This is an English translation for convenience. The Russian version at idealconsult.ru/policy.html is the governing text; in case of any discrepancy, the Russian version prevails.
01 General provisions
1.1. This Policy sets out the procedure for processing personal data and the measures to ensure its security at Limited Liability Company «Consulting Company «IDEAL» (ООО «Консалтинговая компания «ИДЕАЛ»), TIN 9728041746, PSRN 1217700334939, address: apt. 17, 11 Kirova St., Lyubertsy, Lyubertsy Urban District, Moscow Region, 140002, Russia (the «Operator»), and is drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 «On Personal Data».
1.2. The Policy applies to personal data processed by the Operator on the website idealconsult.ru, in the software «Tartib» available at app.idealconsult.ru (the «Software»), and in the Operator's contractual, HR and business activities.
1.3. The Policy is published in open access on the Operator's website and in the Software in accordance with Part 2 of Article 18.1 of Federal Law No. 152-FZ.
02 Two roles of the Operator
2.1. For the data listed in Section 4, the Operator acts as a personal data operator: it determines the purposes and scope of the data processed.
2.2. For personal data of couriers, courier candidates and employees of organisations using the Software, the Operator acts as a processor on behalf of the operator under Part 3 of Article 6 of Federal Law No. 152-FZ. The operator of such data is the organisation registered in the Software. The terms of processing are set out in the «Instruction on Personal Data Processing» accepted by the organisation at registration.
2.3. For data processed on instruction, the Operator does not determine the purposes of processing, does not disclose the data to third parties other than on the organisation's instructions or at the request of authorised state bodies, and ensures its security to the extent set out in the instruction.
03 Processing principles
3.1. Processing is lawful and fair, limited to specific purposes defined in advance, and not excessive in relation to them.
3.2. Databases processed for mutually incompatible purposes are not combined.
3.3. Only data relevant to the purposes of processing is processed. The Operator ensures its accuracy and sufficiency and, where necessary, keeps it up to date.
3.4. Data is stored no longer than the purposes of processing require, unless a storage period is set by law or contract. Once the purposes are achieved or no longer relevant, the data is destroyed or anonymised.
3.5. Databases containing personal data of citizens of the Russian Federation are located in the Russian Federation.
04 Purposes, data categories and data subjects
4.1. Providing access to the Software and supporting it. Subjects: users of the Software, representatives of client organisations. Data: full name, email address, phone number, position, records of actions in the Software (date, time, IP address). Basis: performance of a contract (licence agreement) to which the subject, or the organisation the subject represents, is a party.
4.2. Concluding and performing contracts with counterparties, accounting and tax records. Subjects: counterparties and their representatives. Data: full name, position, phone number, email address, TIN, identity document details (for sole proprietors and individuals), bank details. Basis: performance of a contract and obligations imposed on the Operator by law.
4.3. Compliance with labour law. Subjects: employees, job applicants, former employees. Data: full name, date and place of birth, sex, citizenship, registered and residential addresses, phone number, email address, SNILS, TIN, identity document details, education and employment history, military registration status, position. Basis: obligations imposed on the Operator by law.
4.4. Providing consulting services. Subjects: clients, representatives of counterparties. Data: full name, position, phone number, email address. Basis: performance of a contract.
4.5. Handling enquiries submitted through the website. Subjects: website visitors. Data: full name, email address, phone number, content of the enquiry. Basis: consent of the data subject.
4.6. The Operator does not process special categories of personal data (health, ethnicity, political views, religious beliefs, criminal record) or biometric personal data. Document images containing a photograph are processed in the Software on behalf of client organisations as document images and are not used for automated identification.
05 Procedure and conditions of processing
5.1. Processing is mixed: with and without automation, with transfer over the Operator's internal network and over the internet.
5.2. Actions performed: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.
5.3. Processing by third parties on instruction. The Operator may instruct persons located in the Russian Federation to process data in compliance with Part 3 of Article 6 of Federal Law No. 152-FZ. The current list of such persons is published in the Software and includes the provider of cloud infrastructure and image recognition services, the SMS provider, the email service provider and the service that checks information about legal entities in open state registers.
5.4. No cross-border transfer of personal data takes place.
5.5. Storage periods: for the term of the contract with the subject or organisation and thereafter for the periods established by Russian law; data from website enquiries is stored until the purpose of the enquiry is achieved, but no longer than one year; HR documents are stored for the periods established by archival law. For data processed on instruction, storage periods are set by the organisation acting as operator.
5.6. Processing ends when its purposes are achieved, upon liquidation or reorganisation of the Operator, upon withdrawal of consent by the subject, or upon termination of the contract with the subject and expiry of the storage periods established by law.
06 Security measures
6.1. A person responsible for organising personal data processing has been appointed.
6.2. Internal regulations governing personal data processing and protection have been approved; employees who process data are familiar with them.
6.3. Security threats and the level of protection have been determined in accordance with Government Decree No. 1119 of 01.11.2012; the measures set out in FSTEC Order No. 21 of 18.02.2013 have been implemented.
6.4. Measures applied: role-based and organisation-based access control, user identification and authentication, storage of passwords as irreversible hashes, logging of actions with personal data with tamper protection, encryption of data in transit, anti-virus protection, firewalling, backups stored in the Russian Federation, monitoring and assessment of the measures taken.
6.5. Upon detecting an incident involving unlawful transfer of personal data, the Operator notifies Roskomnadzor within 24 hours of detection, submits the results of an internal investigation within 72 hours, and notifies the organisation acting as operator if the incident affects data processed on its instruction.
07 Rights of the data subject
7.1. The data subject may obtain information about the processing of their personal data, demand its clarification, blocking or destruction if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose, and withdraw consent to processing.
7.2. Requests are sent to ideal@idealconsult.ru or by post to: apt. 17, 11 Kirova St., Lyubertsy, Lyubertsy Urban District, Moscow Region, 140002, Russia. A reply is sent within 10 working days of the request; this period may be extended by no more than 5 working days with notice to the subject.
7.3. If the data is processed by the Operator on an organisation's instruction, the request is forwarded to that organisation as the personal data operator, and the subject is notified.
08 Changes
8.1. The Operator may amend this Policy. The current version is published on the Operator's website and in the Software with its date and version number.