Personal Data Processing Policy
GENERAL PROVISIONS
1.1. This policy on personal data processing (hereinafter referred to as the "Policy") has been developed for the St. Petersburg State Budgetary Institution of Culture "State Museum of the History of St. Petersburg" (hereinafter referred to as the Museum) in pursuance of the requirements of paragraph 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter referred to as the "Law on Personal Data") in order to ensure the protection of the rights and freedoms of man and citizen during the processing of his personal data, including the protection of rights to privacy, personal and family secrecy.
1.2. This Policy applies to the following categories of personal data subjects, information about which is processed by the Museum: employees; counterparties; visitors; website users. It applies to all personal data processing processes carried out by the Museum.
1.3. Within the framework of compliance with the requirements of the "Law on Personal Data", the Museum sets itself the following key tasks:
− ensuring the legality of personal data processing;
− ensuring the necessary level of protection of the processed personal data.
1.4. Basic concepts used in the Policy:
Personal data — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).
Personal data operator (Operator) — the Museum, independently or jointly with other legal entities (natural persons) organizing and/or carrying out personal data processing, as well as determining the purposes of personal data processing, the composition of personal data subject to processing, actions (operations) performed with personal data.
Personal data processing — any action (operation) or set of actions (operations) with personal data performed using automation tools or without their use. Personal data processing includes, among other things: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction.
Automated personal data processing — personal data processing using computer technology.
Dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons.
Provision of personal data — actions aimed at disclosing personal data to a certain person or a certain circle of persons.
Blocking of personal data — temporary termination of personal data processing (except for cases where processing is necessary to clarify personal data).
Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the material carriers of personal data are destroyed.
Depersonalization of personal data — actions as a result of which it becomes impossible, without using additional information, to determine the belonging of personal data to a specific personal data subject.
Personal data information system — a set of personal data contained in databases and information technologies and technical means ensuring their processing.
Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign natural person or a foreign legal entity.
Unauthorized access to information — access to information that violates the established rules of access differentiation, using standard computer technology or automated systems.
Information protection means — software and/or software and hardware means designed to solve information protection tasks, including preventing leakage and ensuring the security of protected data.
Threats to personal data security — a set of conditions and factors creating a risk of unauthorized, including accidental, access to personal data, which may lead to their destruction, modification, blocking, copying, dissemination, as well as other unlawful actions during data processing.
Integrity of personal data — the ability of computer technology or information systems to ensure the immutability of personal data under conditions of accidental and/or intentional distortions or destruction.
Website — a set of programs for electronic computing machines and other information contained in an information system, access to which is provided via the information and telecommunications network Internet and which is located at:
https://www.spbmuseum.ru.
1.5. Basic rights and obligations of the Operator.
1.5.1. The Operator has the right:
• to independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Law on Personal Data and normative legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
• to entrust personal data processing to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with this person. The person carrying out personal data processing on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Law on Personal Data;
• in case the personal data subject withdraws consent to personal data processing, the Operator has the right to continue personal data processing without the consent of the personal data subject if there are grounds specified in the Law on Personal Data.
1.5.2. The Operator is obliged:
• to organize personal data processing in accordance with the requirements of the Law on Personal Data;
• to respond to appeals and requests of personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
• to inform the authorized body for the protection of the rights of personal data subjects (hereinafter referred to as "Roskomnadzor") at the request of this body of the necessary information within 10 working days from the date of receipt of such request.
1.6. Basic rights of Personal Data Subjects. The personal data subject has the right:
• to receive information concerning the processing of his personal data, except for cases provided for by federal laws. Information is provided to the Personal Data Subject by the Operator in an accessible form, and it must not contain personal data relating to other Personal Data Subjects, except for cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
• to demand from the Operator clarification of his personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the declared purpose of processing;
• to appeal to Roskomnadzor or in court against unlawful actions or inaction of the Operator during the processing of his personal data;
• to protect his rights and interests, including to demand compensation for losses and moral harm in court.
1.7. The personal data subject may exercise the rights to receive information concerning the processing of his personal data, as well as the rights to clarify his personal data, block or destroy them, by contacting the Operator with a corresponding request at the address: 197046, St. Petersburg, Petropavlovskaya Fortress, 3, or by contacting the Operator with a corresponding request by email: gmi@spbmuseum.ru.
1.8. Control over the implementation of the requirements of this Policy is carried out by the authorized person responsible for organizing personal data processing at the Operator.
1.9. Responsibility for violation of the requirements of the legislation of the Russian Federation and local acts of the Operator in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.
PRINCIPLES OF PERSONAL DATA PROCESSING
2.1. Personal data processing is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation and on the basis of the following principles:
• legality and fair basis;
• limitation of personal data processing to the achievement of specific, predetermined and lawful purposes;
• prevention of personal data processing incompatible with the purposes of personal data collection;
• prevention of combining databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
• processing only those personal data that meet the purposes of their processing;
• compliance of the content and volume of processed personal data with the declared purposes of processing;
• prevention of processing of personal data excessive in relation to the declared purposes of their processing;
• ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of personal data processing;
• destruction or depersonalization of personal data upon achievement of the purposes of their processing or in case of loss of necessity to achieve these purposes, if it is impossible for the Operator to eliminate the violations of personal data committed, unless otherwise provided by federal law.
LEGAL GROUNDS FOR PERSONAL DATA PROCESSING
3.1. The legal basis for personal data processing is a set of normative legal acts in pursuance of which and in accordance with which the Operator carries out personal data processing, including:
• Constitution of the Russian Federation;
• Labor Code of the Russian Federation;
• Civil Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
• Federal Law No. 402-FZ of December 6, 2011 "On Accounting";
• other normative legal acts regulating relations related to the Operator's activities;
• local legal acts of the Museum and this Policy.
3.2. The legal basis for personal data processing also includes:
• contracts concluded with the Personal Data Subject;
• consent of the Personal Data Subject to personal data processing;
• obligation of non-disclosure of information containing personal data.
PURPOSES, COMPOSITION AND GROUNDS FOR PERSONAL DATA PROCESSING
4.1. The Operator processes personal data for the following purposes:
4.1.1. Compliance with labor legislation:
− performance of the functions and duties of the Museum as an employer;
− filling vacant positions at the Museum;
− formation of a personnel reserve;
− ensuring access control on the territory of the Museum.
4.1.2. Ensuring proper fulfillment of the terms of contracts with counterparties.
4.1.3. Provision and promotion of services provided by the Museum corresponding to the Charter purposes, including its own products (services, events, expositions, exhibitions and others) and brand by carrying out marketing (advertising, PR) and other events.
4.1.4. Improvement of information provision technologies:
− improvement of the website;
− processing of incoming requests from the Website and the Museum's email;
− provision of information about the Museum's activities;
− maintaining statistics.
4.1.5. Organization of video surveillance on the territory of the Museum.
4.2. The given list of processed personal data is exhaustive. In exceptional cases, the collection of additional data about the Subject is allowed, which must be reflected in the Subject's consent to personal data processing or in the contract with him.
4.3. The Operator does not process special categories of personal data and biometric data, except for cases expressly provided for by this Policy.
4.4. The Operator does not use personal data for advertising, promotion of goods and services or political agitation, and also does not create publicly available sources of personal data.
4.5. The composition of personal data strictly corresponds to the principle of sufficiency for achieving the purposes of processing with control of the absence of redundancy.
VOLUME, CATEGORIES AND CONDITIONS OF PROCESSED PERSONAL DATA, CATEGORIES OF PERSONAL DATA SUBJECTS IN RELATION TO THE DECLARED PURPOSES OF PERSONAL DATA PROCESSING
5.1 Personal data processing is limited to the achievement of specific, predetermined and lawful purposes. Personal data processing incompatible with the purposes of personal data collection is not allowed. Only personal data that meet the purposes of their processing are subject to processing.
5.2. The content and volume of processed personal data must correspond to the declared purposes of processing provided for in this section. The processed personal data must not be excessive in relation to the declared purposes of their processing.
5.3. In accordance with this Policy, the Operator may process personal data belonging to the following categories of Personal Data Subjects:
• employees of the Operator;
• counterparties of the Operator;
• clients of the Operator;
• visitors of the Operator's Website.
5.4. Personal data processing for the purposes of ensuring compliance with the labor legislation of the Russian Federation.
5.4.1. In accordance with this section of the Policy, the Operator determines the categories and list of processed personal data, categories of subjects whose personal data are processed, methods, terms of their processing and storage, the procedure for destroying personal data upon achievement of the purpose of their processing or upon occurrence of other lawful grounds in relation to such a purpose as "ensuring compliance with the labor legislation of the Russian Federation (including assistance to employees in employment, obtaining education and promotion, ensuring personal safety of employees, monitoring the quantity and quality of work performed and ensuring the safety of property, ensuring compliance with laws and other normative legal acts)".
5.4.2. For the purpose specified in this section of the Policy, the Operator processes personal data belonging to the following category(ies) of personal data subjects as:
• employees of the Operator.
5.4.3. The Operator processes the following categories and list of personal data of employees for the purpose specified in this section of the Policy:
a) processing of general (other) categories of personal data of employees is carried out in accordance with the following list:
• surname, name, patronymic;
• address of residence;
• date and place of birth;
• gender;
• military registration data;
• driver's license data;
• information about education, qualifications, academic degree;
• information about advanced training and professional retraining;
• work experience, information from the employment record book;
• bank account details;
• contact phone number and email address;
• information about disability;
• information about criminal record or criminal prosecution;
• participation in management bodies of other organizations;
• passport data;
• contact phone number;
• information about vehicles;
• financial situation and income;
• position;
• taxpayer identification number (TIN);
• insurance number of individual personal account (SNILS);
• information about the right to tax deductions and benefits;
• details of the death certificate (if applicable);
• marital status;
• personal data of relatives of employees necessary for processing personnel documents, obtaining social deductions and benefits:
− surname, name, patronymic;
− date of birth;
− birth certificate of minor children;
− certificate from the spouse's place of work;
b) processing of special categories of personal data of employees is carried out in accordance with the requirements of the legislation of the Russian Federation, namely:
• information about health status;
• state affiliation (citizenship);
c) processing by the Operator of biometric personal data of employees (information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established) is carried out in accordance with the requirements of the legislation of the Russian Federation, namely:
• facial image data obtained using photo and video devices.
5.4.4. The Operator carries out mixed processing of personal data of employees for the purpose specified in this section of the Policy with transfer via the internal network, with transfer via the Internet.
5.4.5. The list of actions performed by the Operator with personal data of employees for the purpose specified in this section of the Policy: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), blocking, deletion, destruction.
5.4.6. Processing of personal data of employees does not require obtaining appropriate consent provided that the volume of personal data processed by the Operator corresponds to the purpose of ensuring compliance with the labor legislation of the Russian Federation specified in this section of the Policy, on the basis of paragraph 2 of part 1 of Article 6 of the Law on Personal Data.
5.4.7. When concluding an employment contract, employees provide the Operator with the following documents containing their personal data:
• passport or other identity document;
• employment record book and/or information about labor activity, except for cases when the employment contract is concluded for the first time;
• document confirming registration in the individual (personalized) accounting system, including in the form of an electronic document;
• military registration documents — for those liable for military service and persons subject to conscription for military service;
• document on education and/or qualifications or availability of special knowledge — when applying for a job requiring special knowledge or special training;
• other documents in accordance with the requirements of the legislation and this Policy.
5.4.8. In the case of initial conclusion of an employment contract with employees, the employment record book and the state pension insurance certificate are issued by the Operator.
5.4.9. If, in accordance with the legislation, other documents are required for the employment of employees, the Operator asks persons applying for work to provide such documents containing their personal data.
5.4.10. The Operator stores personal data of employees in a form that allows identifying the personal data subjects no longer than required by the purpose of personal data processing specified in this section of the Policy, unless the storage period of personal data is established by federal law.
5.4.11. The Operator processes personal data of dismissed employees in cases and within the timeframes provided for by the legislation of the Russian Federation. Such cases include, among other things, personal data processing within the framework of accounting and tax accounting, including to ensure the preservation of documents necessary for calculating, withholding and transferring tax.
5.4.12. The Operator is obliged to store accounting documentation for the periods established in accordance with the rules for organizing state archival affairs, but the minimum storage period cannot be less than 5 (five) years.
5.4.13. After the expiration of the periods determined by the legislation of the Russian Federation, personal files of employees and other documents are transferred to archival storage.
5.4.14. The Operator does not disclose to third parties or disseminate personal data of employees for the purpose specified in this section of the Policy without the consent of employees, unless otherwise provided by the legislation of the Russian Federation.
Consent of employees is not required in cases of transfer by the Operator of personal data of employees to tax authorities, military commissariats, trade union bodies, provided for by the current legislation of the Russian Federation, as well as upon receipt, within the established powers, of motivated requests from prosecutor's bodies, law enforcement bodies, security bodies, from state labor inspectors during their implementation of state supervision and control over compliance with labor legislation and other bodies authorized to request information about employees in accordance with the competence provided for by the current legislation of the Russian Federation (hereinafter referred to as competent bodies).
5.4.15. When transferring personal data of employees, the Operator must comply with the following requirements:
• it is prohibited to disclose personal data of employees to a third party without the written consent of employees, except for cases when this is necessary in order to prevent a threat to the life and health of employees, as well as in cases established by the current legislation of the Russian Federation;
• the employee transferring personal data of employees of the Operator is obliged to warn persons receiving personal data of employees that these data can be used only for the purposes for which they were communicated, and to require these persons to confirm compliance with this rule. Persons receiving personal data of employees of the Operator are obliged to observe the confidentiality regime. This provision does not apply to the exchange of personal data of employees in the manner established by the current legislation of the Russian Federation;
• the employee transferring personal data of employees of the Operator has the right to transfer their personal data to representatives of employees in the manner established by the Labor Code of the Russian Federation, and to limit this information only to those personal data of employees that are necessary for the performance by the said representatives of their functions;
• transfer of personal data of employees to the Pension and Social Insurance Fund of the Russian Federation (Social Fund of Russia) in the manner established by federal laws, in particular the Federal Law "On Compulsory Pension Insurance in the Russian Federation", the Federal Law "On the Basics of Compulsory Social Insurance", the Federal Law "On Compulsory Medical Insurance in the Russian Federation" is carried out without the consent of employees;
• transfer of personal data of employees to competent bodies is carried out in accordance with the legislation of the Russian Federation, including participation in court proceedings.
5.4.16. The Operator does not carry out cross-border transfer of personal data of employees for the purpose specified in this section of the Policy.
5.4.17. The terms of processing and storage of personal data for the purpose specified in this section of the Policy are established during the validity of the employment contract and 5 (five) years after termination of the employment contract.
5.5. Personal data processing for the purposes of preparing, concluding and executing contracts.
5.5.1. In accordance with this section of the Policy, the Operator determines the categories and list of processed personal data, categories of subjects whose personal data are processed, methods, terms of their processing and storage, the procedure for destroying personal data upon achievement of the purpose of their processing or upon occurrence of other lawful grounds in relation to such a purpose as "preparation, conclusion and execution of contracts".
5.5.2. For the purpose specified in this section of the Policy, the Operator processes personal data belonging to the following category(ies) of personal data subjects as:
• counterparties of the Operator;
• clients of the Operator.
5.5.3. The Operator processes the following categories and list of personal data of counterparties and clients for the purpose specified in this section of the Policy:
a) processing of general (other) categories of personal data of counterparties and clients is carried out in accordance with the following list:
• surname, name, patronymic;
• address of residence;
• position;
• data on staffing level;
• passport data;
• contact phone number;
• email address;
• gender;
• SNILS;
• TIN;
• extract from the EGRN (EGRYU, EGRIP);
• membership in an SRO (for certain types of activity);
• types of permitted economic activity, availability of licenses (permits) (for certain types of activity);
• bank details and financial situation (for certain types of activity);
• information about education and qualifications (for certain types of activity);
• information about ownership of vehicles, construction and other special equipment;
• information about advanced training (for certain types of activity);
b) processing of special categories of personal data of counterparties and clients is not carried out;
c) processing of biometric personal data of clients (information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established) is carried out in accordance with the requirements of the legislation of the Russian Federation, namely:
• facial image data obtained using photo and video devices.
5.5.4. The Operator carries out mixed processing of personal data of counterparties and clients for the purpose specified in this section of the Policy with transfer via the internal network, with transfer via the Internet.
5.5.5. The list of actions performed by the Operator with personal data of counterparties and clients for the purpose specified in this section: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction, transfer (provision, access).
5.5.6. Processing of personal data of counterparties and clients does not require obtaining appropriate consent provided that the volume of personal data processed by the Operator corresponds to the purpose of preparing, concluding and executing a civil law contract specified in this section of the Policy, on the basis of paragraph 5 of part 1 of Article 6 of the Law on Personal Data.
5.5.7. The basis for processing is the need to perform a contract to which the data subject is a party.
5.5.8. The Operator does not disclose to third parties or disseminate personal data of counterparties and clients for the purpose specified in this section of the Policy without the consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation.
5.5.9. The Operator does not carry out cross-border transfer of personal data of counterparties and clients for the purpose specified in this section of the Policy.
5.5.10. The terms of processing and storage of personal data for the purpose specified in this section of the Policy are established during the validity of the contract with the client and the period established by legislation after termination of such contract.
5.6. Provision and promotion of services provided by the Museum corresponding to the Charter purposes, including its own products (services, events, expositions, exhibitions and others) and brand by carrying out marketing (advertising, PR) and other events.
5.6.1. For the purpose specified in this section of the Policy, the Operator processes personal data belonging to the following category(ies) of personal data subjects as:
• clients of the Operator;
• visitors of the Operator's Website.
5.6.2. The Operator processes the following categories and list of personal data of clients and visitors for the purpose specified in this section of the Policy:
a) processing of general (other) categories of personal data of clients and visitors is carried out in accordance with the following list:
• surname, name, patronymic;
• contact phone number;
• email address;
• other information that the subject may provide when filling out the request;
b) processing of special categories of personal data of clients and visitors is not carried out;
c) processing of biometric personal data of clients and visitors (information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established) is not carried out.
5.6.3. The Operator carries out mixed processing of personal data of clients and visitors for the purpose specified in this section of the Policy with transfer via the internal network, with transfer via the Internet.
5.6.4. The list of actions performed by the Operator with personal data of clients and visitors for the purpose specified in this section: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction.
5.6.5. Processing of personal data of clients and visitors for the purpose specified in this section of the Policy is carried out subject to obtaining prior consent to such processing.
5.6.6. The Operator does not disclose to third parties or disseminate personal data of clients and visitors for the purpose specified in this section of the Policy without the consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation.
5.6.7. The Operator does not carry out cross-border transfer of personal data of clients and visitors for the purpose specified in this section of the Policy.
5.6.8. The terms of processing and storage of personal data of visitors for the purpose specified in this section of the Policy are established from the moment of receipt of personal data of visitors until the moment of achievement of the purpose of personal data processing — offering and promoting own products and brand on the market by carrying out marketing (advertising, PR) events and sales stimulation.
5.7. Improvement of information provision technologies.
5.7.1. For the purpose specified in this section of the Policy, the Operator processes personal data belonging to the following category(ies) of personal data subjects as:
• visitors of the Operator's Website
5.7.2. The Operator processes behavioral information and preferences:
a) obtaining general (other) categories of personal data of visitors is carried out through analytical services Yandex.Metrica, Yandex Webmaster, through messengers Telegram and Max, social networks: VK;
− in accordance with the request posted on the website;
− technical data of the browser and device;
− IP addresses and time of actions on the website.
b) processing of special categories of personal data of visitors is not carried out;
c) processing of biometric personal data of visitors (information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established) is not carried out.
5.7.3. The Operator carries out mixed processing of personal data of visitors for the purpose specified in this section of the Policy with transfer via the internal network, with transfer via the Internet.
5.7.4. The list of actions performed by the Operator with personal data of visitors for the purpose specified in this section: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion, destruction.
5.7.5. Processing of personal data of visitors for the purpose specified in this section of the Policy is carried out subject to obtaining prior consent to such processing.
5.7.6. The Operator does not disclose to third parties or disseminate personal data of visitors for the purpose specified in this section of the Policy without the consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation.
5.7.7. The Operator does not carry out cross-border transfer of personal data of visitors for the purpose specified in this section of the Policy.
5.7.8. The terms of processing and storage of personal data of visitors for the purpose specified in this section of the Policy are established from the moment of receipt of personal data of visitors until the moment of achievement of the purpose of personal data processing — processing of incoming requests from the Website.
5.7.9. Processing is based on the user's consent expressed through a cookie banner.
5.7.10. Data is processed automatically, with different storage periods for "session" and "persistent" cookies: from a session to one year.
5.8. Personal data processing for the organization of video surveillance on the territory of the Museum.
5.8.1. For the purpose of organizing video surveillance, the Operator processes the following data:
− video image of face and body.
5.8.2. Video surveillance is organized for the purposes of monitoring the safety of employees and visitors of the Museum and work performed on the territory of the Museum.
5.8.3. Processing is carried out automatically with the following actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, blocking, deletion.
5.8.4. Video recordings are stored for no more than 14 days from the moment of recording.
5.9. Processing of personal data permitted for dissemination for the purpose of providing information about the Museum's activities.
5.9.1. The Operator publishes personal data of employees permitted for dissemination on the official website for the purpose of providing information about the Company's activities.
5.9.2. Processing of such data is carried out only with separate consent of the subject, which is valid from the moment of provision until termination of the employment contract or withdrawal of consent.
5.9.3. At the request of the subject, access to his personal data from public sources may be terminated.
5.9.4. The personal data subject previously permitted for dissemination has the right to demand termination of transfer or dissemination of his data in case of violation of requirements or to apply with such a demand to court.
PROCEDURE FOR COLLECTION AND STORAGE OF PERSONAL DATA
6.1. Within the framework of its activities, the Operator, on the basis of an appropriate contract and with the consent of the personal data subject, has the right to collect and store personal data.
6.2. The procedure for collection, the list of departments and officials having access to the collection, storage and processing of personal data is regulated by local legal acts of the Museum.
6.3. The terms of processing and storage of personal data are established based on the purposes of processing and are fixed for each category of subjects and purposes of processing. Terms may also be regulated by contractual terms in which the personal data subject acts as a party, beneficiary or guarantor, requirements of the legislation of the Russian Federation and regulatory acts of regulators.
6.4. When collecting personal data, including via the information and telecommunications network Internet, the Operator ensures recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.
6.5. Persons who have transferred to the Operator information about another Personal Data Subject, including through the Website, without having the consent of the subject whose personal data was transferred, bear responsibility in accordance with the legislation of the Russian Federation.
6.6. The Operator stores personal data in a form that allows identifying the personal data subject no longer than required by the purposes of personal data processing, unless the storage period of personal data is established by federal law or a contract to which the Personal Data Subject is a party, beneficiary or guarantor.
6.7. The Operator strictly adheres to the principles of data minimization and data processing terms. Processed personal data is subject to destruction in the following cases:
• achievement of the purposes of personal data processing;
• receipt of withdrawal of consent to personal data processing or expiration of the consent to personal data processing;
• loss of necessity to achieve the purposes of personal data processing;
• exclusion of the Operator from the Unified State Register of Individual Entrepreneurs.
6.8. After the expiration of the specified periods, the Operator may process personal data if processing is necessary for the Operator's compliance with the legislation of the Russian Federation.
6.9. The Operator does not collect personal data concerning political, religious and other beliefs, as well as the private life of the personal data subject.
PERSONAL DATA PROTECTION
7.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, dissemination and other unauthorized actions, including:
• determines threats to the security of personal data during their processing;
• adopts local normative acts and other documents regulating relations in the field of personal data processing and protection;
• appoints persons responsible for ensuring the security of personal data in structural subdivisions and information systems of the Operator;
• creates the necessary conditions for working with personal data;
• organizes accounting of documents containing personal data;
• organizes work with information systems in which personal data is processed;
• stores personal data in conditions under which their safety is ensured and unlawful access to them is excluded;
• organizes training of the Operator's employees engaged in personal data processing.
7.2. The security of personal data processed by the Operator is ensured through a complex of legal, organizational, technical and software measures aimed at protecting personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as other unlawful actions in relation to personal data.
7.3. To ensure the security of personal data during their processing, the Museum applies the following organizational and technical measures:
− assessment of possible harm that may be caused to personal data subjects in case of violation of the requirements of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data";
− internal control over compliance with the requirements of the legislation of the Russian Federation in the field of personal data processing;
− training and familiarization of the Museum's employees with the rules for working with personal data and relevant local normative acts;
− provision of security and fire alarms;
− implementation of an access control and management system for personal data;
− use of anti-virus protection means, firewalls, data backup.
7.4. The objects of protection at the Museum are:
− personal data stored in documented form on paper media;
− personal data processed and stored on servers and automated workstations of users;
− personal data transmitted via communication channels;
− applied and system software of servers and workstations used for personal data processing;
− hardware of software and technical complexes, server equipment, workstations and communication equipment;
− information protection means of personal data information systems.
7.5. The Operator carries out careful selection and motivation of personnel within the framework of personnel policy, which helps minimize the risks of violation of personal data security by employees.
UPDATING, CORRECTION, DELETION AND DESTRUCTION OF PERSONAL DATA, RESPONSES TO REQUESTS OF SUBJECTS FOR ACCESS TO PERSONAL DATA
8.1. Confirmation of the fact of personal data processing by the Operator, legal grounds and purposes of personal data processing, as well as other information specified in part 7 of Article 14 of the Law on Personal Data, are provided by the Operator to the Personal Data Subject or his representative upon application or upon receipt of a request from the Personal Data Subject or his representative within 10 (ten) working days from the moment of receipt of the application or receipt of the request. The provided information does not include personal data relating to other Personal Data Subjects, except for cases where there are legal grounds for disclosing such personal data.
8.2. The request must contain:
• number of the main document proving the identity of the Personal Data Subject or his representative, information about the date of issue of the said document and the body that issued it;
• information confirming the participation of the Personal Data Subject in relations with the Operator (contract number, date of conclusion of the contract, conditional verbal designation and/or other information), or information otherwise confirming the fact of personal data processing by the Operator;
• signature of the Personal Data Subject or his representative.
8.3. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
8.4. If the appeal (request) of the Personal Data Subject does not reflect, in accordance with the requirements of the Law on Personal Data, all necessary information or the subject does not have access rights to the requested information, then a reasoned refusal is sent to him.
8.5. The right of the Personal Data Subject to access his personal data may be limited in accordance with part 8 of Article 14 of the Law on Personal Data, including if the access of the Personal Data Subject to his personal data violates the rights and legitimate interests of third parties.
8.6. In case of detection of inaccurate personal data upon application of the Personal Data Subject or his representative or upon their request or upon request of Roskomnadzor, the Operator blocks personal data relating to this Personal Data Subject from the moment of such application or receipt of the said request for the period of verification, if blocking of personal data does not violate the rights and legitimate interests of the Personal Data Subject or third parties.
8.7. In case of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the personal data subject or his representative or Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the day of submission of such information and removes the blocking of personal data.
8.8. Personal data is subject to destruction by the Operator in the following cases:
• achievement of the purposes of personal data processing;
• withdrawal by the personal data subject of consent to the processing of his personal data;
• detection of unlawful actions with personal data, as well as in other cases provided for by the current legislation of the Russian Federation.
8.9. In case of achievement of the purpose of personal data processing, the Operator undertakes to stop personal data processing or ensure its termination (if personal data processing is carried out by another person acting on behalf of the Operator) and destroy personal data or ensure their destruction (if personal data processing is carried out by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date of achievement of the purpose of personal data processing, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, or another agreement between the Operator and the personal data subject, or unless the Operator is not entitled to process personal data without the consent of the personal data subject.
8.10. In case the personal data subject has withdrawn his consent to personal data processing, the Operator undertakes to stop their processing or ensure termination of such processing (if personal data processing is carried out by another person acting on behalf of the Operator) and, if storage of personal data is no longer required for the purposes of personal data processing, destroy personal data or ensure their destruction (if personal data processing is carried out by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date of receipt of the said withdrawal, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, or another agreement between the Operator and the personal data subject, or unless the Operator is not entitled to process personal data without the consent of the personal data subject.
8.11. In case of detection of unlawful processing of personal data carried out by the Operator or a person acting on behalf of the Operator, and the impossibility of ensuring the lawfulness of personal data processing, the Operator, within a period not exceeding ten working days from the date of detection of unlawful processing of personal data, undertakes to destroy such personal data or ensure their destruction. The Operator undertakes to notify the personal data subject or his representative about the destruction of personal data, and if the application of the personal data subject or his representative or the request of the authorized body for the protection of the rights of personal data subjects were sent by the authorized body for the protection of the rights of personal data subjects, also the said body.
CONFIDENTIALITY OF PERSONAL DATA
9.1. The Operator ensures the confidentiality of personal data of subjects in full accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data".
9.2. Access to personal data and their transfer to third parties are regulated by federal legislation of the Russian Federation, as well as internal normative acts of the Museum and are provided exclusively within the framework provided for by legislation.
9.3. Museum employees who have been granted access to personal data undertake to maintain their confidentiality in accordance with the terms of the employment contract and internal normative acts of the Museum.
FINAL PROVISIONS
10.1. The Operator has the right to send informational messages to the Personal Data Subject via email, SMS and push notifications.
10.2. In pursuance of the requirements of part 2 of Article 18.1 of the Law on Personal Data, this Policy is posted at the location of the Operator, in free access on the information and telecommunications network "Internet" on the Website.