1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy (the “Policy”) has been developed pursuant to Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” for the purpose of protecting the rights and freedoms of individuals and citizens in connection with the processing of their personal data, including the protection of the rights to privacy and personal and family confidentiality.
1.2. This Policy applies to the following categories of personal data subjects whose information is processed by the Operator:

• employees;
• job applicants;
• counterparties;
• Website visitors.

1.3. Definitions used in this Policy:
Personal Data means any information relating directly or indirectly to an identified or identifiable individual (personal data subject).
Personal Data Operator (Operator) means ООО «ГЛОБАЛ РАША +», PSRN 1137847379955, TIN/KPP 7810762970/784101001, registered at: 191123, St Petersburg, 21 Ryleeva St., Letter A, Premises No. 22-N, Part 2, which independently or jointly with other persons organises and/or carries out the processing of Personal Data and determines the purposes of such processing, the scope of Personal Data to be processed and the actions (operations) performed with Personal Data.
Processing of Personal Data means any action (operation) or set of actions (operations) performed with Personal Data, with or without the use of automated means. Processing includes, without limitation: collection, recording, systematisation, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision or access), depersonalisation, blocking, deletion and destruction.
Automated Processing of Personal Data means processing of Personal Data using computing equipment.
Dissemination of Personal Data means actions aimed at disclosing Personal Data to an indefinite number of persons.
Provision of Personal Data means actions aimed at disclosing Personal Data to a specific person or a specific group of persons.
Blocking of Personal Data means the temporary suspension of Personal Data processing, except where processing is required for the clarification of Personal Data.
Destruction of Personal Data means actions resulting in the impossibility of restoring the contents of Personal Data within a Personal Data Information System and/or resulting in the destruction of physical media containing Personal Data.
Depersonalisation of Personal Data means actions resulting in the inability to determine, without the use of additional information, whether Personal Data relates to a specific Personal Data Subject.
Personal Data Information System means a set of Personal Data contained in databases together with the information technologies and technical means used to process such Personal Data.
Cross-Border Transfer of Personal Data means the transfer of Personal Data to the territory of a foreign state to a foreign public authority, foreign individual or foreign legal entity.
Website means a collection of software for electronic computing systems and other information contained within an information system, access to which is provided via the Internet and which is available at: www.globalrussia.com/.
1.4. Principal rights and obligations of the Operator
1.4.1. The Operator has the right to:

• independently determine the scope and list of measures necessary and sufficient to fulfil the obligations established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and regulations adopted pursuant thereto, unless otherwise provided by the legislation of the Russian Federation;
• entrust the processing of Personal Data to another person with the consent of the Personal Data Subject, unless otherwise provided by federal law, pursuant to an agreement entered into with such person. A person processing Personal Data on behalf of the Operator must comply with the principles and rules governing Personal Data processing established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
• where a Personal Data Subject withdraws consent to the processing of Personal Data, continue such processing without the Subject’s consent where grounds for such processing exist under Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.

1.4.2. The Operator is required to:

• organise the processing of Personal Data in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
• respond to requests and enquiries from Personal Data Subjects and their legal representatives in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
• provide the authorised authority responsible for the protection of the rights of Personal Data Subjects (“Roskomnadzor”) with the requested information within 10 business days of receiving the relevant request.

1.5. Principal rights of Personal Data Subjects
A Personal Data Subject has the right to:

• obtain information relating to the processing of their Personal Data, except where otherwise provided by federal law. Such information shall be provided by the Operator in an accessible form and shall not contain Personal Data relating to other Personal Data Subjects unless there are lawful grounds for disclosing such data. The scope of information and the procedure for obtaining it are established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”;
• require the Operator to clarify, block or destroy their Personal Data if such data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and to take other measures provided by law to protect their rights;
• challenge unlawful acts or omissions of the Operator in relation to the processing of their Personal Data before Roskomnadzor or a court.

A Personal Data Subject may exercise their rights to obtain information concerning the processing of their Personal Data and to request clarification, blocking or destruction of their Personal Data by submitting a request to the Operator at:
191123, St Petersburg, 21 Ryleeva St., Letter A, Premises No. 22-N, Part 2
or by email to:
info@globalrussia.com
In either case, the request must comply with the requirements of Section 8 of this Policy.
1.6. Compliance with this Policy is monitored by the person authorised by the Operator and responsible for organising the processing of Personal Data.
1.7. Liability for violations of the legislation of the Russian Federation and the Operator’s internal regulations relating to the processing and protection of Personal Data shall be determined in accordance with the legislation of the Russian Federation.


2. PRINCIPLES OF PERSONAL DATA PROCESSING
2.1. The Operator processes Personal Data in accordance with the requirements of the legislation of the Russian Federation and based on the following principles:
2.1.1. Personal Data shall be processed lawfully and fairly.
2.1.2. Personal Data processing shall be limited to achieving specific, predetermined and legitimate purposes.
2.1.3. Databases containing Personal Data processed for incompatible purposes shall not be combined.
2.1.4. Only Personal Data relevant to the purposes of processing shall be processed.
2.1.5. The content and scope of Personal Data processed shall correspond to the stated purposes of processing. Personal Data processed shall not be excessive in relation to such purposes.
2.1.6. The accuracy, sufficiency and, where necessary, relevance of Personal Data shall be ensured in relation to the stated purposes of processing.
2.1.7. The Operator shall take the necessary measures and, where applicable, ensure that such measures are taken to delete or correct incomplete or inaccurate Personal Data.
2.1.8. Personal Data shall be stored in a form that permits identification of the Personal Data Subject for no longer than is necessary for the purposes of processing, unless a longer storage period is established by federal law or by an agreement to which the Personal Data Subject is a party, beneficiary or guarantor.
2.1.9. Personal Data processed shall be destroyed once the purposes of processing have been achieved or where the need to achieve such purposes no longer exists, unless otherwise provided by the legislation of the Russian Federation.
2.1.10. The Operator proceeds on the basis that Personal Data Subjects provide accurate and reliable information when interacting with the Operator and notify the Operator’s representatives of any changes to their Personal Data.
2.1.11. Agreements between the Operator and Personal Data Subjects shall not contain provisions restricting the rights and freedoms of Personal Data Subjects, shall not establish cases of processing Personal Data of minors and shall not make inaction by a Personal Data Subject a condition for entering into an agreement.
2.1.12. Documents and internal regulations adopted by the Operator shall not contain provisions restricting the rights of Personal Data Subjects or imposing powers or obligations upon the Operator that are not provided for by law.


3. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
3.1. The legal basis for processing Personal Data consists of the applicable laws and regulations pursuant to which and in accordance with which the Operator processes Personal Data, including:

• the Constitution of the Russian Federation;
• the Labour Code of the Russian Federation;
• the Civil Code of the Russian Federation;
• the Tax Code of the Russian Federation;
• Federal Law No. 402-FZ dated 6 December 2011 “On Accounting”;
• other laws and regulations governing matters related to the Operator’s activities.

3.2. The legal grounds for processing Personal Data also include:

• the Operator’s Charter;
• agreements entered into with Personal Data Subjects;
• consent of Personal Data Subjects to the processing of their Personal Data.

4. SCOPE, CATEGORIES AND CONDITIONS OF PERSONAL DATA PROCESSING AND CATEGORIES OF PERSONAL DATA SUBJECTS IN RELATION TO THE STATED PURPOSES OF PROCESSING
4.1. Personal Data processing shall be limited to specific, predetermined and legitimate purposes. Processing that is incompatible with the purposes for which Personal Data was collected is not permitted. Only Personal Data relevant to the purposes of processing shall be processed.
4.2. The content and scope of Personal Data processed shall correspond to the purposes stated in this Section. Personal Data processed shall not be excessive in relation to the purposes for which it is processed.
The Operator processes Personal Data for the following purposes:

• ensuring compliance with the labour legislation of the Russian Federation;
• considering applicants for vacant positions and deciding whether to employ or reject an applicant;
• preparing, entering into and performing agreements;
• processing enquiries submitted through the Website.

4.3. Processing Personal Data for the purpose of ensuring compliance with Russian labour legislation
4.3.1. Under this Section of the Policy, the Operator determines the categories and list of Personal Data processed, the categories of Personal Data Subjects, the methods and periods of processing and storage, and the procedure for destroying Personal Data once the purpose of processing has been achieved or other lawful grounds arise, in relation to the purpose of “ensuring compliance with the labour legislation of the Russian Federation, including assistance to employees in employment, education and career development, ensuring employees’ personal safety, monitoring the quantity and quality of work performed, safeguarding property and ensuring compliance with applicable laws and regulations”.
4.3.2. For this purpose, the Operator processes Personal Data belonging to the following category of Personal Data Subjects:

• employees of the Operator.

4.3.3. The Operator processes the following categories and types of employee Personal Data:
a) General and other categories of Personal Data:

• surname, first name and patronymic;
• year of birth;
• month of birth;
• date of birth;
• place of birth;
• marital status;
• social status;
• sex;
• residential address;
• registered address;
• email address;
• telephone number;
• citizenship;
• identity document details;
• details of documents identifying the individual outside the Russian Federation;
• bank card details;
• bank account number;
• personal account number;
• profession;
• job title;
• employment history;
• military service status and military registration information;
• educational information;
• photograph.

b) The Operator does not process special categories of employees’ Personal Data.
c) The Operator does not process employees’ biometric Personal Data, meaning information characterising physiological and biological features of an individual that may be used to establish their identity.
4.3.4. The Operator carries out mixed processing of employees’ Personal Data for the purposes stated in this Section, without transmission over an internal network and with transmission over the Internet.
4.3.5. Actions performed by the Operator with employees’ Personal Data include: collection, recording, systematisation, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (provision and access), blocking, deletion and destruction.
4.3.6. Processing of employees’ Personal Data does not require separate consent provided that the scope of Personal Data processed corresponds to the purpose of ensuring compliance with Russian labour legislation stated in this Section, pursuant to Clause 2, Part 1, Article 6 of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.
4.3.7. When entering into an employment agreement, employees provide the Operator with documents containing their Personal Data, including:

• a passport or other identity document;
• an employment record book and/or information on employment history, except where an employment agreement is entered into for the first time;
• a document confirming registration within the individual personalised record-keeping system, including in electronic form;
• military registration documents for persons liable for military service and persons subject to military conscription;
• documents confirming education, qualifications or specialist knowledge where the relevant position requires such qualifications or training;
• other documents required by applicable law.

4.3.8. Where additional documents are required for employment under applicable legislation, the Operator may request such documents containing Personal Data from the applicant.
4.3.9. The Operator stores employees’ Personal Data in a form permitting identification of Personal Data Subjects for no longer than required for the purpose stated in this Section, unless another storage period is established by federal law.
4.3.10. The Operator processes Personal Data of former employees in the cases and for the periods prescribed by Russian legislation, including for accounting and tax purposes and for the preservation of documents required for calculating, withholding and transferring taxes.
4.3.11. The Operator shall retain accounting documents for periods established in accordance with the rules governing state archival records, provided that the minimum retention period shall not be less than five (5) years.
4.3.12. Upon expiry of the periods established by Russian legislation, employees’ personnel files and other documents shall be transferred to archival storage for a period of 50 years.
4.3.13. Employee consent to the processing of Personal Data in the cases provided for in Clauses 4.3.11–4.3.13 of this Policy is not required.
4.3.14. The Operator shall not disclose employees’ Personal Data to third parties or disseminate such data for the purposes stated in this Section without employee consent, unless otherwise provided by the legislation of the Russian Federation.
4.3.15. When transferring employees’ Personal Data, the Operator shall comply with the following requirements:

• employees’ Personal Data may not be disclosed to third parties without the employees’ written consent, except where necessary to prevent a threat to an employee’s life or health or in other cases established by Russian legislation;
• an employee transferring other employees’ Personal Data shall inform recipients that such data may be used solely for the purposes for which it was disclosed and shall require recipients to confirm compliance with this requirement. Persons receiving employees’ Personal Data shall maintain its confidentiality. This requirement does not apply to exchanges of Personal Data carried out in accordance with Russian legislation;
• an employee transferring Personal Data may provide such data to employee representatives in accordance with the Labour Code of the Russian Federation and shall limit such information to the Personal Data necessary for those representatives to perform their functions;
• transfer of employees’ Personal Data to the Pension and Social Insurance Fund of the Russian Federation (Social Fund of Russia) in accordance with applicable federal laws, including legislation on compulsory pension insurance, compulsory social insurance and compulsory medical insurance, shall be carried out without employee consent;
• employee consent is not required for transfers of Personal Data by the Operator to tax authorities, military commissariats, trade union bodies and other entities in cases prescribed by applicable Russian legislation, or in response to duly reasoned requests made within the scope of authority of prosecutors, law enforcement agencies, security authorities, state labour inspectors and other public authorities authorised by law to request employee information.

4.3.16. The Operator does not carry out Cross-Border Transfers of employees’ Personal Data for the purposes stated in this Section.
4.4. Processing Personal Data for recruitment purposes
4.4.1. Under this Section of the Policy, the Operator determines the categories and types of Personal Data processed, categories of Personal Data Subjects, methods and periods of processing and storage, and procedures for destruction of Personal Data in relation to the purpose of “considering an applicant for a vacant position and deciding whether to employ or reject the applicant”.
4.4.2. For this purpose, the Operator processes Personal Data of:

• applicants for vacant positions with the Operator.

4.4.3. The Operator processes the following categories and types of applicants’ Personal Data:
a) General and other categories of Personal Data:

• surname, first name and patronymic;
• year of birth;
• month of birth;
• date of birth;
• marital status;
• sex;
• email address;
• telephone number;
• citizenship;
• identity document details;
• details of documents identifying the individual outside the Russian Federation;
• profession;
• job title;
• employment history;
• military service status and military registration information;
• educational information;
• photograph.

b) The Operator does not process special categories of applicants’ Personal Data.
c) The Operator does not process applicants’ biometric Personal Data.
4.4.4. The Operator carries out non-automated processing of applicants’ Personal Data for the purposes stated in this Section, without transmission over an internal network or the Internet.
4.4.5. Actions performed by the Operator with applicants’ Personal Data include: collection, recording, systematisation, accumulation, storage, clarification (updating or modification), retrieval, use, blocking, deletion and destruction.
4.4.6. Processing applicants’ Personal Data for the purposes stated in this Section is subject to prior consent. Such consent is obtained where an applicant is invited to an interview.
4.4.7. Applicants who publish their information on online recruitment platforms do so in accordance with the rules of such platforms. By sending a CV to the Operator by email, an applicant expresses consent to the processing of their Personal Data through their conduct.
4.4.8. During interviews, Personal Data contained in applications and CVs may be verified using supporting documents. Copies of supporting documents may be retained by the Operator, but no longer than required to achieve the purposes of processing or until the need for such processing ceases. Once the purpose of processing has been achieved, applicants’ Personal Data shall be deleted within 30 days.
4.4.9. The Operator shall not disclose or disseminate applicants’ Personal Data to third parties without the Personal Data Subject’s consent unless otherwise provided by Russian legislation.
4.4.10. The Operator does not carry out Cross-Border Transfers of applicants’ Personal Data for the purposes stated in this Section.
4.5. Processing Personal Data for the preparation, conclusion and performance of agreements
4.5.1. Under this Section, the Operator determines the categories and list of Personal Data processed, categories of Personal Data Subjects, methods and periods of processing and storage, and procedures for destruction of Personal Data in relation to the purpose of “preparing, entering into and performing agreements”.
4.5.2. For this purpose, the Operator processes Personal Data belonging to:

• the Operator’s counterparties.

4.5.3. The Operator processes the following categories and types of counterparties’ Personal Data:
a) General and other categories of Personal Data:

• surname, first name and patronymic;
• sex;
• email address;
• telephone number;
• taxpayer identification number;
• citizenship;
• bank account number;
• personal account number;
• profession.

b) The Operator does not process special categories of counterparties’ Personal Data.
c) The Operator does not process counterparties’ biometric Personal Data.
4.5.4. The Operator carries out mixed processing of counterparties’ Personal Data for the purposes stated in this Section, without transmission over an internal network or the Internet.
4.5.5. Actions performed with counterparties’ Personal Data include: collection, recording, systematisation, accumulation, storage, clarification (updating or modification), retrieval, use, blocking, deletion and destruction.
4.5.6. Processing counterparties’ Personal Data does not require separate consent provided that the scope of Personal Data processed corresponds to the purpose of preparing, entering into and performing a civil-law agreement, pursuant to Clause 5, Part 1, Article 6 of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.
4.5.7. The Operator shall not disclose counterparties’ Personal Data to third parties or disseminate such data without the Personal Data Subject’s consent unless otherwise provided by Russian legislation.
4.5.8. The Operator does not carry out Cross-Border Transfers of counterparties’ Personal Data for the purposes stated in this Section.
4.6. Processing Personal Data for Website enquiries
4.6.1. Under this Section, the Operator determines the categories and types of Personal Data processed, categories of Personal Data Subjects, methods and periods of processing and storage, and procedures for destruction of Personal Data in relation to the purpose of “processing enquiries submitted through the Website”.
4.6.2. For this purpose, the Operator processes Personal Data belonging to:

• visitors to the Operator’s Website.

4.6.3. The Operator processes the following categories and types of Website visitors’ Personal Data:
a) General and other categories of Personal Data:

• surname, first name and patronymic;
• email address;
• telephone number.

b) The Operator does not process special categories of Website visitors’ Personal Data.
c) The Operator does not process Website visitors’ biometric Personal Data.
4.6.4. The Operator carries out mixed processing of Website visitors’ Personal Data for the purposes stated in this Section, without transmission over an internal network or the Internet.
4.6.5. Actions performed with Website visitors’ Personal Data include: collection, recording, systematisation, accumulation, storage, clarification (updating or modification), retrieval, use, blocking, deletion and destruction.
4.6.6. Processing of Website visitors’ Personal Data for the purposes stated in this Section is carried out subject to prior consent to such processing.
4.6.7. The Operator shall not disclose or disseminate Website visitors’ Personal Data to third parties without the Personal Data Subject’s consent unless otherwise provided by Russian legislation.
4.6.8. The Operator does not carry out Cross-Border Transfers of Website visitors’ Personal Data for the purposes stated in this Section.


5. PROCESSING WEBSITE VISITORS’ PERSONAL DATA USING COOKIES
5.1. Cookies transmitted to a Personal Data Subject’s device may be used to provide personalised Website functionality, deliver personalised advertising, conduct statistical and research analysis and improve the operation of the Website.
5.2. The Personal Data Subject acknowledges that the hardware and software used to access websites on the Internet may provide functionality for disabling cookies, either for all websites or for selected websites, and for deleting cookies previously received.
5.3. The Operator may determine that certain Website functions are available only where the Personal Data Subject has enabled the acceptance and use of cookies.
5.4. The structure, content and technical parameters of cookies are determined by the Operator and may be changed without prior notice to Personal Data Subjects.
5.5. Analytics counters and similar technologies placed on the Website or within Website applications may be used to analyse cookies, collect and process statistical information regarding use of the Website and ensure the functionality of the Website as a whole or certain individual features. Their technical parameters are determined by the Operator and may be changed without prior notice to Personal Data Subjects.


6. PROCEDURE FOR COLLECTING AND STORING PERSONAL DATA
6.1. When collecting Personal Data, including through the Internet, the Operator shall ensure that Personal Data of citizens of the Russian Federation is recorded, systematised, accumulated, stored, updated, modified and retrieved using databases located within the territory of the Russian Federation.
6.2. Persons who provide the Operator, including through the Website, with information relating to another Personal Data Subject without obtaining that Subject’s consent shall bear responsibility in accordance with the legislation of the Russian Federation.
6.3. The Operator shall store Personal Data in a form permitting identification of the Personal Data Subject for no longer than required for the purposes of processing, unless another storage period is established by federal law or an agreement to which the Personal Data Subject is a party, beneficiary or guarantor.
6.4. The Operator strictly follows the principles of data minimisation and limited retention periods.
Personal Data processed shall be destroyed upon:

• achievement of the purposes of Personal Data processing;
• receipt of a withdrawal of consent to Personal Data processing or expiry of such consent;
• cessation of the need to achieve the purposes of Personal Data processing;
• removal of the Operator from the Unified State Register of Legal Entities.

Following expiry of the relevant periods, the Operator may continue to process Personal Data where such processing is necessary to comply with the legislation of the Russian Federation.