for the protection of the rights of personal data subjects of its intention to process personal data. The Operator shall update the information specified in the notification in good faith and within the appropriate period.
2. General definitions
Personal data – any information relating to a directly or indirectly identified or identifiable individual (subject of PD)
Operator of personal data (operator) – state body, municipal body, legal or natural person, independently or together with other persons, organizing and (or) carrying out the processing of personal data, as well as defining the purpose of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data.
Processing of personal data – any action (operation) or a set of actions (operations) performed with or without the use of means of automation with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, disclosure, access), anonymization, blocking, erasure, destruction of personal data.
Automated data processing – processing of personal data by means of computer technology.
Dissemination – actions aimed at disclosure of personal data to an indefinite number of people.
Disclosure – actions aimed at disclosure of personal data to a certain person or a certain number of people.
Blocking – temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data).
Destruction – actions that make it impossible to recover the content of personal data in the information system of personal data and (or) as a result of which physical media of personal data are destroyed.
Anonymization – actions that make it impossible to determine whether personal data belongs to a particular personal data subject without using additional information
Information system of personal data – a set of personal data contained in databases and information technologies and technical means that ensure their processing.
Cross-border transfer – transfer of personal data to the territory of a foreign state to a foreign government authority, a foreign physical or to a foreign legal entity
Special category of personal data – personal data including those related to race, nationality, political views, religious or philosophical beliefs, health, privacy, criminal records.
Biometric personal data – information that characterizes physiological and biological characteristics of a person, on the basis of which it is possible establish his identity.
Personal data permitted by the subject of personal data for dissemination – personal data, access to which is granted to the general public as authorized by the data subject by giving a consent to the processing of personal data by the subject of personal data for dissemination.
Data Privacy Officer – a natural or legal person appointed by ENKA FLEX OFFICES, LLC to be responsible for organizing the processing of personal data.
The processing of personal data should be limited to achieving specific, predetermined and legitimate purposes. The subject of personal data, giving consent to the processing of his personal data, must be informed about the purposes of their processing. The purposes of processing must be included in the consent form of the personal data subject. Processing of personal data that is incompatible with the purposes of collecting personal data is not allowed.
3. Rights and obligations of the Operator
3.1. Operator has the right to:
1) receive reliable information and / or documents containing personal data from the subject of personal data;
2) demand from the subject of personal data timely clarification of the provided personal data.
3.2. Operator shall be obliged to:
1) process personal data in accordance with the procedure established by the current legislation of the Russian Federation;
2) consider appeals of the subject of personal data (or his legal representative) on the processing of personal data and provide reasoned responses;
3) provide the subject of personal data (or his legal representative) with free access to his personal data;
4) take measures to clarify, destroy personal data of the subject of personal data in connection with his (or his legal representative's) application with legitimate and reasonable demands;
5) ensure the protection of personal data in accordance with the requirements of Russian legislation.
4. Rights and obligations of the subjects of personal data
4.1. The subject of personal data has the right to receive information about the processing of his personal data by the Operator.
4.2. The subject of personal data has the right to require the Operator to clarify these personal data, block or destroy them if they are incomplete, outdated, inaccurate, illegally obtained or cannot be recognized as necessary for the stated purpose of processing, as well as to take measures provided for by law to protect his rights.
4.3. The right of a personal data subject to access to his personal data may be restricted in accordance with federal laws, including if the access of a personal data subject to his personal data violates the rights and legitimate interests of third parties.
4.4. To exercise and protect their rights and legitimate interests, subjects of personal data have the right to apply to the Operator. The operator considers any requests and complaints from subjects of personal data, thoroughly investigates facts of violations and takes all necessary measures for their immediate elimination, punishment of guilty persons and settlement of disputable and conflict situations in pre-trial order.
4.5. The subject of personal data has the right to appeal against the actions or inaction of the Operator by contacting the authorized body for the protection of the rights of personal data subjects.
4.6. The subject of personal data has the right to withdraw consent to the processing of personal data.
4.7. The subject of personal data has the right to protect his rights and legitimate interests, including compensation for losses and/or compensation for moral damage in court.
4.8. The subject of personal data shall be obliged to provide the Operator with only reliable data about himself, as well as to provide documents containing personal data to the extent necessary for the purpose of processing.
4.9. The subject of personal data shall be obliged to inform the Operator about the clarification (update, change) of his personal data.
4.10. A person who has transferred to the Operator inaccurate information about himself, or information about another subject of personal data without the consent of the latter, bears responsibility in accordance with the legislation of the Russian Federation.
5. Purposes of personal data processing
5.1. The processing of personal data in ENKA FLEX OFFICES, LLC is limited to the achievement of specific, predetermined and legitimate purposes.
5.2. Personal data is processed by ENKA FLEX OFFICES, LLC for the following purposes:
1) attracting and considering candidates for filling vacant positions, including through verification and requests for additional information, to assess business qualities in order to make a decision on refusal / conclude an employment contract, or to be included in the personnel reserve for the purpose of possible employment in the future;
2) conclusion with the subjects of personal data of any transactions and contracts, and further fulfillment of obligations under the concluded transactions and contracts;
3) informing the subjects of personal data within the framework of professional activities, including informing about the events carried out and (or) organized by ENKA FLEX OFFICES, LLC;
4) conducting by ENKA FLEX OFFICES, LLC surveys, interviews, lectures, and other events with the participation of personal data subjects;
5) ensuring the legitimate interests of ENKA FLEX OFFICES, LLC, including the maintenance of internal order, protection of property and ownership;
6) compliance with and fulfillment of the mandatory requirements of the legislation of the Russian Federation in the field of mandatory medical and pension insurance, labor, civil and tax legislation, occupational safety and health, etc;
7) maintaining personnel work and organizing the accounting of employees (workers) of ENKA FLEX OFFICE, LLC;
8) regulating employment and other directly related relationships, including assisting employees (workers) with employment, training and promotion, as well as setting wages, calculating and paying wages, and ensuring the personal safety of employees;
9) representation, including the execution of powers of attorney;
10) conducting business activities, including sending and receiving correspondence and other postal items, as well as providing access to the IT resources of the operator and providing support in their use;
11) organization of access control to the territory of the Operator;
12) receipt (registration) and storage of personal data and their carriers in accordance with the legislation of the Russian Federation and the internal regulations of ENKA FLEX OFFICES, LLC for the implementation of activities stipulated by the Charter of the Company;
13) analyzing user actions on the Operator's website and ensuring the functioning of websites, as well as registration on the Operator's websites;
14) disclosing information and ensuring compliance with legal requirements when making management decisions;
15) emergency communication;
16) organizing and conducting marketing activities, including promotions and loyalty programs, with the participation of personal data subjects;
17) feedback from subjects of personal data, including the reception and processing of their requests and complaints;
18) formation and maintenance of a database for providing personal data subjects with information through newsletters, including advertising;
19) formation and maintenance of a database containing personal data of individuals-representatives of legal entities and individual entrepreneurs, for business contacts;
20) implementation of other functions, powers and duties assigned to ENKA FLEX OFFICES, LLC by the legislation of the Russian Federation and internal regulatory documents of ENKA FLEX OFFICES, LLC.
5.3. ENKA FLEX OFFICES, LLC does not process personal data that is incompatible with the purposes of collecting personal data.
5.4. It is not allowed to combine databases containing personal data, the processing of which is carried out for purposes that are not compatible with each other.
6. Legal basis for personal data processing
6.1. The policy has been developed in accordance with the current legislation of the Russian Federation in the field of personal data processing and protection.
6.2. The legal basis for processing personal data in accordance with which ENKA FLEX OFFICES, LLC processes personal data, in addition to the legislation of the Russian Federation in the field of processing and protection of personal data, also include:
1) statutory documents of the Operator;
2) agreements concluded between ENKA FLEX OFFICES, LLC and subjects of personal data;
3) consent of personal data subjects to the processing of personal data;
4) other grounds when consent to the processing of personal data is not required by law.
6.3. In pursuance of the Policy, the head of the Operator approved the «Regulation on the organization of processing and protection of personal data in ENKA FLEX OFFICES, LLC», as well as other local acts of the Operator in the field of processing and protection of personal data.
7. Volume and categories of personal data processed, categories of personal data subjects
7.1. The operator in its activities provides compliance with the principles of processing personal data specified in Article 5 of the Federal Law of 27.07.2006 № 152-FZ «On personal data».
7.2. The operator processes the following categories of personal data subjects:
1) Applicants;
2) Employees;
3) Dismissed employees;
4) Relatives of employees;
5) Clients;
6) Users/visitors of the Operator's website;
7) Individuals - representatives of legal entities, individual entrepreneurs.
7.3. The composition of the processed personal data and the purposes of personal data processing for each category are shown below:
1) Composition of processed personal data:
⠀⠀1) Applicants:
- last name, first name and patronymic;
- date of birth (date, month, year);
- citizenship;
- sex;
- type and data of the document identifying the person (series, number, when and by what authority it was issued, unit code);
- address of actual residence;
- registration address at the place of residence/stay;
- phone numbers and email addresses or information about other communication methods;
- information about education, including postgraduate professional education (level of education, form of study, name of the educational institution, year of graduation, name and details of the document on education, qualification and specialty according to the document on education);
- information about professional development and certification (number and date of issue of the certificate of completion of training);
- information about foreign language proficiency, degree of proficiency, preferred language of communication;
- information about skills and professional experience;
- professional field;
- specialization;
- information about work activity and its results, including a list of duties, information about employers (month and year of admission to work, month and year of leaving work, position held, name of the organization), promotion, disciplinary penalties, transfers to a new position/place of work, reasons for dismissal, and work experience;
- work permit;
- desired position;
- desired salary;
- desired type of employment and work schedule;
- readiness for business trips and for moving;
- marital status;
- information about the availability of a driver's license, category and driving experience;
- information about the availability of the car (model, license plate);
- information about the results of interviews and the decision made;
- information about preferences, hobbies, interests;
- photographic image;
- additional information provided for by the requirements of federal laws defining the cases and features of personal data processing.
⠀⠀2) Employees and dismissed employees:
- last name, first name and patronymic;
- date of birth (date, month, year);
- citizenship;
- sex;
- type and data of the document identifying the person (series, number, when and by what authority it was issued, unit code);
- address of actual residence;
- registration address at the place of residence/stay;
- phone numbers and email addresses or information about other communication methods;
- information about education, including postgraduate professional education (level of education, form of study, name of the educational institution, year of graduation, name and details of the document on education, qualification and specialty according to the document on education);
- information about professional development and certification (number and date of issue of the certificate of completion of training);
- information about foreign language proficiency, degree of proficiency, preferred language of communication;
- information about skills and professional experience;
- professional field;
- specialization;
- information about work activity and its results, including a list of duties, information about employers (month and year of admission to work, month and year of leaving work, position held, name of the organization), promotion, disciplinary penalties, transfers to a new position/place of work, reasons for dismissal, and work experience;
- place of work and current position;
- service number/ identification number/ pass number to the territory of work;
- information on the accounting of working hours (time of entry and departure, other records of absence from the workplace, the number of hours worked and the number of hours under the contract or department standards, the status of leave);
- information about annual paid leave, study leave and leave without pay;
- work permit;
- desired position;
- desired salary;
- desired type of employment and work schedule;
- readiness for business trips and for moving;
- marital status;
- information about a close relative (wife/husband, parents, children) (indicating the degree of kinship( proximity), surname, first name, patronymic, year of birth);
- information of a financial nature: salary, rate, other accruals and payments, about bank accounts for payroll and other payments, information about taxes to be paid and paid and insurance contributions to off-budget funds;
- bank details;
- number of the insurance certificate of the state pension insurance (SNILS);
- taxpayer identification number (TIN);
- information about military registration and details of military registration documents;
- information about the availability of a driver's license (series, number), category and length of service;
- information about the availability of the car (model, license plate);
- information about social benefits that are provided in accordance with the legislation and legal acts of the Russian Federation;
- information about promotions and awards;
- information about disqualification and deprivation of the right to hold a certain position, perform a labor function;
- information about restrictions on work activity for health reasons;
- other information contained in the employment contract, the contract on individual, collective, financial responsibility, student contracts, service contracts;
- photographic image;
- signature;
- additional information provided by the terms of the contract and the requirements of federal laws defining the cases and features of personal data processing.
⠀⠀3) Relatives of employees:
- last name, first name, patronymic;
- year of birth;
- degree of kinship.
⠀⠀4) Clients:
- last name, first name, patronymic;
- type and data of the document identifying the person (series, number, when and by what authority it was issued, unit code);
- phone numbers, email addresses or other information about communication methods;
- the name of the company that the client is a representative of;
- taxpayer identification number (TIN);
- information about the availability of the car (model, license plate);
- signature;
- depersonalized user data provided by Internet analytics services (including: location information; OS type and version; browser type and version; provider; pages visited; number of page visits; information about moving through the pages of the site; duration of the user session; user entry points; OS and browser language);
- cookies;
- additional information provided by the terms of the contract and the requirements of federal laws defining the cases and features of personal data processing.
⠀⠀5) Users/visitors of the Operator's website:
- last name, first name, patronymic;
- email address or information about other communication methods;
- the name of the company that the user is a representative of;
- depersonalized user data provided by Internet analytics services (including: location information; OS type and version; browser type and version; provider; pages visited; number of page visits; information about moving through the pages of the site; duration of the user session; user entry points; OS and browser language);
- cookies;
- additional information provided by the terms of the contract and the requirements of federal laws defining the cases and features of personal data processing.
⠀⠀6) Individuals - representatives of legal entities, individual entrepreneurs:
- last name, first name, patronymic;
- type and data of the document identifying the person (series, number, when and by what authority it was issued, unit code);
- phone numbers and email addresses or information about other communication methods;
- place of work and current position;
- company name and address;
- taxpayer identification number (TIN);
- information about the availability of the car (model, license plate);
- signature;
- additional information provided by the terms of the contract and the requirements of federal laws defining the cases and features of personal data processing.
7.4. The operator ensures that the content and volume of the processed personal data correspond to the stated processing purposes and, if necessary, takes measures to eliminate their redundancy in relation to the stated processing purposes.
7.5. The operator processes special categories of personal data subject to the written consent of the relevant personal data subjects, as well as in other cases stipulated by Russian law.
8. Procedure and conditions of personal data processing
8.1. The processing of personal data is carried out by the Operator with the consent of the personal data subjects, unless otherwise provided by the legislation of the Russian Federation, when the processing of personal data may be carried out without such consent.
8.2. The subject of personal data makes a decision on the provision of his personal data and gives consent freely, of his own will and in his own interest.
8.3. Consent is given in any form which allows to confirm the fact of its receipt. In cases stipulated by the laws of the Russian Federation, consent shall be given in writing.
8.4. Consent may be withdrawn by written notice sent to the Operator by mail.
8.5. The operator processes personal data in the following ways:
1) non-automated processing of personal data;
2) automated processing of personal data with or without transmission of the information received via information and telecommunication networks;
3) mixed processing of personal data.
8.6. The operator does not make decisions that produce legal consequences in relation to the subjects of personal data or otherwise affect their rights and legitimate interests, based solely on the automated processing of their personal data.
8.7. Processing of personal data by the Operator includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, disclosure, access), anonymization, blocking, erasure, destruction of personal data
8.8. The operator has the right to transfer personal data to bodies of inquiry and investigation and other authorized bodies on the grounds stipulated by the current legislation of the Russian Federation.
8.9. In cases where it is necessary to interact with third parties in order to achieve the purposes of personal data processing, the Operator may transfer personal data to authorized third parties in order to achieve the purposes of processing.
8.10. The operator may create publicly accessible sources of personal data (directories, address books) only with the written consent of the subject of personal data or on the basis of the requirements of current legislation of the Russian Federation.
8.11. The operator may process personal data on subjects of personal data, permitted for dissemination, on the basis of separately obtained consent of the subject of personal data to process such personal data. The operator shall provide the subject of personal data with an opportunity to determine the list of personal data for each category of personal data specified in the consent for processing of personal data, permitted by the subject of personal data for dissemination.
8.12. The operator has established the following conditions for terminating the processing of personal data:
1) achievement of the purposes of personal data processing and the maximum retention period;
2) loss of the need to achieve the purposes of personal data processing;
3) provision by the subject of personal data or his legal representative of information confirming that personal data is illegally obtained or is not necessary for the stated purpose of processing;
4) impossibility of ensuring the legality of the processing of personal data;
5) withdrawal of consent to the processing of personal data by the subject of personal data, if the storage of personal data is no longer required for the purposes of personal data processing;
6) expiration of the limitation period for legal relations in which personal data is being processed or has been processed.
8.13. Personal data is stored in a form that allows determining the subject of personal data for a period not longer than the purposes of personal data processing require, except in cases when the period of personal data storage is established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor.
8.14. When storing personal data, the Operator uses databases located on the territory of the Russian Federation.
9. Measures for the proper processing and protection of personal data
9.1. When processing personal data, the Operator takes all necessary legal, organizational and technical measures to protect them from unauthorized or accidental access, destruction, modification, blocking, copying, disclosure, dissemination, as well as from other illegal actions in relation to them. Ensuring the protection of personal data is achieved, in particular:
1) by appointing a Data Privacy Officer (DPO);
2) by implementing internal control and / or auditing the compliance of personal data processing with Federal Law No. 152-FZ of 27.07.2006 «On personal data» and regulatory legal acts adopted in accordance with it, requirements for the protection of personal data, local acts of the Operator;
3) by familiarizing the Operator's employees directly engaged in the processing of personal data with the provisions of the legislation of the Russian Federation on personal data, including the requirements for the protection of personal data, local acts regarding the processing of personal data and (or) training of these employees;
4) by identifying threats to the protection of personal data when they are processed in personal data information systems;
5) by applying organizational and technical measures to ensure the protection of personal data during their processing in personal data information systems necessary to meet the requirements for personal data protection;
6) by evaluating the effectiveness of the measures taken to ensure the security of personal data before the commissioning of the personal data information system;
7) by taking into account the machine carriers of personal data;
8) by identifying the facts of unauthorized access to personal data and taking appropriate measures;
9) by restoring personal data that has been modified or destroyed due to unauthorized access to them
10) by establishing rules for access to personal data processed in the personal data information system, as well as ensuring the registration and accounting of all actions performed with personal data in the personal data information system;
11) by controlling the measures taken to ensure the security of personal data and the level of protection of personal data information systems.
9.2. The obligations of the Operator's employees who process and protect personal data, as well as their responsibility, are defined in the «Regulation on the organization of processing and protection of personal data» of the Operator.
10. Data Privacy Officer (DPO)
10.1. The rights, obligations and legal responsibility of the DPO are established by Federal Law No. 152-FZ of July 27, 2006 «On personal data» and «Regulation on the organization of processing and protection of personal data».
10.2. The appointment of a DPO and release from these duties is carried out by order of the General Director of the Operator. When appointing a DPO, the powers, competencies and personal qualities of an official are taken into account, designed to allow him to properly and fully exercise his rights and fulfill the obligations provided for by the «Regulation on the organization of processing and protection of personal data».
10.3 The DPO:
1) implements internal control over the compliance of the Operator and its employees with the legislation of the Russian Federation on personal data, including the requirements for the protection of personal data;
2) brings to the attention of the Operator's employees the provisions of the legislation of the Russian Federation on personal data, local acts on the processing of personal data, requirements for the protection of personal data or ensures that;
3) exercises control over the reception and processing of requests and complaints from subjects of personal data or their representatives.
10.4. Contact details of the DPO: ENKA FLEX OFFICES, LLC, phone: + 7 (495) 258-68-58, e-mail: hello@flexity.ru, 115054, Russian Federation, Moscow, Paveletskaya square 2, building 2, floor 2, room 11.
11 Update, modification, erasure and destruction of personal data, responding to subjects' requests for access to personal data
11.1. If the fact of inaccuracy of personal data or illegality of its processing is confirmed, personal data must be updated by the Operator, or its processing must be terminated.
11.2. The fact of inaccuracy of personal data or illegality of its processing can be established either by the subject of personal data, or the competent state authorities of the Russian Federation.
11.3. At the written request of the subject of personal data or his representative, the operator must provide information about the processing of personal data on that subject.
11.4 The request shall contain:
1) number of the main document certifying the identity of the subject of personal data and his/her representative,
2) information about the date of issuance of this document and the issuing authority,
3) information confirming participation of the personal data subject in relations with the Operator (contract number, contract conclusion date, conventional word mark and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator,
4) signature of the subject of personal data or his representative.
11.5. The request may be sent in the form of an electronic document and signed by electronic signature in accordance with the laws of the Russian Federation.
11.6. If a personal data subject's request does not reflect all the necessary information or the subject does not have the rights of access to the requested information, a reasoned refusal is sent to him.
11.7. In the manner stipulated in clause 11.3 the subject of personal data shall have the right to request the operator to clarify, block or destroy his personal data if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as to take statutory measures to protect his rights.
11.8. When the purposes of personal data processing are achieved, as well as in the case of withdrawal of consent by the subject of personal data, personal data shall be destroyed:
1) unless otherwise provided by the contract, a party, beneficiary or guarantor of which is the subject of personal data;
2) if the operator is not entitled to the processing without the consent of the subject of personal data on the legal basis provided by the Federal Law «On personal data» or other federal laws;
3) unless otherwise provided by other agreement between the operator and the subject of personal data.
12. Responsibility
12.1. Persons guilty of violating the norms governing the processing and protection of personal data are liable under the legislation of the Russian Federation, local acts of the Operator and contracts regulating the legal relations of the Operator with third parties.
13. Access to the Policy
13.1. The current version of the Policy on paper is stored at the address: 115054, Russian Federation, Moscow, Paveletskaya square 2, building 2, floor 2, room 11.
13.2. The electronic version of the current Policy is publicly available on the Operator's website on the Internet: www.flexity.ru.
14. Alteration
14.1. The Policy is approved and put into effect by the General Director of the Operator.
14.2. The Operator has the right to make changes to the Policy. When making changes, the date of approval of the current version of the Policy is indicated in the Policy header.
14.3. The Policy is reviewed on a regular basis-once a year since the previous review of the Policy. The Policy is re-approved if changes are made to the Policy based on the results of the review.
14.4. The Policy may be revised and re-approved earlier than the deadline specified above, as changes are made
1) in the regulatory legal acts in the field of personal data;
2) in the local regulatory and individual acts of the Operator regulating the organization of processing and ensuring the security of personal data.
14.5. All relations concerning the processing of personal data that are not reflected in this Policy are regulated in accordance with the provisions of the legislation of the Russian Federation.
Павелецкая
Третьяковская
