Policy regarding the processing of personal data

Policy

regarding the processing of personal data

1. General Provisions

1.1. This Policy regarding the processing of personal data (hereinafter referred to as the Policy) has been developed in compliance with the requirements of paragraph 2 of part 1 of Article 18.1 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" (hereinafter referred to as the Law) in order to ensure the protection of the rights and freedoms of an individual and citizen when processing his personal data, including the protection of the rights to privacy, personal and family secrets.
1.2. The Policy applies to all personal data processed by GTS ENGINEERING LLC (hereinafter referred to as the Operator).
1.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
1.4. In compliance with the requirements of part 2 of Article 18.1 of the Law, this Policy is published in the public domain by posting it on the Operator's websites on the Internet information and telecommunications network, at www.гтсинжиниринг.рф and at www.pf-trade.ru, as well as on the information board on the Operator's premises, at the address: Yaroslavl, Rybinskaya St., 11/26, office 4.
1.5. Basic concepts used in the Policy:
personal data - any information related to a directly or indirectly determined or determinable individual (subject of personal data);
personal data operator (operator) - a government agency, municipal agency, legal entity or individual that independently or jointly with other persons organizes and (or) carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data;
personal data processing - any action (operation) or set of actions (operations) with personal data, performed with or without the use of automation tools. Personal data processing includes, among other things:
• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating, modification);
• retrieval;
• use;
• transfer (distribution, provision, access);
• depersonalization;
• blocking;
• deletion;
• destruction.
automated personal data processing - processing of personal data using computer technology;
dissemination of personal data - actions aimed at disclosing personal data to an indefinite number of persons;
Head - sole executive body of the Operator;
provision of personal data - actions aimed at disclosing personal data to a specific person or a specific number of persons;
blocking of personal data - temporary cessation of processing of personal data (except in cases where processing is necessary to clarify personal data);
destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the tangible media of personal data are destroyed;
depersonalization of personal data - actions as a result of which it becomes impossible to determine the ownership of personal data by a specific personal data subject without the use of additional information;
personal data information system - a set of personal data contained in databases and the information technologies and technical means that ensure their processing.
1.6. Basic rights and obligations of the Operator.
1.6.1. The Operator has the right:
• independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
• entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data stipulated by the Law on Personal Data, maintain the confidentiality of personal data, and take the necessary measures aimed at ensuring the fulfillment of the obligations stipulated by the Law on Personal Data;
• in the event of the withdrawal of consent to the processing of personal data by the subject of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal Data.
1.6.2. The Operator is obliged to:
• organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
• respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
• notify the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) at the request of this body of the necessary information within 10 working days from the date of receipt of such a request. This period may be extended, but not more than by five working days. To do this, the Operator must send Roskomnadzor a reasoned notice indicating the reasons for the extension of the period for providing the requested information;
• in the manner determined by the federal executive body authorized in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it of computer incidents that entailed the illegal transfer (provision, distribution, access) of personal data.
1.7. Basic rights of the personal data subject. The personal data subject has the right to:
• receive information regarding the processing of his personal data, except for cases stipulated by federal laws. Information is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data related to other personal data subjects, except for cases when there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
• demand that the operator clarify his personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing, as well as take measures provided by law to protect his rights;
• give preliminary consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
• appeal to Roskomnadzor or in court against illegal actions or inaction of the Operator when processing his personal data.
1.8. Control over compliance with the requirements of this Policy is carried out by an authorized person responsible for organizing the processing of personal data by the Operator.
1.9. Responsibility for violation of the requirements of the legislation of the Russian Federation and the regulatory acts of the Operator in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2. Purposes of collecting personal data

2.1. The processing of personal data is limited to achieving specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of collecting personal data is not allowed.
2.2. Only personal data that meets the purposes of their processing may be processed.
2.3. The Operator processes personal data for the following purposes:
• maintaining personnel and accounting records;
• ensuring compliance with the labor legislation of the Russian Federation;
• ensuring compliance with the tax legislation of the Russian Federation;
• ensuring compliance with the pension legislation of the Russian Federation;
• recruiting personnel (applicants) for vacant positions of the Operator;
• organizing military registration;
• preparing, concluding and executing civil contracts;
• promoting goods, works, services on the market;
• other purposes stipulated by the current legislation of the Russian Federation.
2.4. Personal data may be processed solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

3. Legal basis for processing personal data

3.1. The legal basis for processing personal data is a set of regulatory legal acts, pursuant to which and in accordance with which the Operator processes personal data, including:
• The Constitution of the Russian Federation;
• The Civil Code of the Russian Federation;
• The Labor Code of the Russian Federation;
• The Tax Code of the Russian Federation;
• Federal Law of 27.07.2006 No. 152-FZ "On Personal Data";
• Federal Law of 06.12.2011 No. 402-FZ "On Accounting";
• Federal Law of 15.12.2001 No. 167-FZ "On Compulsory Pension Insurance in the Russian Federation";
• Federal Law of 27.07.2006 No. 149-FZ "On Information, Information Technologies and Information Protection";
• RF Government Resolution of 27.11.2006 No. 719 "On Approval of the Regulation on Military Registration";
• RF Government Resolution of 15.09.2008 No. 687 "On Approval of the Regulation on the Peculiarities of Personal Data Processing Carried Out Without the Use of Automation Tools";
• other regulatory legal acts governing relations related to the Operator's activities.
3.2. The legal basis for processing personal data shall also include:
• Operator's Charter;
• agreements concluded between the Operator and personal data subjects;
• consent of personal data subjects to the processing of their personal data.
4. Volume and categories of processed personal data, categories of personal data subjects

4.1. The content and volume of processed personal data must correspond to the stated purposes of processing, provided for in Section 2 of this Policy. The processed personal data must not be excessive in relation to the stated purposes of their processing.
4.2. The Operator may process personal data of the following categories of personal data subjects:
4.2.1. Dismissed employees, employees, as well as their relatives - for the purpose of maintaining personnel and accounting records, including the implementation of directly related legal relationships, including labor, tax, pension:
• last name, first name, patronymic;
• year of birth;
• month of birth;
• date of birth;
• place of birth;
• marital status;
• income;
• gender;
• email address;
• residential address;
• registration address;
• telephone number;
• SNILS;
• TIN;
• citizenship;
• identity document details;
• driver's license details;
• document details contained in the birth certificate;
• bank card details;
• current account number;
• personal account number;
• profession;
• position;
• information about work experience (including length of service, information about current employment with the name and current account of the organization);
• attitude to military service, information about military registration;
• information about education;
• other personal data, the receipt of which is necessary to comply with the requirements of the current legislation.
4.2.2. Clients and contractors of the Operator, including their representatives - for the purpose of carrying out statutory activities, including the preparation, conclusion and execution of contracts:
• last name, first name, patronymic;
• year of birth;
• month of birth;
• date of birth;
• place of birth;
• gender;
• email address;
• residential address;
• registration address;
• telephone number;
• TIN;
• citizenship;
• identity document details;
• driver's license details;
• bank card details;
• current account number;
• personal account number;
• profession;
• position;
• information about work experience (including length of service, information about current employment with the name and current account of the organization);
• other personal data provided by the subject of personal data.
4.2.3. Employees and dismissed employees of the Operator - for the purpose of organizing military registration:
• last name, first name, patronymic;
• year of birth;
• month of birth;
• date of birth;
• place of birth;
• marital status;
• gender;
• email address;
• residential address;
• registration address;
• telephone number;
• SNILS;
• INN;
• citizenship;
• identity document details;
• driver's license details;
• document details contained in the birth certificate;
• profession;
• position;
• information about work experience (including length of service, information about current employment with the name and bank account of the organization); attitude to military service, information about military registration;
• information about education;
• other personal data, the receipt of which is necessary to comply with the requirements of current legislation.
4.2.4. Applicants - for the purpose of recruiting personnel for vacant positions of the Operator and forming a personnel reserve:
• last name, first name, patronymic;
• year of birth;
• month of birth;
• date of birth;
• place of birth;
• gender;
• email address;
• residential address;
• registration address;
• telephone number;
• TIN;
• citizenship;
• identity document details;
• driver's license details;
• profession;
• position;
• information on work experience (including length of service, information on current employment with the name and bank account of the organization);
• information on education;
• other personal data provided by the subject of personal data.
4.2.5. Website visitors - for the purpose of processing personal data on the Operator's website:
• last name, first name, patronymic;
• email address;
• telephone number;
• information collected through metric programs;
• other personal data provided by the subject of personal data.
4.3. The Operator processes personal data in the following ways:
• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (updating, modification);
• retrieval;
• use;
• transfer (distribution, provision, access);
• blocking;
• deletion;
• destruction.
4.4. The Operator processes biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which his or her identity can be established) in accordance with the legislation of the Russian Federation.
4.5. The Operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, except for cases provided for by the legislation of the Russian Federation.

5. Procedure and conditions for processing personal data

5.1. The Operator processes personal data in accordance with the requirements of the legislation of the Russian Federation.
5.2. The processing of personal data is carried out with the consent of the personal data subjects to the processing of their personal data, as well as without such consent in cases stipulated by the legislation of the Russian Federation.
5.3. The Operator processes personal data for each purpose of their processing in the following ways:
• non-automated processing of personal data;
• automated processing of personal data with or without the transfer of the received information via information and telecommunications networks;
• mixed processing of personal data.
5.4. The Operator's employees whose job responsibilities include the processing of personal data are allowed to process personal data.
5.5. The processing of personal data for each processing purpose specified in paragraph 2.3 of the Policy is carried out by:
• receiving personal data in oral and written form directly from the personal data subjects;
• entering personal data into the Operator's journals, registers and information systems;
• use of other methods of processing personal data.
5.6. Disclosure to third parties and distribution of personal data without the consent of the personal data subject is prohibited, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the personal data subject for distribution is drawn up separately from other consents of the personal data subject to the processing of his personal data.
The requirements for the content of consent to the processing of personal data permitted by the personal data subject for distribution are approved by Order of Roskomnadzor dated 02.24.2021 No. 18 "On approval of requirements for the content of consent to the processing of personal data permitted by the personal data subject for distribution".
5.7. The transfer of personal data to inquiry and investigation bodies, the Federal Tax Service, the Social Fund of Russia and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator shall take the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution and other unauthorized actions, including:
• determines threats to the security of personal data during their processing;
• adopts local regulations and other documents governing relations in the field of processing and protecting personal data;
• appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;
• creates the necessary conditions for working with personal data;
• organizes the accounting of documents containing personal data;
• organizes work with information systems in which personal data is processed;
• stores personal data in conditions that ensure their safety and exclude unauthorized access to them;
• organizes training for the Operator's employees processing personal data.
5.9. The Operator shall store personal data in a form that allows identifying the subject of personal data for no longer than required for each purpose of processing personal data, unless the storage period for personal data is established by federal law or an agreement.
5.9.1. Personal data on paper media shall be stored by the Operator for the storage periods of documents for which these periods are provided for by the legislation on archival affairs in the Russian Federation (Federal Law of 22.10.2004 No. 125-FZ "On Archival Affairs in the Russian Federation", the List of standard management archival documents generated in the course of activities of state bodies, local governments and organizations, indicating their storage periods (approved by Order of Rosarchive dated 20.12.2019 No. 236 "On approval of the List of standard management archival documents generated in the course of activities of state bodies, local governments and organizations, indicating their storage periods")).
5.9.2. The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper media.
5.10. The Operator shall stop processing personal data in the following cases:
• the fact of their illegal processing is revealed. The period is within three working days from the date of detection;
• the purpose of their processing is achieved;
• the consent of the subject of personal data to the processing of the specified data has expired or has been revoked, when, according to the Law, the processing of these data is permitted only with consent.
5.11. Upon achieving the goals of personal data processing, as well as in the event of the personal data subject's withdrawal of consent to their processing, the Operator shall stop processing these data, unless:
• otherwise provided by the agreement to which the personal data subject is a party, beneficiary or guarantor;
• the Operator shall not have the right to carry out processing without the consent of the personal data subject on the grounds stipulated by the Law or other federal laws;
• otherwise provided by another agreement between the Operator and the personal data subject.
5.12. If the personal data subject applies to the Operator with a request to stop processing personal data within a period not exceeding 10 working days from the date of receipt by the Operator of the relevant request, the processing of personal data shall be terminated, except for cases stipulated by the Law. The specified period may be extended, but not more than by five working days. To this end, the Operator must send the personal data subject a reasoned notice indicating the reasons for the extension of the period.
5.13. When collecting personal data, including via the Internet information and telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification (update, change), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.
5.14. The Operator uses the following information systems:
• 1C: Accounting;
• Corporate mail.

6. Updating, correcting, deleting, destroying personal data, responding to requests from subjects for access to personal data

6.1. Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of personal data processing, as well as other information specified in Part 7 of Article 14 of the Law, are provided by the Operator to the subject of personal data or his representative within 10 working days from the date of the request or receipt of the request from the subject of personal data or his representative. This period may be extended, but not more than by five working days. To do this, the Operator should send the personal data subject a reasoned notice indicating the reasons for extending the deadline for providing the requested information.
The information provided does not include personal data related to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.
The request must contain:
• the number of the main document certifying the identity of the personal data subject or his representative, information on the date of issue of the specified document and the issuing authority;
• information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator;
• the signature of the personal data subject or his representative.
The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
The Operator provides the information specified in Part 7 of Art. 14 of the Law, to the personal data subject or his representative in the form in which the relevant request or inquiry was sent, unless otherwise specified in the request or inquiry.
If the request (inquiry) of the personal data subject does not reflect all the necessary information in accordance with the requirements of the Law on Personal Data or the subject does not have the right to access the requested information, then a reasoned refusal is sent to him.
The right of the personal data subject to access his personal data may be limited in accordance with Part 8 of Art. 14 of the Law, including if the personal data subject's access to his personal data violates the rights and legitimate interests of third parties.
6.2. In the event that inaccurate personal data is discovered upon the request of the personal data subject or his representative or at their request or at the request of Roskomnadzor, the Operator blocks the personal data related to this personal data subject from the moment of such request or receipt of the said request for the verification period, if the blocking of the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
In case of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the subject of personal data or his representative or Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
6.3. In the event of detection of unlawful processing of personal data upon an appeal (request) from a personal data subject or his/her representative or Roskomnadzor, the Operator shall block the unlawfully processed personal data related to this personal data subject from the moment of such appeal or receipt of the request.
6.4. If the Operator, Roskomnadzor or another interested party detects a fact of unlawful or accidental transfer (provision, distribution) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator:
• within 24 hours - notifies Roskomnadzor of the incident that has occurred, the presumed reasons that resulted in a violation of the rights of personal data subjects, the presumed harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
• within 72 hours - notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information about the persons whose actions caused it (if any).
6.5. Procedure for destruction of personal data by the Operator.
6.5.1. Conditions and terms for destruction of personal data by the Operator:
• achievement of the purpose of processing personal data or loss of the need to achieve this purpose - within 30 days;
• achievement of the maximum storage periods for documents containing personal data - within 30 days;
• provision by the subject of personal data (his representative) of confirmation that the personal data were obtained illegally or are not necessary for the stated purpose of processing - within seven working days;
• revocation by the subject of personal data of consent to the processing of his personal data if their preservation for the purpose of their processing is no longer required - within 30 days.
6.5.2. Upon achieving the purpose of personal data processing, as well as in the event of the personal data subject's withdrawal of consent to their processing, personal data are subject to destruction, unless:
• otherwise provided by the agreement to which the personal data subject is a party, beneficiary or guarantor;
• the Operator has no right to carry out processing without the consent of the personal data subject on the grounds stipulated by the Personal Data Law or other federal laws;
• otherwise provided by another agreement between the Operator and the personal data subject.
6.5.3. The destruction of personal data is carried out by a commission created by the order of the Head of the Operator.
6.5.4. The methods of destruction of personal data are established in local regulations of the Operator.

7. Final Provisions

7.1. The Policy was approved by order of the Head of the Operator No. 1-PDn dated 05/28/2025, and is valid indefinitely until the new version of the Policy comes into force.
7.2. In the event of a change in the legislation of the Russian Federation in the field of personal data protection, the Operator shall accept a new version of the Policy taking into account the changes. Until that moment, the Policy shall be valid to the extent that it does not contradict the current legislation of the Russian Federation.
7.3. The following contact information may be used to contact the Operator:
e-mail: info@gts.team;
mailing address: 150014, Yaroslavl, Svobody St., Building 79, P.O. Box 50