Personal data processing policy

1. General provisions

1.1. This Policy of FILIPCHIK STUDIOS Limited Liability Company on the processing of personal data (the “Policy”) was developed pursuant to Federal Law No. 152-FZ “On Personal Data” of 27 July 2006 (the “Personal Data Law”) to protect human and civil rights and freedoms when personal data is processed, including the rights to privacy and personal and family secrets.

1.2. The Policy sets out the key concepts, purposes, methods and procedure for processing and protecting personal data, the categories of data subjects and personal data processed, the actions (operations) performed with personal data, the rights and obligations of the Operator and data subjects, the handling of data subject requests, and liability for violations in the field of personal data.

1.3. The Policy applies to all personal data processed by FILIPCHIK STUDIOS LLC (the “Operator”).

1.4. This Policy is published in open access on the Operator’s website.

2. Terms and abbreviations

Personal data — any information relating to a directly or indirectly identified or identifiable individual (data subject).

Personal data permitted by the data subject for dissemination — personal data to which the data subject has granted access to an unlimited number of persons by giving consent to such processing.

Personal data operator (Operator) — a state or municipal body, legal entity or individual that, alone or jointly with others, organizes and/or carries out the processing of personal data and determines the purposes of processing, the personal data to be processed and the actions (operations) performed with it.

Processing of personal data — any action (operation) or set of actions performed with personal data, with or without automation tools, including:

collection;
recording;
systematization;
accumulation;
storage;
clarification (updating, modification);
retrieval;
use;
transfer (provision, access);
dissemination;
depersonalization;
blocking;
deletion;
destruction.

Automated processing — processing of personal data using computer technology.

Provision of personal data — actions aimed at disclosing personal data to a specific person or group of persons.

Dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons.

Blocking of personal data — temporary suspension of processing (except where processing is needed to clarify the data).

Destruction of personal data — actions that make it impossible to restore the content of personal data in the information system and/or destroy the physical media containing it.

Depersonalization of personal data — actions that make it impossible, without additional information, to attribute personal data to a specific data subject.

Personal data information system (PDIS) — a set of personal data in databases together with the information technologies and hardware used to process it.

Cross-border transfer — transfer of personal data to the territory of a foreign state, to a foreign authority, individual or legal entity.

Personal data protection — activities aimed at preventing leaks of protected personal data and unauthorized or unintended interference with it.

3. Procedure and conditions for processing and storing personal data

3.1. The Operator processes personal data in accordance with the legislation of the Russian Federation.

3.2. Personal data is processed with the consent of data subjects, as well as without it in cases provided for by Russian law.

3.3. Consent to the processing of personal data permitted for dissemination is given separately from other consents of the data subject.

3.4. Such consent may be given to the Operator:

directly;
through the information system of the authorized body for the protection of data subjects’ rights.

3.5. The Operator carries out both automated and non-automated processing of personal data.

3.6. Processing is carried out only by Operator employees whose duties include processing personal data.

3.7. Personal data is processed by:

receiving personal data orally and in writing directly with the data subject’s consent to processing or dissemination;
entering personal data into the Operator’s logs, registers and information systems;
other methods of processing personal data.

3.8. Personal data is not disclosed to third parties or disseminated without the data subject’s consent unless otherwise provided by federal law.

3.9. Personal data is transferred to investigative bodies, the Federal Tax Service, the Social Fund and other authorized bodies and organizations in accordance with Russian law.

3.10. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, dissemination and other unauthorized actions, including:

identifying threats to personal data security during processing;
adopting internal regulations and other documents governing the processing and protection of personal data;
appointing persons responsible for personal data security in its departments and information systems;
creating the necessary conditions for working with personal data;
keeping records of documents containing personal data;
organizing work with the information systems in which personal data is processed;
storing personal data in conditions that ensure its safety and prevent unlawful access;
training employees who process personal data.

3.11. The Operator stores personal data in a form that allows the data subject to be identified no longer than the purposes of processing require, unless the retention period is set by federal law, contract or agreement.

3.12. When collecting personal data, including via the Internet, the Operator records, systematizes, accumulates, stores, clarifies and retrieves personal data of Russian citizens using databases located in the Russian Federation, except as specified in the Personal Data Law.

3.13. Purposes of processing.

3.13.1. Only personal data that meets the purposes of processing is processed.

3.13.2. The Operator processes personal data for the following purposes:

compliance with the Constitution, federal laws and other regulations of the Russian Federation;
carrying out its activities in accordance with the charter of FILIPCHIK STUDIOS LLC;
HR record-keeping;
assisting employees with employment;
recruiting and selecting job candidates;
registering employees in the mandatory pension insurance system;
completing and submitting required reports to authorities and other authorized organizations;
civil-law relations;
accounting and tax records.

3.14. Employees’ personal data may be processed solely to ensure compliance with laws and other regulations.

3.15. Categories of data subjects. The Operator processes personal data of:

individuals employed by FILIPCHIK STUDIOS LLC;
individuals who have left FILIPCHIK STUDIOS LLC;
job candidates;
users of the Operator’s website;
the Operator’s counterparties (individuals) in contractual and other civil-law relations with FILIPCHIK STUDIOS LLC, or their authorized representatives;
representatives or employees of the Operator’s counterparties (legal entities).

3.16. Personal data processed by the Operator:

data obtained in the course of employment relations;
data obtained for selecting job candidates;
data obtained in the course of civil-law relations;
data provided by users of the Operator’s website.

Depending on the specific purpose, the personal data processed may include: full name (including previous names); date and place of birth; citizenship; identity document details; registration and residential address; work, home and mobile phone numbers or other contact details; pension insurance number; taxpayer identification number; mandatory medical insurance details; bank account details for salary and social payments; birth and marriage certificate details; marital status and family composition as permitted by Russian law; employment history; military registration details; education, professional retraining and qualifications; academic degree; foreign language skills; employment contract details; stays abroad; criminal record information for candidates where required by federal law; security clearances; state and other awards; medical fitness results; leave records; place of work and position; corporate email address; biometric data in the form of photos and videos; depersonalized data about website visitors, including cookies obtained through web analytics services; and other data in cases defined by federal law.

3.17. Storage of personal data.

3.17.1. Personal data may be received, processed and stored both on paper and electronically.

3.17.2. Personal data on paper is kept in lockable cabinets or lockable rooms with restricted access.

3.17.3. Personal data processed with automation tools for different purposes is stored in separate folders.

3.17.4. Documents containing personal data may not be stored or placed in open electronic directories (file-sharing services) in the PDIS.

3.17.5. Personal data in a form that allows the data subject to be identified is stored no longer than the purposes of processing require and is destroyed once those purposes are achieved or are no longer needed.

3.18. Destruction of personal data.

3.18.1. Personal data is destroyed once the purposes of processing are achieved, when consent is withdrawn, at the request of the data subject or other persons as provided by law, or when unlawful processing is detected.

3.18.2. Documents (media) containing personal data are destroyed by burning or shredding. A shredder may be used for paper documents.

3.18.3. Personal data on electronic media is destroyed by erasing or formatting the media.

4. Personal data protection

4.1. In accordance with regulatory requirements, the Operator maintains a personal data protection system.

4.2. The Operator’s main protection measures may include:

4.2.1. Appointing a person responsible for personal data processing who organizes processing, training and instruction, and internal control over compliance with personal data protection requirements.

4.2.2. Identifying current threats to personal data security in the PDIS and developing protective measures.

4.2.3. Developing a personal data processing policy.

4.2.4. Setting rules for access to personal data in the PDIS and registering and logging all actions performed with personal data in the PDIS.

4.2.5. Using information security tools that have passed conformity assessment.

4.2.6. Certified antivirus software with regularly updated databases.

4.2.7. Maintaining conditions that ensure the safety of personal data and prevent unauthorized access.

4.2.8. Detecting unauthorized access to personal data and taking action.

4.2.9. Restoring personal data modified or destroyed as a result of unauthorized access.

5. Rights of the data subject and obligations of the Operator

5.1. Rights of the data subject

5.1.1. The data subject has the right to access their personal data and the following information:

confirmation that the Operator processes their personal data;
the legal grounds and purposes of processing;
the purposes and methods of processing used by the Operator;
the name and location of the Operator and information about persons (other than employees) who have access to personal data or to whom it may be disclosed under a contract with the Operator or federal law;
processing periods, including retention periods;
the procedure for exercising the data subject’s rights under the Personal Data Law;
the name or full name and address of any person processing personal data on the Operator’s behalf;
other information provided for by the Personal Data Law or other federal laws.

5.1.2. The data subject has the right to contact the Operator and send requests.

5.1.3. The data subject has the right to appeal the Operator’s actions or inaction.

5.1.4. The data subject has the right to withdraw consent to the processing of personal data.

5.2. Obligations of the Operator

The Operator must:

provide information about the processing when collecting personal data;
notify the data subject if personal data was not obtained from them;
explain the consequences to the data subject if they refuse to provide personal data;
publish or otherwise provide unrestricted access to its personal data processing policy and to information on the protection requirements it implements;
take the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions;
respond to requests from data subjects, their representatives and the authorized body for the protection of data subjects’ rights;
fulfil other obligations under the Personal Data Law.

6. Updating, correcting, deleting and destroying personal data; responding to access requests

6.1. Confirmation of processing, its legal grounds and purposes, and other information listed in Part 7 of Article 14 of the Personal Data Law are provided to the data subject or their representative upon contact or request. This information does not include personal data of other data subjects unless there are legal grounds to disclose it.

A request must contain the number of the identity document of the data subject or their representative, its date of issue and issuing authority; information confirming the data subject’s relationship with the Operator (contract number and date, conventional designation and/or other information) or otherwise confirming that the Operator processes their data; and the signature of the data subject or their representative. A request may be sent as an electronic document signed with an electronic signature under Russian law.

If a request does not contain all required information or the data subject has no right of access to the requested information, a reasoned refusal is sent. The data subject’s right of access may be restricted in cases expressly provided for by the Personal Data Law.

6.2. If unlawful processing is detected upon a request of the data subject, their representative or the authorized body, the Operator blocks the unlawfully processed personal data for the period of verification. If inaccurate personal data is detected, the Operator blocks it for the period of verification, provided this does not violate the rights and legitimate interests of the data subject or third parties.

6.3. If inaccuracy is confirmed, the Operator corrects the personal data within seven business days of receiving the relevant information and lifts the block.

6.4. If unlawful processing by the Operator is detected, the Operator stops it within three business days. If lawful processing cannot be ensured, the Operator destroys the personal data within ten business days and notifies the data subject or their representative, and, where the request came from the authorized body, that body as well.

6.5. When the purposes of processing are achieved or consent is withdrawn, personal data is destroyed unless:

otherwise provided by a contract to which the data subject is a party, beneficiary or guarantor;
the Operator is entitled to process the data without consent on grounds provided by the Personal Data Law or other federal laws;
otherwise provided by another agreement between the Operator and the data subject.

7. Final provisions

7.1. Liability for violating Russian law and FILIPCHIK STUDIOS LLC regulations on personal data is determined in accordance with Russian law.

7.2. This Policy enters into force upon approval and remains valid indefinitely or until a new Policy is adopted.

7.3. If Russian legislation changes, this Policy applies to the extent it does not contradict the law until it is brought into line with the amended rules.

7.4. The Operator sets, amends and cancels the terms of this Policy unilaterally without prior notice to data subjects.

General Director of FILIPCHIK STUDIOS LLC A. O. Filipchik