Personal Data Processing Policy

Personal Data Processing Policy of the Professional Non-Profit Organization Association for Children’s Health

1. General provisions

1.1. This Policy of the Professional Non-Profit Organization Association for Children’s Health (hereinafter — PNO Association for Children’s Health, the Operator) on the processing of personal data (hereinafter — the Policy) has been adopted to comply with clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter — the Personal Data Law) in order to protect the rights and freedoms of individuals in the processing of their personal data, including the right to privacy and to personal and family confidentiality.

1.2. The Policy sets out the purposes, basic principles and rules of personal data processing and defines the main measures to ensure their security.

1.3. The Policy applies to personal data processing relationships that arose both before and after the approval of this Policy.

1.4. In accordance with part 2 of Article 18.1 of the Personal Data Law, this Policy is published in open access on the Internet on the Operator’s website.

2. Key terms used in the Policy

Automated processing of personal data — processing of personal data by means of computer technology.

Blocking of personal data — temporary suspension of personal data processing, except where processing is required to update the personal data.

Website — a set of graphic and information materials, as well as computer programs and databases, that make them available on the Internet at https://zdravdeti.org/.

Personal data information system — a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

Depersonalization of personal data — actions that make it impossible, without additional information, to determine that personal data belong to a specific User or another personal data subject.

Processing of personal data — any action (operation) or set of actions (operations) performed with or without automation tools on personal data, including collection, recording, systematization, accumulation, storage, updating (refreshing, changing), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of personal data.

Personal data — any information relating directly or indirectly to an identified or identifiable User of the website https://zdravdeti.org/.

Personal data authorized by the personal data subject for dissemination — personal data to which an unlimited number of persons have been granted access by the personal data subject through consent to the processing of personal data authorized for dissemination, in the manner provided by the Personal Data Law (hereinafter — personal data authorized for dissemination).

User — a personal data subject who has provided their personal data to PNO Association for Children’s Health via the website https://zdravdeti.org/.

Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data available to an unlimited number of persons, including publication in the media, posting on information and telecommunication networks, or otherwise providing access to personal data.

Personal data subject — individuals whose personal data have become known in the course of the statutory activities of PNO Association for Children’s Health or the performance of its other functions and tasks; visitors of the website https://zdravdeti.org/; employees and former employees and their close relatives; job applicants; individuals who have entered into contractual relationship with PNO Association for Children’s Health; and other persons who have provided their personal data to PNO Association for Children’s Health.

Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to a foreign public authority, a foreign individual or a foreign legal entity.

Destruction of personal data — any actions that result in the irreversible destruction of personal data so that their content cannot be restored in a personal data information system and/or that destroy the physical media containing personal data.

Cookies — small files containing information that are downloaded to your device (PC, smartphone, etc.) while you browse the Website.

3. Main rights and obligations of the Operator

3.1. The Operator has the right:

  • to receive from the personal data subject reliable information and/or documents containing personal data;
  • to determine independently the composition and list of measures necessary and sufficient to fulfil the duties provided by the Personal Data Law and the regulations adopted pursuant to it, unless otherwise provided by the Personal Data Law or other federal laws;
  • to instruct another person to process personal data with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with that person. A person processing personal data on the Operator’s instructions must comply with the principles and rules of personal data processing provided by the Personal Data Law, keep personal data confidential and take the measures necessary to fulfil the duties provided by the Personal Data Law;
  • if the personal data subject withdraws consent to the processing of personal data, the Operator may continue processing personal data without such consent where the grounds specified in the Personal Data Law exist.

3.2. The Operator shall:

  • organize the processing of personal data in accordance with the requirements of the Personal Data Law;
  • respond to requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
  • provide the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)), upon that body’s request, with the necessary information within 10 business days from the date of receipt of such a request. This period may be extended by no more than five business days. To do so, the Operator must send Roskomnadzor a reasoned notice stating the reasons for the extension;
  • in the manner determined by the federal executive authority authorized in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing it of computer incidents that resulted in the unlawful transfer (provision, dissemination, access) of personal data.

4. Main rights of the personal data subject

4.1. The personal data subject has the right:

  • to receive information concerning the processing of their personal data, except in cases provided by federal laws. The information is provided by the Operator to the personal data subject in an accessible form and must not contain personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
  • to require the Operator to update, block or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated processing purpose, and to take the measures provided by law to protect their rights;
  • to give prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
  • to withdraw consent to the processing of personal data;
  • to appeal to the authorized body for the protection of the rights of personal data subjects or to a court against unlawful actions or omissions of the Operator in the processing of their personal data;
  • to exercise other rights provided by the legislation of the Russian Federation.

4.2. Personal data subjects shall:

  • provide the Operator with accurate information about themselves;
  • inform the Operator of any update (refresh, change) of their personal data.

4.3. Persons who have provided the Operator with inaccurate information about themselves, or information about another personal data subject without that person’s consent, are liable in accordance with the legislation of the Russian Federation.

5. Purposes of personal data collection

5.1. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of their collection is not permitted.

5.2. Only personal data that meet the purposes of their processing are subject to processing.

5.3. The Operator processes personal data for the following purposes:

  • carrying out its activities in accordance with the charter of PNO Association for Children’s Health, including the conclusion and performance of contracts with counterparties;
  • compliance with labour legislation within employment and related relationships, including: assisting employees in employment, education and career advancement; attracting and selecting candidates for work with the Operator; ensuring the personal safety of employees; monitoring the quantity and quality of work performed; ensuring the safety of property; maintaining HR and accounting records; completing and submitting required reporting forms to authorized bodies; arranging the individual (personalized) registration of employees in the compulsory pension insurance and compulsory social insurance systems;
  • ensuring the security of confidential information;
  • informing the User by sending emails;
  • providing the User with access to the services, information and/or materials contained on the Website.

5.4. The processing of employees’ personal data may be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

6. Legal grounds for the processing of personal data

6.1. The legal grounds for the processing of personal data are the set of regulatory legal acts pursuant to which and in accordance with which the Operator processes personal data, including:

  • the Constitution of the Russian Federation;
  • the Civil Code of the Russian Federation;
  • the Labour Code of the Russian Federation;
  • the Tax Code of the Russian Federation;
  • Federal Law No. 7-FZ of 12 January 1996 “On Non-Profit Organizations”;
  • Federal Law No. 402-FZ of 6 December 2011 “On Accounting”;
  • Federal Law No. 167-FZ of 15 December 2001 “On Compulsory Pension Insurance in the Russian Federation”;
  • other regulatory legal acts governing relations related to the Operator’s activities;
  • the charter of PNO Association for Children’s Health;
  • contracts concluded between the Operator and the personal data subject;
  • the consent of personal data subjects to the processing of their personal data.

6.2. The personal data subject independently decides to provide their personal data and gives consent freely, of their own will and in their own interest.

7. Scope and categories of personal data processed, and categories of personal data subjects

7.1. The content and scope of the personal data processed must correspond to the stated processing purposes provided in section 5 of this Policy. The personal data processed must not be excessive in relation to the stated processing purposes.

7.2. The Operator may process personal data of the following categories of personal data subjects.

7.2.1. Candidates for employment with the Operator — for the purposes of complying with labour legislation within employment and related relationships, and implementing an access-control regime:

  • last name, first name, patronymic;
  • sex;
  • citizenship;
  • date and place of birth;
  • contact details;
  • information about education, work experience and qualifications;
  • other personal data provided by candidates in CVs and cover letters.

7.2.2. Employees and former employees of the Operator — for the purposes of complying with labour legislation within employment and related relationships, and implementing an access-control regime:

  • last name, first name, patronymic;
  • sex;
  • citizenship;
  • date and place of birth;
  • image (photograph);
  • passport details;
  • registered address;
  • actual residential address;
  • contact details;
  • taxpayer identification number;
  • individual insurance account number (SNILS);
  • information about education, qualifications, professional training and advanced training;
  • marital status, children, family relationships;
  • information about employment, including awards, commendations and/or disciplinary sanctions;
  • marriage registration data;
  • military registration information;
  • disability information;
  • information about alimony deductions;
  • income information from the previous place of work;
  • other personal data provided by employees in accordance with labour legislation.

7.2.3. Family members of the Operator’s employees — for the purposes of complying with labour legislation within employment and related relationships:

  • last name, first name, patronymic;
  • degree of kinship;
  • year of birth;
  • other personal data provided by employees in accordance with labour legislation.

7.2.4. Counterparties of the Operator (individuals) — for the purposes of carrying out activities in accordance with the charter of PNO Association for Children’s Health and implementing an access-control regime:

  • last name, first name, patronymic;
  • date and place of birth;
  • passport details;
  • registered address;
  • contact details;
  • position held;
  • taxpayer identification number;
  • settlement account number;
  • other personal data provided by clients and counterparties (individuals) that are necessary for the conclusion and performance of contracts.

7.2.5. Representatives (employees) of the Operator’s clients and counterparties (legal entities) — for the purposes of carrying out activities in accordance with the charter of PNO Association for Children’s Health and implementing an access-control regime:

  • last name, first name, patronymic;
  • passport details;
  • contact details;
  • position held;
  • other personal data provided by representatives (employees) of clients and counterparties that are necessary for the conclusion and performance of contracts.

7.2.6. Users, when using the Website and in related relationships, including providing the User with access to the services, information and/or materials contained on the Website:

  • last name, first name, patronymic;
  • date of birth;
  • email address;
  • telephone numbers;
  • country, region and city of residence;
  • education and specialization;
  • specialty;
  • place of work / study;
  • position;
  • depersonalized data about visitors (including cookies) are also collected and processed on the website using internet statistics services (Yandex Metrica, Google Analytics and others).

7.3. The Operator does not process biometric personal data (information that characterizes the physiological and biological features of a person and on the basis of which their identity can be established).

7.4. The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health or intimate life, except in cases provided by the legislation of the Russian Federation.

8. Procedure and conditions for the processing of personal data

8.1. Personal data are processed by PNO Association for Children’s Health on the basis of the following principles:

  • lawfulness and fairness of the purposes and methods of personal data processing, and consistency of the processing purposes with the purposes predetermined and stated when the personal data were collected;
  • consistency of the scope and nature of the personal data processed with the purposes of processing;
  • accuracy of personal data, their sufficiency for the processing purposes, and the inadmissibility of processing personal data that are excessive in relation to the purposes stated when they were collected;
  • the inadmissibility of combining databases containing personal data processed for incompatible purposes;
  • storage of personal data in a form that makes it possible to identify the personal data subject for no longer than the processing purposes require;
  • destruction or depersonalization of personal data upon achievement of the processing purposes or if they are no longer needed, unless a retention period is established by the legislation of the Russian Federation or other documents determining such a period.

8.2. The actions performed by PNO Association for Children’s Health with personal data are: collection, recording, systematization, accumulation, storage, updating (refreshing, changing), retrieval, use, transfer (dissemination, provision, access), including cross-border transfer, depersonalization, blocking, deletion and destruction.

8.3. Conditions for the processing of personal data at PNO Association for Children’s Health:

  • personal data are processed with the consent of the personal data subject (or their legal representative), and without such consent in the cases provided by the legislation of the Russian Federation;
  • confidentiality of personal data is observed during processing;
  • access to personal data is granted to employees of the organization who need it to perform their official duties. The list of persons with access to personal data is approved by a legal act of PNO Association for Children’s Health;
  • premises in which personal data are processed must be equipped in accordance with the requirements of the legislation of the Russian Federation and must provide the necessary level of protection of personal data, as well as exclude the risk of unauthorized access for the purpose of theft or unlawful use of personal data;
  • waiting areas for visitors are designated so as to exclude unauthorized access to the personal data being processed.

8.4. The security of personal data processed by the Operator is ensured by implementing the legal, organizational and technical measures necessary to fulfil in full the requirements of applicable legislation on the protection of personal data.

8.5. The transfer of personal data to inquiry and investigation authorities, the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

8.6. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, dissemination and other unauthorized actions, including:

  • identifying threats to the security of personal data during their processing;
  • adopting local regulations and other documents governing relations in the field of personal data processing and protection;
  • appointing persons responsible for ensuring the security of personal data;
  • creating the necessary conditions for working with personal data;
  • keeping records of documents containing personal data;
  • organizing work with information systems in which personal data are processed;
  • storing personal data under conditions that ensure their safety and exclude unlawful access to them;
  • training the Operator’s employees who process personal data.

8.7. The Operator stores personal data in a form that makes it possible to identify the personal data subject for no longer than each processing purpose requires, unless a retention period is established by federal law or a contract.

8.7.1. Personal data on paper are stored by PNO Association for Children’s Health for the document retention periods provided by the legislation of the Russian Federation on archives (Federal Law No. 125-FZ of 22 October 2004 “On Archiving in the Russian Federation”; the List of standard management archival documents generated in the course of the activities of state bodies, local self-government bodies and organizations, with indication of retention periods, approved by Order of Rosarkhiv No. 236 of 20 December 2019).

8.7.2. The retention period for personal data processed in personal data information systems corresponds to the retention period for personal data on paper.

8.8. The Operator ceases processing personal data in the following cases:

  • unlawful processing has been identified — within three business days from the date of identification;
  • the purpose of processing has been achieved;
  • the term of the personal data subject’s consent has expired or the consent has been withdrawn, where under the Personal Data Law such data may be processed only with consent.

8.9. Upon achievement of the purposes of personal data processing, and if consent to their processing is withdrawn, the Operator ceases processing these data unless:

  • otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor;
  • the Operator is entitled to process the data without the consent of the personal data subject on the grounds provided by the Personal Data Law or other federal laws;
  • otherwise provided by another agreement between the Operator and the personal data subject.

8.10. If the personal data subject requests the Operator to cease processing personal data, processing is ceased within no more than 10 business days from the date the Operator receives the request, except in cases provided by the Personal Data Law. This period may be extended by no more than five business days. To do so, the Operator must send the personal data subject a reasoned notice stating the reasons for the extension.

8.11. When collecting personal data, including via the Internet, the Operator ensures the recording, systematization, accumulation, storage, updating (refreshing, changing) and retrieval of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, except in the cases specified in the Personal Data Law.

9. Updating, correction, deletion and destruction of personal data; responses to requests from subjects for access to personal data

9.1. Confirmation of the fact that the Operator processes personal data, the legal grounds and purposes of processing, and other information specified in part 7 of Article 14 of the Personal Data Law are provided by the Operator to the personal data subject or their representative within 10 business days of the request. This period may be extended by no more than five business days. To do so, the Operator must send the personal data subject a reasoned notice stating the reasons for the extension.

The information provided does not include personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data.

The request must contain:

  • the number of the principal identity document of the personal data subject or their representative, information about the date of issue of that document and the issuing authority;
  • information confirming the personal data subject’s relationship with the Operator (contract number, date of conclusion, a conventional designation and/or other information), or other information confirming that the Operator processes the personal data;
  • the signature of the personal data subject or their representative.

The request may be sent as an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator provides the information specified in part 7 of Article 14 of the Personal Data Law to the personal data subject or their representative in the same form in which the request was sent, unless otherwise stated in the request.

If the request of the personal data subject does not contain all the information required by the Personal Data Law, or the subject does not have the right of access to the requested information, a reasoned refusal is sent.

The right of the personal data subject to access their personal data may be restricted in accordance with part 8 of Article 14 of the Personal Data Law, including where such access would violate the rights and legitimate interests of third parties.

9.2. If inaccurate personal data are identified upon a request from the personal data subject or their representative, or upon a request from Roskomnadzor, the Operator blocks the personal data relating to that personal data subject from the moment of the request for the period of verification, unless blocking would violate the rights and legitimate interests of the personal data subject or third parties.

If the inaccuracy of the personal data is confirmed, the Operator, on the basis of information provided by the personal data subject or their representative or by Roskomnadzor, or other necessary documents, updates the personal data within seven business days from the date such information is provided and unblocks the personal data.

9.3. If unlawful processing of personal data is identified upon a request from the personal data subject or their representative, or from Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to that personal data subject from the moment of the request.

9.4. If the Operator, Roskomnadzor or another interested party identifies the fact of an unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator:

  • within 24 hours — notifies Roskomnadzor of the incident, the presumed causes that resulted in the violation of the rights of personal data subjects, the presumed harm caused to those rights, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor in connection with the incident;
  • within 72 hours — notifies Roskomnadzor of the results of the internal investigation of the identified incident and provides information about the persons whose actions caused it (if available).

9.5. Procedure for the destruction of personal data by the Operator.

9.5.1. Conditions and time limits for the destruction of personal data by the Operator:

  • the purpose of processing has been achieved, or there is no longer a need to achieve it — within 30 days;
  • the maximum retention periods for documents containing personal data have been reached — within 30 days;
  • the personal data subject (or their representative) has provided confirmation that the personal data were obtained unlawfully or are not necessary for the stated processing purpose — within seven business days;
  • the personal data subject has withdrawn consent to the processing of their personal data, if their retention for the processing purpose is no longer required — within 30 days.

9.5.2. Upon achievement of the purpose of processing personal data, and if the personal data subject withdraws consent to their processing, the personal data are to be destroyed unless:

  • otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor;
  • the Operator is entitled to process the data without the consent of the personal data subject on the grounds provided by the Personal Data Law or other federal laws;
  • otherwise provided by another agreement between the Operator and the personal data subject.

9.5.3. Personal data are destroyed in the manner determined by the relevant order of the Operator’s authorized management body.

9.5.4. The methods of destroying personal data are established in the Operator’s local regulations.

10. Cookies

10.1. Cookies are files or fragments of information that may be stored on your computer (or other Internet-enabled devices, such as a smartphone or tablet) when you visit the Website and/or use a mobile application. This type of file usually contains the name of the Website/mobile application (hereinafter — the “site”) from which it was obtained, the file’s lifetime (for example, how long it will remain on the device) and a value that is generally a randomly generated unique number.

The Operator may use other technologies, including web beacons and JavaScript, which sometimes work together with cookies and other means to uniquely identify your device. These technologies help improve the operation of the Operator’s sites. The Operator may also use such technologies to determine whether a user has opened an email or clicked a link contained in an email.

When visiting the Operator’s site, a user may incidentally receive cookies from other sites or web servers, so-called “third-party” cookies. This happens because the Operator’s site you are visiting may contain elements such as images, maps, audio files or links to individual web pages on different domains hosted on other servers. Cookies do not harm your device and allow the Operator to provide you with faster and better navigation on the site (their purpose may range from authentication to storing information about user configurations for access to a given server, and so on) on the pages of the Operator’s site.

10.2. The Operator may use cookies for the operation of the site, including: to keep statistics and track the total number of visitors to the Operator’s site on an anonymous basis; to improve the site and allow the user to customize the services and functions of the Operator’s sites individually; to recognize new and returning users; to store a password if the user is registered on the Operator’s site; to provide users with targeted advertising; to dynamically monitor your actions and browser activity when visiting various sites or using other platforms; to better understand the interests of site users; and to achieve other purposes provided by the Operator’s personal data processing policy.

10.3. The Operator may use the analytics services Google Analytics and Yandex Metrica provided by third-party vendors. They are used to assess your use of the website, compile reports on site activity for the website Operator and provide other services related to website activity and Internet use. Information about the use of the website generated by the cookie is transmitted to and stored by the providers on their servers, including those located in countries that do not provide an adequate level of protection of the rights of personal data subjects.

10.4. Continued use of the Operator’s site services means that the site user, who is a personal data subject, consents to the processing of their cookies in accordance with the terms of this Policy.

If the personal data subject refuses the processing of cookies, they are informed of the need to stop using the site or to disable cookies in the browser settings.

11. Final provisions

11.1. The User may obtain any clarifications on questions of interest concerning the processing of their personal data by contacting the Operator at info@zdravdeti.org.

11.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy remains in force indefinitely until it is replaced by a new version.

11.3. The current version of the Policy is freely available on the Internet at https://zdravdeti.org/privacy-policy/. The English version is published at https://zdravdeti.org/privacy-policy-en/.