1. general provisions

1.1. This Regulation on the processing of personal data of employees is developed in accordance with the Labor Code of the Russian Federation, the Constitution of the Russian Federation, the Civil Code of the Russian Federation, the Federal Law "On Information, Information Technologies and Information Protection," the Federal Law "On Personal Data," internal labor regulations.

1.2. The purpose of the Regulation is to determine the procedure for processing personal data of employees; ensuring the protection of the rights and freedoms of employees when processing their personal data, as well as establishing the responsibility of officials who have access to personal data of M employees for non-compliance with the requirements of the norms governing the processing and protection of personal data.

1.3. Procedure for enactment and amendment of the Regulation.

1.3.1 This Regulation shall come into force from the moment of its approval by the director and shall be valid indefinitely until replaced by a new Regulation.

1.3.2. All amendments to the Regulation are made by order.

1.4. The privacy regime of personal data is removed in cases of depersonalization and after 75 years of their storage period or extended on the basis of the conclusion of the expert commission, unless otherwise determined by law.

2. Basic concepts and composition of personal data of employees

2.1 The following basic concepts are used for the purposes of this Regulation:

- personal data of the employee - any information related to the employee defined or determined on the basis of such information, including his/her surname, name, patronymic, year, month, date and place of birth, address, family, social, property status, education, profession, income, other information required by the employer in connection with labor relations;

- processing of personal data - collection, systematization, accumulation, storage, clarification (updating, modification), use, distribution (including transfer), depersonalization, blocking, destruction of personal data of employees;

- confidentiality of personal data - a mandatory requirement to comply with the appointed responsible person who has gained access to personal data of employees, to prevent their distribution without the consent of the employee or other legal basis;

- distribution of personal data - actions aimed at transfer of personal data of employees to a certain circle of persons (transfer of personal data) or at familiarization with personal data of an unlimited circle of persons, including publication of personal data of employees in mass media, placement in information and telecommunication networks or provision of access to personal data of employees in any other way;

- use of personal data - actions (operations) with personal data performed by an official in order to make decisions or perform other actions that have legal consequences for employees or otherwise affect their rights and freedoms or the rights and freedoms of other persons;

- blocking of personal data - temporary termination of collection, systematization, accumulation, use, distribution of personal data of employees, including their transfer;

- destruction of personal data - actions as a result of which it is impossible to restore the content of personal data in the information system of personal data of employees or as a result of which material carriers of personal data of employees are destroyed;

- depersonalization of personal data - actions as a result of which it is impossible to determine the belonging of personal data to a specific employee;

- publicly available personal data - personal data, access of an unlimited number of persons to which is provided with the consent of the employee or to which, in accordance with federal laws, the requirement of confidentiality does not apply;

- information - information (messages, data) regardless of the form of their presentation;

- documented information - recorded on a tangible medium by documenting information with details that allow to determine such information or its tangible medium.

2.2. The personal data of employees include documents containing information about passport data, education, attitude to military duty, marital status, place of residence, health status, as well as their previous places of work.

2.3. A set of documents accompanying the process of registration of an employee's labor relations during his admission, transfer and dismissal.

2.3.1. Information provided by the employee when applying for a job in an institution shall have a documentary form. When concluding an employment contract in accordance with Art. 65 of the Labor Code of the Russian Federation, a person applying for a job presents to the employer:

- passport or other identity document;

- employment record book, except for cases when the employment contract is concluded for the first time, or the employee is hired together An employment contract is concluded for the first time, or a worker is taking up work on a joint basis, or the employee lacks a labour record due to its loss or other reasons;

- State pension insurance certificate;

- Military registration documents - for persons liable to military service and subject to military registration;

- Document on education, qualification or the existence of special knowledge when entering a job that requires special knowledge or special training;

- Certificate of PIN assignment (if the employee has one).

2.3.2. When an employee is registered, the standardized T-2 form "Personal Worker Card" is filled in, which reflects the following employee’s background and curriculum vitae:

- General information (employee’s name, date of birth, place of birth, nationality, education, profession, employment history, marital status, passport data);

- Information about the military record;

- Employment data

Subsequently, the following are entered into the personal card:

- Information on transfers to other work;

- Certification information

- Information on further training;

- Information on professional retraining;

- Details of awards (rewards), honorary degrees;

- Vacation information

- Information on social guarantees;

- Information about the place of residence and contact telephones.

2.3.3. The following groups of documents containing worker data in a single or consolidated form shall be created and stored:

2.3.3.1. Documents containing employees' personal data (Sets of documents accompanying the process of employment relations when hiring, transferring, and firing; a set of materials for questionnaires, testing; conducting job interviews with a candidate; originals and copies of personal orders; personal files and workers' labour records; cases containing grounds for a personnel order; cases containing employee certification materials; service investigations; reference and information data bank on personnel (files); originals and copies of reports, analytical and reference materials transmitted to management, heads of structural divisions; copies of reports sent to state statistical agencies, tax inspectorates, higher administrative bodies and other institutions).

2.3.3.2. Documentation on the organization of work of structural units (regulations on structural units, employee job instructions, orders, orders, guidelines); documents on planning, accounting, analysis and reporting in terms of work with personnel.

3. Collection, processing and protection of personal data

3.1. Order of obtaining personal data.

3.1.1. All personal data of the employee should be obtained from him/her. If an employee’s personal data can only be obtained from a third party, the employee must be notified in advance and receive written consent. The employer’s official must inform the employee of the purposes, intended sources and ways of obtaining personal data, as well as the nature of the personal data to be obtained and the consequences of the employee’s refusal to give written consent to their receipt.

3.1.2. The employer is not entitled to receive and process personal data of an employee about his race, nationality, political views, religious or philosophical beliefs, state of health, intimate life. In cases directly related to labour relations, according to art. 24 of the Constitution of the Russian Federation, an employer has the right to receive and process data on the private life of a worker only with his written consent.

The processing of specified personal data of employees by the employer is only possible with their consent or without their consent in the following cases:

- Personal data is public;

- personal data relate to the health of the employee, and their processing is necessary to protect his life, health or other vital interests or life, health or other vital interests or the life, health or other vital interests of other persons and obtaining the employee’s consent is impossible;

- at the request of authorized state bodies in cases provided for by federal law.

3.1.3. The employer is entitled to process employees' personal data only with their written consent.

3.1.4. The employee’s written consent to the processing of their personal data must include:

- name, first name, middle name, address of the subject of personal data, number of the main document that identifies him/her, information on the date of issuance of the said document and by the issuing authority;

- Name (surname, first name, middle name) and address of the operator who receives consent of the subject of personal data;

- the purpose of processing personal data;

- a list of personal data for which the subject of personal data has given consent;

- list of the personal data activities for which consent is given, general description of the methods used by the operator to process personal data;

- the period during which consent is valid, as well as the procedure for its withdrawal. The form of the employee’s consent to the processing of personal data can be found here. in Annex 1 to this Regulation.

3.1.5. Employee consent is not required in the following cases:

- Processing of personal data is carried out on the basis of the RF Labor Code or another federal law, establishing its purpose, conditions for obtaining personal data and the circle of subjects whose personal data are to be processed, as well as determining the employer’s powers;

- processing of personal data is carried out for the purpose of fulfilling an employment contract;

- processing of personal data is carried out for statistical or other scientific purposes, provided that the anonymization of personal data is mandatory;

- processing of personal data is necessary to protect the life, health or other vital interests of an employee if obtaining his consent is not possible.

3.2. How personal data is processed, transferred and stored.

3.2.1. The employee provides accurate information about themselves. The person responsible for processing personal data verifies the accuracy of the information by comparing the data provided by the employee with the documents available to the employee.

3.2.2. In accordance with art. 86 RFT in order to ensure human and civil rights and freedoms The employer and its representatives must comply with the following general requirements when processing an employee’s personal data:

3.2.2.1. Processing of personal data may be carried out solely for the purpose of ensuring compliance with laws and other regulatory acts, assisting employees in employment, training and promotion, ensuring personal safety of employees, Control the quantity and quality of work performed and ensure the safety of property.

3.2.2.2. When determining the scope and content of personal data processed, the employer must be guided by the Constitution of the Russian Federation, the Labour Code of the Russian Federation and other federal laws.

3.2.2.3. When making decisions affecting the employee’s interests, the Employer is not entitled to rely on the personal data of the employee obtained solely as a result of their automated processing or electronic receipt.

3.2.2.4. The protection of personal data of an employee against misuse or loss is ensured by the employer at his/her own expense in a manner established by federal law.

3.2.2.5. Employees and their representatives should be acquainted with the documents of the institution establishing the procedure for processing employees' personal data, as well as their rights and obligations in this area.

3.2.2.6. In all cases, the employee’s waiver of his or her rights to maintain and protect secrecy is invalid.

4. Transfer and storage of personal data

4.1. When transmitting personal data of an employee, the Employer must comply with the following requirements:

4.1.1. Do not disclose an employee’s personal data to a third party without the employee’s written consent, except when it is necessary for the purpose of preventing danger to the life and health of the employee, as well as in cases established by federal law.

4.1.2. Do not disclose the personal data of an employee for commercial purposes without his or her written consent. The processing of personal data of employees for the purpose of promoting goods, works, services on the market by making direct contact with a potential consumer by means of communication is permitted only with their prior consent.

4.1.3. To warn those who have received personal data from an employee that it may only be used for the purposes for which it has been disclosed, and to require such persons to confirm compliance with this rule. Persons who have received personal data from an employee are obliged to observe a confidentiality regime. This provision does not apply to the sharing of employees' personal data in accordance with federal laws.

4.1.4. To transfer employees' personal data within the Organization in accordance with this Regulation.

4.1.5. Allow access to employees' personal data only to specially authorized persons, with said persons being entitled to receive only those employee’s personal data that are necessary for the performance of a particular function.

4.1.6. Do not ask for information about the health of an employee, except for information related to whether the employee is able to perform a job.

4.1.7. To transmit the employee’s personal data to representatives of employees in accordance with the procedure established by the Labour Code of the Russian Federation, and to limit this information only to those personal data of the employee that are necessary for the performance of their duties.

4.2. Storage and use of employee personal data.

4.2.1. Employees' personal data is processed and stored in the HR department.

4.2.2. Personal data of employees can be obtained, further processed and transferred to storage both on paper and in electronic form - local computer network.

4.3. When receiving personal data not from an employee (except if the personal data was provided to the employer under federal law or if the personal data is publicly available) Before processing such personal data, the employer is required to provide the employee with the following information:

- Name (surname, first name, middle name) and address of the operator or his representative;

- the purpose of processing personal data and its legal basis;

- Intended users of personal data

- the rights of the subject of personal data established by this Federal Law.

5. Access to employees' personal data

5.1. The right of access to personal data of employees have:

- Director

- Personnel of the HR department;

- Accounting staff

- Managers of structural divisions by line of work (access to personal data only employees of their division).

5.2. is entitled to:

5.2.1. Access and review your personal data, including the right to receive free copies of any record that contains an employee’s personal data.

5.2.2. Require the Employer to clarify, delete or correct incomplete, incorrect, outdated, unreliable, illegally obtained or personal data not necessary for the Employer.

5.2.3. Receive from the Employer:

- Information about the individuals who have access to personal data or who may be granted such access;

- a list of the personal data processed and the source of their receipt;

- The processing time of personal data, including storage time;

- The processing time of personal data, including storage time;

- Information on the legal consequences for the data subject related to the processing of personal data.

5.2.3. To require notification by the Employer of all persons to whom incorrect or incomplete personal data has previously been communicated, of any exceptions, corrections or additions made in them.

To appeal to the competent authority for the protection of the rights of subjects of personal data or in judicial procedure against unlawful actions or omissions of the employer in the processing and protection of his personal data.