Personal Data Processing POLICY

1. GENERAL TERMS 

1.1. Ingrediens Joint-Stock Company located at 15, Moskovskaya St., Naro-Fominsk city, Naro-Fominsky district, Moscow region, Russia with Tax ID 5030090699, OGRN 1175074004038 (hereinafter referred to as “Operator”) has compiled this Policy guided by Сlause 2 of Article 18.1 of the Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” in order to execute the federal law regarding individuals’ personal data processing and to comply with the principles of legality, fairness and confidentiality of the process of third parties personal data processing and to ensure the security of that process.

1.2. Main terms used in the Policy:

personal data - any information relating directly or indirectly to the certain or determined individual (personal data owner);

operator - Ingrediens Joint-Stock Company located at the address: 15, Moskovskaya St., Naro-Fominsk city, Naro-Fominsky district, Moscow region, Russia with Tax ID 5030090699, OGRN 1175074004038;

personal data owner - any individual providing to the Operator its personal data in order to be processed by the Operator;

personal data processing - any action (operation) or a set of actions (operations) with personal data performed by using automation tools or without use of such tools, including collection, recording, systematization, accumulation, storage, refinement (update, amendment), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, eliminating, destruction of personal data.

1.3. This policy is a publicly available document declaring conceptual framework of Operator’s personal data processing activities. This Policy is a local regulatory act of the Operator and is approved to protect the personal data of third parties from unauthorized use.

1.4. This Policy governs the procedure of receiving, processing, organizing, storing, using, transferring and disclosing personal data of third parties and is fully applicable to all processed personal data of third parties as indicated in the Policy.

1.5. This Policy concerns the information obtained, including (but not exclusively) through the Operator’s Internet Website containing the link to this Policy (hereinafter referred to as the “Website”), from third parties who have viWebsited the Website, in particular, the owners and potential buyers of the products sold by the Operator (or employees of such buyers in case the buyer is a legal entity).

1.6. Third parties expressly agree to their personal data processing as described in this Policy. Use of the Website means that the Website visitor expressly consents to the Policy and the indicated terms of information processing. The Website Visitor should not use the Website if he does not agree with the terms of the Policy.

1.7. Basic rights of the personal data owner:

1.7.1. The personal data owner has right, basing on the relevant request executed in the manner and form established by applicable law, to receive information concerning his personal data processing including:

– confirmation of the personal data processing by the Operator;

– legal grounds and purpose of personal data processing;

– the purposes and methods of personal data processing applied by the Operator;

– name and location of the Operator, information about the people having access to personal data (except Operator’s employees) or having capability to disclose personal data according to the agreement with the Operator or Federal Law;

– personal data processing period, including storage period;

– the procedure of execution by the personal data owner the rights provided for by the Federal Law No. 152-FZ dated 27 July 2006 “On personal data”;

- information on completed or intended cross-border data transfer;

– name or surname, name, patronym and address of the person/entity processing personal data on behalf of the Operator, if processing is entrusted to or will be entrusted to such person/entity;

- other information stipulated by Federal Law No. 152-ФЗ dated 27 July 2006. "On personal data" or by other Federal Laws.

1.7.2. The personal data owner has the right to contact and send requests to the Operator.

1.7.3. The personal data owner has right to appeal against the actions or omissions of the Operator to the authorized body protecting the rights of personal data owners or to the court.

1.7.4. The personal data owner has right to require from the Operator to specify the personal data, to block or delete it if the personal data is incomplete, outdated, inaccurate, illegally obtained or not required for the declared processing purpose, as well as to take measures provided by law to protect its rights.

1.8. Operator Responsibilities:

1.8.1. When collecting personal data, the Operator is obliged to provide to the personal data owner upon inquiry (request) the information mentioned in the Clause 1.7.1 of this Policy, except the cases, when according to the law, the Operator is exempted from the obligation to provide the specified information to the personal data owner.

1.8.2. In case personal data provision is mandatory according to the Federal Law, the Operator is obliged to explain to the personal data owner the legal consequences of refusing to provide its personal data.

1.8.3. In case personal data was not received from the personal data owner, the Operator is obliged to provide to the personal data owner the information on Personal Data Operator, the processing purposes, the intended personal data users, the rights of the personal data owner, the sources of personal data, except the cases when according to the law, the Operator is exempted from the obligation to provide the specified information to the personal data owner.

1.8.4. When collecting personal data, including through Internet network, the Operator is obliged to ensure recording, systematization, accumulation, storage, refinement (update, change), extraction of personal data of citizens of the Russian Federation using databases located in the Russian Federation, except special cases specified by law.

1.8.5. The Operator is also obliged to take necessary and sufficient legal, organizational and technical measures or to ensure their fulfillment to protect personal data from unlawful or accidental access to them, destruction, alteration, blocking, copying, provision, dissemination of personal data, as well as from other illegal actions in relation to personal data.

1.8.6. The Operator is also obliged to publish or otherwise provide unrestricted access to the document defining the personal data processing policy of the Operator and to the information on the implemented personal data protection requirements.

1.8.7. The Operator is also obliged to give answers to the inquiries and requests of personal data owners, their representatives and the body authorized to protect personal data owners’ rights.

1.8.8. The Operator is also obliged to block, clarify, destroy, terminate the processing of personal data in special cases stipulated by law

 

2. PURPOSE OF PERSONAL DATA COLLECTION 

2.1. The Operator processes personal data for the following purposes:

2.1.1. Communication with the visitors of the Operator's Website i.e. personal data owners, including, but only by means of sending notifications, responses to inquiries (questions) of Website visitors, or any other information relating to the activities of the Operator.

2.1.2. Informing visitors of the Operator’s Website i.e. personal data owners on the Operator’s activities, including the products sold by the Operator, the terms of product supply, Operator’s partners.

2.1.3. Conducting statistical and other studies based on anonymized data.

2.1.4 Improving the quality of the Operator’s Website, its usability.

2.1.5. Conclusion and fulfillment of obligations under labor contracts, civil law contracts, supply contracts with counterparties.

2.1.6. Advertising.

2.1.7. For internal purposes of the Operator, including information analysis, auditing, forming a base of frequently asked questions on the Website and publishing general answers, developing and improving Operator’s activities.

2.1.8. For the purposes specified in the relevant application/request/letter received from the Website visitor, i.e. the personal data owner.

2.2. Filling out the appropriate form on the Operator’s Website means the unconditional consent of the personal data owner with the goals and conditions of Website visitor personal data processing specified in this Policy.

 

3. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING  

3.1. The legal grounds for the personal data processing by the Operator include the following legal acts, other documents, pursuant to and in accordance with the Operator processes personal data:

- The Constitution of the Russian Federation;

- Labor Code of the Russian Federation;

- Civil Code of the Russian Federation;

- Federal Law No. 160-FZ of December 19, 2005 “On Ratification of the Convention of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data”;

- Federal Law No. 149-FZ dated July 27, 2006 “On Information, Information Technologies and Information Protection”;

- Federal Law No. 38-FZ of March 13, 2006, on Advertising;

- statutory documents of the Operator;

- contracts concluded between the Operator and the personal data owner;

- Consent to personal data processing (for the cases not expressly provided by the legislation of the Russian Federation, but within the capability of the Operator).

 

4. PERSONAL DATA VOLUME AND CATEGORIES, CATEGORIES OF PERSONAL DATA OWNERS

4.1. The Operator collects, accesses and uses, for the purposes defined by the Policy, the personal data of visitors of the Operator’s Website, technical and other information related to the Website visitors, particularly through the Website.

4.2. For the purpose of due feedback, the Operator processes the personal data of the Website visitors in the following content and scope: last name, first name, patronymic; contact number; E-mail address.

At its own discretion, the Website visitor can provide to the Operator other personal information conforming purposes specified in Section 2 of this Policy (date of birth, place of residence, other information). This information can be provided not only by filling out the form on the Operator’s Website, but also by sending it to the email address or postal address of the Operator.

4.3. The operator can also process the data being publicly available by personal data owner, or being subject to publication or mandatory disclosure according to the law.

4.4. The operator does not verify the accuracy of personal information provided by the personal data owner, and does not have the ability to assess its legal capability. However, the Operator assumes that the subject of personal data provides reliable and sufficient personal information about itself and keeps this information up to date.

4.5. Technical information is not personal data. The Operator uses cookies to identify the Website visitor. Cookies are text files available for the Operator for the purpose of processing information on Operator’s activity, including information on the web pages visited by the visitor and the time the Website visitor spent on the page. Website visitors can disable the use of cookies in their browser settings.

4.6. Also, technical information refers to the information being automatically transmitted to the Operator in the process of using the Operator's Website through the software installed on the device of the Visitor of the Website.

4.7. Categories of personal data owners:

4.7.1. Operator’s employees, former employees, candidates for vacant positions, as well as relatives of employees / candidates for vacant positions.

4.7.2. Clients and counterparties of the Operator (individual entrepreneurs, employees of Clients / Counterparties, being their representatives).

4.7.3. Any individuals completing the “Feedback” form on the Operator’s Website or sending documents and information containing personal data to the email address or postal address of the Operator.

 

5. PERSONAL DATA PROCESSING METHOD AND TERMS 

5.1. The Operator processes personal data of personal data owners by using automation tools or not and stores personal data in electronic form or in paper in a confidential manner.

5.2. The owner of personal data consents to the processing of its personal data by sending application (any written request containing personal data) or by separate consent to the processing of personal data in written or electronic form. When sending a request / question / inquiry from the Operator’s Website (by filling in the appropriate form at the Website), the personal data owner consents to the processing of its personal data and is obliged to read this Policy by following the appropriate link.

5.3. The operator performs the following actions with personal data of personal data owners: personal data processing, including recording, collecting, organizing, accumulating, storing, specifying (updating, changing), retrieving, using, transferring (distributing, providing, accessing), including cross-border transferring, depersonalization, blocking, removal, destruction.

5.4. With respect to the personal information of the personal data owner, its confidentiality is guaranteed, except the cases when personal data owner provides its personal information for open source access to the unlimited number of persons on free-will basis.

5.5. The Operator does not process biometric personal data (information specifying physiological and biological characteristics of the person and being the basis for personal identification).

5.6. The Operator does not perform processing of some personal data categories. i.e. race, nationality, political opinion, religious or philosophical beliefs, health, intimate life.

5.7. The operator may perform a cross-border transfer of personal data (on the territory of a foreign state, to the authority of a foreign state, a foreign individual or a foreign legal entity) in case the owner of the personal data agrees to such cross-border transfer and in compliance with applicable law.

5.8. The Operator has the right to transfer personal information of the personal data owner to third parties in case of prior consent of the personal data owner to such transfer, as well as in cases provided for by the legislation of the Russian Federation or this Policy.

5.9. The operator has the right to transfer personal data of the personal data owner without its prior consent to the following people:

• to third parties providing to the Operator or to the personal data owner such services as website hosting, data analysis, delivery of orders, IT services, customer service, e-mail services, auditing and other services requiring personal information of the personal data owner (access to the personal data of the personal data owners is being provided to such third parties only for the purpose of providing services);

• to third parties in the event of reorganization, merger, sale, assignment, transfer or other similar actions relating to the part of the business or to the whole business, assets or fixed capital of the Operator (including in connection with declaration of bankruptcy or similar procedures);

• affiliates of the Operator.

5.10. The operator also has the right to transfer personal data without the prior written consent of the personal data owner, in case personal data is required in accordance with mandatory laws of the Russian Federation; for the execution of mandatory judicial acts and requirements of the competent state bodies of the Russian Federation (investigative authorities, other authorized bodies).

5.11. The conditions for terminating of personal data processing are:

- achieving the goal of personal data processing;

- expiration of the consent for the personal data processing;

- withdrawal of the consent of the personal data owner to its personal data processing;

- revealing of the unlawful processing of personal data.

5.12. The periods of personal data storage are determined in accordance with the purposes of their collection and cannot be longer than personal data processing purposes require.

 

6. ACTUALIZATION, MANAGEMENT, REMOVAL AND DESTRUCTION OF PERSONAL DATA, RESPONSES TO THE PERSONAL DATA OWNERS REQUESTS FOR ACCESS TO THE PERSONAL DATA  

6.1. In case unlawful processing of personal data or inaccurate personal data is revealed, the Operator is obliged to carry out / ensure blocking of unlawfully processed / inaccurate personal data.

6.2. In case of confirmation of the fact of personal data inaccuracy on the basis of information provided by the personal data owner or its representative or by the authorized body for protection of personal data owners, or as per other essential documents, the Operator is obliged to clarify personal data or to ensure its clarification (if personal data is processed by another person acting according Operator’s instructions) within seven working days from the date of submitting of such information and to stop personal data blocking.

6.3. In case unlawful processing of personal data is revealed by the Operator or by the person acting on behalf of the Operator, the Operator is obliged to stop unlawful processing of personal data or to ensure the termination of unlawful personal data processing by the person acting on behalf of the Operator. If it is impossible to ensure the legality of the personal data processing, the Operator is obliged to destroy such personal data or ensure its destruction within the period not exceeding ten working days from the date of revealing of unlawful personal data processing.

6.4. If the goal of personal data processing is achieved, the Operator is obliged to stop personal data processing or to ensure its termination (if personal data is processed by another person acting on behalf of the Operator) and destroy personal data or ensure its destruction (if personal data is processed by another person acting on Operator’s instructions) within a period not exceeding thirty days from the date of achieving the goal of personal data processing, unless otherwise is stipulated by the contract being concluded with the personal data owner being the party, beneficiary or guarantor of such contract, or by another agreement between the Operator and the personal data owner.

6.5. In case of withdrawal of the consent to personal data processing by the personal data owner, the Operator is obliged to stop processing the data or to ensure the termination of such processing (if processing of personal data is carried out by another person acting on the instructions of the Operator) and in case the personal data keeping is not required for processing purposes any more, to destroy personal data or to ensure its destruction (if personal data processing is carried out by another person acting on the instructions of the Operator) within a period not exceeding thirty days from the date of receipt of the relevant request, unless otherwise is stipulated by the contract being concluded with the personal data owner being the party, beneficiary or guarantor of such contract, or by another agreement between the Operator and the personal data owner.

6.6. If it is not possible to destroy personal data during the period specified in clauses 6.3-6.5 of this Policy, the Operator will block such personal data or ensure its blocking (if the personal data is processed by another person acting on behalf of the Operator) and ensure personal data destruction within the period not exceeding six months, unless otherwise is stipulated by federal laws.

6.7. The information specified in clause 1.7.1 of this Policy is to be provided to the personal data owner or its representative by the Operator when required or upon receipt of a request from the personal data owner or its representative. The request should contain the number of the main document identifying the personal data owner or its representative, information on the issue date and the issuing authority of the document identifying the personal data, information confirming participation of the personal data owner in relations with the Operator (contract number, date of contract conclusion, conditional verbal legend and (or) other information), or information otherwise confirming the fact that the Operator has processed personal data, the signature of the personal data owner or its representative. The request may be sent in the form of the electronic document and signed with electronic signature according to the legislation of the Russian Federation.

6.8. In case the Operator provides information on the initial request, the second request may be made by the personal data owner or its representative not earlier than thirty days after the initial inquiry or request.

6.9. The Operator is obliged to inform the personal data owner or its representative on the availability of the personal data relating to the relevant personal data owner, as well as to provide the opportunity to get acquainted with this personal data upon request of the personal data owner or its representative within thirty days from the date of receipt of the request from the personal data owner or its representative.

6.10. In case of refusal to provide information on the availability of the personal data relating to the relevant personal data owner or in case of refusal to submit information on the available personal data to the personal data owner or its representative upon receipt of the relevant request, the Operator must give a written reasonable response containing reference to the provisions of the current legislation being the basis for such refusal within the period not exceeding thirty days from the date of the request of the personal data owner or its representative.

6.11. The operator is obliged to provide to the personal data owner or its representative the free of charge opportunity to get acquainted with personal data relating to the personal data owner. The Operator is obliged to make necessary changes to the personal data details within the period not exceeding seven working days from the date of submission by the personal data owner or its representative the information confirming that personal data is incomplete, inaccurate or irrelevant. The Operator is obliged to destroy personal data within the period not exceeding seven working days from the date of submission by the personal data owner or its representative the information confirming that the personal data has been illegally obtained or has not been required for the stated purpose of data processing. The Operator is obliged to notify the personal data owner or its representative of the changes and measures taken and to take reasonable measures to notify third parties to whom the personal data has been transferred.

6.12. The Operator is obliged to inform the authorized body for the protection of the rights of personal data owners upon request of this body for required information within thirty days from the date of receipt of such request.