Personal data processing policy

The Russian text is the official version of this policy.

1. General provisions

1.1. This Policy of the National Association of Experts in Primary Immunodeficiencies (NAEPID) on the processing of personal data (the Policy) is adopted in accordance with clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the Personal Data Law), in order to protect the rights and freedoms of a person and citizen when their personal data are processed, including the right to privacy and to personal and family secrecy.

1.2. The Policy applies to all personal data processed by the National Association of Experts in Primary Immunodeficiencies (the Operator, NAEPID).

1.3. The Policy applies to personal-data processing that arose for the Operator both before and after this Policy was approved.

1.4. In accordance with part 2 of Article 18.1 of the Personal Data Law, this Policy is published for free access on the Operator’s website.

1.5. The main terms used in the Policy:

personal data — any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject);

personal data operator (operator) — a state body, municipal body, legal entity, or natural person that, alone or jointly with others, organizes and/or carries out the processing of personal data and determines the purposes of processing, the composition of the personal data to be processed, and the actions (operations) performed with personal data;

processing of personal data — any action (operation) or set of actions (operations) with personal data, whether or not by automated means. Processing includes, among other things:

collection;
recording;
systematization;
accumulation;
storage;
updating (renewal, modification);
retrieval;
use;
transfer (distribution, provision, access);
depersonalization;
blocking;
deletion;
destruction.

automated processing of personal data — processing of personal data by means of computer technology;

distribution of personal data — actions aimed at disclosing personal data to an indefinite number of persons;

provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons;

blocking of personal data — temporary suspension of the processing of personal data (except where processing is necessary to clarify the personal data);

destruction of personal data — actions that make it impossible to restore the content of personal data in a personal data information system and/or that destroy the physical media containing personal data;

depersonalization of personal data — actions that make it impossible, without additional information, to determine that personal data belong to a specific personal data subject;

personal data information system — the personal data contained in databases together with the information technologies and technical means that process them;

cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to an authority of a foreign state, or to a foreign natural or legal person.

1.6. Principal rights and duties of the Operator.

1.6.1. The Operator may:

determine on its own the set of measures necessary and sufficient to fulfill the duties provided by the Personal Data Law and the regulations adopted under it, unless the Personal Data Law or another federal law provides otherwise;
entrust the processing of personal data to another person with the consent of the personal data subject, unless a federal law provides otherwise, under a contract with that person. A person processing personal data on the Operator’s instructions must follow the principles and rules of the Personal Data Law;
if a personal data subject withdraws consent, continue processing without that consent where the Personal Data Law provides grounds to do so.

1.6.2. The Operator must:

organize the processing of personal data in accordance with the Personal Data Law;
respond to requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;
provide the authority responsible for protecting the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media, Roskomnadzor), at that authority’s request, with the necessary information within 30 days of receiving the request.

1.7. Principal rights of the personal data subject. A personal data subject may:

receive information about the processing of their personal data, except in cases provided by federal law. The Operator provides that information in an accessible form, and it must not include personal data of other subjects unless there is a lawful ground to disclose them. The Personal Data Law sets out what information is provided and how it is obtained;
require the operator to correct, block, or destroy their personal data if the data are incomplete, outdated, inaccurate, obtained unlawfully, or are not necessary for the stated purpose, and to take the measures provided by law to protect their rights;
complain to Roskomnadzor or to a court about unlawful acts or omissions of the Operator in processing their personal data.

1.8. Compliance with this Policy is overseen by the person authorized to organize the processing of personal data at the Operator.

1.9. Liability for breach of the laws of the Russian Federation and of NAEPID’s rules on the processing and protection of personal data is determined under the laws of the Russian Federation.

2. Purposes of collecting personal data

2.1. Processing of personal data is limited to specific, predetermined, and lawful purposes. Personal data may not be processed in a way incompatible with the purposes for which they were collected.

2.2. Only personal data that meet the purposes of processing are subject to processing.

2.3. The Operator processes personal data for the following purposes:

compliance with the Constitution of the Russian Federation, federal laws, and other regulations of the Russian Federation;
carrying out its activities under the NAEPID charter;
personnel records;
assisting employees with employment, education, and promotion, protecting employees’ personal safety, monitoring the quantity and quality of work, and safeguarding property;
recruiting and selecting candidates for work with the Operator;
registering employees in the mandatory pension insurance system;
completing and submitting required reports to executive authorities and other authorized organizations;
civil-law relations;
accounting;
access control.

2.4. Employees’ personal data may be processed only to ensure compliance with laws and other regulations.

3. Legal grounds for processing personal data

3.1. The legal ground for processing personal data is the body of regulations under which and in accordance with which the Operator processes personal data, including:

the Constitution of the Russian Federation;
the Civil Code of the Russian Federation;
the Labor Code of the Russian Federation;
the Tax Code of the Russian Federation;
Federal Law No. 14-FZ of 8 February 1998 “On Limited Liability Companies”;
Federal Law No. 402-FZ of 6 December 2011 “On Accounting”;
Federal Law No. 167-FZ of 15 December 2001 “On Mandatory Pension Insurance in the Russian Federation”;
other regulations governing relations connected with the Operator’s activities.

3.2. Personal data are also processed on the basis of:

the NAEPID charter;
contracts between the Operator and personal data subjects;
a contract under which NAEPID entrusts the processing of personal data to another person;
the consent of personal data subjects to the processing of their personal data.

4. Scope and categories of personal data, and categories of personal data subjects

4.1. The content and scope of personal data processed must match the purposes stated in section 2 of this Policy. The personal data processed must not be excessive in relation to those purposes.

4.2. The Operator may process personal data of the following categories of subjects.

4.2.1. Candidates for employment with the Operator:

surname, first name, and patronymic;
sex;
citizenship;
date and place of birth;
contact details;
information on education, work experience, and qualifications;
other personal data given by candidates in résumés and cover letters.

4.2.2. Current and former employees of the Operator:

surname, first name, and patronymic;
sex;
citizenship;
date and place of birth;
image (photograph);
passport details;
registered address;
actual residential address;
contact details;
taxpayer identification number;
insurance number of an individual personal account (SNILS);
information on education, qualifications, professional training, and further training;
marital status, children, and family relations;
information on employment, including awards and disciplinary sanctions;
marriage registration data;
military registration data;
information on disability;
information on the withholding of alimony;
information on income from a previous place of work;
other personal data provided by employees as required by labor law.

4.2.3. Family members of the Operator’s employees:

surname, first name, and patronymic;
degree of kinship;
year of birth;
other personal data provided by employees as required by labor law.

4.2.4. Clients and counterparties of the Operator (natural persons):

surname, first name, and patronymic;
date and place of birth;
passport details;
registered address;
contact details;
position held;
taxpayer identification number;
bank account number;
other personal data provided by clients and counterparties (natural persons) that are necessary to conclude and perform contracts.

4.2.5. Representatives (employees) of the Operator’s clients and counterparties (legal entities):

surname, first name, and patronymic;
passport details;
contact details;
position held;
other personal data provided by representatives (employees) of clients and counterparties that are necessary to conclude and perform contracts.

4.2.6. The Operator processes special categories of personal data (concerning health and other matters) in order to develop scientific and clinical immunology, to support the introduction in Russia of current methods of diagnosis, treatment, and prevention of immunological diseases in children and adults, and of rehabilitation and palliative-care programs, and to maintain the registry of patients with primary immunodeficiencies.

5. Procedure and conditions for processing personal data

5.1. The Operator processes personal data in accordance with the laws of the Russian Federation.

5.2. Personal data are processed with the consent of the personal data subject, and without such consent in the cases provided by the laws of the Russian Federation.

5.3. The Operator processes personal data both by automated means and without them.

5.4. Only employees of the Operator whose duties include the processing of personal data are admitted to that processing.

5.5. Personal data are processed by:

receiving personal data orally and in writing directly from personal data subjects;
receiving personal data from publicly available sources;
entering personal data in the Operator’s logs, registers, and information systems;
other methods of processing personal data.

5.6. Personal data may not be disclosed to third parties or distributed without the consent of the personal data subject, unless a federal law provides otherwise. Consent to the processing of personal data that the subject has permitted for distribution is obtained separately from other consents to the processing of their personal data.

The requirements for the content of consent to the processing of personal data permitted by the subject for distribution are approved by Roskomnadzor Order No. 18 of 24 February 2021.

5.7. Personal data are transferred to bodies of inquiry and investigation, the Federal Tax Service, the Pension Fund of the Russian Federation, the Social Insurance Fund, and other authorized executive authorities and organizations in accordance with the laws of the Russian Federation.

5.8. The Operator takes the legal, organizational, and technical measures necessary to protect personal data from unlawful or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including the following:

identifying threats to the security of personal data during processing;
adopting local regulations and other documents governing the processing and protection of personal data;
appointing persons responsible for the security of personal data in the Operator’s units and information systems;
creating the conditions necessary for working with personal data;
keeping records of documents that contain personal data;
organizing work with the information systems in which personal data are processed;
storing personal data in conditions that keep them safe and exclude unlawful access;
training the Operator’s employees who process personal data.

5.9. The Operator stores personal data in a form that makes it possible to identify the subject for no longer than the purposes of processing require, unless a federal law or a contract sets a storage period.

5.10. When collecting personal data, including over the internet, the Operator records, systematizes, accumulates, stores, updates, and retrieves the personal data of citizens of the Russian Federation using databases located in the Russian Federation, except in the cases specified in the Personal Data Law.

6. Updating, correcting, deleting, and destroying personal data, and responding to subjects’ requests for access

6.1. Confirmation that the Operator is processing personal data, the legal grounds and purposes of processing, and the other information specified in part 7 of Article 14 of the Personal Data Law are provided by the Operator to the personal data subject or their representative upon an application or upon a request from the subject or their representative.

The information provided does not include personal data of other subjects, except where there is a lawful ground to disclose them.

A request must contain:

the number of the principal identity document of the personal data subject or their representative, the date of issue, and the issuing authority;
information confirming the subject’s relationship with the Operator (contract number, date of the contract, a conventional designation, and/or other information), or other information confirming that the Operator is processing the personal data;
the signature of the personal data subject or their representative.

A request may be sent as an electronic document and signed with an electronic signature in accordance with the laws of the Russian Federation.

If an application or request does not contain all the information required by the Personal Data Law, or the subject has no right of access to the information requested, a reasoned refusal is sent.

The subject’s right of access to their personal data may be limited under part 8 of Article 14 of the Personal Data Law, including where access would infringe the rights and lawful interests of third parties.

6.2. If inaccurate personal data are found upon an application by the subject or their representative, or upon their request or a request from Roskomnadzor, the Operator blocks the personal data of that subject from the moment of the application or request for the period of verification, unless blocking would infringe the rights and lawful interests of the subject or of third parties.

If the inaccuracy is confirmed, the Operator corrects the personal data within seven working days of receiving the information provided by the subject, their representative, or Roskomnadzor, or other necessary documents, and then lifts the block.

6.3. If unlawful processing is found upon an application or request by the subject, their representative, or Roskomnadzor, the Operator blocks the personal data of that subject that are being processed unlawfully, from the moment of the application or request.

6.4. When the purposes of processing have been achieved, and also if the subject withdraws consent, the personal data are destroyed, unless:

a contract to which the subject is a party, beneficiary, or guarantor provides otherwise;
the operator may process the data without the subject’s consent on grounds provided by the Personal Data Law or other federal laws;
another agreement between the Operator and the subject provides otherwise.

Back to the conference