1.1. This Policy of Limited Liability Company "Medvezhiy Kamen" on Personal Data Processing (hereinafter, the "Policy") has been developed pursuant to Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated 27 July 2006 "On Personal Data" (hereinafter, the "Personal Data Law") for the purpose of protecting the rights and freedoms of individuals and citizens in the processing of their personal data, including the rights to privacy and personal and family confidentiality.
1.2. The Policy applies to all personal data processed by Limited Liability Company "Medvezhiy Kamen" (hereinafter, the "Operator", LLC "MK").
1.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after approval of this Policy.
1.4. Pursuant to Part 2, Article 18.1 of the Personal Data Law, this Policy is published in the public domain on the Operator’s website on the Internet.

1.5. Key terms used in the Policy:
personal data — any information relating directly or indirectly to an identified or identifiable individual (personal data subject);
personal data operator (operator) — a state authority, municipal authority, legal entity or individual that, independently or jointly with other persons, organizes and/or carries out the processing of personal data and determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data;
personal data processing — any action (operation) or set of actions (operations) performed with personal data, whether by automated means or without the use of such means. Personal data processing includes, among other things:
·   collection;
·   recording;
·   systematization;
·   accumulation;
·   storage;
·   clarification (updating, modification);
·   retrieval;
·   use;
·   transfer (dissemination, provision, access);
·   anonymization;
·   blocking;
·   deletion;
·   destruction;
automated processing of personal data — processing of personal data by means of computer technology;
dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons;
provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons;
blocking of personal data — temporary suspension of personal data processing (except where processing is necessary to clarify personal data);
destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which physical media containing personal data are destroyed;
anonymization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine that personal data belong to a specific personal data subject;
personal data information system — a set of personal data contained in databases together with the information technologies and technical means used to process such data.
1.6. Principal rights and obligations of the Operator.
1.6.1. The Operator has the right to:
1)   independently determine the composition and list of measures necessary and sufficient to ensure fulfillment of the obligations provided for by the Personal Data Law and regulations adopted pursuant thereto, unless otherwise provided by the Personal Data Law or other federal laws;
2)   entrust the processing of personal data to another person, with the consent of the personal data subject unless otherwise provided by federal law, on the basis of an agreement concluded with such person. A person processing personal data on behalf of the Operator must comply with the principles and rules for personal data processing stipulated by the Personal Data Law, maintain the confidentiality of personal data, and take the necessary measures aimed at ensuring fulfillment of the obligations stipulated by the Personal Data Law;
3)   if a personal data subject withdraws consent to the processing of personal data, the Operator may continue processing personal data without the subject’s consent where grounds specified in the Personal Data Law exist.
1.6.2. The Operator shall:
1)   organize personal data processing in accordance with the requirements of the Personal Data Law;
2)   respond to applications and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
3)   provide the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)), at its request, with the necessary information within 10 business days from the date such request is received. This period may be extended by no more than five business days. To do so, the Operator must send Roskomnadzor a reasoned notice stating the grounds for extending the period for providing the requested information;
4)   in the manner determined by the federal executive authority authorized in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including notifying it of computer incidents that resulted in unlawful transfer (provision, dissemination, access) of personal data.
1.7. Principal rights of a personal data subject. A personal data subject has the right to:
1)   receive information concerning the processing of their personal data, except in cases provided for by federal laws. Such information shall be provided by the Operator to the personal data subject in an accessible form and shall not contain personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
2)   require the Operator to clarify, block or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and take measures provided by law to protect their rights;
3)   give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
4)   appeal unlawful actions or omissions of the Operator in processing their personal data to Roskomnadzor or before a court.
1.8. Compliance with the requirements of this Policy shall be monitored by the authorized person responsible for organizing personal data processing by the Operator.
1.9. Liability for violation of the requirements of the legislation of the Russian Federation and the internal regulations of LLC "MK" in the field of personal data processing and protection shall be determined in accordance with the legislation of the Russian Federation.

2.1. Personal data processing shall be limited to achieving specific, predetermined and lawful purposes. Processing personal data in a manner incompatible with the purposes for which the personal data were collected is not permitted.
2.2. Only personal data that correspond to the purposes of their processing shall be processed.
2.3. The Operator processes personal data for the following purposes:
·   carrying out its activities in accordance with the charter of LLC "MK", including entering into and performing agreements with counterparties;
·   compliance with labor legislation within the framework of employment and other directly related relations, including: assisting employees with employment, education and career advancement; recruiting and selecting candidates for employment with the Operator; ensuring employees' personal safety; monitoring the quantity and quality of work performed; safeguarding property; maintaining personnel and accounting records; completing and submitting required reporting forms to authorized bodies; and arranging individual (personalized) registration of employees in the mandatory pension insurance and mandatory social insurance systems;
·   implementing access control procedures;
·   processing applications and inquiries, providing feedback to website visitors, sending newsletters, analytics, and improving the operation of the website.
·   other purposes related to the activities actually carried out by the Operator.
2.4. Personal data of employees may be processed solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

3.1. The legal grounds for personal data processing comprise the set of regulatory legal acts pursuant to and in accordance with which the Operator processes personal data, including:
·   the Constitution of the Russian Federation;
·   the Civil Code of the Russian Federation;
·   the Labor Code of the Russian Federation;
·   the Tax Code of the Russian Federation;
·   Federal Law No. 14-FZ dated 8 February 1998 "On Limited Liability Companies";
·   Federal Law No. 402-FZ dated 6 December 2011 "On Accounting";
·   Federal Law No. 167-FZ dated 15 December 2001 "On Mandatory Pension Insurance in the Russian Federation";
·   other regulatory legal acts governing relations associated with the Operator’s activities.
3.2. The legal grounds for personal data processing also include:
·   the charter of LLC "MK";
·   agreements concluded between the Operator and personal data subjects;
·   consent of personal data subjects to the processing of their personal data.

4.1. The content and scope of personal data processed shall correspond to the stated processing purposes set out in Section 2 of this Policy. Personal data processed shall not be excessive in relation to the stated purposes of their processing.
4.2. The Operator may process personal data of the following categories of personal data subjects.
4.2.1. Candidates for employment with the Operator — for the purposes of compliance with labor legislation within the framework of employment and other directly related relations and implementation of access control procedures:
·   surname, first name, patronymic;
·   sex;
·   citizenship;
·   date and place of birth;
·   contact details;
·   information on education, work experience and qualifications;
·   other personal data provided by candidates in CVs and cover letters.
4.2.2. Current and former employees of the Operator — for the purposes of compliance with labor legislation within the framework of employment and other directly related relations and implementation of access control procedures:
·   surname, first name, patronymic;
·   sex;
·   citizenship;
·   date and place of birth;
·   image (photograph);
·   passport details;
·   registered residential address;
·   actual residential address;
·   contact details;
·   taxpayer identification number (INN);
·   individual insurance account number (SNILS);
·   information on education, qualifications, vocational training and professional development;
·   marital status, children and family relationships;
·   employment history, including incentives, awards and/or disciplinary sanctions;
·   marriage registration details;
·   military registration information;
·   disability information;
·   information on alimony withholding;
·   information on income from the previous place of employment;
·   other personal data provided by employees in accordance with the requirements of labor legislation.
4.2.3. Family members of the Operator’s employees — for the purposes of compliance with labor legislation within the framework of employment and other directly related relations:
·   surname, first name, patronymic;
·   degree of kinship;
·   year of birth;
·   other personal data provided by employees in accordance with the requirements of labor legislation.
4.2.4. Clients and counterparties of the Operator (individuals) — for the purposes of carrying out its activities in accordance with the charter of LLC "MK" and implementing access control procedures:
·   surname, first name, patronymic;
·   date and place of birth;
·   passport details;
·   registered residential address;
·   contact details;
·   position held;
·   taxpayer identification number (INN);
·   bank account number;
·   other personal data provided by clients and counterparties (individuals) that are necessary for entering into and performing agreements.
4.2.5. Representatives (employees) of the Operator’s clients and counterparties (legal entities) — for the purposes of carrying out its activities in accordance with the charter of LLC "MK" and implementing access control procedures:
·   surname, first name, patronymic;
·   passport details;
·   contact details;
·   position held;
·   other personal data provided by representatives (employees) of clients and counterparties that are necessary for entering into and performing agreements.
4.2.6. Website visitors; personal data voluntarily provided through forms:
• surname, first name, patronymic;
• telephone number;
• email address;
• other data in accordance with the website forms.
Technical data are also processed automatically: cookies, IP address, and analytics system data.
4.3. The Operator’s processing of biometric personal data (information characterizing a person’s physiological and biological characteristics on the basis of which their identity can be established) shall be carried out in accordance with the legislation of the Russian Federation.
4.4. The Operator does not process special categories of personal data relating to race, ethnicity, political views, religious or philosophical beliefs, health status or intimate life, except in cases provided for by the legislation of the Russian Federation.

5.1. Personal data shall be processed by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2. Personal data shall be processed with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation, and by the following services supporting the operation of the website: hosting provider, analytics service, and mailing service. No cross-border transfer of personal data is carried out.
5.3. For each processing purpose, the Operator processes personal data by the following methods:
·       non-automated personal data processing;
·       automated personal data processing with or without transmission of the information received via information and telecommunications networks;
·       mixed personal data processing.
·       The website uses cookies and analytics systems, such as Yandex Metrica, to ensure proper operation of the website and analyze traffic. A visitor may disable cookies in their browser settings. By continuing to use the website, the visitor consents to the processing of cookies.
5.4. Employees of the Operator whose job duties include personal data processing are permitted to process personal data.
5.5. Personal data processing for each purpose specified in Clause 2.3 of the Policy is carried out by:
·   obtaining personal data orally and in writing directly from personal data subjects;
·   entering personal data into the Operator’s logs, registers and information systems;
·   using other methods of personal data processing.
5.6. Disclosure to third parties and dissemination of personal data without the consent of the personal data subject are not permitted unless otherwise provided by federal law. Consent to the processing of personal data that the personal data subject has permitted for dissemination shall be executed separately from any other consents of the personal data subject to the processing of their personal data.
The requirements for the content of consent to the processing of personal data permitted by the personal data subject for dissemination were approved by Roskomnadzor Order No. 18 dated 24 February 2021.
5.7. Personal data shall be transferred to inquiry and investigative bodies, the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator shall take the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, dissemination and other unauthorized actions, including:
·   identifying threats to personal data security during processing;
·   adopting local regulations and other documents governing relations in the field of personal data processing and protection;
·   appointing persons responsible for ensuring personal data security in the Operator’s structural units and information systems;
·   creating the conditions necessary for working with personal data;
·   organizing the accounting and control of documents containing personal data;
·   organizing work with information systems in which personal data are processed;
·   storing personal data under conditions that ensure their preservation and prevent unlawful access;
·   organizing training for the Operator’s employees who process personal data.
5.9. The Operator shall store personal data in a form that allows the personal data subject to be identified for no longer than required for each purpose of personal data processing, unless a retention period is established by federal law or an agreement.
5.9.1. Personal data on paper media shall be stored by LLC "MK" for the document retention periods established by the legislation of the Russian Federation on archives (Federal Law No. 125-FZ dated 22 October 2004 "On Archival Affairs in the Russian Federation"; the List of Standard Administrative Archival Documents Generated in the Course of Activities of State Authorities, Local Self-Government Bodies and Organizations, with Indication of Their Retention Periods (approved by Order No. 236 of the Federal Archival Agency dated 20 December 2019)).
5.9.2. The retention period for personal data processed in personal data information systems shall correspond to the retention period for personal data on paper media.
5.10. The Operator shall cease processing personal data in the following cases:
·       unlawful processing has been identified — within three business days from the date of identification;
·       the purpose of processing has been achieved;
·       the consent of the personal data subject to the processing of such data has expired or been withdrawn where, under the Personal Data Law, processing of such data is permitted only with consent.
5.11. Upon achievement of the purposes of personal data processing, and also if the personal data subject withdraws consent to processing, the Operator shall cease processing such data unless:
·       otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
·       the Operator is entitled to carry out processing without the consent of the personal data subject on the grounds provided by the Personal Data Law or other federal laws;
·       otherwise provided by another agreement between the Operator and the personal data subject.
5.12. If a personal data subject submits a request to the Operator to cease processing personal data, such processing shall cease within a period not exceeding 10 business days from the date the Operator receives the relevant request, except in cases provided for by the Personal Data Law. This period may be extended by no more than five business days. To do so, the Operator must send the personal data subject a reasoned notice stating the grounds for the extension.
5.13. When personal data are collected, including via the Internet, recording, systematization, accumulation, storage, clarification (updating, modification) and retrieval of personal data of citizens of the Russian Federation using databases located outside the Russian Federation are not permitted, except in cases specified in the Personal Data Law.

6.1. Confirmation that the Operator processes personal data, the legal grounds and purposes of personal data processing, and other information specified in Part 7, Article 14 of the Personal Data Law shall be provided by the Operator to the personal data subject or their representative within 10 business days from the date of the application or receipt of the request from the personal data subject or their representative. This period may be extended by no more than five business days. To do so, the Operator shall send the personal data subject a reasoned notice stating the grounds for extending the period for providing the requested information.
The information provided shall not include personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data.
The request must contain:
·   the number of the principal identity document of the personal data subject or their representative, information on the date of issue of such document and the issuing authority;
·   information confirming the personal data subject’s participation in relations with the Operator (agreement number, date of conclusion, conventional verbal designation and/or other information), or information otherwise confirming that the Operator processes the personal data;
·   the signature of the personal data subject or their representative.
The request may be submitted in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
The Operator shall provide the information specified in Part 7, Article 14 of the Personal Data Law to the personal data subject or their representative in the same form in which the relevant application or request was submitted, unless otherwise specified in the application or request.
If an application (request) from a personal data subject does not contain all information required by the Personal Data Law, or if the subject does not have the right to access the requested information, a reasoned refusal shall be sent.
The right of a personal data subject to access their personal data may be restricted in accordance with Part 8, Article 14 of the Personal Data Law, including where the personal data subject’s access to their personal data would violate the rights and legitimate interests of third parties.
6.2. If inaccurate personal data are identified following an application by the personal data subject or their representative, or at their request or at the request of Roskomnadzor, the Operator shall block the personal data relating to that personal data subject from the moment such application or request is received for the period of verification, provided that blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
If the inaccuracy of personal data is confirmed, the Operator shall, on the basis of information provided by the personal data subject or their representative, Roskomnadzor, or other necessary documents, clarify the personal data within seven business days from the date such information is provided and shall remove the blocking of the personal data.
6.3. If unlawful processing of personal data is identified following an application (request) from the personal data subject or their representative, or from Roskomnadzor, the Operator shall block the unlawfully processed personal data relating to that personal data subject from the moment such application or request is received.
6.4. If the Operator, Roskomnadzor or another interested party identifies an unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) resulting in a violation of the rights of personal data subjects, the Operator shall:
·       within 24 hours — notify Roskomnadzor of the incident, the presumed causes that led to the violation of the rights of personal data subjects, the presumed harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provide information about the person authorized by the Operator to interact with Roskomnadzor on matters related to the incident;
·       within 72 hours — notify Roskomnadzor of the results of the internal investigation of the identified incident and provide information about the persons whose actions caused it (if available).
6.5. Procedure for destruction of personal data by the Operator.
6.5.1. Conditions and time limits for destruction of personal data by the Operator:
·       achievement of the purpose of personal data processing or loss of the need to achieve that purpose — within 30 days;
·       expiration of the maximum retention periods for documents containing personal data — within 30 days;
·       submission by the personal data subject (or their representative) of confirmation that the personal data were obtained unlawfully or are not necessary for the stated purpose of processing — within seven business days;
·       withdrawal by the personal data subject of consent to the processing of their personal data, if retention of such data is no longer required for the purpose of processing — within 30 days.
6.5.2. Upon achievement of the purpose of personal data processing, and also if the personal data subject withdraws consent to processing, the personal data shall be destroyed unless:
·   otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor;
·   the Operator is entitled to carry out processing without the consent of the personal data subject on the grounds provided by the Personal Data Law or other federal laws;
·   otherwise provided by another agreement between the Operator and the personal data subject.
6.5.3. Personal data shall be destroyed by a commission established by order of the General Director of LLC "MK".
6.5.4. Methods for destruction of personal data shall be established by the Operator’s local regulations.