Russian producer
of sodium percarbonate

Personal data processing and protection policy

01. General provisions

1.1. The present Policy of Percarbonat Limited Liability Company on the processing of personal data (hereinafter referred to as the Policy) has been developed in pursuance of the requirements of paragraph 2 of part 1 of Art. 18.1 of the Federal Law No. 152-FZ dated July 27, 2006 "On Personal Data" (hereinafter referred to as the Law on Personal Data) in order to ensure the protection of the rights and freedoms of a person and citizen in the processing of his/her personal data, including the protection of the rights to privacy, personal and family secrets.

1.2. The Policy applies to all personal data processed by Percarbonat Limited Liability Company (hereinafter referred to as the Operator).

1.3. The Policy applies to relations in the field of personal data processing that was in possession of the Operator  both before and after the approval of this Policy.

1.4. In pursuance of the requirements of part 2 of Art. 18.1 of the Law on Personal Data, this Policy is published in the public domain on the Internet on the Operator's website.

1.5. Basic terms used in the Policy and their definitions:

personal data– any information relating directly or indirectly to a specific or identifiable natural person  (personal data subject);

personal data operator (operator) – a government agency, municipal authority, legal entity or natural person, which independently or jointly with other persons organizes and (or) carries out the processing of personal data, as well as determines the purposes of processing, the scope of personal data to be processed, the actions (operations) performed with personal data;

personal data processing –any action (operation) or a set of actions (operations) with personal data performed using automation tools or without their use. Personal data processing includes, without limitation:

• collection;
• record;
• systematization;
• accumulation;
• storage;
• clarification (update, change);
• extraction;
• usage;
• transfer (distribution, provision, access);
• depersonalization;
• blocking;
• removal;
• destruction;

automated personal data processing– processing of personal data using computer technology;

distribution of personal data – actions aimed at disclosing personal data to an unlimited number of persons;

personal data sharing – actions aimed at disclosing personal data to a certain person or a certain number of persons;

blocking of personal data – interruption in the processing of personal data (except the cases when processing is necessary to rectify personal data);

destruction of personal data – actions, as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material media bearing the personal data are destroyed;

depersonalization of personal data – actions as a result of which it becomes impossible to determine the ownership of personal data by a specific  personal data subject  without the use of additional information;

personal data information system – a set of personal data contained in databases and information technologies and technical means that ensure their processing.

1.6. Basic rights and obligations of the Operator.

1.6.1. The Operator has the right to:

• Independently determine the scope and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Law on Personal Data and the legislative acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
• entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for personal data processing provided for by the Law on Personal Data, respect the confidentiality of personal data, take the necessary measures aimed at ensuring the fulfillment of the obligations provided for by the Law on Personal Data;
• if the personal data subject withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Law on Personal Data

1.6.2. The Operator is obliged to:

• organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
• respond to appeals and requests from the personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data
• at the request of the authorized body for the protection of the rights of personal data subjects (Federal Supervision Agency for Information Technologies and Communications (Roskomnadzor)) report the necessary information within 10 business days from the date of receipt of such a request. The specified period may be extended, but should not be more than five business days. To do this, the Operator shall send a reasoned notification to Roskomnadzor indicating the reasons for extending the period for providing the requested information;
• in the manner determined by the federal authority in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including reporting to it about computer incidents that led to the illegal transfer (provision, distribution, access ) of personal data.

1.7. Basic rights of the personal data subject. Personal data subject has the right to:

• receive information regarding the processing of his/her personal data except for the cases provided for in the federal laws. The information shall be provided to the personal data subject by the Operator in an accessible form, and it should not contain personal data relating to other personal data subjects, unless there are legal grounds for disclosing such personal data. The list of information and the procedure for its obtaining is established by the Law on Personal Data;
• require the Operator to rectify his/her personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as take legal measures to protect their rights;
• give prior consent to the processing of personal data in order to promote goods, works and services on the market;
• appeal to Roskomnadzor or in court against illegal actions or inaction of the Operator when processing his/her personal data.

1.8. Supervision over the fulfillment of the requirements of this Policy shall be carried out by an authorized person responsible for organizing the processing of personal data by the Operator.
1.9. Responsibility for violation of the Russian Federation legislation and Percarbonat LLC regulations in the field of processing and protecting personal data shall be determined in accordance with the Russian Federation legislation.

2. Purposes of collecting personal data

2.1. The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Personal data processing incompatible with the purposes of personal data collecting is not allowed.

2.2. Only personal data that is consistent with the purposes of its processing is subject to processing.

2.3. Personal data processing by the Operator is carried out for the following purposes:

• recruitment of personnel for vacant positions of the Operator;
• ensuring compliance with labor, tax, social legislation of the Russian Federation, as well as legislation on combating corruption and countering terrorism; 
• management of personnel and accounting;
• organization and provision of access and intra-site regimes, anti-terrorist protection of the Operator's facilities, including implementation of video surveillance in the premises of the Employer; the use by the Employer of a video surveillance system in order to ensure the safety of the parties to the employment contract, control of the implementation by the employees of the Internal Labor Regulations, ensuring the safety of property, identifying violations of the legislation of the Russian Federation and local regulations of the Employer;
• ensuring the introductory, industrial or pre-diploma practical training on the basis of an agreement between the Operator and an educational institution;
• preparation, implementation, development of civil law contracts;
• provision of additional benefits to the Operator's employees and members of their families;
  
• protection of life, health or other vital interests of personal data subjects;
  
• preparation, conclusion, execution and termination of contracts with counterparties of the Operator;
• execution of judicial acts, acts of other bodies or officials,
  subject to execution in accordance with the legislation of the Russian
  Federation on Enforcement Proceedings;
• implementation of the rights and legitimate interests of the Operator in the performance of the types of activities provided for by the Charter of the Operator;

2.4. The employees personal data processing may be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

3. Legal basis for  personal data processing

3.1. The legal basis for personal data processing is a set of regulatory legal acts, in pursuance of which and in accordance with which the Operator processes personal data, including:

• the Constitution of the Russian Federation;
• Civil Code of the Russian Federation;
• Labor Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Federal Law No. 402-FZ dated December 06, 2011 "On Accounting";
• Federal Law No. 208-FZ dated December 26, 1995 "On Joint Stock Companies";
•  Federal Law No. 14-FZ dated February 8, 1998 (as amended on April 16, 2022) "On Limited Liability Companies"
• Federal Law No. 81-FZ dated May 19, 1995  “On State Benefits for Citizens with Children”;
  
• Federal Law No. 181-FZ dated  November 24, 1995 "On Social Protection of Disabled Persons in the Russian Federation";
•  Federal Law No. 53-FZ  dated  March 28, 1998 "On  Military Duty and Military Service";
• Federal Law No. 125-FZ dated July 24, 1998 “On Compulsory Social Insurance Against Industrial Accidents and Occupational Illnesses”;
  
• Federal Law No. 126-F dated July 7, 2003 No. 126-FZ "On Communications";
• Federal Law No. 236-FZ dated July 14, 2022 "On the Pension and Social Insurance Fund of the Russian Federation" (latest revision);
• Federal Law No. 237-FZ dated July 14, 2022 "On Amendments to Certain Legislative Acts of the Russian Federation" (latest revision);
• consent of personal data subject  to the processing of personal data;
• other regulatory legal acts regulating relations related to the activities of the Operator.

3.2. Further, the legal basis for personal data processing is:

• the charter of Percarbonat LLC;
• agreements concluded between the Operator and personal data subjects;
• consent of personal data subjects to the processing of their personal data.

4. Scope and categories of personal data processed, categories of personal data subjects

4.1. To achieve the processing purposes specified in this Policy, the Operator processes the personal data of its employees, as well as of other personal data subjects who are not the employees of the Operator, including:

• applicants for the vacant position of the Operator;
• employees of the Operator, former employees, as well as their close relatives and representatives;
• employees and representatives of the Operator's counterparties;
• students;
• visitors to the Operator's facilities and participants in events held by the Operator;
• subjects whose personal data is transferred to the Operator by third parties under the concluded agreements.

4.2. The Operator may process personal data of the following categories of personal data subjects:

4.2.1. Applicants for the vacant positions of the Operator - for the purposes of recruiting personnel for the vacant positions of the Operator, the implementation of access control:

• Full Name;
• gender;
• citizenship;
• date and place of birth;
• contact details, including email address;
• information about education, work experience, qualifications;

4.2.2. Employees of the Operator and former employees - for the purposes of compliance with the labor legislation within the framework of labor and other directly related relations:

• Full Name;
• gender;
• citizenship;
• date and place of birth;
• image (photo);
• passport data;
• address of registration at the place of residence;
• address of the actual residence;
• contact details, including email address;
• Taxpayer Identification Number;
• document confirming registration in the system of individual personalized accounting;
• information about education, qualifications, professional training and advanced training;
• marital status, parental status, links to relatives ;
• information about labor activity, including the presence of incentives, awards and (or) disciplinary sanctions;
• information about marriage registration;
• information about military service;
• information on disability;
• information about the withholding of alimony;
• information about income from the previous place of work;
• information about citizenship;
• information about knowledge of foreign languages;
• number of current account, bank card;
• information about the state of health (for certain categories of employees);
• information about the presence (absence) of a criminal record and (or) the fact of criminal prosecution or the termination of criminal prosecution on rehabilitating grounds (for certain categories of employees);

4.2.3. Close relatives of the Operator's employees - for the purposes of compliance with social and tax legislation within the framework of labor and other directly related relations:

• Full Name;
• relation degree;
• year of birth;

4.2.4. Employees and representatives of the Operator's counterparties, students, visitors to the Operator's facilities and participants in events held by the Operator (natural persons) - for the purposes of carrying out activities in accordance with the charter of Percarbonat LLC:

• Full Name;
• date and place of birth;
• passport data;
• address of registration at the place of residence;
• contact details
• image (photo);
• replaced position;

4.2.5. Representatives (employees) of the Operator's clients and counterparties (legal entities) - for the purposes of carrying out activities in accordance with the charter of Percarbonat LLC:

• Full Name;
• passport data;
• contact details;
•   job title;

4.3. Processing by the Operator of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his/her identity) is carried out in accordance with the legislation of the Russian Federation.

Processing of biometric personal data is only allowed with the written consent of the personal data subject. The exception shall be the circumstances provided for in Part 2 of Art. 11 of the Law on Personal Data.

4.4. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, except as provided by the legislation of the Russian Federation.

5. Procedure and conditions for processing personal data

5.1. Processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. Processing of personal data is carried out with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.

5.3. The Operator processes personal data for each purpose of its processing by means of:

• manual processing of personal data;
• automated processing of personal data with or without transmission of the received information via information and telecommunication networks;
• mixed processing of personal data.

5.4. Only the Employees of the Operator whose duties include the processing of personal data are allowed to process personal data.

5.5. Processing of personal data for each purpose of processing specified in clause 2.3 of the Policy is carried out by:

• obtaining personal data in oral and written form directly from the personal data subjects;
• entering personal data into the logs, registers and information systems of the Operator;
• use of other methods of processing personal data.

5.6. Disclosing to third parties and distributing personal data without the consent of the personal data subject is not allowed, unless otherwise provided by federal law. Consent to personal data processing authorized by the  personal data subject for distribution is issued separately from other consents of the personal data subject to his/her personal data processing .

Requirements for the content of the consent personal data processing authorized by the personal data subject for distribution are approved by Order No. 18 of Roskomnadzor dated February 24, 2021.

5.7. Transfer of personal data to the investigation authorities, the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

5.8. The operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access to it, destruction, modification, blocking, distribution and other unauthorized actions, including:

• determines threats to the security of personal data during their processing;
• adopts local regulations and other documents regulating relations in the field of processing and protection of personal data;
• appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;
• creates the necessary conditions for working with personal data;
• organizes accounting of documents containing personal data;
• organizes work with information systems in which personal data is processed;
• stores personal data under conditions that ensure their safety and prevent unauthorized access to it;
• organizes training for the Operator's employees who process personal data.

5.9. The Operator stores personal data in a form that allows to determine the  personal data subject, during the period no longer than required by each purpose of processing personal data, if the period of personal data storage is not established by federal law or contract.

5.9.1. Personal data on paper is stored at Percarbonat LLC during the periods of documents storage for which these periods are provided for by the legislation on archiving of the Russian Federation (Federal Law No. 125-FZ dated October 22, 2004 "On archiving in the Russian Federation", the list of standard managerial archival documents generated in the course of the activities of state bodies, local governments and organizations, indicating the terms of their storage (approved by the Order No. 236 of the Federal Archive dated December 20, 2019)).

5.9.2. The period of storage of personal data processed in personal data information systems corresponds to the period of storage of personal data on paper.

The Company establishes the following periods for processing and storing personal data:

• personal data processed for the purpose of the main activity - during the term of the civil law contract and the limitation period after its completion;
• personal data processed in connection with an employment relationship - during the term of the employment contract, 75 years for personal files filed before 2003, 50 years for personal files filed since 2004 after the end of the employment contract;
• personal data of candidates for vacant positions, including those who were not employed - 1 year from the date of the decision on  employment.

5.10. The Operator stops processing personal data in the following cases:

• the fact of its illegal processing was detected. Deadline - within three business days from the date of detection;
• the purpose of processing has been achieved;
• the consent of the personal data subject  to the processing of said data has expired or revoked, when, under the Law on Personal Data, the processing of this data is allowed only with consent.

5.11. Upon reaching the purposes of processing personal data, as well as in the event that the personal data subject withdraws consent to their processing, the Operator stops processing this data unless:

• otherwise provided by the contract, the party to which, the beneficiary or the guarantor of which is the personal data subject;
• The operator is not entitled to process data without the consent of the personal data subject on the grounds provided for by the Law on Personal Data or other federal laws;
• otherwise provided by another agreement between the Operator and the personal data subject .

5.12. When the personal data subject applies to the Operator with a request to stop the processing of personal data within a period not exceeding 10 business days from the date the Operator receives the relevant request, the processing of personal data is terminated, except as otherwise provided by the Law on Personal Data. The specified period may be extended, but not more than five business days. To do this, the Operator shall send a reasoned notification to the personal data subject indicating the reasons for the extension of the period.
5.13. When collecting personal data, including through the Internet information and telecommunications network, the Operator ensures recording, systematization, accumulation, storage, clarification (updating, changing), retrieval of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, for except in the cases specified in the Law on Personal Data.

6. Update, correction, deletion, destruction personal data, responses to requests from subjects for access to personal data

6.1. Confirmation of the fact of personal data processing by the Operator, legal grounds and purposes of personal data processing, as well as other information specified in Part 7 of Art. 14 of the Law on Personal Data are provided by the Operator to the personal data subject or his/her representative within 10 business days from the date of application or receipt of a request from the personal data subject or his/her representative. The specified period may be extended, but should not be more than five business days. To do this, the Operator should send a reasoned notification to the personal data subject indicating the reasons for extending the period for providing the requested information.

The information provided does not include personal data relating to other personal data subjects, unless there are legal grounds for disclosing such personal data.

The request shall contain:

• number of the main document proving the identity of the personal data subject or his/her representative, information on the date of issue of the said document and the authority that issued it;
• information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conditional verbal designation and (or) other information), or information otherwise confirming the fact of processing personal data by the Operator;
• signature of the personal data subject or his/her representative.

The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The operator provides the information specified in Part 7 of Art. 14 of the Law on Personal Data, to the personal data subject or his/her representative in the form in which the relevant appeal or request is sent, unless otherwise specified in the appeal or request.

If in the appeal (request) of the personal data subject, in accordance with the requirements of the Law on Personal Data, all the necessary information is not reflected or the subject does not have the right to access the requested information, then a reasoned refusal is sent to him.

The right of the personal data subject to access his/her personal data may be limited in accordance with Part 8 of Art. 14 of the Law on Personal Data, including if the access of the personal data subject to his/her personal data violates the rights and legitimate interests of third parties.

6.2. In the event that inaccurate personal data is detected when the personal data subject or his/her representative contacts, or at their request or at the request of Roskomnadzor, the Operator blocks personal data related to this personal data subject from the moment of such request or receipt of the specified request for the period of verification, if the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

If the fact of inaccuracy of personal data is confirmed, the Operator, on the basis of information provided by the personal data subject or his/her representative or Roskomnadzor, or other necessary documents, clarifies personal data within seven business days from the date of submission of such information and removes the blocking of personal data.

6.3. If unlawful processing of personal data is detected when a personal data subject or his/her representative or Roskomnadzor contacts (requests) the Operator blocks the unlawfully processed personal data relating to this personal data subject from the moment such a request or receipt of a request.

6.4. If the Operator, Roskomnadzor or another interested person reveals the fact of illegal or accidental transfer (provision, distribution) of personal data (access to personal data), which resulted in a violation of the rights of personal data subjects, the Operator:

• within 24 hours - notifies Roskomnadzor of the incident, the alleged causes that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
• within 72 hours - notifies Roskomnadzor of the results of the internal investigation of the detected incident and provides information about the persons whose actions caused it (if any).

6.5. The procedure for the destruction of personal data by the Operator.

6.5.1. Conditions and terms for the destruction of personal data by the Operator:

• achievement of the purpose of processing personal data or the loss of the need to achieve this purpose - within 30 days;
• achievement of the maximum storage periods for documents containing personal data - within 30 days;
• provision by the personal data subject (his/her representative) of confirmation that personal data was obtained illegally or is not necessary for the stated purpose of processing - within seven business days;
• withdrawal by the personal data subject of consent to the processing of his/her personal data, if their storage for the purpose of their processing is no longer required - within 30 days;
• termination of the Operator's activity (liquidation or reorganization).

6.5.2. Upon reaching the purpose of processing personal data, as well as in the event that the personal data subject withdraws consent to their processing, personal data shall be destroyed if:

• otherwise provided by the contract, the party to which, the beneficiary or the guarantor of which is the personal data subject;
• The operator is not entitled to process data without the consent of the personal data subject on the grounds provided for by the Law on Personal Data or other federal laws;
• otherwise provided by another agreement between the Operator and the personal data subject .

6.5.3. Methods for the destruction of personal data are established in the local regulations of the Operator.

6.5.4. If it is not possible to destroy personal data within the specified period, the Operator blocks such personal data and ensures the destruction of personal data within a period of no more than 6 months, unless another period is established by federal laws.