PRIVACY POLICY
processing and protection of personal data
Children's Development Center "Bright Children"
processing and protection of personal data
Children's Development Center "Bright Children"
I. GENERAL PROVISIONS
1.1. In order to guarantee the fulfillment of federal legislation in full, the Children's Center "Bright Children" represented by IE Eremina Ulyana Nikolaevna (hereinafter referred to as the Operator) considers it its tasks to comply with the principles of legality, fairness and confidentiality in the processing of personal data, as well as to ensure the safety of their processing.
1.2. This policy in the field of processing and protection of personal data in the Children's Center "Bright Children" (hereinafter referred to as the policy) is characterized by the following features:
1.2.1. Developed in order to ensure the implementation of the requirements of the legislation of the Russian Federation in the field of processing personal data of personal data subjects (an individual who is directly or indirectly defined or determined using personal data).
1.2.2. Discloses the main categories of personal data processed by the operator, the goals, methods and principles of processing personal data by the operator, the rights and obligations of the operator when processing personal data, the rights of subjects of personal data, and also includes a list of measures used by the operator to ensure the security of personal data during their processing ...
1.2.3. It is a publicly available document that declares the conceptual foundations of the operator's activities in the processing of personal data.
II. DEFINITIONS
2.1. Biometric personal data - information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity and which is used by the operator to establish the identity of the subject of personal data.
2.2. Blocking of personal data is a temporary suspension of the processing of personal data (unless the processing is necessary to clarify personal data).
2.3. Access to information (access) - familiarization with information, its processing, in particular, copying, modification or destruction of information.
2.4. Information system of personal data (hereinafter - ISPDN) - a set of personal data contained in databases and providing their processing of information technologies and technical means.
2.5. Unauthorized access (unauthorized access) - access to information stored on various types of media (paper, magnetic, optical, etc.) in computer databases, file storages, archives, secret parts, etc. of various organizations by changing (increasing , falsification) of their access rights.
2.6. Information carrier - any material object or medium used to store or transmit information.
2.7. Personal data (hereinafter - PD) - any information relating directly or indirectly to a specific or identifiable individual (subject of personal data).
2.8. PD operator - a state body, a municipal body, a legal entity or an individual, independently or jointly with other persons organizing and (or) processing personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations), committed with personal data.
2.9. Processing of personal data - any action (operation) or a set of actions (operations) performed using automation tools or without using such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
2.10. Provision of personal data - actions aimed at disclosing personal data to a certain person or a certain circle of persons.
2.11. Dissemination of personal data - actions aimed at disclosing personal data to an indefinite circle of persons.
2.12. Special categories of personal data - categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, intimate life.
2.13. Personal data subject is an individual who is directly or indirectly defined or determined using personal data.
2.14. Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual or a foreign legal entity.
2.15. Destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which material carriers of personal data are destroyed.
III. OPERATOR INFORMATION
3.1. Name: IP Eremina Ulyana Nikolaevna. INN: 667008462396
3.2. Actual address: 620043, Yekaterinburg, st. Rhodonite 25
3.3. Tel., Fax: 8 (343) 288-70-21
IV. LEGAL BASIS FOR PROCESSING PERSONAL DATA
4.1. The Operator's policy in the field of personal data processing is determined in accordance with the following regulatory legal acts:
4.1.1. The Constitution of the Russian Federation.
4.1.2. Labor Code of the Russian Federation.
4.1.3. The Civil Code of the Russian Federation.
4.1.4. Federal Law of December 19, 2005 No. 160-FZ "On Ratification of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data"
4.1.5. Federal Law of 27.07.2006 No. 152-FZ "On Personal Data".
4.1.6. Federal Law of July 27, 2006 No. 149-FZ "On Information, Information Technologies and Information Protection".
4.2. In pursuance of this Policy, the governing body of the Operator approved the following local regulatory legal acts:
4.2.1. Regulation on the processing of personal data using automation tools.
4.2.2. Regulation on the procedure for processing personal data without using automation tools.
4.2.3. Data backup and recovery regulations.
4.2.4. Instructions on the procedure for working with personal data.
4.2.5. The act of determining the level of security of the personal data information system.
4.2.6. Instructions for the security administrator of personal data information systems.
4.2.7. Instruction of the person responsible for organizing the processing of personal data.
4.2.8. User manual for the personal data information system.
4.2.9. A typical form of consent of subjects to the processing of personal data, etc.
V. PURPOSES OF PERSONAL DATA PROCESSING
5.1. The operator processes personal data solely for the following purposes:
5.1.1. Carrying out activities for the sale of seedlings of plants, meeting the needs of citizens in obtaining advice on plants.
5.1.2. Conclusion and fulfillment of obligations to contracts of a civil nature and contracts with counterparties.
Vi. CATEGORIES OF PROCESSED PERSONAL DATA
6.1. The following categories of personal data are processed in the information systems of the operator's personal data:
6.1.1. Personal data of clients.
6.1.2. Personal data of contractors.
6.1.3. Personal data of employees.
Vii. BASIC PRINCIPLES OF PERSONAL DATA PROCESSING
7.1. The operator in its activities ensures compliance with the principles of personal data processing specified in Article 5 of Federal Law 152-FZ "On Personal Data".
7.2. The operator does not process biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity and which are used by the operator to establish the identity of the subject of personal data).
7.3. The operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, intimate life.
7.4. The operator makes a cross-border (on the territory of a foreign state to the authority of a foreign state, a foreign individual or a foreign legal entity) transfer of personal data.
7.5. The operator has not created public sources of personal data (directories, address books).
VIII. INFORMATION ABOUT THIRD PARTIES INVOLVED IN THE PROCESSING OF PERSONAL DATA
8.1. In order to comply with the legislation of the Russian Federation, to achieve the purposes of processing, as well as in the interests and with the consent of the subjects of personal data, the Operator, in the course of its activities, provides personal data to the following organizations:
8.1.1. Federal Tax Service.
8.1.2. To the Pension Fund of Russia.
8.1.3. Non-state pension funds.
8.1.4. Bank PJSC UBRD.
8.1.5. To partners of IE Eremina Ulyana Nikolaevna and other third parties who directly provide services related to the implementation of services for additional education and the organization of festive events.
IX. MEASURES TO ENSURE THE SECURITY OF PERSONAL DATA DURING THEIR PROCESSING
9.1. When processing personal data, the operator takes all the necessary legal, organizational and technical measures to protect them from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other illegal actions in relation to them. Ensuring the security of personal data is achieved, in particular, in the following ways:
9.1.1. Appointment of those responsible for organizing the processing of personal data.
9.1.2. Implementation of internal control and / or audit of the compliance of personal data processing with the Federal Law dated July 27, 2006 No. 152-ФЗ "On Personal Data" and the regulatory legal acts adopted in accordance with it, the requirements for the protection of personal data, and local acts.
9.1.3. Familiarization of the Operator's employees who directly process personal data with the provisions of the legislation of the Russian Federation on personal data, including the requirements for the protection of personal data, local acts regarding the processing of personal data, and (or) training of these employees.
9.1.4. Determination of threats to the security of personal data during their processing in personal data information systems.
9.1.5. The application of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems, necessary to meet the requirements for the protection of personal data.
9.1.6. Evaluation of the effectiveness of measures taken to ensure the security of personal data prior to the commissioning of the personal data information system.
9.1.7. Taking into account the machine carriers of personal data.
9.1.8. Revealing facts of unauthorized access to personal data and taking appropriate measures.
9.1.9. Recovery of personal data modified or destroyed due to unauthorized access to them.
9.1.10. Establishing rules for accessing personal data processed in the personal data information system, as well as ensuring registration and accounting of all actions performed with personal data in the personal data information system.
9.1.11. Control over the measures taken to ensure the security of personal data and the level of protection of the information system of personal data.
X. RIGHTS OF PERSONAL DATA SUBJECTS
10.1. The subject of personal data has the right to receive information about the processing of his personal data by the Operator.
10.2. The subject of personal data has the right to demand from the Operator, who processes them, to clarify these personal data, to block or destroy them if they are incomplete, outdated, inaccurate, illegally obtained or cannot be deemed necessary for the stated purpose of processing, as well as to accept the provided the law measures to protect their rights.
10.3. The right of the subject of personal data to access his personal data may be limited in accordance with federal laws.
10.4. To exercise his rights and protect legitimate interests, the subject of personal data has the right to contact the Operator. He considers any appeals and complaints from the subjects of personal data, thoroughly investigates the facts of violations and takes all necessary measures for their immediate elimination, punishment of the perpetrators and the settlement of disputes and conflict situations out of court.
10.5. The subject of personal data has the right to appeal against the actions or inaction of the Operator by contacting the authorized body for the protection of the rights of subjects of personal data.
10.6. The subject of personal data has the right to protect his rights and legitimate interests, including compensation for damages and / or compensation for moral damage in court.
XI. CONTACT INFORMATION
11.1. Eremina U.N. was appointed responsible for organizing the processing and security of personal data at the Operator.
11.2. The authorized body for the protection of the rights of subjects of personal data is the Federal Service for Supervision in the Sphere of Communications, Information Technology and Mass Media (Roskomnadzor), the Department for the Protection of the Rights of Subjects of Personal Data.
Roskomnadzor Administration for the Ural Federal District:
Address: 620000, Yekaterinburg, Lenin Avenue, 39, PO Box 337
Tel.: (343) 359-01-00
E-mail: rsockanc66@rkn.gov.ru
Head of Department: Marina Gvozdetskaya
Website: http://66.rkn.gov.ru
XII. FINAL PROVISIONS
12.1. This policy is an internal document of the Operator, publicly available and must be posted on the official website of the Operator.