1. Goals and Scope of Application
1.1. This document (hereinafter – the “Policy”) determines the goals and general principals of personal data processing, as well as the measures for protection of personal data processed by the Representative office of Pakistan Trade House Information Services, Inc. (USA) (Accreditation No. 20150030626, Tax ID: 9909020804, located at the address: 7 Lesnaya St., Moscow, 125196 (hereinafter – the “Operator”). The Operator conducts personal data processing together with the Representative office of the American Chamber of Commerce, Inc. in Russian Federation (registration number 86, Tax ID 9909005820, located at the address: 7 Lesnaya St., Moscow, 125196), which is also referred to as the “Operator”.
1.2. This Policy is a public document of the Operator and is publicly accessible for review by all persons.
1.3. All terms and definitions used in this Policy are used in the same meaning as in the Federal Law “On Personal Data” No.152-FZ.
1.4. This Policy is applicable to processing of personal data of all physical persons (hereinafter – the “Subjects”), who provide their personal data to the Operator, including the employees of the Operator, as well as the persons who provide their personal data voluntarily for the purposes of participation in the events organized and carried out by the Operator and receiving assistance from the Operator in establishment of business contacts in the required areas of business interests, obtaining membership in the “American Chamber of Commerce, Inc.”, as well as providing visa support by the Operator to the Subject and/or support in obtaining work permit in Russia.
1.5. This Policy is applicable to all structural subdivisions of the Operator including its separate subdivisions, as well as to all third persons participating in processing of personal data by the Operator, particularly when the personal data if provided to them on the basis of concluded agreements or orders for personal data processing.
2. Procedure and Scope of Personal Data Processing
2.1. Personal data is processed by the Operator both with and without the means of automatization.
2.2. Processing of the personal data by the Operator includes the gathering, recording, systematizing, accumulating, storing, updating (renewing and altering), retrieving, using, transmitting (disseminating, providing and accessing), blocking, deleting and destroying of the personal data.
2.3. The Operator may process the following personal data of the Subjects:
Full name; Date of birth; Main personal identification document details (series, number, date of issue, name of the issuing body); Address; Phone number; Email; Citizenship; Language skills; Place of work, job description; Information on participation in the events arranged and carried out by the Operator; Marital status, children; Photographs.
2.4. The scope and volume of personal data to be processed by the operator are determined by the Operator according to the purpose of processing. The purposes of processing of the personal data by the Operator include:
Arrangement of human resource procedures with regard to the employees of the Operator; Attracting and selection of candidates for employment by the Operator; Participation of the Subject in events, arranged and carried out by the Operator; Assistance in establishment by the Subject of business contacts in the required areas of business interests; Conclusion of any agreements with the Subjects and their performance; Conducting of marketing and social research; Obtaining membership in the “American Chamber of Commerce, Inc.” by the Subject; Visa support to the Subject; Support in obtaining work permit in Russia to the Subject; Compliance with the legislation of the Russian Federation; Achievement of other goals not prohibited by legislation.
2.5. The Operator does not process special categories of personal data relating to race, nationality, political and philosophical views, religious beliefs, state of health, private life, criminal prosecution of the physical persons, with the exception of the cases when the Subject gave a written consent to processing of such data.
2.6. The Operator performs trans-border transfer of personal data only in the cases when the Subject gave a consent to such processing of the data in the form provided for by effective legislation of the Russian Federation.
2.7. Personal data not listed in items 2.4. and 2.5. of this Policy are processed by the operator on the basis of the law or on the basis of agreement of the Subject which the Subject may provide to the Operator by giving consent to the Operator in the form located at the Operator’s website www.amcham.ru, by regular mail, personally to the Operator; as a scanned copy; as a text document to the following e-mail: info@amcham.ru. In case the written consent of the Subject to personal data processing is necessary, the consent is considered to be received if it is signed with simple e-signature which is deemed as sending information via chosen forms on the Operator’s website www.amcham.ru (or submitting the unique pair of login + password if applicable) and pressing the button “I give my consent to the processing of my personal data”.
2.8. When processing the personal data, the Operator maintains the accuracy of the personal data, their sufficiency and up to date according to the goals of processing. In case inaccurate or not full personal data, the data shall be specified and actualized.
2.9. For the personal data, which is not publicly available, the Operator shall maintain full confidentiality of such data.
2.10. Processing and storage of the personal data shall be made within the terms required for the purposes of processing of the personal data if the legal grounds for their further processing are not established by applicable law, for example if the Federal Law, agreement with the Subject or the Subject’s consent do not provide for another term of their storage. The processed personal data is should be destroyed or depersonalized if the following conditions are met:
Reaching the goals for processing of personal data or maximum terms of storage established by Law – within 30 days; Loss of necessity of further reaching the goals of processing of the personal data – within 30 days; Providing by the Subject or his/her legal representative of a confirmation that the personal data are obtained illegally or not required for the declared purposes of their processing – within 10 days; Revocation of the Subject’s consent for personal data protection – within 10 days; Expiration of the limitation terms for the legal relations in which the processing of the personal data was processed or is being processed; Liquidation (reorganization) of the Operator; Other cases directly provided by Law.
2.11. The Representative office of Pakistan Trade House Information Services, Inc. (USA) is registered in the registry of an authorized state body in the sphere of protection of rights of personal data subjects with the registration number 77-17-008616. The Representative office of the American Chamber of Commerce, Inc. in Russian Federation) is registered in the registry of an authorized state body in the sphere of protection of rights of personal data subjects with the registration number 77-18-011556.
3. Maintenance of Personal Data Security
3.1. The Operator undertakes necessary legal, organizational and technical measures for maintenance of personal data security and their protection from unauthorized (including accidental) access, destroying, alteration, blocking or other unauthorized actions with personal data. Such measures inter alia include:
Appointment of the employees responsible for the organization of processing and maintenance of security of the personal data; Checking of presence in the contracts and inclusion if necessary the confidentiality clauses with regard to personal data; Issuing of local acts with regard to processing of personal data, familiarization of employees with these acts; Maintenance of physical safety of the premises, places of storage of personal data, and processing facilities; Limitation and division of access of employees and other persons to personal data and processing facilities, control over the operations with personal data; Application of security measures (anti-virus, firewalls, measures for protection from unauthorized access; cryptographic measures); Recording and keeping of data storage devices, excluding their theft, replacement, unauthorized copying and destroying; Creating of backup copies of information for the purposes of recovery; Internal control over the application of protection measures, checking of effectivity of adopted protection measures.
4. Rights of Personal Data Subjects
4.1. The Subject has a right to revoke the consent to personal data protection by providing a respective request to the Operator in the form published on the Operator’s website www.amcham.ru. The request may be provided in original by registered mail or personally by the Subject to the Operator, and also be sent by e-mail as a scanned copy or plain text to the address info@amcham.ru.
4.2. The Subject has a right to receive the following information relating to processing of his/her personal data, including inter alia:
Confirmation of the fact of processing of the personal data by the Operator; Legal grounds and purposes of personal data processing; Goals and mechanisms of personal data processing applied by the Operator; Name and place of location of the Operator, information of the persons (except for the Operator’s employees) which have access to personal data, or to which the personal data may be disclosed on the basis of an agreement with the Operator, or on the basis of Federal Law; The personal data being processed and relating to the respective personal data Subject, the source of obtaining this personal data, if other procedure for obtaining such information is not provided by Federal Law; Terms of processing and terms of storage of personal data; Procedure of execution of rights of the personal data Subject provided by the Federal Law “On Personal Data” Information on already performed or expecting trans-border transfer of personal data; Name and address of person, whether organization or individual, processing personal data per instruction of the Operator if the processing of personal data is transferred to such person; Other information provided by law.
4.3. The Subject has a right to demand from Operator to alter his/her personal data, block or delete the data if the data is incomplete, outdated, not precise, received illegally or are not necessary for the declared purposes of data processing, as well as to take measures provided by the law for the purposes of protection of his/her rights.
4.4. In case the Subject believes that the Operator performs processing of the personal data with violation of legal requirements or otherwise infringes the Subject’s rights and freedoms, the Subject has a right to appeal the actions or lack of action of the Operator to the authorized body for protection of rights of personal data subjects or through court procedure.
4.5. The personal data Subject has a right to protection of his rights and legal interests, including right to claim for compensation of damages and (or) moral damages through court procedure.
5. Other Provisions
5.1. Control over observation of the requirements set forth in this Policy is performed by the responsible authorized persons of the Operator within their scope of authorities.
5.2. The Operator, its authorized persons and employees shall bear civil and other liability in accordance with applicable legislation for non-observation of the procedure, scope and conditions of personal data processing, as well as for disclosure or illegal use of the personal data.
5.3. This Policy shall be reviewed and actualized by the Operator as necessary. In case of discrepancies between different versions of the Policy, the Policy published on the website of the Operator shall be deemed valid and effective.
