Personal Data Protection and Processing Policy of the Founder of the Online Publication Journal of Frontier Studies

Personal Data Protection and Processing Policy of the Founder of the Online Publication Journal of Frontier Studies

 

Personal Data Protection and Processing Policy of the Founder of the Online Publication Journal of Frontier Studies

1. General Provisions

1.1. This Policy of the Genesis.Frontier.Science Research and Production Enterprise Limited Liability Company regarding the processing of personal data (hereinafter referred to as the “Policy”) has been developed pursuant to the requirements of Clause 2 of Part 1 of Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (hereinafter referred to as the “Personal Data Law”), for the purpose of protecting the rights and freedoms of individuals and citizens when their personal data are processed, including the protection of the rights to privacy and to personal and family confidentiality.

1.2. The Policy applies to all personal data processed by the Genesis.Frontier.Science Research and Production Enterprise Limited Liability Company (hereinafter referred to as the “Operator”).

1.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.

1.4. Pursuant to the requirements of Part 2 of Article 18.1 of the Personal Data Law, this Policy shall be made publicly available on the Operator’s website on the information and telecommunications network known as the Internet.

2. Terms and Abbreviations Used

Personal data (PD) – any information relating directly or indirectly to an identified or identifiable individual (personal data subject).

Personal data authorized by the personal data subject for dissemination – personal data to which access by an unlimited number of persons has been granted by the personal data subject by giving consent to the processing of personal data authorized by the personal data subject for dissemination.

Personal data operator (Operator) – a state authority, municipal authority, legal entity or individual that independently or jointly with other persons organizes and/or carries out the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.

Processing of personal data – any action (operation) or set of actions (operations) performed with personal data using automation tools or without the use of such tools. Processing of personal data includes, in particular:

  • collection;
  • recording;
  • systematization;
  • accumulation;
  • storage;
  • clarification (updating, modification);
  • retrieval;
  • use;
  • transfer (provision, access);
  • dissemination;
  • depersonalization;
  • blocking;
  • deletion;
  • destruction.

Automated processing of personal data – processing of personal data by means of computer technology.

Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons.

Dissemination of personal data – actions aimed at disclosing personal data to an unlimited number of persons.

Blocking of personal data – temporary suspension of personal data processing (except where processing is necessary to clarify personal data).

Destruction of personal data – actions as a result of which it becomes impossible to restore the contents of personal data in the personal data information system and/or as a result of which physical media containing personal data are destroyed.

Depersonalization of personal data – actions as a result of which it becomes impossible, without using additional information, to determine that personal data belong to a specific personal data subject.

Personal data information system – a combination of personal data contained in databases and the information technologies and technical means used to process such data.

Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a public authority of a foreign state, a foreign individual or a foreign legal entity.

Protection of personal data – activities aimed at preventing leakage of protected personal data and unauthorized or unintended impacts on protected personal data.

3. Procedure and Conditions for Processing and Storing Personal Data

3.1. Personal data shall be processed by the Operator in accordance with the requirements of the legislation of the Russian Federation.

3.2. Personal data shall be processed with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.

3.3. Consent to the processing of personal data authorized by the personal data subject for dissemination shall be executed separately from other consents of the personal data subject to the processing of his or her personal data.

3.4. Consent to the processing of personal data authorized by the personal data subject for dissemination may be provided to the Operator:

  • directly;
  • using the information system of the authority responsible for the protection of the rights of personal data subjects.

3.5. The Operator carries out both automated and non-automated processing of personal data.

3.6. Employees of the Operator whose job duties include the processing of personal data are permitted to process personal data.

3.7. Personal data are processed by:

  • obtaining personal data orally and in writing directly with the consent of the personal data subject to the processing or dissemination of his or her personal data;
  • entering personal data into the Operator’s logs, registers and information systems;
  • using other methods of personal data processing.

3.8. Personal data may not be disclosed to third parties or disseminated without the consent of the personal data subject unless otherwise provided by federal law.

3.9. Personal data shall be transferred to inquiry and investigation authorities, the Federal Tax Service, the Pension Fund, the Social Insurance Fund and other authorized executive authorities and organizations in accordance with the requirements of the legislation of the Russian Federation.

3.10. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, dissemination and other unauthorized actions, including the following:

  • identifying threats to the security of personal data during their processing;
  • adopting local regulations and other documents governing relations in the field of personal data processing and protection;
  • appointing persons responsible for ensuring the security of personal data in the Operator’s structural divisions and information systems;
  • creating the necessary conditions for working with personal data;
  • organizing the accounting and control of documents containing personal data;
  • organizing work with information systems in which personal data are processed;
  • storing personal data under conditions that ensure their integrity and prevent unlawful access to them;
  • organizing training for the Operator’s employees who process personal data.

3.11. The Operator stores personal data in a form that makes it possible to identify the personal data subject for no longer than required by the purposes of personal data processing, unless a personal data retention period is established by federal law, a contract or an agreement.

3.12. When collecting personal data, including via the information and telecommunications network known as the Internet, the Operator ensures that the recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of personal data of citizens of the Russian Federation are carried out using databases located within the territory of the Russian Federation, except in the cases specified in the Personal Data Law.

3.13. Purposes of Personal Data Processing

3.13.1. Only personal data that correspond to the purposes of their processing shall be processed.

3.13.2. The Operator processes personal data for the following purposes:

  • ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation;
  • carrying out its activities in accordance with the Operator’s constituent documents and the legislation of the Russian Federation;
  • identifying a user in order to provide access to the Operator’s service;
  • identifying an individual by the editorial office for the purpose of deciding on publication when an application for publication is submitted;
  • identifying the authorship of a published work;
  • entering into copyright transfer agreements;
  • identifying an individual so that the editorial office may send an invitation to conduct a peer review (if the user has consented);
  • maintaining personnel records;
  • assisting employees with employment, education and career advancement, ensuring employees’ personal safety, monitoring the quantity and quality of work performed, and ensuring the preservation of property;
  • recruiting and selecting candidates for employment with the Operator;
  • arranging for employees to be registered in the individual (personalized) record-keeping system of compulsory pension insurance;
  • completing and submitting required reporting forms to executive authorities and other authorized organizations;
  • carrying out civil-law relations;
  • maintaining accounting records.

3.13.3. The processing of employees’ personal data may be carried out exclusively for the purpose of ensuring compliance with laws and other regulatory legal acts.

3.14. Categories of Personal Data Subjects

The personal data of the following personal data subjects are processed:

  • individuals who are or were previously in employment relations with the Operator;
  • individuals who are candidates for employment;
  • individuals who are in civil-law relations with the Operator.

3.15. Personal Data Processed by the Operator

  • data obtained in the course of employment relations;
  • data obtained for the purpose of selecting candidates for employment;
  • data obtained in the course of civil-law relations.

3.16. Storage of Personal Data

3.16.1. Personal data of subjects may be obtained, subsequently processed and transferred for storage both on paper and in electronic form.

3.16.2. Personal data recorded on paper media are stored in locked cabinets or locked premises with restricted access.

3.16.3. Personal data of subjects processed using automation tools for different purposes are stored in separate folders.

3.16.4. Documents containing personal data may not be stored or placed in open electronic directories (file-sharing systems) within the personal data information system.

3.16.5. Personal data shall be stored in a form that makes it possible to identify the personal data subject for no longer than required by the purposes of their processing, and such data shall be destroyed once the purposes of processing have been achieved or if the need to achieve those purposes has ceased to exist. Data obtained as a result of entering into a civil-law contract shall be stored for the entire term of the contract and for twenty years after its termination. Data obtained as a result of entering into a civil-law copyright agreement shall be stored after completion of the agreement for the entire term of copyright protection.

3.17. Destruction of Personal Data

3.17.1. Documents (media) containing personal data shall be destroyed by burning, crushing (shredding), chemical decomposition, or conversion into a shapeless mass or powder. A shredder may be used to destroy paper documents.

3.17.2. Personal data on electronic media shall be destroyed by erasing or formatting the medium.

3.17.3. The destruction of personal data shall be documented by a certificate of destruction of the media.

4. Protection of Personal Data

4.1. In accordance with the requirements of regulatory documents, the Operator has created a personal data protection system (PDPS) consisting of legal, organizational and technical protection subsystems.

4.2. The legal protection subsystem is a set of legal, organizational, administrative and regulatory documents that ensure the creation, functioning and improvement of the PDPS.

4.3. The organizational protection subsystem includes the organization of the PDPS management structure, the authorization system, and information protection when working with employees, partners and third parties.

4.4. The technical protection subsystem includes a set of technical, software, and software-and-hardware tools that ensure the protection of personal data.

4.5. The principal personal data protection measures used by the Operator are as follows:

4.5.1. Appointment of a person responsible for personal data processing, who organizes personal data processing, provides training and instruction, and conducts internal monitoring of the institution’s and its employees’ compliance with personal data protection requirements.

4.5.2. Identification of current threats to the security of personal data when processed in the personal data information system and development of measures and activities for personal data protection.

4.5.3. Development of a policy regarding the processing of personal data.

4.5.4. Establishment of rules for access to personal data processed in the personal data information system, as well as ensuring the registration and recording of all actions performed with personal data in the personal data information system.

4.5.5. Establishment of individual employee passwords for access to the information system in accordance with their job duties.

4.5.6. Use of information security tools that have passed the conformity assessment procedure in the prescribed manner.

4.5.7. Certified antivirus software with regularly updated databases.

4.5.8. Compliance with conditions ensuring the integrity of personal data and preventing unauthorized access to such data.

4.5.9. Detection of unauthorized access to personal data and taking appropriate measures.

4.5.10. Restoration of personal data modified or destroyed as a result of unauthorized access.

4.5.11. Training of the Operator’s employees who directly process personal data in the provisions of the legislation of the Russian Federation on personal data, including personal data protection requirements, documents defining the Operator’s personal data processing policy, and local regulations governing personal data processing.

4.5.12. Conducting internal control and audits.

5. Fundamental Rights of the Personal Data Subject and Obligations of the Operator

5.1. Fundamental Rights of the Personal Data Subject

The subject has the right to access his or her personal data and the following information:

  • confirmation that the Operator processes personal data;
  • the legal grounds and purposes for processing personal data;
  • the purposes and methods of personal data processing used by the Operator;
  • the name and location of the Operator, and information about persons (other than the Operator’s employees) who have access to personal data or to whom personal data may be disclosed under an agreement with the Operator or pursuant to federal law;
  • the periods during which personal data are processed, including their retention periods;
  • the procedure for the personal data subject to exercise the rights provided for by this Federal Law;
  • the name or surname, first name, patronymic and address of the person processing personal data on behalf of the Operator, if such processing has been or will be entrusted to such person;
  • contacting the Operator and sending requests to the Operator;
  • appealing against the Operator’s actions or inaction.

5.2. Obligations of the Operator

The Operator shall:

  • provide information about the processing of personal data when personal data are collected;
  • notify the personal data subject if the personal data were not obtained from the subject;
  • if the subject refuses to provide personal data, explain the consequences of such refusal;
  • publish or otherwise ensure unrestricted access to the document defining its policy regarding the processing of personal data and to information about the implemented requirements for personal data protection;
  • take the necessary legal, organizational and technical measures, or ensure that such measures are taken, to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, as well as other unlawful actions involving personal data;
  • respond to requests and communications from personal data subjects, their representatives and the authority responsible for the protection of the rights of personal data subjects.

6. Updating, Correction, Deletion and Destruction of Personal Data; Responses to Requests from Subjects for Access to Personal Data

6.1. Confirmation that the Operator processes personal data, the legal grounds and purposes for processing personal data, as well as other information specified in Part 7 of Article 14 of the Personal Data Law, shall be provided by the Operator to the personal data subject or his or her representative upon application or upon receipt of a request from the personal data subject or his or her representative.

The information provided shall not include personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data.

The request must contain:

  • the number of the primary identity document of the personal data subject or his or her representative, information on the date of issue of that document and the issuing authority;
  • information confirming the participation of the personal data subject in relations with the Operator (contract number, date of execution of the contract, a conventional verbal designation and/or other information), or information otherwise confirming that the Operator processes the personal data;
  • the signature of the personal data subject or his or her representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

If the application (request) of the personal data subject does not contain all the necessary information in accordance with the requirements of the Personal Data Law, or if the subject does not have the right to access the requested information, a reasoned refusal shall be sent to the subject.

The right of the personal data subject to access his or her personal data may be restricted in accordance with Part 8 of Article 14 of the Personal Data Law, including where the personal data subject’s access to his or her personal data would violate the rights and legitimate interests of third parties.

6.2. If inaccurate personal data are identified upon an application by the personal data subject or his or her representative, or pursuant to their request or a request from Roskomnadzor, the Operator shall block the personal data relating to that subject from the moment such application or request is received and for the duration of the verification, provided that such blocking does not violate the rights and legitimate interests of the personal data subject or third parties.

If the inaccuracy of the personal data is confirmed, the Operator, on the basis of information provided by the personal data subject or his or her representative, Roskomnadzor, or other necessary documents, shall correct the personal data within seven business days from the date such information is provided and shall remove the blocking of the personal data.

6.3. If unlawful processing of personal data is identified upon an application (request) by the personal data subject or his or her representative, or by Roskomnadzor, the Operator shall block the unlawfully processed personal data relating to that subject from the moment such application or request is received.

6.4. Upon achieving the purposes of personal data processing, as well as if the personal data subject withdraws consent to the processing of personal data, the personal data shall be destroyed unless:

  • otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
  • the Operator is entitled to process the personal data without the subject’s consent on the grounds provided for by the Personal Data Law or other federal laws;
  • otherwise provided by another agreement between the Operator and the personal data subject.

7. Final Provisions

7.1. Liability for violations of the requirements of the legislation of the Russian Federation and the Operator’s regulatory documents in the field of personal data shall be determined in accordance with the legislation of the Russian Federation.

7.2. This Policy shall enter into force upon approval and shall remain in effect indefinitely until a new Policy is adopted.

7.3. All amendments and additions to this Policy must be approved by the Director of the Operator.