Personal data processing policy
The current personal data processing policy has been drawn up in accordance with the Federal Law requirements dated July 27, 2006 No. 152-FL «The Russian Federal Law on Personal Data» (hereinafter referred to as the Personal Data Law) and determines personal data processing procedure and measures to ensure personal data security, taken by SCANFORM LLC (hereinafter referred to as the Operator).
1.1. The operator focuses on the human and civil rights and freedoms observance when processing their personal data, including privacy, personal and family secrets rights protection.
1.2. The current Operator’s policy regarding personal data processing (hereinafter referred to as the Policy) is applied to all the information, which can be obtained by the Operator about the website visitors https://scanform.ru/.
2.1. Automated personal data processing means personal data processing while using computer technology.
2.2. Personal data blocking means temporary personal data processing suspension (unless the processing is required to clarify personal data).
2.3. Website means graphic and information materials set, as well as computer programs and databases, ensuring their availability on the Internet at the address https://scanform.ru/.
2.4. Personal data information system means personal data set, contained in databases and information technologies and technical means, ensuring their processing.
2.5. Personal data anonymization means actions, which result in in inability to determine which User or persona data subject owns particular personal data.
2.6. Personal data processing means any action (operation) or actions (operations) set, performed while using automation tools or without using such tools relatively to personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion or destruction.
2.7. Operator is a state body, a municipal body, a legal entity or an individual, independently or jointly with other persons organizing and (or) carrying out personal data processing, as well as determining personal data processing purposes, personal data composition to be processed, actions (operations) performed with personal data.
2.8. Personal data means any information, either directly or indirectly relating to a particular or identifiable User of https://scanform.ru/ website.
2.9. Personal data, permitted by the personal data subject to be disseminated, means personal data, an access to which is provided to unlimited persons number by personal data subject by giving consent to the personal data processing, permitted by personal data subject for further dissemination in the manner, prescribed by the Personal Data Law on (hereinafter – personal data permitted for distribution).
2.10. User means any visitor of https://scanform.ru/ website.
2.11. Personal data provision means any actions, aimed at personal data discloser to particular person or several persons.
2.12. Personal data dissemination means any actions, aimed at personal data disclosure to several persons (personal data transfer) or friends, including personal data disclosure in media, posting on information and telecommunication networks or providing access to personal data in any other way.
2.13. Cross-border personal data transfer means personal data transfer to the foreign state territory, to the foreign state authority, to a foreign individual or foreign legal entity.
2.14. Personal data destruction means any actions, which result in personal data destruction forever and it is impossible to restore such data ever neither in the personal data information system, nor on material carriers.
3.1. The operator is entitled to:
– get reliable information and/or documents, containing personal data, from personal data subject;
– if the personal data subject withdraws own consent to personal data processing, the Operator is entitled to continue processing personal data without personal data subject’s consent, if there are certain grounds, specified in the Russian Federal Law on Personal Data;
– independently determine measures composition and list, required and sufficient to ensure the obligations fulfillment, provided for by the Russian Federal Law on Personal Data and regulatory legal acts, adopted in accordance with it, unless otherwise provided by the Russian Federal Law on Personal Data or other federal laws.
3.2. The operator is entitled to:
– provide personal data subject, upon his request, with the information regarding his personal data processing;
– organize personal data processing in the manner, prescribed by the current Russian Federation legislation;
– respond to personal data subjects’ and their legal representatives’ requests and inquiries in accordance with requirements of the Russian Federal Law on Personal Data;
– provide the authorized personal data subjects rights protection body at its request with the required information within 30 days from such a request receipt date;
– publish or otherwise provide unrestricted access to the current Policy regarding personal data protection;
– take legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, provision, dissemination and any illegal actions;
– stop personal data transfer (distribution, provision, access), processing and destruction in the manner and in cases, provided for by the Russian Federal Law on Personal Data;
– perform other duties, provided for by the Russian Federal Law on Personal Data.
4.1. Personal data subjects are entitled to:
– get information regarding own personal data processing except for cases, provided for by the Federal laws. The information is provided to personal data subject by the Operator in any accessible form and it should not contain personal data, relating to other personal data subjects, unless there are legal grounds for such personal data disclosure. The information list and its obtaining procedure is established by the Russian Federal Law on Personal Data;
– require the operator to clarify his personal data, block or destroy such data, if it is incomplete, outdated, inaccurate, illegally obtained or not required for the stated processing purpose, as well as take measures, provided by the law, in order to protect own rights;
– put forward the prior consent condition when processing personal data in order to promote goods, works and services on the market;
– withdraw consent to personal data processing;
– appeal to the authorized body for personal data subjects’ rights protection or in the court regarding the Operator’s illegal actions or inaction when processing his personal data;
– perform other rights, provided for by the Russian Federation legislation.
4.2. Personal data subjects are obliged to:
– provide the Operator with own reliable data;
– inform the Operator about their personal data clarification (update, change).
4.3. Persons, who have transferred false information about themselves to the Operator, or information about another personal data subject without the latter’s consent, are liable in accordance with the Russian Federation legislation.
5.1. Full name.
5.2. Email address.
5.3. Phone numbers.
5.4. Besides the website collects and processes visitors’ anonymized data (including cookies) while using Internet statistics services (such as Yandex Metrica, Google Analytic, etc).
5.6. The Operator doesn’t process special personal data categories, concerning race, nationality, political views, religious or philosophical beliefs and intimate life.
5.7. Personal data processing, permitted to be distributed from among the special personal data categories, specified in Part 1 of Art. 10 of the Russian Federal Law on Personal Data, is allowed, if the prohibitions and conditions provided for in Art. 10.1 of the Law on Personal Data, are fully met.
5.8. The User’s consent to the personal data processing to be distributed, is drawn up separately from other consents to his personal data processing. The conditions, provided for, in particular, Art. 10.1 of the Russian Federal Law on Personal Data, are fully met. Such consent content requirements are established by the authorized body for the personal data subjects’ rights protection.
5.8.1 The User provides the Operator with own consent to his personal data processing to be distributed.
5.8.2 The Operator is obliged, no later than three working days from the User’s specified consent receipt date, to publish information on the processing conditions, on the prohibitions and conditions for the personal data processing, if any, by an unlimited persons number for further data dissemination.
5.8.3 Personal data transfer (distribution, provision, access), permitted by the personal data subject for distribution, must be stopped at any time at the personal data subject’s request. The current requirement should include the personal data subject’s full name, contact data (including phone number, e-mail address or postal address), as well as personal data list, which processing must be terminated. The personal data specified in the current requirement can be processed by the Operator only, whom it is sent to.
5.8.4 Consent to personal data processing, permitted to be distributed, is terminated once the Operator has got the request, specified in clause 5.8.3 of the current Policy regarding personal data processing.
6.1. Personal data processing is carried out on a legal and fair basis.
6.2. Personal data processing is limited to the specific, predetermined and legitimate purposes achievement. It is prohibited to process personal data, if such processing goal is incompatible with the personal data collection purposes.
6.3. It is prohibited to combine databases, containing personal data, which processing is carried out for the purposes, incompatible with each other.
6.4. Only personal data, meeting own processing goals, is subject to processing.
6.5. Personal data content and volume being processed correspond to the stated processing purposes. The processed personal data redundancy regarding their processing purposes is prohibited.
6.6. There is ensured personal data accuracy, sufficiency and relevance in relation to the personal data processing purposes. The operator takes the required measures and/or ensures their adoption to remove or clarify incomplete or inaccurate data.
6.7. Personal data storage is carried out in the form, allowing to determine personal data subject, no longer than the personal data processing purpose requires, unless the storage period for personal data is established by the federal law or an agreement, according to which the personal data subject is deemed a party, beneficiary or guarantor. The personal data being processed is destroyed or depersonalized upon processing goals achievement or in case of loss of the need to achieve these goals, unless otherwise provided by the Federal law.
7.1. User’s personal data processing goal is to:
– provide the User with an access to the services, information and/or materials, contained on https://scanform.ru/ website.
7.2. The Operator is entitled to send notifications to the User regarding new products and services, special offers and various events. The user is entitled to always refuse from receiving informational messages by sending a letter to the e-mail address email@example.com to the Operator with «Refusal from notifications about new products, services and special offers» mark.
7.3. Anonymized Users data, collected while using Internet statistics services, are used to collect information about the Users’ actions on the website, improve website and its content quality.
8.1. The legal grounds for the personal data processing by the Operator are:
– Operator’s statutory (constituent) documents;
– contracts signed between the operator and the personal data subject;
– federal laws and other regulations in the personal data protection field;
– the Users’ consent to their personal data processing as well as personal data processing to be distributed.
8.2. The Operator processes the User’s personal data only if such data are filled in and/or sent by the User independently through special forms, available by the link https://scanform.ru or sent to the Operator via e-mail. The User agrees with the current Policy by filling out the appropriate forms and/or sending his personal data to the Operator.
8.4. The personal data subject independently makes a decision regarding his personal data provision and gives own consent freely within his own will and according to his own interest.
9.1. The personal data processing is carried out with the personal data subject consent to his personal data processing.
9.2. The personal data processing is required to achieve the goals provided for by the Russian Federation international treaty or law, for the functions, powers and duties implementation by the operator, imposed by the Russian Federation legislation.
9.3. The personal data processing is required for the justice administration, the judicial act execution, another body or official act to be executed in accordance with the Russian Federation legislation on enforcement proceedings.
9.4. The personal data processing is required to comply with the agreement, which the personal data subject is a party or beneficiary or guarantor to, as well as for signing an agreement on the personal data subject’s initiative or an agreement, within which the personal data subject will be the beneficiary or guarantor.
9.5. The personal data processing is required to comply with the operator’s or third parties’ rights and legitimate interests or to achieve socially significant goals, provided that this does not violate the personal data subject’s rights and freedoms.
9.6. There is carried out the personal data processing, an access to which is given to unlimited persons number by the personal data subject or at his request (hereinafter – publicly available personal data).
9.7. There is carried out the personal data processing, subject to publication or mandatory disclosure in accordance with the federal law.
The personal data security, processed by the Operator, is ensured through the legal, organizational and technical measures implementation, required to fully comply with the current legislation requirements in the personal data protection field.
10.1. The operator is responsible for personal data safety and takes all possible measures to exclude an access to unauthorized persons’ data.
10.2. The User’s personal data will never be transferred to third parties, except for cases, related to the current legislation implementation or if the personal data subject has given own consent to the Operator to transfer own data to a third party in order to comply with own obligations within the civil contract.
10.3. The User is entitled to update own personal data independently, if revealing inaccurate one, by sending a notification to the Operator’s e-mail address marked «Updated personal data».
10.4. The personal data processing period is determined by the goals achievement, which the personal data were collected for, unless another period is provided for by the contract or the current legislation.
The user is entitled to decline his consent to the personal data processing by sending a notification to the Operator via e-mail to the Operator’s email address marked «Consent withdrawal to personal data processing».
10.6. The prohibitions established by the personal data subject relatively personal data transfer (except for access provision), as well as processing conditions (except for gaining access), permitted for dissemination, are not applied in cases of personal data processing in the state, public and other public interests, determined by the Russian Federation law.
10.7. The operator ensures the personal data confidentiality when processing personal data.
10.8. The operator stores personal data in a form, allowing to determine the personal data subject, no longer than the personal data processing goal requires, if the personal data storage period is not established by the federal law or agreement, according to which the personal data subject is deemed a party, beneficiary or guarantor.
10.9. Personal data processing goals achievement, personal data subject’s consent expiration or consent withdrawal by the personal data subject, as well as personal data illegal processing identification may become personal data processing termination condition.
11.1. The operator is engaged in personal data collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, usage, transfer (distributing, providing, accessing), depersonalization, blocking, removal and destruction.
11.2. The operator performs automated personal data processing with the information receipt and/or transmission, received via information and telecommunication networks or without it.
12.1. Before starting personal data cross-border transfer, the operator must make sure that the foreign state, to whose territory it is supposed to transfer personal data, provides reliable protection of the rights of subjects of personal data.
12.2. Cross-border personal data transfer on foreign states territory, which do not meet the requirements mentioned above, can be carried out, if there is personal data subject’s written consent to the cross-border transfer of his personal data and/or compliance with the agreement, which party is deemed the personal data subject.
The operator and other persons, who have gained an access to personal data, are prohibited to disclose and distribute personal data to third parties without personal data subject’s consent, unless otherwise provided by the federal law.
14.1. The User is entitled to get any clarifications on all the issues he is interested in regarding his personal data processing by contacting the Operator via e-mail firstname.lastname@example.org.
14.2. The current document will reflect any changes in the personal data processing policy by the Operator. The policy is valid indefinitely until it is replaced by a new version.