Policy regarding processing of personal data
"APPROVED"
Head of the Bogdan Safonov Public Benefit Charity Fund
"Moving Toward Achievement."
N.A. Shokina
PROPOSAL
of the Bogdan Safonov Public Benefit Charity Fund
"Moving Toward Achievement."
on personal data processing and protection
1. General terms
This Regulation on Processing and Protection of Personal Data (hereinafter referred to as the Regulation) has been adopted and is in force at the Bogdan Safonov Fund "Movement to Achievement" (hereinafter referred to as the Fund).
The Regulation defines the purposes and general principles of personal data processing, as well as the personal data protection measures implemented by the Fund.
The Regulations are a public document of the Fund and provide for the possibility of familiarization with it by an unlimited number of persons by posting the Regulations on the Fund's website and (or) pages of the Fund in social networks.
These Regulations are valid indefinitely until they are canceled or replaced by a new version of the document. The Fund has the right to change (update) these Regulations in case of changes in legal requirements or as necessary. In the event of changes to these Regulations, the Fund shall post a corresponding information message on its website and pages in social networks. The personal data subject, by continuing to use the Fund's website or pages in social networks after the above information message has been posted, thereby confirms his/her consent to the processing of his/her personal data subject to the amendments made to the Regulation.
The Regulation uses terms and definitions as defined in the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" and other normative legal acts.
Personal data processing is carried out by the Fund in compliance with the principles and conditions stipulated by this Regulation and the legislation of the Russian Federation in the field of personal data.
The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes, which are determined by the statutory documents of the Fund, the activities actually carried out by the Fund, the specific relationship between the Fund and the personal data subject. Processing of personal data incompatible with the purposes of personal data collection is not allowed.
2. Legal basis for the processing of personal data
The processing of personal data is carried out by the Fund on a lawful and fair basis, on the basis of the following documents:
- The Constitution of the Russian Federation;
- The Labor Code of the Russian Federation;
- The Civil Code of the Russian Federation;
- The Tax Code of the Russian Federation;
- The Federal Law of 12.01.1996 No. 7-FZ "On Non-Profit Organizations";
- The Federal Law of 19.05.1995 No. 89-FZ "On Public Associations";
- The Federal Law of 11.08.1995 №135-FZ "On Charitable Activity and Volunteerism (Volunteering)";
- The Federal Law of 06.04.2011 No. 63-FZ "On Electronic Signature";
- The Federal Law of 04.05.2011 №99-FZ "On licensing of certain types of activities";
- The Federal Law of 07.07.2003 No. 126-FZ "On Communications";
- The Federal Law of 01.04.1996 No. 27-FZ "On individual (personified) accounting in the system of compulsory pension insurance";
- The Federal Law of 22.10.2004 No. 125-FZ "On Archiving in the Russian Federation";
- The Federal Law of 29.12.2012 No. 273-FZ "On Education in the Russian Federation";
- The Charter of the Bogdan Safonov Public Charitable Fund "Movement to Achievement";
- The Contracts concluded between the Fund and the subject of personal data;
- The consent to the processing and dissemination of personal data (in cases not expressly provided for by the legislation of the Russian Federation, but corresponding to the powers of the Fund).
3. Amount and categories of processed personal data,
categories of personal data subjects
The content and volume of processed personal data corresponds to the purposes of processing and is determined by the nature of the relationship between the Fund and the subject of personal data.
The categories of subjects whose personal data may be processed by the Fund include:
- employees of the Fund, former employees, candidates for vacant positions, as well as relatives of employees;
- clients and counterparties of the Fund (individuals);
- representatives/employees of the Fund's clients and counterparties (legal entities);
- beneficiaries of the Fund;
- volunteers (volunteers) participating in the Fund's charitable activities.
Processing of special categories of personal data and biometric personal data by the Fund may be carried out in accordance with the provisions of Article 10 of the Federal Law "On Personal Data" dated July 27, 2006, No. 152-FZ.
The Fund processes technical data on the use of the Fund's website by the subject of personal data (automatically transmitted by the devices used by the subject of personal data to fill in the relevant forms (fields) on the Fund's website, including the technical characteristics of the devices, IP address, information in cookies, browser information, date and time of website use, addresses of the requested pages of the Fund's website and other similar information) solely to ensure the functioning and security of the website, as well as to improve its quality.
4. Procedure and conditions of personal data processing
The Fund processes personal data in a mixed manner, both with and without the use of automation.
The Fund performs the following operations with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer, provision, access), depersonalization, blocking, deletion, destruction of personal data.
During processing, the accuracy, adequacy and relevance of personal data in relation to the purposes of their processing shall be ensured. If inaccurate or incomplete personal data is discovered, it will be updated
The collection and processing of personal data in the cases specified by the Federal Law "On Personal Data" No. 152-FZ dated July 27, 2006, is carried out by the Fund with the written consent of the personal data subject. Consent in the form of an electronic document signed with a qualified electronic signature shall be recognized as equivalent to consent in the form of a paper document bearing the personal data subject's handwritten signature.
Consent to the processing of personal data may be given by the data subject or his/her representative in any form allowing to confirm the fact of its receipt, unless otherwise provided by law. The form of consent to the processing of personal data shall be developed by the Fund in accordance with the requirements of Article 9 of the Federal Law "On Personal Data" dated July 27, 2006, No. 152-FZ.
Processing of personal data authorized by the subject of personal data for dissemination is carried out by the Fund in strict compliance with the requirements of Article 10.1 of the Federal Law "On Personal Data" dated 27.07.2006 No. 152-FZ. The form of consent to such processing is developed by the Operator in strict compliance with the requirements of the Order of the Federal Service for Supervision of Communications, Information Technology and Mass Media dated 24.02.2021 N 18 "On Approval of Requirements to the Content of the Consent to Processing of Personal Data Authorized by the Subject of Personal Data for Dissemination".
Processing and storage of personal data is carried out for no longer than necessary for the purposes of personal data processing, unless there are legal grounds for further processing.
When storing personal data, the Personal Data Fund uses databases located in the territory of the Russian Federation.
The condition for termination of personal data processing is achievement of the purposes of personal data processing, expiration of consent or withdrawal of consent of the data subject to processing of his/her personal data, as well as detection of cases of unlawful processing of personal data.
Processing of personal data on the basis of contracts and other agreements of the Fund, instructions to the Fund and orders of the Fund to process personal data shall be performed in accordance with the terms and conditions of such contracts, agreements and orders. The above mentioned documents may, in particular, determine the following:
- purposes, conditions and terms of the processing of personal data;
- obligations of the parties, including measures to ensure the security of personal data;
- the rights, obligations and responsibilities of the parties with respect to the processing of personal data.
In cases not expressly provided for by applicable law or by the Contract, the processing shall be carried out after obtaining the consent of the data subject. Consent may be expressed in the form of performing actions, accepting the terms and conditions of the Contract - Offer, making appropriate marks, filling in fields in forms (including electronic), blanks, or in writing in accordance with the law.
The Fund is obliged to transfer personal data to bodies of inquiry and preliminary investigation, other authorized bodies in accordance with their competence and only on the grounds provided by the current legislation of the Russian Federation.
The Fund undertakes the necessary legal, organizational and technical measures to ensure the security of personal data, their protection from unauthorized (including accidental) access, destruction, modification, blocking access and other unauthorized actions. Such measures include, in particular, the following:
- appointing employees responsible for organizing the processing and ensuring the security of personal data;
- reviewing and, if necessary, including clauses on personal data confidentiality in contracts;
- adopting local regulations on the processing of personal data, familiarizing employees with them, training users;
- ensure the security of premises and processing equipment;
- limiting and delimiting the access of employees and other persons to personal data and means of processing;
- identifying threats to the security of personal data during its processing;
- application of security measures (antivirus, protection against unauthorized access);
- accounting and storage of data media to prevent their theft, replacement, unauthorized copying and destruction;
- backup copies of information for possible recovery;
- internal control of compliance with the established procedure, verification of the effectiveness of the measures taken, response to incidents.
5. Rights of Personal Data Subjects
The data subject has the right to withdraw consent to the processing of personal data by submitting a request to the Fund by mail or in person.
The personal data subject has the right to obtain information regarding the processing of his/her personal data, including information regarding:
- Confirmation of the fact of processing of personal data by the Fund;
- the legal grounds and purposes of the personal data processing;
- the purposes and methods of personal data processing applied by the Fund;
- Name and location of the Fund, information on persons (except for employees/workers of the Fund) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Fund or on the basis of federal law;
- processed personal data relating to the respective personal data subject, the source of their acquisition, unless another procedure for submitting such data is provided by the federal law;
- the conditions of personal data processing, including the conditions of its storage;
- the procedure of exercising by the personal data subject the rights provided by the Federal Law "On Personal Data" dated 27.07.2006 No. 152-FZ;
- Information about realized or supposed cross-border data transfer;
- Name or surname, first name, patronymic and address of the person processing personal data on behalf of the Fund, if the processing is or will be entrusted to such person;
- other information provided by the Federal Law "On Personal Data" dated July 27, 2006 No. 152-FZ or other federal laws.
The data subject shall have the right to demand from the Fund the clarification, blocking or destruction of his/her personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, as well as to take measures provided by law to protect his/her rights.
If the data subject believes that the Fund processes his/her personal data in violation of the requirements of the Federal Law "On Personal Data" No. 152-Federal Law dated July 27, 2006, or otherwise violates his/her rights and freedoms, the data subject shall have the right to appeal the actions or omissions of the Fund to the authorized body for the protection of the rights of data subjects (Federal Service for Supervision of Communications, Information Technology and Mass Media - Roskomnadzor) or in court.
The data subject has the right to protect his/her rights and legitimate interests, including compensation for losses and/or moral damages in court.
6. Rights and obligations of the Fund
The rights and obligations of the Fund are determined by the legislation in force and the agreements of the Fund.
The control over the fulfillment of the requirements of this regulation is carried out by the person responsible for the organization of the processing of personal data.
The liability of persons who process personal data on the basis of the Fund's instructions for unauthorized use of personal data shall be determined in accordance with the terms of the civil law contract concluded between the Fund and such person.
Persons guilty of violating the rules on processing and protection of personal data shall be subject to material, disciplinary, administrative, civil or criminal liability established by law.
The Fund's website or the Fund's social networking pages may contain links to third party websites and services, the activities of which are not controlled by the Fund. The Fund is not responsible for the security of personal data provided by the data subject when clicking on these links.
