Policy on the Processing of Personal Data of Website Visitors

The protection of personal data of individuals is of great importance to JSC AVK (hereinafter referred to as AVK, we). This Policy on the Processing of Personal Data of Website Visitors (hereinafter referred to as the Policy) describes in detail what kind of information we collect in the course of interacting with website visitors and how such information is processed.

AVK processes the personal data of website visitors on lawful grounds in accordance with Part 1 of Article 6 of Federal Law No. 152-FZ “On Personal Data” on the basis of the data subject’s consent to the processing of personal data.

As a personal data operator, we have implemented numerous technical and organizational measures to ensure the highest possible level of protection of personal data. Nevertheless, if you do not wish to transmit your personal data via the Internet, you may choose alternative methods (for example, by visiting an AVK office in person).

The personal data of website visitors may be obtained by AVK directly from you, from your representative acting in your interests, or from the devices you use to access the website.

Principles of Personal Data Processing

When processing personal data, AVK adheres to the following principles:

  • processes personal data only on a lawful and fair basis;
  • determines specific lawful purposes prior to commencing the processing (including collection) of personal data;
  • collects only such personal data as are necessary and sufficient for the stated purpose of processing;
  • limits the processing of personal data to the achievement of specific, predetermined and lawful purposes;
  • destroys personal data upon achievement of the purposes of processing or when the need to achieve such purposes no longer exists (unless otherwise provided by an agreement with the data subject or by the legislation of the Russian Federation).

Conditions and Methods of Personal Data Processing at AVK

Personal data are processed by AVK only where there is an appropriate legal basis: on the basis of the data subject’s consent to the processing of their personal data, unless otherwise provided by the applicable legislation of the Russian Federation governing personal data.

AVK does not process biometric personal data or special categories of personal data of website visitors relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.

AVK does not use the personal data of data subjects to make decisions based solely on automated processing that produce legal consequences for the data subject or otherwise affect their rights and legitimate interests.

AVK processes health-related personal data only to the extent necessary to comply with the labor legislation of the Russian Federation.

AVK does not publish personal data in publicly available sources.

AVK does not disclose, transfer to third parties, or otherwise disseminate personal data without an appropriate legal basis. Whenever personal data are transferred to third parties, such parties are expressly informed of the confidential nature of the information being transferred.

AVK may entrust the processing of personal data to third parties with the consent of the data subject, unless otherwise provided by the legislation of the Russian Federation, on the basis of an agreement concluded with such persons (hereinafter referred to as an operator’s processing assignment).

Persons processing personal data under an agreement concluded with AVK (operator’s processing assignment) undertake to comply with the principles and requirements governing the processing and protection of personal data established by the legislation of the Russian Federation. For each such third party, the agreement specifies the list of actions (operations) to be performed with the personal data, the purposes of processing, the obligation to maintain confidentiality and ensure the security of personal data during processing, as well as the applicable requirements for the protection of personal data in accordance with the legislation of the Russian Federation.

Where AVK entrusts the processing of personal data to another person, AVK remains liable to the data subject for the actions of such person. The person processing personal data on behalf of AVK, acting under the operator’s assignment, shall be liable to AVK.

AVK processes personal data by the following methods:

  • using automation tools, including information technologies and technical means, such as computer equipment, information technology systems and networks, systems for the transmission, receipt and processing of personal data, software (operating systems, database management systems, etc.), and information security tools used in information systems;
  • without the use of automation tools.

The set of personal data processing operations performed by AVK in relation to website visitors includes collection, recording, systematization, accumulation, storage, updating (modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction of personal data.

Protection of Personal Data

AVK has implemented a comprehensive set of measures aimed at ensuring the security of personal data in the course of its management and operational activities.

For the protection of personal data, AVK has established the following measures:

  • appointment of a person responsible for organizing personal data processing and a person responsible for ensuring the security of personal data in information systems;
  • development and approval of internal regulations governing the processing and protection of personal data;
  • implementation of information security measures;
  • maintaining records of physical media containing personal data;
  • detection of unauthorized access to personal data and implementation of measures to prevent similar incidents in the future;
  • restoration of personal data modified or destroyed as a result of unauthorized access;
  • establishment of access rules for personal data processed within information systems, as well as logging and recording of all actions performed with personal data within such systems;
  • monitoring the effectiveness of measures taken to ensure the security of personal data and the level of protection of information systems;
  • assessment of the potential harm that may be caused to data subjects in the event of violations of applicable legislation, and evaluation of such harm against the measures implemented by AVK to ensure compliance with legal requirements;
  • ensuring conditions that prevent unauthorized access to physical media containing personal data and guarantee the preservation of such data;
  • familiarizing AVK employees directly involved in personal data processing with the applicable legislation on personal data, including personal data protection requirements and internal regulations governing the processing and protection of personal data;
  • establishing procedures for the destruction of information containing personal data;
  • conducting awareness activities among AVK employees to prevent threats to or loss of personal data;
  • maintaining access control procedures within AVK;
  • organizing security measures for AVK’s premises, buildings and facilities.

Rights and Obligations of AVK as a Personal Data Operator

AVK shall have the right to:

  • provide personal data to state authorities and other authorized bodies where required by the legislation of the Russian Federation (including tax authorities, law enforcement authorities, etc.);
  • refuse to provide personal data in the cases предусмотренных legislation of the Russian Federation;
  • process a data subject’s personal data without their consent in the cases provided for by the legislation of the Russian Federation.

AVK shall be obliged to:

  • provide data subjects, upon their request, with information relating to the processing of their personal data;
  • explain to data subjects the legal consequences of their refusal to provide AVK with their personal data where such provision is mandatory under the legislation of the Russian Federation;
  • where personal data are obtained not directly from the data subject, except in the cases provided for by Part 4 of Article 18 of Federal Law No. 152-FZ of July 27, 2006, provide the data subject, prior to the commencement of processing, with the following information:
    • the name or full name and address of the Operator or its representative;
    • the purpose and legal basis for the processing of personal data;
    • the intended recipients (users) of the personal data;
    • the rights of the data subject established by Federal Law No. 152-FZ of July 27, 2006;
    • the source from which the personal data were obtained;
  • when collecting personal data, including via the Internet, ensure the recording, systematization, accumulation, storage, updating (modification), retrieval of personal data of citizens of the Russian Federation using databases located within the territory of the Russian Federation, except in the cases specified in Clauses 2, 3, 4 and 8 of Part 1 of Article 6 of Federal Law No. 152-FZ of July 27, 2006.

Rights of the Personal Data Subject

If AVK processes your personal data on the basis of your consent¹ to such processing, you may withdraw your consent at any time.

You have the right to obtain information² regarding the processing of your personal data, to request its rectification or deletion³, to challenge the actions of AVK⁴, and to seek compensation for damages, including moral damages⁵.

To exercise your rights, please contact us.

¹ Withdrawal of Consent

If you withdraw your consent to the processing of personal data or terminate the Public Offer, we will be required to cease processing your personal data, provided there are no other legal grounds for such processing.

Your personal data, for the purposes of facilitating employment, are processed on the basis of the Public Offer accepted by you. The procedure for withdrawing your acceptance and terminating the Public Offer is set out in Section 6 of the Public Offer.

Applicants sometimes interpret refusal to the processing of personal data as a desire not to be considered for a particular vacancy or not to receive information from recruiters because they are not currently seeking employment. This is not an entirely correct interpretation of the law.

Such a step is advisable only where you are firmly convinced that AVK’s specialists will never be able to provide any benefit to you.

If you have an interesting job and do not intend to change it in the near future, there is no need to formally withdraw your consent to the processing of personal data or terminate the Public Offer. Instead, simply inform an AVK employee during your next contact that you do not wish to receive information about new vacancies for, for example, the next year. The AVK specialist will record your preference in the information system, and you will not be contacted until the specified period has expired.

If your decision to formally withdraw consent is based on dissatisfaction with the work of a particular AVK employee, this should not necessarily result in terminating your relationship with the company as a whole. We continuously strive to improve the qualifications of our employees, and your feedback is very important to us.

Please send your comments and suggestions regarding the quality of our work with applicants to info@avkavk.ru. Every such case will be reviewed individually, and appropriate corrective measures will be taken.

If you are unsure whether you should formally withdraw your consent, please contact info@avkavk.ru, where you will receive appropriate advice.

Should you nevertheless decide to withdraw your consent, you must submit to AVK a written withdrawal of consent to the processing of personal data bearing your personal signature.

² Right to Obtain Information

As a personal data subject, you have the right to obtain from AVK:

  • confirmation as to whether AVK processes your personal data;
  • information on the legal grounds for and purposes of the processing of your personal data;
  • information on the methods used by AVK to process personal data;
  • information on the name and location of AVK, as well as information on persons (other than AVK employees) who have access to your personal data or to whom your personal data may be disclosed pursuant to an agreement with AVK or in accordance with the legislation of the Russian Federation;
  • a list of the personal data relating to you that are being processed and information on the source from which such personal data were obtained, unless another procedure for providing such information is established by law;
  • information on the period during which your personal data will be processed, including the period of storage thereof;
  • information on any completed or intended cross-border transfer of personal data;
  • information on the procedure for exercising the rights of a personal data subject;
  • the surname, first name, patronymic (if applicable), or the name and address of the person processing personal data on behalf of AVK;
  • any other information provided for by the legislation of the Russian Federation.

If you wish to obtain such information, please send a scanned copy of your completed request to info@avkavk.ru.

A paper copy of the request may be submitted in person at any AVK office or sent by registered mail with acknowledgment of receipt.

As required by the personal data protection legislation, we will provide the requested information relating to the processing of your personal data within a period not exceeding thirty (30) days from the date of receipt of your written request.

³ Right to Rectification, Blocking or Erasure

You may request that your personal data be corrected if they are inaccurate, incomplete or outdated. If the personal data are inaccurate and AVK possesses the correct information, the personal data will be rectified.

You may also request the blocking or destruction of your personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purpose of processing.

If the inaccuracy or incompleteness of the personal data is confirmed, AVK shall notify all persons to whom the inaccurate or incomplete personal data were previously disclosed of any corrections, amendments or additions made thereto.

Please send a scanned copy of your completed request to info@avkavk.ru.

A paper copy of the request may be submitted in person at any AVK office or sent by registered mail with acknowledgment of receipt.

As required by the personal data protection legislation, within no more than seven (7) business days following completion of the verification of the submitted information, we will comply with your request or provide a reasoned refusal to do so.

⁴ Right to Lodge a Complaint

As a personal data subject, you have the right to challenge any unlawful actions or omissions of AVK in connection with the processing of your personal data before the competent authority for the protection of the rights of personal data subjects or in court.

Pursuant to Article 23 of Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006, the authorized body responsible for protecting the rights of personal data subjects in the Russian Federation is the federal executive authority exercising supervision and control in the field of information technology and communications.

At present, the competent authority responsible for protecting the rights of personal data subjects is the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), specifically its Department for the Protection of the Rights of Personal Data Subjects.

⁵ Right to Compensation

As a personal data subject, you have the right to protect your rights and legitimate interests, including the right to recover damages and/or obtain compensation for moral harm through judicial proceedings.