This Personal Data Processing Policy of the Data Controller (hereinafter referred to as the “Policy”) describes personal data processing activities and the implemented personal data protection requirements applicable to the following legal entities: Antal Talent JSC and its subsidiary Antal Business Solutions LLC, each of which acts as an independent personal data controller.
1. Key terms and definitions
Automated processing of personal data means the processing of personal data using computer technology.
Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify personal data.
Personal data information system means a set of personal data contained in databases, as well as information technologies and technical means enabling the processing of such personal data.
Depersonalisation of personal data means actions as a result of which it becomes impossible, without the use of additional information, to determine whether personal data belongs to a particular personal data subject.
Processing of personal data means any action (operation) or set of actions (operations) performed with personal data, whether by automated means or without such means, including collection, recording, organisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion and destruction of personal data.
Personal data controller (Controller) means a state authority, municipal authority, legal entity or individual that, independently or jointly with other persons, organises and/or carries out the processing of personal data and determines the purposes of personal data processing, the personal data to be processed, and the actions (operations) performed with personal data.
Personal data means any information relating directly or indirectly to an identified or identifiable individual (personal data subject).
Provision of personal data means actions aimed at disclosing personal data to a specific person or a specific group of persons.
Distribution of personal data means actions aimed at disclosing personal data to an indefinite number of persons.
Destruction of personal data means actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which physical media containing personal data are destroyed.
2. General provisions and principles of personal data processing
2.1. This Personal Data Processing Policy of Antal Talent JSC (hereinafter referred to as the “Controller”) is an official document developed for the purpose of protecting the rights and freedoms of personal data subjects in the processing of their personal data, including the protection of the rights to privacy and personal and family confidentiality (hereinafter referred to as the “Policy”).
2.2. This Policy shall enter into force upon its approval and shall remain in force indefinitely until replaced by a new Policy.
2.3. Personal data shall be processed in accordance with the following principles:
1. personal data shall be processed lawfully and fairly;
2. personal data processing shall be limited to the achievement of specific, predetermined and legitimate purposes;
3. processing of personal data incompatible with the purposes for which the personal data were collected shall not be permitted;
4. the combination of databases containing personal data that are processed for mutually incompatible purposes shall not be permitted;
5. only personal data corresponding to the purposes of their processing shall be processed; the content and scope of personal data processed shall correspond to the stated purposes of processing. Excessive processing of personal data in relation to the stated purposes of processing shall not be permitted;
6. the accuracy and sufficiency of personal data and, where necessary, their relevance to the purposes of personal data processing shall be ensured during processing. The Controller shall take, or ensure that measures are taken, to delete or clarify incomplete or inaccurate personal data;
7. personal data shall be stored in a form that allows the personal data subject to be identified for no longer than is required for the purposes of personal data processing, unless a personal data retention period is established by federal law or by an agreement to which the personal data subject is a party, beneficiary or guarantor;
8. personal data being processed shall be destroyed or depersonalised once the purposes of processing have been achieved or where there is no longer a need to achieve such purposes, unless otherwise provided for by the legislation of the Russian Federation.
3. Legal grounds for personal data processing
3.1. The legal grounds for processing personal data (hereinafter referred to as “PD”) are:
1. laws and other regulatory legal acts of the Russian Federation;
2. constitutional documents and internal regulations of Antal Talent JSC;
3. agreements with personal data subjects;
4. consents of personal data subjects to the processing of their personal data.
4. Categories of personal data subjects and personal data processed
4.1. The Controller processes PD relating to the following categories of personal data subjects:
1. employees of the Controller;
2. former employees;
3. relatives of the Controller’s employees;
4. contractors who are individuals;
5. contractors and representatives of contractors;
6. clients and representatives of the Controller’s clients;
7. clients who are individuals;
8. the Controller’s job applicants;
9. job applicants of the Controller’s clients;
10. visitors to the Controller’s website;
11. representatives of state and municipal authorities.
4.2. The Controller also processes other categories of PD, as well as special categories of PD relating to health status, in respect of the following categories of personal data subjects:
1. employees of the Controller;
2. former employees of the Controller.
4.3. The Controller does not process special categories of PD relating to race, nationality, political opinions, religious or philosophical beliefs, or intimate life.
4.4. The Controller does not process biometric PD, i.e. information characterising the physiological and biological features of an individual on the basis of which that individual’s identity can be established and which is used by the Controller to establish the identity of a personal data subject.
5. Procedure and conditions for personal data processing
5.1. PD shall be processed lawfully and fairly.
5.2. PD processing shall be limited to the achievement of specific, predetermined and legitimate purposes. Processing of PD incompatible with the purposes for which PD were collected shall not be permitted.
5.3. The combination of databases containing PD that are processed for mutually incompatible purposes shall not be permitted.
5.4. Only PD corresponding to the purposes of their processing shall be processed.
5.5. The content and scope of the PD processed shall correspond to the stated purposes of processing and shall not be excessive in relation to such purposes.
5.6. The accuracy and sufficiency of PD and, where necessary, their relevance to the purposes of PD processing shall be ensured during processing. Necessary measures shall be taken to delete or clarify incomplete or inaccurate data.
5.7. For the purposes of providing information support to the Controller, publicly available sources of the Controller’s PD may be created, including directories, electronic databases and pages of the Controller’s website on the Internet. Publicly available sources of PD may include only the PD specified by the personal data subject in their written consent to the inclusion of their PD in publicly available sources.
5.8. PD shall be stored in a form that allows the personal data subject to be identified for no longer than is required for the purposes of PD processing, unless a PD retention period is established by federal law or by an agreement to which the personal data subject is a party, beneficiary or guarantor. Upon achievement of the purposes of processing, or if the need to achieve such purposes ceases to exist, the PD being processed shall be destroyed or depersonalised unless otherwise provided for by federal law.
6. Purposes of personal data processing
6.1. The Company processes personal data exclusively for the purposes for which such data were collected or obtained. The Company processes personal data to the extent sufficient to achieve the purposes specified in Appendix 1.
6.2. The list of personal data shall be reviewed by the person responsible for organising the Company’s personal data processing at least once a year and as necessary whenever personal data processing procedures change, in order to ensure the accuracy, reliability and relevance of personal data, including in relation to the purposes of personal data processing. For these purposes, the Company may enter personal data into information systems, store such data and process them by any means that do not contravene applicable legislation.
7. Conditions and periods for processing and termination of personal data processing
7.1. The periods for processing and storing personal data processed for each individual purpose shall be determined on the basis of the conditions for personal data processing established by Federal Law No. 152-FZ, the provisions of an agreement to which the personal data subject is a party, beneficiary or guarantor, and/or the personal data subject’s consent. Personal data shall be processed and stored for no longer than is required for the purposes of personal data processing, unless otherwise provided for by Federal Law No. 152-FZ.
7.2. PD processing shall cease within the following periods:
1. upon achievement of the purposes of PD processing or expiry of the maximum retention periods — within 30 days;
2. when the need to achieve the purposes of PD processing ceases to exist — within 30 days;
3. where the personal data subject or their legal representative provides information confirming that the PD were obtained unlawfully or are not necessary for the stated purpose of processing — within 7 days;
4. where it is impossible to ensure the lawfulness of PD processing — within 10 days;
5. where the personal data subject withdraws consent to PD processing and continued storage of the PD is no longer required for the purposes of processing — within 30 days;
6. upon expiry of the limitation periods applicable to the legal relationships within which the PD are or were processed.
7.3. In accordance with Article 21, Part 5 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, the Controller shall not cease processing or destroy the personal data of the Subject in the following cases:
1. where otherwise provided for by an agreement to which the Subject is a party, beneficiary or guarantor;
2. where the Controller is entitled to process personal data without the Subject’s consent on grounds provided for by federal laws;
3. where the periods for processing the Subject’s personal data established by federal laws of the Russian Federation and other regulations have not expired.
7.4. Personal data shall be retained for the periods established by applicable personal data legislation and by Order No. 236 of the Federal Archival Agency dated 20 December 2019 “On Approval of the List of Standard Administrative Archival Documents Generated in the Course of Activities of State Authorities, Local Self-Government Bodies and Organisations, Indicating Their Retention Periods”.
8. Measures to ensure personal data security
8.1. The security of PD processed by the Controller shall be ensured through the implementation of legal, organisational, technical and software measures that are necessary and sufficient to comply with the requirements of personal data protection legislation.
8.2. The Controller shall take the necessary organisational and technical measures to protect PD against accidental or unauthorised access, destruction, alteration, blocking of access and other unauthorised actions.
8.3. The Controller shall implement the following organisational and technical measures:
1. appointing officers responsible for organising PD processing and ensuring PD security;
2. restricting and regulating the number of the Controller’s employees who have access to PD;
3. familiarising the Controller’s employees with the requirements of federal legislation and internal regulations governing PD processing and protection;
4. ensuring the recording, storage and handling of physical media containing PD in a manner preventing theft, substitution, unauthorised copying and destruction;
5. identifying threats to PD security when PD are processed in personal data information systems (hereinafter referred to as “PDIS”) and developing threat models on that basis;
6. developing a PD protection system on the basis of the threat model for the appropriate level of PD security when processed in PDIS;
7. using the necessary technical information security tools to ensure the required level of PDIS security;
8. implementing an authorisation-based system governing PDIS users’ access to information resources and hardware and software used for information processing and protection;
9. registering and recording the activities of PDIS users;
10. using password protection for user access to PDIS;
11. where necessary, using cryptographic information protection tools to ensure PD security during transmission via open communication channels and when stored on removable machine-readable PD storage media;
12. performing antivirus monitoring and preventing malicious software, including computer viruses and software backdoors, from entering the corporate network;
13. where necessary, using firewall protection;
14. where necessary, using intrusion detection tools to identify intrusions into the corporate network that violate or create conditions for violating established PD security requirements;
15. training employees of the Controller who use information security tools implemented in PDIS in the rules governing their use;
16. maintaining records of information security tools used and the related operating and technical documentation;
17. where necessary, using information security tools that have undergone the prescribed conformity assessment procedure;
18. monitoring the activities of PDIS users and investigating violations of PD security requirements;
19. assessing the effectiveness of measures taken to ensure PD security;
20. maintaining technical security and premises alarm systems in a state of continuous operational readiness.
9. Cross-border transfer of personal data
9.1. Before commencing any activities involving the cross-border transfer of personal data, the Controller shall notify the authorised body responsible for protecting the rights of personal data subjects of its intention to carry out cross-border transfers of personal data. Such notification shall be submitted separately from the notification of the intention to process personal data.
9.2. Before submitting the above notification, the Controller shall obtain the relevant information from the authorities of the foreign state, foreign individuals and foreign legal entities to which the cross-border transfer of personal data is planned.
9.3. Cross-border transfers of PD shall be carried out to foreign states that ensure adequate protection of the rights of personal data subjects, including countries that are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as the Kyrgyz Republic, the People’s Republic of China, the Republic of Belarus, the Republic of Kazakhstan, the Republic of Tajikistan, the Republic of Uzbekistan, Japan, the Republic of Singapore, India, the Federative Republic of Brazil and the Kingdom of Thailand, as well as to the United Arab Emirates.
9.4. Cross-border transfers of PD to foreign states shall be carried out on the basis of:
1. the personal data subject’s written consent to the cross-border transfer of their PD;
2. performance of agreements to which the personal data subject is a party.
10. Rights of personal data subjects
10.1. A personal data subject shall have the right to obtain information concerning the processing of their PD, including:
1. confirmation that the Controller processes their PD;
2. the legal grounds and purposes of PD processing;
3. the purposes and methods of PD processing applied by the Controller;
4. the name and location of the Controller and information about persons, other than the Controller’s employees, who have access to PD or to whom PD may be disclosed pursuant to an agreement with the Controller or pursuant to federal law;
5. the PD being processed in relation to the relevant personal data subject and the source from which such data were obtained, unless a different procedure for providing such data is established by federal law;
6. the periods of PD processing, including retention periods;
7. the procedure for the exercise by the personal data subject of the rights provided for by the Federal Law “On Personal Data”;
8. information about any completed or proposed cross-border transfer of PD;
9. the name or surname, first name and patronymic, and address of the person processing PD on behalf of the Controller, where such processing has been or will be entrusted to such person;
10. other information provided for by the Federal Law “On Personal Data” or other federal laws.
10.2. A personal data subject shall have the right to require the Controller to clarify, block or destroy their PD where such PD are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, as well as to take other measures provided for by law to protect their rights.
10.3. If a personal data subject believes that the Controller is processing their PD in violation of the requirements of the Federal Law “On Personal Data” or otherwise infringing their rights and freedoms, the personal data subject shall have the right to appeal against the Controller’s actions or inaction to the competent authority responsible for protecting the rights of personal data subjects — the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) — or through the courts.
10.4. A personal data subject shall have the right to protect their rights and legitimate interests, including the right to claim damages and/or compensation for moral harm through the courts.
10.5. A personal data subject shall have other rights provided for by applicable legislation.
11. Final provisions
11.1. Compliance with the requirements of this Policy shall be monitored by the person responsible for organising PD processing.
11.2. Other rights and obligations of the Controller shall be determined by the Federal Law “On Personal Data” and other regulatory legal acts governing the protection of PD.
11.3. Officers responsible for violations of the rules governing the processing and protection of PD shall bear material, disciplinary, administrative, civil or criminal liability in accordance with the procedure established by federal laws.
Appendix 1 to the Personal Data Processing Policy