Policy of PRINT-DESIGN Limited Liability Company regarding the processing of personal data

1. General information

1.1. This Policy of PRINT-DESIGN LLC regarding the processing of personal data (hereinafter referred to as the Policy) has been developed in compliance with the requirements of paragraph 2 of Part 1 of Article 18.1 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" (hereinafter referred to as the Personal Data Law), the Decree of the Government of the Russian Federation of 21.03.2012 No. 211 "On approval of the list of measures aimed at ensuring the fulfillment of obligations stipulated by the Federal Law "On Personal Data" and regulatory legal acts adopted in accordance with it, in order to ensure the protection of the rights and freedoms of man and citizen when processing his personal data, including the protection of the rights to privacy, personal and family secrets.

1.2. The policy applies to all personal data processed by PRINT-DESIGN LLC (hereinafter referred to as the Operator, PRINT-DESIGN LLC).

1.3. The Policy applies to relationships in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.

1.4. In compliance with the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in the public domain on the Operator's website (https://www.print-diz.ru/label).

1.5. Key concepts used in the Policy:

personal data - any information relating to a directly or indirectly identified or identifiable individual (subject of personal data);

personal data operator (operator) - a state body, municipal body, legal entity or individual that, independently or jointly with other persons, organizes and (or) carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data;

personal data subject – an individual who is directly or indirectly identified or identifiable using personal data;

personal data processing - any action (operation) or set of actions (operations) with personal data, performed with or without the use of automated tools. Personal data processing includes, but is not limited to:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (update, change);
• extraction;
• usage;
• transfer (distribution, provision, access);
• depersonalization;
• blocking;
• removal;
• destruction;

automated processing of personal data - processing of personal data using computer technology;

dissemination of personal data - actions aimed at disclosing personal data to an indefinite number of persons;

provision of personal data - actions aimed at disclosing personal data to a specific person or a specific group of persons;

blocking of personal data - temporary cessation of processing of personal data (except in cases where processing is necessary to clarify personal data);

destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the tangible carriers of personal data are destroyed;

anonymization of personal data - actions as a result of which it becomes impossible to determine the ownership of personal data by a specific subject of personal data without the use of additional information;

personal data information system - a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

1.6. Basic rights and obligations of the Operator.

1.6.1. The operator has the right:

1. independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
2. Entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with that person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data stipulated by the Law on Personal Data, maintain the confidentiality of personal data, and take the necessary measures to ensure the fulfillment of obligations stipulated by the Law on Personal Data;
3. In the event of the personal data subject's withdrawal of consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Personal Data Law.

1.6.2. The operator is obliged to:

1. organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
2. respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
3. Provide the authorized body for the protection of personal data subjects' rights (the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor)) with the necessary information upon request of this body within 10 business days of receiving such a request. This period may be extended, but not more than by five business days. To do this, the Operator must send Roskomnadzor a reasoned notice stating the reasons for the extension of the deadline for providing the requested information;
4. in the manner determined by the federal executive body authorized in the field of security, ensure interaction with the state system for the detection, prevention and elimination of the consequences of computer attacks on the information resources of the Russian Federation, including informing it of computer incidents that have resulted in the unauthorized transfer (provision, distribution, access) of personal data.

1.7. Fundamental rights of the personal data subject. The personal data subject has the right to:

1. Receive information regarding the processing of their personal data, except in cases stipulated by federal laws. Information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data related to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
2. to demand from the operator clarification of his personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also to take measures provided by law to protect his rights;
3. give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
4. appeal to Roskomnadzor or in court against the Operator's illegal actions or inactions when processing his personal data.

1.8. Compliance with the requirements of this Policy is monitored by an authorized person responsible for organizing the processing of personal data by the Operator.

1.9. Liability for violation of the requirements of the legislation of the Russian Federation and the regulations of PRINT-DESIGN LLC in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2. Purposes of collecting personal data

2.1. The processing of personal data is limited to achieving specific, predetermined, and legitimate purposes. Processing of personal data incompatible with the purposes for which it was collected is prohibited.

2.2. Only personal data that meets the purposes of their processing are subject to processing.

2.3. The Operator processes personal data for the following purposes:

• carrying out its activities in accordance with the charter of PRINT-DESIGN LLC, including the conclusion and execution of contracts with counterparties;
• compliance with labor legislation within the framework of labor and other directly related relations, including: assisting employees in finding employment, obtaining education and career advancement, attracting and selecting candidates for employment with the Operator, ensuring the personal safety of employees, monitoring the quantity and quality of work performed, ensuring the safety of property, maintaining personnel and accounting records, completing and submitting to authorized bodies the required reporting forms, organizing the registration of employees for individual (personalized) records in the compulsory pension insurance and compulsory social insurance systems;
• implementation of the access control system.

2.4. The processing of personal data of employees may be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

3. Legal grounds for processing personal data

3.1. The legal basis for the processing of personal data is the set of regulatory legal acts, pursuant to which and in accordance with which the Operator processes personal data, including:

• Constitution of the Russian Federation;
• Civil Code of the Russian Federation;
• Labor Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Federal Law of 08.02.1998 No. 14-FZ "On Limited Liability Companies";
• Federal Law of 06.12.2011 No. 402-FZ "On Accounting";
• Federal Law of 15.12.2001 No. 167-FZ "On Compulsory Pension Insurance in the Russian Federation";
• Federal Law of March 28, 1998 No. 53-FZ "On Military Duty and Military Service";
• other regulatory legal acts governing relations related to the activities of the Operator.

3.2. The legal basis for processing personal data also includes:

• Charter of PRINT-DESIGN LLC;
• agreements concluded between the Operator and personal data subjects;
• consent of personal data subjects to the processing of their personal data.

4. The volume and categories of personal data processed, categories of personal data subjects

4.1. The content and volume of personal data processed must correspond to the stated processing purposes, as set out in Section 2 of this Policy. The personal data processed must not be excessive in relation to the stated processing purposes.

4.2. The operator may process personal data of the following categories of personal data subjects.

4.2.1. Candidates for employment with the Operator - for the purposes of enforcing labor legislation within the framework of labor and other directly related relations, and implementing the access control regime:

• last name, first name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• contact information;
• information about education, work experience, qualifications;
• other personal data provided by candidates in their resumes and cover letters.

4.2.2. Employees and former employees of the Operator - for the purposes of enforcing labor legislation within the framework of labor and other directly related relations, and implementing the access control regime:

• last name, first name, patronymic;
• gender;
• citizenship;
• date and place of birth;
• image (photograph);
• passport details;
• registered address of residence;
• actual residential address;
• contact information;
• individual taxpayer identification number;
• individual insurance account number (SNILS);
• information on education, qualifications, professional training and advanced training;
• marital status, presence of children, family ties;
• information about work experience, including the presence of incentives, awards and (or) disciplinary sanctions;
• marriage registration data;
• military registration information;
• information about disability;
• information on alimony withholding;
• information about income from the previous place of employment;
• other personal data provided by employees in accordance with the requirements of labor legislation.

4.2.3. Family members of the Operator's employees - for the purposes of complying with labor legislation within the framework of labor and other directly related relationships:

• last name, first name, patronymic;
• degree of kinship;
• year of birth;
• other personal data provided by employees in accordance with the requirements of labor legislation.

4.2.4. Clients and contractors of the Operator (individuals) - for the purposes of carrying out their activities in accordance with the charter of PRINT-DESIGN LLC, implementing the access control regime:

• last name, first name, patronymic;
• date and place of birth;
• passport details;
• registration address at the place of residence;
• contact information;
• position being filled;
• individual taxpayer identification number;
• bank account number;
• other personal data provided by clients and counterparties (individuals) necessary for the conclusion and execution of contracts.

4.2.5. Representatives (employees) of the Operator’s clients and counterparties (legal entities) - for the purposes of carrying out their activities in accordance with the charter of PRINT-DESIGN LLC, implementing the access control regime:

• last name, first name, patronymic;
• passport details;
• contact information;
• position being filled;
• other personal data provided by representatives (employees) of clients and counterparties, necessary for the conclusion and execution of contracts.

4.3. The Operator's processing of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which his or her identity can be established) is carried out in accordance with the legislation of the Russian Federation.

4.4. The operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, or intimate life, except in cases stipulated by Russian legislation.

5. Procedure and conditions for processing personal data

5.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. The processing of personal data is carried out with the consent of the subjects of personal data to the processing of their personal data, as well as without such consent in cases stipulated by the legislation of the Russian Federation.

5.3. The operator processes personal data for each purpose of processing in the following ways:

• non-automated processing of personal data;
• automated processing of personal data with or without the transfer of received information via information and telecommunication networks;
• mixed processing of personal data.

5.4. Only the Operator's employees whose job responsibilities include processing personal data are allowed to process personal data.

5.5. The processing of personal data for each processing purpose specified in paragraph 2.3 of the Policy is carried out by:

• obtaining personal data in oral and written form directly from personal data subjects;
• entering personal data into the Operator’s journals, registers and information systems;
• entering personal data into the Operator’s journals, registers and information systems;

5.6. Disclosure and distribution of personal data to third parties is prohibited without the consent of the personal data subject, unless otherwise provided by federal law. Consent to the processing of personal data authorized for distribution by the personal data subject is issued separately from other consents of the personal data subject for the processing of their personal data.

Requirements for the content of consent to the processing of personal data, authorized by the personal data subject for distribution, are approved by Order No. 18 of Roskomnadzor dated February 24, 2021.

5.7. The transfer of personal data to inquiry and investigative bodies, the Federal Tax Service, the Social Fund of Russia and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

5.8. The operator takes the necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including:

• identifies threats to the security of personal data during their processing;
• adopts local regulations and other documents governing relations in the field of processing and protection of personal data;
• appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;
• creates the necessary conditions for working with personal data;
• organizes the registration of documents containing personal data;
• organizes work with information systems in which personal data is processed;
• stores personal data under conditions that ensure their safety and prevent unauthorized access to them;
• organizes training for the Operator's employees who process personal data.

5.9. The operator stores personal data in a form that allows the identification of the subject of the personal data for no longer than required for each purpose of processing the personal data, unless the storage period for personal data is established by federal law or an agreement.

5.9.1. Personal data on paper media are stored in PRINT-DESIGN LLC for the document storage periods for which these periods are stipulated by the legislation on archival affairs in the Russian Federation (Federal Law of October 22, 2004 No. 125-FZ "On Archival Affairs in the Russian Federation", List of standard management archival documents generated in the course of activities of state bodies, local governments and organizations, indicating their storage periods (approved by Order of Rosarchive dated December 20, 2019 No. 236)).

5.9.2. The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper media.

5.10. The operator stops processing personal data in the following cases:

• the fact of their illegal processing is detected. The deadline is within three working days from the date of detection;
• the purpose of their processing has been achieved;
• the consent of the personal data subject to the processing of the said data has expired or has been revoked, when, according to the Personal Data Law, the processing of these data is permitted only with consent.

5.11. Upon achieving the purposes of personal data processing, as well as in the event of the personal data subject’s withdrawal of consent to their processing, the Operator shall cease processing these data if:

• unless otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
• The operator does not have the right to carry out processing without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws;
• unless otherwise provided by another agreement between the Operator and the personal data subject.

5.12. If a personal data subject requests the Operator to cease processing personal data within 10 business days from the date the Operator receives the request, the processing of the personal data will cease, except in cases stipulated by the Personal Data Law. This period may be extended, but by no more than five business days. To do so, the Operator must send the personal data subject a reasoned notice stating the reasons for the extension.

5.13. When collecting personal data, including through the Internet information and telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.

6. Updating, correcting, deleting, and destroying personal data; responding to requests from subjects for access to personal data

6.1. Confirmation of the personal data processing by the Operator, the legal grounds and purposes for which the personal data is processed, as well as other information specified in Part 7 of Article 14 of the Law on Personal Data, shall be provided by the Operator to the personal data subject or their representative within 10 business days of the request or receipt of the personal data subject's or their representative's request. This period may be extended, but by no more than five business days. To this end, the Operator shall send the personal data subject a reasoned notice stating the reasons for the extension of the deadline for providing the requested information.

The information provided does not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosure of such personal data.

The request must contain:

• the number of the main document certifying the identity of the personal data subject or his representative, information on the date of issue of the said document and the issuing authority;
• information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator;
• signature of the personal data subject or his/her representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The operator provides the information specified in Part 7 of Article 14 of the Law on Personal Data to the personal data subject or his representative in the form in which the relevant request or appeal was sent, unless otherwise specified in the request or appeal.

If the personal data subject's request (appeal) does not contain all the necessary information in accordance with the requirements of the Personal Data Law, or the subject does not have the right to access the requested information, then a reasoned refusal will be sent to him.

The right of a personal data subject to access their personal data may be limited in accordance with Part 8 of Article 14 of the Law on Personal Data, including if the personal data subject's access to their personal data violates the rights and legitimate interests of third parties.

6.2. In the event that inaccurate personal data is discovered upon an appeal by a personal data subject or his/her representative, or at their request or at the request of Roskomnadzor, the Operator shall block the personal data related to this personal data subject from the moment of such appeal or receipt of the said request for the verification period, if the blocking of the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

In the event of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the personal data subject or his representative or Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of the personal data.

6.3. In the event of detection of unlawful processing of personal data upon an appeal (request) from the subject of personal data or his representative or Roskomnadzor, the Operator shall block the unlawfully processed personal data related to this subject of personal data from the moment of such appeal or receipt of the request.

6.4. If the Operator, Roskomnadzor or another interested party discovers an unlawful or accidental transfer (provision, distribution) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator:

• within 24 hours - notifies Roskomnadzor of the incident that has occurred, the alleged reasons that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
• within 72 hours - notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information about the persons whose actions caused it (if any).

6.5. The procedure for destruction of personal data by the Operator.

6.5.1. Conditions and terms for destruction of personal data by the Operator:

• achievement of the purpose of processing personal data or loss of the need to achieve this purpose - within 30 days;
• achieving the maximum storage period for documents containing personal data - within 30 days;
• provision by the subject of personal data (his representative) of confirmation that the personal data were obtained illegally or are not necessary for the stated purpose of processing - within seven working days;
• revocation by the subject of personal data of consent to the processing of his personal data, if their storage for the purpose of their processing is no longer required - within 30 days.

6.5.2. Upon achieving the purpose of processing personal data, as well as in the event of the withdrawal of consent to their processing by the subject of personal data, personal data are subject to destruction if:

• unless otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
• the operator does not have the right to process personal data without the consent of the subject on the grounds provided for by the Law on Personal Data or other federal laws;
• unless otherwise provided by another agreement between the Operator and the personal data subject.

6.5.3. The destruction of personal data is carried out by a commission established by order of the General Director of PRINT-DESIGN LLC.

6.5.4. Methods for destruction of personal data are established in the Operator’s local regulations.

You have any questions?

Please send us your contact information and we will get in touch with you.