Policy regarding the processing of personal data in LLC "DREAM"
1. General provisions1.1. This policy regarding the processing of personal data (hereinafter referred to as PD) at DREAM LLC (hereinafter referred to as the operator) (hereinafter referred to as the Policy) "in accordance with the requirements of Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data" (hereinafter referred to as the Law on Personal Data defines the purposes, content and the procedure for processing personal data, measures aimed at protecting personal data, as well as procedures aimed at detecting and preventing violations of the legislation of the Russian Federation in the field of personal data at DREAM LLC.
1.2. The Policy defines:
— the main issues related to the processing of PD by an Operator using automation tools, including in information and telecommunication networks, or without the use of such tools, if PD processing without the use of such tools corresponds to the nature of actions (operations) performed with PD using automation tools, that is, allows it to be carried out in accordance with a given algorithm search for PD recorded on a tangible medium and contained in card files or other systematized PD collections, and (or) access to such PD;
1.3. The purpose of this Policy is to implement the requirements of legislation in the field of personal data processing and protection and is aimed at ensuring the protection of human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy, personal, family.
2. Basic concepts2.1. The basic concepts used in this policy
2.1.1 PD — any information related directly or indirectly to a specific or identifiable natural person (PD subject);
2.1.2 Operator — a state body, municipal body, legal entity or individual who independently or jointly with other persons organize and (or) process PD, as well as determine the purposes of PD processing, the composition of PD to be processed, actions (operations) performed with PD;
2.1.3 PD processing — any action (operation) or set of actions (operations) performed with or without the use of automation tools with PD, including collection, recording, systematization, accumulation, storage, refinement (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data;
2.1.4 Automated PD processing — PD processing using computer technology;
2.1.5 Distribution of PD — actions aimed at disclosing PD to an unspecified group of people;
2.1.6 Providing PD — actions aimed at disclosing PD to a certain person or a certain circle of people;
2.1.7 Blocking of PD — temporary termination of PD processing (except in cases where processing is necessary to clarify PD);
2.1.8 Destruction of PD — actions as a result of which it becomes impossible to restore the content of PD in the PD information system and (or) as a result of which the material carriers of PD are destroyed;
2.1.9 Depersonalization of PD — actions that make it impossible to determine whether a PD belongs to a specific PD subject without using additional information;
2.1.10 Personal Data Information System (hereinafter referred to as ISPS) is a set of information technologies and technical means contained in databases and ensuring their processing;
2.1.11 Cross—border transfer of PD is the transfer of PD to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
2.1.12 Personal data subject — an individual whose data is being processed;
2.1.13 Confidentiality of personal data is a mandatory requirement for the operator and other persons who have access to personal data not to disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law.
2.2. The Operator processes personal data in order to:
— ensure compliance with the legislation of the Russian Federation in the field of healthcare;
— collection of statistical data of site visitors;
— processing preferences and statistics of visitors to the official
website.
3. The content and scope of personal data processed3.1. Categories of personal data subjects whose data is being processed:
— website visitors.
3.2. Collection of statistical data of website visitors
3.2.1. Categories of processed personal data:
— name ;
— email address;
— phone number.
3.2.2. Collection of the category of subjects whose PD is processed: site visitors.
3.2.3. Legal basis for PD processing: PD processing is carried out based on the consent of the legal representative.
3.2.4. List of actions with PD: collection, systematization, accumulation, storage, clarification (updating, modification), use, depersonalization, deletion.
3.2.5. Processing methods: mixed, with transmission over the internal network of a legal entity, with transmission over the Internet.
3.3. Processing preferences and statistics of visits to the official website
3.3.1. Processing of depersonalized data of visitors to the official website of LLC "DREAM" using the Yandex metric program. Yandex.Metrica (cookies) https://int.dream-sakhalin.com/
3.3.2. List of actions with depersonalized data: collection, recording, accumulation, storage, clarification (updating, modification), use, transfer (provision, access), deletion, destruction of depersonalized data.
3.3.3. Processing methods: Yandex.Metrica Internet statistics service
3.4. The storage of personal data of PD subjects is carried out in a form that makes it possible to identify the PD subject, no longer than required by the purposes of their processing in accordance with the retention periods determined by the legislation of the Russian Federation and the regulatory documents of LLC DREAM:
— the shelf life of PD included in the ISPs corresponds to the shelf life of paper originals.
3.5. The processed PD is subject to destruction or depersonalization upon achievement of the processing objectives or in case of loss of the need to achieve these objectives, unless otherwise provided by applicable law.
3.6. When processing PD, DREAM LLC takes necessary and sufficient legal, organizational and technical measures to protect PD from accidental or unlawful access to them, destruction, modification, blocking, copying, provision, distribution of PD, as well as from other illegal actions in relation to PD.
3.7. In case of detection of illegal PD processing at the request of the PD subject or his representative, or at the request of the PD subject or his representative, DREAM LLC blocks the unlawfully processed PD related to this PD subject, or ensures their blocking (if PD processing is carried out by another person acting on behalf of DREAM LLC) from the moment of such request or receipt of the specified request for the verification period. In case of detection of inaccurate PD when contacting the PD subject or its representative, or at their request, LLC DREAM blocks PD related to this PD subject, or ensures their blocking (if PD processing is carried out by another person acting on behalf of LLC DREAM) from the moment of such request or receipt of the specified request for the verification period, if blocking the PD does not violate the rights and legitimate interests of the PD subject or third parties.
3.13. In case of confirmation of the fact of inaccuracy of PD, LLC DREAM, based on information provided by the PD subject or his representative or other necessary documents, is obliged to clarify the PD or ensure their clarification (if PD processing is carried out by another person acting on behalf of LLC DREAM). within seven business days from the date of submission of such information, and remove the blocking of the PD.
3.14. In case of detection of illegal PD processing carried out by LLC DREAM or a person acting on behalf of LLC DREAM, LLC DREAM, within a period not exceeding three working days from the date of this detection, stops the illegal PD processing or ensures the termination of illegal PD processing by a person acting on behalf of LLC DREAM.". If it is impossible to ensure the legality of PD processing, DREAM LLC destroys such PD or ensures their destruction within a period not exceeding ten working days from the date of detection of illegal PD processing. DREAM LLC notifies the PD subject or its representative about the elimination of violations or the destruction of PD, and if the PD subject's appeal or his representative's request or the request of the authorized body for the protection of the rights of PD subjects were sent by the authorized body for the protection of the rights of PD subjects, it also notifies the specified body.
3.15. If the purpose of PD processing is achieved, DREAM LLC terminates PD processing or ensures its termination (if PD processing is carried out by another person acting on behalf of DREAM LLC) and destroys PD or ensures their destruction (if PD processing is carried out by another person acting on behalf of DREAM LLC) within a period not exceeding exceeding thirty days from the date of achievement of the PD processing goal, unless otherwise provided by an agreement to which the PD subject is a party, beneficiary or guarantor, or by another agreement between DREAM LLC and the PD subject, or if LLC DREAM is not entitled to process PD without the consent of the PD subject on the grounds provided for by federal laws.
3.16. Employees of DREAM LLC who are guilty of violating the requirements of the Federal Law "On Personal Data" and regulatory legal acts adopted in accordance with it, bear material, disciplinary, administrative, civil or criminal liability in accordance with the procedure established by the legislation of the Russian Federation.
4. Final provisions4.1. Unlimited access is provided to this Policy.
4.2. This Policy is subject to changes and additions in the event of new legislative acts and special regulatory documents on the processing and protection of personal data, but at least once every three years.
4.3. Control over the fulfillment of the requirements of this Policy is carried out by the person responsible for organizing the processing of PD LLC "DREAM".
4.4. The responsibility of DREAM LLC officials with access to PD for non-compliance with the requirements of the regulations governing the processing and protection of PD is determined in accordance with the legislation of the Russian Federation and the internal documents of DREAM LLC.