This policy for the processing of personal data in ZAVOD GORELTEX CO. LTD. (hereinafter referred to as the Policy) defines the basic principles, objectives, conditions and methods of processing personal data, lists of subjects and personal data processed in ZAVOD GORELTEX CO. LTD. (hereinafter referred to as the “organization”, “operator”), the functions of the organization in processing personal data, the rights of personal data subjects, as well as the requirements for the protection of personal data implemented in the organization.

In compliance with the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this policy is published in the public domain on the operator’s website.

Document designation	Document Title
GOST R ISO 9001-2015 (ISO 9001:2015)	Quality Management Systems. Requirements
STO Gazprom 9001-2018	Gazprom PJSC Management System. Requirements
GOST R ISO 14001-2016 (ISO 14001:2015)	Environmental Management Systems: Requirements and Guidance for Use
GOST R ISO 45001-2020 (ISO 45001:2018)	Occupational Health and Safety Management Systems – Requirements and Guidelines for Use
GOST RV 0015-002-2020	Product Development and Production Systems. Military Equipment. Quality Management Systems. General Requirements
ISO/IEC 80079-34:2018	Explosive atmospheres. Part 34: Application of quality systems to equipment manufacturing
GOST R 56404-2021	Lean Manufacturing: Requirements for Management Systems
Federal Law of December 30, 2001 No. 197-FZ	Labor Code of the Russian Federation
Federal Law of July 27, 2006 No. 152-FZ	About personal data
Decree of the President of the Russian Federation of March 6, 1997 No. 188	On approval of the List of confidential information
Resolution of the Government of the Russian Federation of September 15, 2008 No. 687	On approval of the Regulation on the specifics of personal data processing carried out without the use of automation tools
Resolution of the Government of the Russian Federation of July 6, 2008 No. 512	On approval of requirements for tangible carriers of biometric personal data and technologies for storing such data outside of personal data information systems
Resolution of the Government of the Russian Federation of November 1, 2012 No. 1119	On approval of requirements for the protection of personal data when processing them in personal data information systems
Order of the Federal Service for Technical and Export Control of Russia No. 55, the Federal Security Service of Russia No. 86, and the Ministry of Communications of Russia No. 20 of February 13, 2008.	On approval of the Procedure for the classification of personal data information systems
Order of the Federal Service for Technical and Export Control of Russia dated February 18, 2013, No. 21	On approval of the composition and content of organizational and technical measures to ensure the security of personal data when processing them in personal data information systems
Order of Roskomnadzor dated September 5, 2013 No. 996	On approval of requirements and methods for depersonalization of personal data

Term	Definition
Personal data (PD)	any information relating to a directly or indirectly identified or identifiable natural person (subject of personal data).
Personal data permitted for distribution by the personal data subject	personal data, access to which is granted to an unlimited number of persons by the subject of personal data by giving consent to the processing of personal data, permitted by the subject of personal data for distribution
Personal data operator (operator)	a state body, a municipal body, a legal entity or an individual, independently or jointly with other persons, organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data
Processing of personal data	Any action (operation) or set of actions (operations) with personal data, performed with or without the use of automated tools. Processing of personal data includes, but is not limited to: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data
Automated processing of personal data	processing of personal data using computer technology
Provision of personal data	actions aimed at disclosing personal data to a specific person or a specific group of persons
Dissemination of personal data	actions aimed at disclosing personal data to an indefinite number of persons
Blocking personal data	temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify personal data)
Destruction of personal data	actions that make it impossible to restore the content of personal data in the personal data information system and (or) that result in the destruction of tangible media of personal data
Depersonalization of personal data	actions that make it impossible to determine the ownership of personal data by a specific subject of personal data without the use of additional information
Personal data information system	a set of personal data contained in databases and the information technologies and technical means that ensure their processing
Cross-border transfer of personal data	transfer of personal data to the territory of a foreign state to a foreign government body, a foreign individual or a foreign legal entity
Protection of personal data	activities aimed at preventing the leakage of protected personal data, unauthorized and unintentional impacts on protected personal data

1. The policy is a local regulatory act of the organization, developed in compliance with the requirements of paragraph 2 of part 1 of article 18.1 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" (hereinafter referred to as the Law on Personal Data) in order to ensure the protection of the rights and freedoms of an individual and citizen when processing his personal data, including the protection of the rights to privacy, personal and family secrets.
2. The policy applies to all personal data processed by the organization.
3. The policy applies to relationships in the field of personal data processing that arose with the operator both before and after the approval of this policy.
4. The provisions of the policy serve as the basis for the development of local regulations governing the processing of personal data of the organization's employees and other personal data subjects.
5. In compliance with the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in the public domain on the operator’s website on the Internet information and telecommunications network.

4.1 The operator processes the personal data of the organization's employees and other subjects of personal data who are not in an employment relationship with the organization.

4.2 The processing of personal data in the organization is carried out taking into account the need to ensure the protection of the rights and freedoms of the organization's employees and other subjects of personal data, including the protection of the right to privacy, personal and family secrets, based on the following principles:

• the processing of personal data is carried out in the organization on a lawful and fair basis;
• the processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes;
• Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted;
• It is not permitted to combine databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
• Only personal data that meet the purposes of their processing are subject to processing;
• The content and volume of personal data processed correspond to the stated purposes of processing. Excessive amounts of processed personal data in relation to the stated purposes of processing are not permitted;
• When processing personal data, the accuracy, sufficiency, and, where necessary, relevance of the personal data in relation to the purposes of processing the personal data are ensured. The organization takes the necessary measures or ensures their implementation to delete or clarify incomplete or inaccurate personal data;
• Personal data is stored in a form (printed/electronic) that allows the identification of the subject of personal data, for no longer than is required for the purposes of processing personal data, unless the storage period for personal data is established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor;
• Processed personal data are destroyed or anonymized upon achieving the processing purposes or in the event of loss of the need to achieve these purposes, unless otherwise provided by federal law.

4.3 Only personal data that meets the purposes for which it is processed is subject to processing. The operator processes personal data for the following purposes:

• ensuring compliance with the Constitution of the Russian Federation, legislative and other regulatory legal acts of the Russian Federation, and local regulatory acts of the organization;
• exercise of the functions, powers and duties imposed by the legislation of the Russian Federation on the organization, including the provision of personal data to government bodies, the Pension Fund of the Russian Federation, the Social Insurance Fund of the Russian Federation, the Federal Compulsory Medical Insurance Fund, as well as other government bodies;
• organizing the registration of employees for individual (personalized) records in the compulsory pension insurance system;
• attracting and selecting candidates to work for the operator;
• accounting;
• personnel records management;
• assistance in employment, education and career advancement, ensuring personal safety, monitoring the quantity and quality of work performed, ensuring the safety of property;
• providing employees of the organization with additional guarantees and compensation, including voluntary health insurance, medical care, taxi and mobile communication services, and other types of social security;
• protection of life, health or other vital interests of personal data subjects;
• implementation of civil law relations;
• preparation, conclusion, execution and termination of contracts with counterparties;
• ensuring access control and internal security at the organization’s facilities;
• formation of reference materials for internal information support of the organization’s activities;
• completion and submission of required reporting forms to executive authorities and other authorized organizations;
• enforcement of judicial acts, acts of other bodies or officials subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings;
• the exercise of the rights and legitimate interests of the organization within the framework of the implementation of activities provided for by the Charter and other local regulatory acts of the organization, or third parties, or the achievement of socially significant goals;
• for other lawful purposes.

5.1 The Operator processes personal data of the following categories of subjects:

• individuals who are in an employment relationship with the organization;
• individuals who left the organization;
• employees of the organization's subsidiaries;
• individuals who are job candidates;
• individuals who are in civil law relations with the organization.

• data obtained during the implementation of labor relations;
• data obtained for the selection of job candidates;
• data obtained in the course of civil legal relations.

7.1 When processing personal data, the Operator:

• takes measures necessary and sufficient to ensure compliance with the requirements of the legislation of the Russian Federation and local regulations of the organization in the field of personal data;
• takes legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data;
• appoints the person(s) responsible for organizing the processing of personal data in the organization;
• issues local regulations defining the policy and issues of processing and protecting personal data in the organization;
• familiarizes the organization's employees directly involved in the processing of personal data with the provisions of the legislation of the Russian Federation and the organization's local regulations in the field of personal data, including the requirements for the protection of personal data;
• publishes or otherwise provides unrestricted access to this Policy;
• informs, in the prescribed manner, the subjects of personal data or their representatives of the availability of personal data related to the relevant subjects, provides the opportunity to become familiar with this personal data upon request and (or) receipt of requests from the said subjects of personal data or their representatives, unless otherwise established by the legislation of the Russian Federation;
• ceases processing and destroys personal data in cases stipulated by the legislation of the Russian Federation in the field of personal data;
• performs other actions provided for by the legislation of the Russian Federation in the field of personal data.

8.1 The processing of personal data is carried out by the operator in accordance with the requirements of the legislation of the Russian Federation.

8.2 The processing of personal data is carried out with the consent of the subjects of personal data to the processing of their personal data (Appendix 22 to STO-008), as well as without it in cases stipulated by the legislation of the Russian Federation.

8.3 Consent to the processing of personal data permitted by the subject of personal data for distribution is drawn up separately from other consents of the subject of personal data to the processing of his personal data.

8.4 Consent to the processing of personal data, permitted by the subject of personal data for distribution, may be provided to the operator:

• directly;
• using the information system of the authorized body for the protection of the rights of personal data subjects.

8.5 The operator carries out both automated and non-automated processing of personal data.

8.6 Only the operator's employees whose job responsibilities include processing personal data are allowed to process personal data.

8.7 The processing of personal data is carried out by:

• obtaining personal data in oral and written form directly with the consent of the subject of personal data to the processing or dissemination of his personal data;
• entering personal data into the operator’s logs, registers and information systems;
• use of other methods of processing personal data.

8.8 Disclosure to third parties and distribution of personal data without the consent of the personal data subject is prohibited, unless otherwise provided by federal law.

8.9 The transfer of personal data to inquiry and investigative bodies, the Federal Tax Service, the Social Fund, and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

8.10 The operator takes the necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including:

• identifies threats to the security of personal data during their processing;
• adopts local regulations and other documents governing relations in the field of processing and protection of personal data;
• appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the operator;
• creates the necessary conditions for working with personal data;
• organizes the registration of documents containing personal data;
• organizes work with information systems in which personal data is processed;
• stores personal data under conditions that ensure their safety and prevent unauthorized access to them;
• organizes training for the operator's employees who process personal data.

8.11 The operator stores personal data in a form that allows the identification of the subject of the personal data for no longer than is required for the purposes of processing the personal data, unless the storage period for personal data is established by federal law, contract or agreement.

8.12 When collecting personal data, including through the Internet information and telecommunications network, the operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, with the exception of cases specified in the law on personal data.

8.13 Storage of personal data

• 8.13.1 Personal data of subjects may be obtained, may undergo further processing and transferred for storage both on paper and in electronic form.
• 8.13.2 Personal data recorded on paper media are stored in locked cabinets or in locked rooms with limited access rights.
• 8.13.3 Personal data of subjects processed using automation tools for different purposes are stored in different folders.
• 8.13.4 Storage and placement of documents containing personal data in open electronic catalogues (file sharing services) in the personal data information system (PDIS) is not permitted.
• 8.13.5 The storage of personal data in a form (printed, electronic) that allows the identification of the subject of personal data is carried out no longer than required by the purposes of their processing, and they are subject to destruction upon achievement of the purposes of processing or in the event of loss of the need to achieve them.

8.14 Destruction of personal data

• 8.14.1 Upon achieving the purposes of processing personal data, as well as in the event of the withdrawal of consent to their processing by the subject of personal data, personal data are subject to destruction if:
  • unless otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
  • the operator does not have the right to process personal data without the consent of the subject on the grounds provided for by the Law on Personal Data or other federal laws;
  • unless otherwise provided by another agreement between the operator and the personal data subject.
• 8.14.2 Documents (media) containing personal data are destroyed by burning, crushing (shredding), chemical decomposition, or transformation into a shapeless mass or powder. A shredder may be used for destroying paper documents.
• 8.14.3 Personal data on electronic media are destroyed by erasing or formatting the media.
• 8.14.4 The fact of destruction of personal data is confirmed by a documented act on the destruction of media.

8.15 Requests from subjects for access to personal data

• 8.15.1 Confirmation of the fact of processing personal data by the operator, the legal grounds and purposes of processing personal data, as well as other information specified in Part 7 of Article 14 of the Law on Personal Data, are provided by the operator to the personal data subject or his representative upon request or upon receipt of a request from the personal data subject or his representative.
  The information provided does not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosure of such personal data.
  The request must contain:
  • the number of the main document certifying the identity of the personal data subject or his representative, information on the date of issue of the said document and the issuing authority;
  • information confirming the participation of the personal data subject in relations with the operator (contract number, date of conclusion of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the operator;
  • signature of the personal data subject or his/her representative.
  The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
  If the personal data subject's request (appeal) does not contain all the necessary information in accordance with the requirements of the law on personal data, or the subject does not have the right to access the requested information, then a reasoned refusal will be sent to him.
  The right of a personal data subject to access their personal data may be limited in accordance with Part 8 of Article 14 of the Law on Personal Data, including if the personal data subject's access to their personal data violates the rights and legitimate interests of third parties.
• 8.15.2 If inaccurate personal data is discovered upon an application from a personal data subject or their representative, or at their request, or at the request of Roskomnadzor, the operator will block the personal data related to this personal data subject from the moment of such application or receipt of the said request for the duration of the verification, unless blocking the personal data violates the rights and legitimate interests of the personal data subject or third parties.
  If the fact of inaccuracy of personal data is confirmed, the operator, based on information provided by the personal data subject or their representative or Roskomnadzor, or other necessary documents, will clarify the personal data within seven business days from the date of submission of such information and unblock the personal data.
• 8.15.3 In the event of detection of unlawful processing of personal data upon an appeal (request) from the subject of personal data or his representative or Roskomnadzor, the operator shall block the unlawfully processed personal data related to this subject of personal data from the moment of such appeal or receipt of the request.

9.1 In accordance with the requirements of regulatory documents, the operator has created a personal data protection system (PDPS), consisting of legal, organizational, and technical protection subsystems.

9.2 The legal protection subsystem is a complex of legal, organizational, administrative and regulatory documents that ensure the creation, functioning and improvement of the legal protection subsystem.

9.3 The organizational security subsystem includes the organization of the management structure of the SPPD, the permit system, and the protection of information when working with employees, partners, and third parties.

9.4 The technical protection subsystem includes a set of technical, software, and hardware tools that ensure the protection of personal data.

9.5 The main measures to protect personal data used by the operator are:

• appointment of a person responsible for the processing of personal data, who will organize the processing of personal data, provide training and instructions, and internal control over the compliance of the institution and its employees with the requirements for the protection of personal data;
• identification of current threats to the security of personal data when processing them in the ISPD and development of measures and activities to protect personal data;
• development of a policy regarding the processing of personal data;
• establishing rules for access to personal data processed in the ISPD, as well as ensuring the registration and accounting of all actions performed with personal data in the ISPD;
• establishing individual passwords for employee access to the information system in accordance with their work responsibilities;
• application of information security tools that have undergone the compliance assessment procedure in accordance with the established procedure;
• certified antivirus software with regularly updated databases;
• compliance with conditions that ensure the safety of personal data and prevent unauthorized access to it;
• detection of unauthorized access to personal data and taking measures;
• restoration of personal data modified or destroyed due to unauthorized access;
• training of the operator's employees directly involved in the processing of personal data in the provisions of the Russian Federation legislation on personal data, including requirements for the protection of personal data, documents defining the operator's policy regarding the processing of personal data, and local regulations on the processing of personal data;
• implementation of internal control and audit in accordance with STO-004.

10.1 Personal data subjects have the right to:

• full information about their personal data processed by the operator;
• access to their personal data, including the right to receive a copy of any record containing their personal data, except in cases provided for by federal law;
• clarification of your personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;
• revocation of consent to the processing of personal data;
• taking measures provided by law to protect one’s rights;
• exercise of other rights provided for by the legislation of the Russian Federation.

10.2 Personal data subjects have the right to access the following information:

• confirmation of the fact of processing personal data by the operator;
• legal grounds and purposes of processing personal data;
• methods of processing personal data used by the operator;
• the name and location of the operator, information about persons (except for the operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the operator or on the basis of federal law;
• the terms of processing personal data, including the terms of their storage;
• the procedure for the exercise by the subject of personal data of the rights provided for by this Federal Law;
• the name or surname, first name, patronymic and address of the person processing personal data on behalf of the operator, if the processing is or will be entrusted to such person;
• contacting the operator and sending him requests;
• appeal against the actions or inactions of the operator.

10.3 Operator's responsibilities

The operator is obliged to:

• when collecting personal data, provide information on the processing of personal data;
• in cases where personal data was not received from the subject of personal data, notify the subject;
• in case of refusal to provide personal data, explain to the subject the consequences of such refusal;
• publish or otherwise provide unrestricted access to the document defining its policy regarding the processing of personal data, to information on the implemented requirements for the protection of personal data;
• take the necessary legal, organizational and technical measures or ensure their adoption to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data;
• provide responses to requests and appeals from personal data subjects, their representatives and the authorized body for the protection of the rights of personal data subjects.

11.1 The measures necessary and sufficient to ensure that ZAVOD GORELTEX CO. LTD. fulfills its obligations under the legislation of the Russian Federation in the field of personal data include:

• appointment of a person(s) responsible for organizing the processing of personal data at ZAVOD GORELTEX CO. LTD.;
• adoption of local regulations and other documents in the field of processing and protection of personal data;
• organizing training and conducting methodological work with employees of structural divisions occupying positions included in the list of positions of structural divisions of ZAVOD GORELTEX CO. LTD., during the replacement of which personal data is processed;
• obtaining consent from personal data subjects for the processing of their personal data, except in cases stipulated by the legislation of the Russian Federation;
• separation of personal data processed without the use of automation tools from other information, in particular by recording them on separate tangible personal data carriers in special sections;
• ensuring separate storage of personal data and their tangible media, the processing of which is carried out for different purposes and which contain different categories of personal data;
• establishing a ban on the transfer of personal data via open communication channels, computer networks outside the protected or controlled communication channels of the Internet without the application of measures established at ZAVOD GORELTEX CO. LTD. to ensure the security of personal data (with the exception of publicly available and (or) anonymized personal data);
• storage of tangible media containing personal data in compliance with conditions that ensure the safety of personal data and prevent unauthorized access to them;
• implementation of internal control over the compliance of personal data processing with the Federal Law "On Personal Data" and regulatory legal acts adopted in accordance with it, requirements for the protection of personal data, this Policy, local regulations of ZAVOD GORELTEX CO. LTD.;
• other measures provided for by the legislation of the Russian Federation in the field of personal data.

11.2 Measures to ensure the security of personal data when processed in personal data information systems are established in accordance with local regulations of ZAVOD GORELTEX CO. LTD., governing issues of ensuring the security of personal data when processed in ZAVOD GORELTEX CO. LTD. personal data information systems.

12.1 Monitoring of compliance by the structural divisions of ZAVOD GORELTEX CO. LTD. with the legislation of the Russian Federation and local regulations of ZAVOD GORELTEX CO. LTD. in the field of personal data, including requirements for the protection of personal data, is carried out in order to verify compliance of the processing of personal data in the structural divisions of ZAVOD GORELTEX CO. LTD. with the legislation of the Russian Federation and local regulations of ZAVOD GORELTEX CO. LTD. in the field of personal data, including requirements for the protection of personal data, as well as the measures taken aimed at preventing and detecting violations of the legislation of the Russian Federation in the field of personal data, identifying possible leakage channels and unauthorized access to personal data, and eliminating the consequences of such violations.

12.2 Internal control over compliance by structural divisions of ZAVOD GORELTEX CO. LTD. with the legislation of the Russian Federation and local regulations of ZAVOD GORELTEX CO. LTD. in the field of personal data, including requirements for the protection of personal data, is carried out by the person (persons) responsible for organizing the processing of personal data in ZAVOD GORELTEX CO. LTD..

12.3 Personal responsibility for compliance with the requirements of the legislation of the Russian Federation and local regulations of ZAVOD GORELTEX CO. LTD. in the field of personal data in the structural divisions of ZAVOD GORELTEX CO. LTD., as well as for ensuring the confidentiality and security of personal data, rests with the heads of the relevant structural divisions.