Personal Data Processing Policy of the PORA Expert Center

1.1. The Policy regarding the processing of personal data of the ANO «Expert Center PORA» has been developed in accordance with the requirements of Part 2 of Article 18.1 of Federal Law No. 152-FZ of July 27, 2006 «On Personal Data» and is intended to provide unrestricted access to information regarding the processing of personal data, as well as to information on the implemented requirements for the protection of personal data at the ANO «Expert Center PORA».
1.2. This Policy describes the procedure for processing and protecting the personal data of individuals in connection with the implementation of labor relations, the conclusion of contracts and the fulfillment of contractual obligations of the ANO «Expert Center PORA», and the implementation of the organization’s statutory activities.
1.3. Personal data belong to the category of confidential information and are protected from unauthorized, including accidental, access to them.

2. Basic Concepts in the Field of Personal Data

personal data — any information relating directly or indirectly to a specific or identifiable individual (personal data subject);

operator — a state body, municipal body, legal entity or individual, organizing and (or) carrying out the processing of personal data independently or jointly with other persons, as well as determining the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed with personal data;

processing of personal data — any action (operation) or set of actions (operations) performed using automation tools or without using such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data;

automated processing of personal data — processing of personal data using computer technology;

dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons;

provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons;

blocking of personal data – temporary cessation of personal data processing (except in cases where processing is necessary to clarify personal data);

destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the physical media of personal data are destroyed;

depersonalization of personal data – actions as a result of which it becomes impossible, without using additional information, to determine the ownership of personal data to a specific personal data subject;

personal data information system – a collection of personal data contained in databases, and the information technologies and technical means ensuring their processing;

cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign government authority, a foreign individual, or a foreign legal entity.

3.1. Processing of personal data at the ANO «Expert Center PORA» is carried out for the purpose of:

complying with the requirements of the legislation of the Russian Federation (including for the purpose of exercising and performing the functions, powers and duties assigned by the legislation of the Russian Federation to the ANO «Expert Center PORA» as an operator);

exercising and performing the rights and obligations arising from labor relations, including for the purpose of assisting employees in employment, obtaining education and career advancement, ensuring personal safety of employees, monitoring the quantity and quality of work performed and ensuring the safety of property, paying wages and other payments due to the employee in accordance with the legislation of the Russian Federation or the contract, making tax and social contributions provided for by the legislation of the Russian Federation;

carrying out recruiting (personnel selection), including for the purpose of providing candidates for filling vacant positions with the opportunity to undergo selection for filling the relevant vacant positions, and employing those who successfully pass the selection for filling the relevant vacant positions;

executing a judicial act, an act of another body or official, subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;

concluding, executing, and terminating civil law contracts in cases provided for by the legislation of the Russian Federation and the Charter of the ANO «Expert Center PORA»;

exercising and performing the rights and obligations assigned to the ANO «Expert Center PORA» by contracts, including for the purpose of executing a contract to which the personal data subject is a party or beneficiary or surety, as well as for concluding a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or surety;

exercising the rights and legitimate interests of the ANO «Expert Center PORA» as an operator or third parties;

carrying out the activities stipulated by the Charter of the ANO «Expert Center PORA»;

providing the personal data subject with access to the use of the ANO «Expert Center PORA» Website and its functionality;

registration, identification, authentication, authorization of the personal data subject on the Website of the ANO «Expert Center PORA»;

providing paid and free services to personal data subjects;

making settlements with personal data subjects;

improving the quality of services provided by the ANO «Expert Center PORA»;

conducting statistical and other research based on depersonalized personal data;

communicating with the personal data subject when necessary, including for sending notifications, information and requests related to the activities of the ANO «Expert Center PORA» in providing services to personal data subjects, as well as processing applications, requests and other messages from personal data subjects;

organizing and conducting events, projects, competitions, surveys;

forming a database of applicants for the purpose of targeted information about open vacancies in the Arctic Zone of the Russian Federation;

forming a database of HR specialists and educational institutions to assist in the employment of young specialists and applicants in the Arctic Zone of the Russian Federation.

3.2. The legal grounds for processing personal data at the ANO «Expert Center PORA» are:

The Civil Code of the Russian Federation;

The Tax Code of the Russian Federation;

The Labor Code of the Russian Federation;

Federal Law No. 27-FZ of 01.04.1996 «On Individual (Personalized) Registration in the Compulsory Pension Insurance System»;

Federal Law No. 402-FZ of 06.12.2011 «On Accounting»;

Federal Law No. 53-FZ of 28.03.1998 «On Military Duty and Military Service»;

The Charter of the ANO «Expert Center PORA»;

contracts;

consents of personal data subjects to the processing of their personal data.

4.1. Processing of personal data at the ANO «Expert Center PORA» is carried out based on the following principles:

existence of legal grounds for processing personal data;

limitation of personal data processing to the achievement of specific, predetermined, and lawful purposes;

preventing the merging of databases containing personal data, the processing of which is carried out for purposes incompatible with each other;

processing only those personal data that meet the purposes of their processing;

compliance of the content and volume (non-excessiveness) of the processed personal data with the stated purposes of processing;

ensuring the accuracy of personal data, their sufficiency, and, where necessary, relevance to the purposes of personal data processing;

storage of personal data in a form that allows identifying the personal data subject for no longer than required by the purposes of personal data processing, unless the storage period for personal data is established by the legislation of the Russian Federation, a contract to which the personal data subject is a party, beneficiary, or surety.

4.2. Processing of personal data at the ANO «Expert Center PORA» may be carried out in the following cases:

the subject’s consent to the processing of their personal data has been obtained;

processing of personal data is necessary for the exercise and performance of functions, powers, and duties assigned to the operator by the legislation of the Russian Federation;

processing of personal data is carried out in connection with the participation of the personal data subject in civil and arbitration court proceedings;

processing of personal data is necessary for the execution of a judicial act in accordance with the legislation of the Russian Federation on enforcement proceedings;

processing of personal data is necessary for the execution of a contract to which the personal data subject is a party or beneficiary or surety, as well as for concluding a contract at the initiative of the personal data subject;

processing of personal data is necessary to protect the life, health, or other vital interests of the personal data subject, if obtaining the consent of the personal data subject is impossible;

processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or third parties, or for achieving socially significant goals, provided that this does not violate the rights and freedoms of the subject;

processing of personal data is carried out for statistical or other research purposes, subject to the mandatory depersonalization of personal data;

processing of personal data subject to publication or mandatory disclosure in accordance with the legislation of the Russian Federation is carried out.

5.1. The ANO «Expert Center PORA» processes personal data of the following subjects:

individuals who are or were previously in labor, other contractual, and other civil law relations with the ANO «Expert Center PORA», and (or) their legal representatives, in particular employees; dismissed employees; family members and relatives of employees and (or) dismissed employees;

candidates (applicants) for filling vacant positions;

participants of events, projects, surveys;

candidates for work in the Russian Arctic Zone (AZRF);

HR specialists and educational institutions;

applicants with appeals.

5.1.1. The composition of processed personal data of individuals who are or were previously in labor, other contractual, and other civil law relations with the ANO «Expert Center PORA», and (or) their legal representatives, in particular employees, dismissed employees, family members and relatives of employees and (or) dismissed employees, as well as candidates for filling vacant positions, contains the following categories of personal data:

last name, first name, patronymic, gender;

date and place of birth;

citizenship information;

education information;

profession, qualification, position;

academic degree, title;

marital status, family composition;

passport details;

address, phone number;

military registration information;

information about awards, incentives, honorary titles;

information about social status;

pension and health insurance data, TIN (Taxpayer Identification Number), SNILS (Insurance Number of Individual Ledger Account);

income, deduction amounts, tax allowances, benefit payments;

information about vacations;

work experience;

personnel number;

retirement date;

information about temporary disability;

photograph;

email address.

5.1.2. The composition of processed personal data of participants in events, projects, surveys, and applicants with appeals contains the following categories of personal data:

last name, first name, patronymic;

gender;

date, place of birth;

city;

education;

contact details (phone, e-mail);

website visitors’ «Cookie» files.

5.1.3. The composition of processed personal data of candidates for work in the Russian Arctic Zone (AZRF) contains the following categories of personal data:

last name, first name, patronymic, gender;

date and place of birth;

citizenship information;

education information;

profession, qualification, position;

marital status, family composition;

residential address, phone number;

information about social status;

professional skills and personal characteristics;

website visitors’ «Cookie» files.

5.1.4. The composition of processed personal data of HR specialists and educational institutions contains the following categories of personal data:

last name, first name, patronymic;

contact details (phone, e-mail);

position;

website visitors’ «Cookie» files.

5.2. Processing of information about the health status of employees, dismissed employees, family members and relatives of employees and (or) dismissed employees is carried out in specific cases in accordance with the legislation of the Russian Federation on state social assistance, labor legislation, and pension legislation of the Russian Federation.
5.3. Biometric personal data are not processed.

6.1. Personal data is collected directly from the personal data subject. If the provision of personal data is mandatory in accordance with the legislation of the Russian Federation, the legal consequences of refusing to provide such data are explained to the personal data subject.
6.2. Obtaining personal data from other persons is possible only if there are legal grounds. When obtaining personal data from other persons, except in cases where the personal data was obtained under a personal data processing instruction or where the consent was obtained by the transferring party, the subject must be notified thereof.
6.3. When collecting personal data, including via the «Internet» information and telecommunications network, the recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of personal data of Russian citizens are ensured using databases located on the territory of the Russian Federation.

7.1. When processing personal data at the ANO «Expert Center PORA», the following actions are carried out: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), blocking, deletion, destruction.
7.2. Personal data is processed both on physical (paper) media and in electronic form (in personal data information systems, on machine media) with transmission via the legal entity’s internal network.
7.3. Processing of personal data may be entrusted to a third party with the consent of the personal data subject or on the grounds provided for by the legislation of the Russian Federation. The person processing personal data under an instruction is not obliged to obtain the subject’s consent to the processing of their personal data.
7.4. In case of confirmation of the inaccuracy of personal data, such personal data is subject to updating.
7.5. In case of detection of unlawful processing of personal data, such personal data is subject to destruction within three days.

8.1. Personal data is stored in a form that allows identifying the personal data subject for no longer than required by the purposes of personal data processing, unless the storage period for personal data is established by the legislation of the Russian Federation or a contract to which the personal data subject is a party.
8.2. Storage of personal data is carried out ensuring their confidentiality.
8.3. Personal data is transferred for archival storage in accordance with the legislation of the Russian Federation on archival affairs, destroyed, or depersonalized upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by the legislation of the Russian Federation or a contract to which the personal data subject is a party.

9.1. Transfer of personal data to a third party is carried out only with the consent of the personal data subject or in cases expressly provided for by the legislation of the Russian Federation.
9.2. Transfer of personal data to a state authority, local government body, security and law enforcement body, state institution and fund, as well as to another authorized body is permitted on the grounds provided for by the legislation of the Russian Federation.
9.3. Disclosure of personal data to a third party without the consent of the relevant subject is not permitted, except in cases where this is necessary to protect the life, health, or other vital interests of the personal data subject.
9.4. Disclosure of personal data to a third party for commercial purposes without the consent of the relevant subject is prohibited. Processing of personal data for the purpose of promoting goods, works, services on the market, as well as for political campaigning, is carried out only subject to the prior consent of the subject.
9.5. Cross-border transfer of personal data to the territories of foreign states is not carried out.

10.1. Processing of personal data authorized by the personal data subject for dissemination is carried out taking into account the fulfillment of requirements provided for by personal data legislation.
10.2. The subject gives consent to the processing of personal data authorized for dissemination separately from other consents of the personal data subject to the processing of their personal data.
10.3. If the subject themselves discloses their personal data to an indefinite circle of persons using the functionality of the Website or service of the ANO «Expert Center PORA» without providing appropriate consent, further dissemination by other operators of personal data is possible only based on the consent of the relevant subject to the processing of personal data authorized for dissemination.
10.4. In the consent to the processing of personal data authorized by the personal data subject for dissemination, the personal data subject has the right to establish prohibitions on the transfer (except for providing access) of these personal data by the operator to an unlimited circle of persons, as well as prohibitions on the processing or conditions for processing (except for obtaining access) of these personal data by an unlimited circle of persons.

11.1. Upon achievement of the purpose of processing personal data, the processing of such personal data must be stopped, and the personal data must be destroyed within thirty days from the date of achieving the purpose of processing, unless otherwise provided by the contract to which the personal data subject is a party, beneficiary, or surety, another agreement between the operator and the personal data subject, or if the operator is not entitled to process personal data without the consent of the personal data subject on the grounds provided for by the legislation of the Russian Federation.
11.2. In case the subject withdraws consent to the processing of their personal data, the processing of such personal data must be stopped, and if the retention of personal data is no longer required for the purposes of personal data processing, such personal data is subject to destruction within thirty days from the date of receipt of the said withdrawal, unless otherwise provided by the contract to which the personal data subject is a party, beneficiary, or surety, another agreement between the operator and the personal data subject, or if the operator is not entitled to process personal data without the consent of the personal data subject on the grounds provided for by the legislation of the Russian Federation.
11.3. In case of detection of unlawful processing of personal data, the processing of such personal data must be stopped within three working days. If it is impossible to ensure the lawfulness of personal data processing, the personal data is subject to destruction within ten working days from the date of detection of the unlawful processing.
11.4. If it is impossible to destroy personal data within the period specified in clauses 11.1-11.3, blocking of such personal data must be ensured, and their destruction must occur within a period not exceeding six months, unless another period is established by the legislation of the Russian Federation.

12.1. The right of access to personal data processed at the ANO «Expert Center PORA» is held by:

The General Director of the ANO «Expert Center PORA»;

employees of the ANO «Expert Center PORA» who need access to personal data in connection with the performance of their official (labor) duties, based on the list of positions approved by the General Director of the ANO «Expert Center PORA»;

other persons based on a separate power of attorney issued by the ANO «Expert Center PORA».

13.1. Any subject whose personal data is processed at the ANO «Expert Center PORA» has the right to access their personal data, including the following information:

confirmation of the fact of processing personal data;

legal grounds and purposes of processing personal data;

purposes and methods of personal data processing used;

name and location of the operator, information about persons (except for employees of the operator) who have access to personal data or to whom personal data may be disclosed based on a contract with the operator or on the basis of the legislation of the Russian Federation;

list of processed personal data relating to the relevant subject and the source of their obtaining;

terms of processing personal data and their storage periods;

procedure for exercising the rights of the subject provided for by the legislation of the Russian Federation;

information on the carried out or intended cross-border data transfer;

name of the person processing personal data on behalf of the operator, if processing is entrusted to a third party.

13.2. The ANO «Expert Center PORA» provides the information specified in clause 13.1 upon request of the subject or their legal representative in an accessible form, and it must not contain personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.
13.3. The request of the subject or their representative must contain:

number of the main identity document of the subject or their representative;

information about the date of issue of the said document and the issuing authority;

information confirming the subject’s participation in relations with the ANO «Expert Center PORA» (contract number, date of contract conclusion, or other information), or information otherwise confirming the fact of personal data processing by the ANO «Expert Center PORA»;

signature of the personal data subject or their representative.

13.4. The subject has the right to re-apply to the ANO «Expert Center PORA» with a request for the information specified in clause 13.1 no earlier than thirty days after the initial application or submission of the initial request.
13.5. The subject has the right to demand clarification of their personal data, their blocking, or destruction if the personal data processed at the ANO «Expert Center PORA» are incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing by the ANO «Expert Center PORA».
13.6. The subject has the right to withdraw their consent to the processing of personal data, if such consent was given. The withdrawal of consent is sent by the subject to the ANO «Expert Center PORA» and must contain the information specified in clause 13.3. In case the subject withdraws consent to the processing of personal data, the ANO «Expert Center PORA» has the right to continue processing personal data without the subject’s consent if there are grounds provided for by the legislation of the Russian Federation or the contract.

In order to fulfill the obligations of the ANO «Expert Center PORA» provided for by the legislation of the Russian Federation on personal data, the following measures are taken:

appointment of a person responsible for organizing the processing of personal data;

issuance of documents defining the policy regarding the processing of personal data, local acts on issues of personal data processing, as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation, and eliminating the consequences of such violations;

application of legal, organizational, and technical measures to ensure the security of personal data;

internal control of compliance of personal data processing with the requirements of the legislation of the Russian Federation;

assessment of the harm that may be caused to personal data subjects in case of violation of the legislation of the Russian Federation;

familiarization of employees of the ANO «Expert Center PORA» with the provisions of the legislation of the Russian Federation and local acts of the ANO «Expert Center PORA».

15.1. When processing personal data, necessary legal, organizational, and technical measures are taken to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions in relation to personal data.
15.2. To ensure the security of personal data at the ANO «Expert Center PORA», the following measures are implemented:

identification of threats to the security of personal data during their processing in information systems;

application of organizational and technical measures to ensure the security of personal data during their processing in information systems, which ensure compliance with the requirements for established levels of protection;

assessment of the effectiveness of measures taken to ensure the security of personal data processed in personal data information systems;

accounting of machine media of personal data;

detection of facts of unauthorized access to personal data and response to such incidents;

restoration of personal data modified or destroyed due to unauthorized access to them;

establishment of rules for accessing personal data processed in personal data information systems;

registration and accounting of actions performed with personal data in personal data information systems;

control over measures taken to ensure the security of personal data in accordance with the established level of personal data protection.

For violation of the requirements established by the legislation of the Russian Federation, the Regulations, and other local acts of the ANO «Expert Center PORA», employees and other persons involved in the processing of personal data at the ANO «Expert Center PORA» bear responsibility provided for by the legislation of the Russian Federation, internal documents, and contracts.

17.1. Unrestricted access to this Policy is provided to all interested parties, including personal data subjects and authorities exercising control and supervision functions in the field of personal data.
17.2. This Policy comes into force from the moment of its approval and is valid indefinitely. Changes to the Policy are made by separate acts of the ANO «Expert Center PORA». The current version of the Policy, as well as notifications of changes to the Policy, are posted on the official Website of the ANO «Expert Center PORA».

Full Name: Autonomous Non-Profit Organization «Expert Center — Project Office for Arctic Development (PORA)».
Abbreviated Name: ANO «Expert Center PORA».
Taxpayer Identification Number (INN): 7704449162.
Tax Registration Reason Code (KPP): 770401001.
Primary State Registration Number (OGRN): 1177700022235.
Legal Address: 119019, Moscow, ul. Arbat, 6/2, floor 4, room I, room 1, office 8.
Postal Address for correspondence: 123100, Moscow, Presnensky district, ul. Maly Tishinsky Pereulok, 23, bldg. 1, floor 2.