English translation of the Russian policy dated 1 March 2024, provided for reference. Read the Russian original.
PRIVACY POLICY (USER DATA) /revision dated 1 March 2024/.
Approved by Order dated 1 March 2024.
General Director A. S. Nikitina.
Saint Petersburg, 1 March 2024.
Terms and definitions
Automated processing of personal data means processing personal data using computer technology.
A personal data information system is the combination of personal data contained in databases and the information technologies and technical means used to process that data.
Processing of personal data means any action or set of actions performed on personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (dissemination, provision or access), anonymisation, blocking, deletion and destruction.
Personal data means any information relating directly or indirectly to an identified or identifiable individual (data subject).
A data subject is an individual, individual entrepreneur or representative of a legal entity who has entered into a civil-law contract with the Controller for work or services within the Controller's activities, as well as the Controller's employees, employees of its counterparties and other individuals.
General provisions
Purpose of this document. This personal data policy of TWIG MODEL GROUP LIMITED LIABILITY COMPANY (TMG LLC), INN 7806267852, OGRN 1177847152174, registered address: Premises 42-N, Building 1, 21 Sotsialisticheskaya Street, Vladimirsky Municipal District, Saint Petersburg, 191119, Russia (the Policy), has been developed pursuant to paragraph 2 of Article 18.1 of Federal Law No. 152 of 27 July 2006, On Personal Data. It sets out the policy of TMG LLC (the Controller) regarding information about data subjects that the Controller may process when carrying out the activities specified in its Articles of Association.
Legislative references
Federal Law No. 149 of 27 July 2006, On Information, Information Technologies and Information Protection.
Federal Law No. 152 of 27 July 2006, On Personal Data.
Federal Law No. 242-FZ of 21 July 2014, On Amendments to Certain Legislative Acts of the Russian Federation Concerning Clarification of the Procedure for Processing Personal Data in Information and Telecommunications Networks.
Scope
This Policy applies to all of the Controller's processes involving personal data, whether automated, including within information and telecommunications networks, or non-automated. Use of the Controller's services signifies the data subject's agreement with this Policy and its conditions for processing their personal data.
Approval and revision
This Policy takes effect upon approval by the General Director and remains in effect indefinitely until replaced by a new Policy. Unrestricted access is provided by publishing it on the Controller's website or by other means.
Personal data processed by the Controller
The Controller observes the following principles and conditions when organising personal data processing:
personal data is processed on a lawful and fair basis;
processing is limited to specific, predetermined and lawful purposes;
databases containing personal data processed for mutually incompatible purposes must not be combined;
only personal data relevant to the purposes of processing may be processed;
personal data must be accurate, sufficient and up to date in relation to the purposes of processing;
the content and volume of the personal data processed must correspond to the stated purposes;
personal data must be destroyed or anonymised once the purposes of processing have been achieved or the need to achieve them no longer exists.
The Controller assumes that data subjects provide accurate and reliable information and inform the Controller's representatives of changes to their personal data during their dealings with the Controller.
Purposes of collecting and processing personal data
The Controller processes only the personal data required to fulfil contractual obligations, including agreements and contracts with data subjects and obligations to counterparties and employees; to conduct its general business activities; and to comply with Russian law.
The Controller processes personal data relating to the following categories of data subjects:
individuals who are employees of the Controller;
individuals;
individuals who are employees of the Controller's counterparties, and individuals who are counterparties of the Controller;
other individuals.
The Controller's purposes for processing personal data are:
managing the Controller's document workflow;
entering into contracts or agreements with counterparties or principals;
recruiting candidates for positions;
fulfilling employment contract obligations and dealing with the Controller's agents and counterparties;
fulfilling the terms of offer-based and bilateral contracts with the Controller's counterparties;
fulfilling agreements with principals and other contracts, and accounting;
HR administration;
payroll, accounting and tax records, and preparation of reports;
publishing information about the Controller and using the Controller's software;
other actions related to the Controller's activities under its Articles of Association.
Conditions for processing personal data and transferring it to third parties
The Controller processes and stores personal data in accordance with internal regulations developed under Russian law. It ensures the confidentiality, integrity and availability of personal data. Personal data is transferred to third parties to fulfil contractual obligations only with the data subject's consent. In the event of a reorganisation, sale or other transfer of all or part of the Controller's business, all obligations under this Policy relating to the personal data received pass to the acquiring party.
The Controller may instruct another person to process personal data subject to the following conditions:
the data subject has consented to the processing being entrusted to another person;
processing is entrusted under a contract with that person, drawn up with regard to Federal Law No. 152 of 27 July 2006, On Personal Data.
A person processing personal data on the Controller's behalf must observe the principles and rules of personal data processing and is liable to the Controller. The Controller is liable to the data subject for the actions of the authorised person entrusted with processing. The Controller follows Federal Law No. 152 of 27 July 2006, On Personal Data, when processing data subjects' personal data.
Data subjects' rights to access and amend their personal data
To safeguard data subjects' statutory rights, the Controller has developed and introduced a procedure for handling enquiries and requests and providing data subjects with the information required by law.
This procedure safeguards the following rights of the Controller's data subjects:
the right to receive information about the processing of their personal data, including:
confirmation that personal data is being processed, and the legal grounds and purposes of processing;
the purposes and methods of processing used by the Controller;
the Controller's name and location, and information about persons other than its employees who have access to personal data or to whom personal data may be disclosed under a contract with the Controller or federal law;
the personal data being processed about the relevant data subject and its source, unless federal law provides a different procedure for providing such data;
the periods for processing personal data, including storage periods;
the procedure for exercising data subjects' rights under the Federal Law;
information about completed or intended cross-border transfers, and the name or full personal name and address of a person processing personal data on the Controller's behalf, where processing has been or will be entrusted to that person;
other information required by Federal Law No. 152-FZ of 27 July 2006, On Personal Data, or other federal laws.
the right to have personal data clarified, blocked or destroyed where it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purposes of processing.
Obligations of the Controller
Under Federal Law No. 152-FZ, On Personal Data, the Controller must:
process personal data in accordance with the principles and rules set out in Federal Law No. 152-FZ, On Personal Data;
not disclose personal data to third parties or disseminate it without the data subject's consent, unless Federal Law No. 152-FZ, On Personal Data, provides otherwise;
provide evidence that the data subject's consent has been obtained, or evidence of grounds on which consent is not required;
process personal data only with the data subject's written consent in the cases specified by Federal Law No. 152-FZ, On Personal Data;
provide information about the processing of personal data at the data subject's request, or lawfully refuse to provide it and issue a reasoned written response citing the provisions of Federal Law No. 152-FZ, On Personal Data, that justify the refusal, within thirty days of an enquiry or request from the data subject or their representative. On an enquiry or receipt of a request, provide the data subject or their representative with information about processing and an opportunity to inspect the personal data, either at the time of the enquiry or within thirty days of receiving the request.
explain the legal consequences of refusing to provide personal data where its provision is mandatory under federal law;
take, or ensure the taking of, necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions. The measures are described in section 7 of this Policy;
at the data subject's request, amend or destroy personal data that is incomplete, inaccurate, outdated, unlawfully obtained or unnecessary for the stated purpose within seven working days after the data subject or representative provides evidence of those circumstances; notify them of the amendments and measures taken; and take reasonable steps to notify third parties to whom the personal data was transferred. Maintain a log recording data subjects' requests for personal data and the provision of personal data in response;
notify the data subject of processing when personal data was obtained from someone other than the data subject, except in the following cases:
the data subject has been informed that the Controller is processing their personal data;
the Controller obtained the personal data under federal law or in connection with performing a contract to which the data subject is a party, beneficiary or guarantor;
the data subject made the personal data publicly available or it was obtained from a publicly available source;
the Controller processes personal data for statistical or other research purposes, professional journalism, or scientific, literary or other creative activities, provided this does not infringe the data subject's rights and legitimate interests;
providing the data subject with the information contained in the Personal Data Processing Notice would infringe third parties' rights and legitimate interests;
where unlawful processing or inaccurate personal data is identified, remedy the violations in accordance with the procedure and time limits specified in parts 1–3 and 6 of Federal Law No. 152-FZ, On Personal Data;
once the purposes of processing have been achieved, cease processing immediately and destroy the relevant personal data within thirty days, unless otherwise provided by a contract to which the data subject is a party, beneficiary or guarantor, or by another agreement between the Controller and the data subject, or unless the Controller is entitled to process the data without consent under Federal Law No. 152-FZ, On Personal Data, or other federal laws;
when the data subject withdraws consent, cease processing and destroy the personal data within thirty days of receipt of the withdrawal, unless an agreement between the Controller and the data subject provides otherwise. The Controller must notify the data subject of the destruction;
immediately cease processing upon a data subject's request to stop the processing of personal data for the promotion of goods, works or services.
Personal data protection measures
The Controller takes necessary and sufficient organisational and technical measures to protect data subjects' personal data against unlawful or accidental access, destruction, alteration, blocking, copying, dissemination and other unlawful third-party actions.
The Controller uses the following methods and measures to ensure personal data security:
security threats to personal data processed in personal data information systems have been identified;
organisational and technical security measures are applied to personal data information systems as required to meet the personal data protection levels established by the Government of the Russian Federation;
information security tools that have undergone the prescribed conformity assessment are used;
the effectiveness of personal data security measures has been assessed before the personal data information system was put into operation;
computer media containing personal data are recorded and accounted for;
arrangements are in place to detect unauthorised access to personal data and respond to identified violations;
personal data altered or destroyed through unauthorised access is restored;
rules governing access to personal data in personal data information systems have been established, and all actions involving personal data in those systems are logged and recorded;
the measures taken to ensure personal data security and the protection level of personal data processed in personal data information systems are monitored.
Deletion of personal data
A person whose personal data has been processed in any way by TMG LLC may submit a freely worded written request asking TMG LLC to delete or destroy that personal data. The data will be deleted no later than ten calendar days after receipt of the request. The original paper request must be submitted to the legal entity's registered address.
Company and contact details
TWIG MODEL GROUP LIMITED LIABILITY COMPANY (TMG LLC). Registered address: Premises 42-N, Building 1, 21 Sotsialisticheskaya Street, Vladimirsky Municipal District, Saint Petersburg, 191119, Russia. OGRN 1177847152174. INN 7806267852. KPP 784001001. OKVED 73.11. General Director __________________ / Aleksandra Sergeyevna Nikitina / Company seal.