Personal Data Processing and Security Policy
|
Annex to Order of |
1. General Provisions
1.1. Personal Data Processing and Security Policy (Policy) shall determine the objectives, contents and processing of personal data processing, measures aimed at personal data protection and procedures aimed at identification and prevention of violations of the legislation of the Russian Federation in the sphere of personal data in Headhunter LLC (Company), INN 7718620740, address: room 25, 48, 2nd Brestskaya Street, Tverskoy Municipal District, Moscow, 125047.
1.2. This Policy shall determine the policy of the Company as the operator processing personal data in respect of personal data processing and protecting.
1.3. This Policy is applicable to all web-sites of the Company under its administration, including, without limitation, https://hh.ru , https://headhunter.ru , https://career.ru, www.zarplata.ru, and other web-sites of the Company referring to this Policy.
1.4. The Company shall carry out personal data processing in compliance with the principles and conditions stipulated by this Policy and the legislation of the Russian Federation in the sphere of personal data.
1.5. The Company as the personal data operator shall:
— ensure confidentiality and security of personal data of the personal data subjects;
— advise the personal data subjects on their rights, provide them with information on their personal data processing at request;
— at the request of the personal data subject, specify his/her personal data, block or delete them if they are incomplete, outdated, unreliable, illegally obtained or are not necessary for the declared objective of processing;
— notify the personal data subject on his/her personal data in compliance with the obligations imposed on the Company as the personal data operator.
1.6. The Company as the personal data operator shall be entitled to:
— provide the personal data of the personal data subjects to third parties if stipulated by the applicable legislation (tax, law-enforcement authorities, etc) and this Policy;
— refuse to provide information on personal data in the cases stipulated by the legislation of the Russian Federation in the sphere of personal data;
— use the personal data of the personal data subject without his/her consent in the cases stipulated by the legislation of the Russian Federation in the sphere of personal data.
1.7. The personal data subject has the following rights:
— request information related to his/her personal data processing;
— demand specification, blocking or destruction of his/her personal data if the personal data are incomplete, outdated, unreliable, illegally obtained or are not necessary for the declared objective of processing;
— withdraw the consent to personal data processing;
— take other actions to protect his/her rights as stipulated by the legislation of the Russian Federation in the sphere of personal data.
1.8. To exercise his/her rights, the personal data subject may contact the Company in the order determined by Article 7 hereof.
2. Objectives of Personal Data Processing
— consideration of possibility of employment with the Company and processing the HR-documents, including personnel reserve of the Company;
— personnel management, including conclusion and/or execution of the concluded employment agreement, career development, recoding of performance results, ensuring working conditions, warranties and compensations established by the legislation of the Russian Federation, as well as provision of corporate benefits and guarantees;
— training of the Company’s employees, including assistance in the development and professional qualification enhancement of employees, human resource management, and recognition of achievements;
— sending the Company’s employees on business trips;
— internal communication for the employees within the Company, including of birthday and work anniversary congratulations within the Company, welcome communication, operation of the HR portal, and participation in surveys;
— conclusion, execution, amendment and termination of agreements associated with spending of funds in the interests of the Company, including establishing and maintaining business communication, information interaction;
— record management and document flow in the Company, including the organization of mail delivery;
— assurance of safe activity of the Company, including the prevention of fraudulent activities;
— assurance of efficiency and sustainability of activity of the Company, including due diligence (verification of the reliability and accuracy of the provided data) and check for presence/absence of conflict of interest, risk management of the Company;
— external communications, including publishing of materials on the information resource of the Company, participation in the Company’s promotional and/or advertising campaigns;
— marketing events, including attraction of users to the web-site of the Company, organizing communications within communities and social media groups administered by the Company, sending ads to the Company’s customers, provision of information on discounts, promotion codes and promotions of the Company’s partners, ensuring the operation of the partner platform for advertising management;
— information and consulting workshops on programming:
— processing of requests from the Company’s customers, including the speech analytics;
— data analytics to improve and develop the activity of the Company, including optimization of web-resources;
— conclusion (execution/amendment/termination) of the contract for provision of products and services of www.hh.ru for applicants, including identification of a party to the contract, granting access to the web-site functionality, personalization of web-site services provided, contributing to employment and provision of possibility of employment or other type of occupation with the employers — customers of the Company, including provision of services/performance of work by the applicant for the employer — customer of the Company on the basis of a civil law contract, and preliminary interview for the purpose of employment or other type of occupation with the employers — customers of the Company, information support and requests processing, research aimed at improvement of the quality of provision to the applicant of the products and services of the web-site and/or creation of new products and services of the web-site;
— conclusion, execution, amendment and termination of the contract for provision of products and services of www.hh.ru for employers, including identification of a party to the contract, publication and advertisement of vacant positions, search and recruitment of candidates for vacant positions, granting access to the database, organization of events, research and formation of HR brand, participation in inspections within the limits of due diligence and tender procedures (under Federal Laws
— customer support when using the services of www.hh.ru, including customer registration on the web-site and moderation of vacant positions/CVs;
— support of sales of products and services of www.hh.ru;
— conclusion (execution/amendment/termination) of the contract for provision of products and services of www.setka.ru , including granting access to the web-site functionality, information support, research aimed at improvement of the quality of provision of the products and services of the web-site and/or creation of new products and services of the web-site;
— creation of new products and services by the Company.
3. Legal Grounds for Personal Data Processing
3.1. The legal grounds for personal data processing in the Company are:
— performance of functions, powers and obligations imposed on the Company by the legislation of the Russian Federation (Labor Code of the Russian Federation, Civil Code of the Russian Federation, Federal Law
— contracts concluded by the Company with personal data subjects;
— consents to personal data processing received by the Company for the purposes specified in Section 2 hereof;
— exercise of rights and legal interests of the Company;
— participation in legal proceedings.
4. Scope and Categories of Processed Personal Data, Categories of Personal Data Subjects
4.1. Scope and categories of processed personal data, categories of personal data subjects, objectives and legal grounds for personal data processing and the terms of storage of personal data are set in the Register of Personal Data Processing Processes in the Company and in the Personal Data Register on the web-site of the Federal Service for Supervision of Communications, Information Technology, and Mass Media.
5. Personal Data Processing Procedure and Conditions
5.1. The personal data of the personal data subjects shall be processed by the Company in strict compliance with the following principles:
— personal data processing is on legal and fair basis;
— personal data processing is limited to achievement of certain, pre-defined and legal objectives;
— it is not permitted to combine databases containing personal data which processing has incompatible objectives;
— only the personal data corresponding to the objectives of their processing are subject to processing;
— the contents and scope of processed personal data correspond to the declared objectives of processing, the Company does not process excessive personal data;
— accuracy of personal data, their sufficiency and, if necessary, relevance in respect of objectives of personal data processing are ensured during processing;
— measures are ensured to delete or specify incomplete or inaccurate data;
— personal data are stored in the form that allows identifying the personal data subject for no longer than required for the objectives of personal data processing unless the term for storing the personal data is established by the federal law or this Policy;
— the processed personal data are destroyed upon achievement of objectives of processing or if there is no longer need in achievement of these objectives unless the current legislation of the Russian Federation provides otherwise.
5.2. The Company shall perform the following actions with the personal data: collection, recording, systematization, accumulation, storage, specification (updating, change), retrieval, use, transfer (dissemination, provision, access), blocking, deletion, destruction, anonymization.
5.3. The Company receives the subjects’ personal data from the personal data subject in person or from the concluded contract to which the personal data subject is a party.
5.4. If the processing of personal data is based on the consent of the data subject and there is no requirement to obtain written consent, the consent may be given by the data subject or their representative in any form that allows confirmation of its receipt.
5.5. In the cases when personal data are not received from the subject or his/her legal representative, the Company shall notify the subject on personal data processing prior to commencement of such processing.
No notification of the subject on processing of personal data not received from him/her is required in the following cases:
— personal data subject is notified on processing of his/her data by the respective operator;
— personal data are received by the Company on the basis of the federal law or in connection with performance under the contract to which the personal data subject is a party or a beneficiary or a surety;
— personal data which the subject permitted to disseminate are processed in compliance with the prohibitions and conditions set by such a subject;
— provision to personal data subject of data contained in the notice on personal data procession violates the rights and legal interests of third parties.
5.6. Except for the cases specified in Clause 5.5 hereof, the Company may disclose the personal data of the subject in the following cases:
— in compliance with the requirements of the current legislation;
— in response to demand from public authorities;
— in compliance with the requirements of legal proceedings in connection with administration of justice;
— if necessary to protect life, health or other vital interests of the personal data subject;
— to protect the rights of the Company or reduce possible damage to the Company;
— emergency situations.
5.7. When personal data processing is delegated to a third party, the Company shall conclude the respective personal data processing agreement with such a party. In such agreement the Company shall oblige the party who processes the personal data to follow the principles and rules of personal data processing stipulated by the current legislation of the Russian Federation.
5.8. If the Company delegates processing of personal data to a third party, the Company shall bear liability for the actions of the said party to the personal data subject. The party processing personal data on a data processing agreement shall bear liability to the Company in compliance with the conditions of the data processing agreement.
5.9. The Company undertakes and obliges other persons who get access to personal data not to disclose to third parties and not to disseminate the personal data without consent of the subject unless the current legislation of the Russian Federation provides otherwise.
5.10. If there is consent of the subject, the Company shall transfer the subject’s personal data to third parties, the actual list of which is hold in the Register of the third parties.
The sense of the services provided by the Company is to grant access to the personal data of an applicant in according with their consent, for the Company’s clients who have contractual relations with the Company. The purpose is to provide employment opportunities or other types of occupation for job seekers.
5.11. When processing the personal data, the Company shall take necessary legal, organizational and technical measures to protect the personal data from illegal or accidental access, destruction, change, blocking, copying, provision, dissemination of personal data, and from other illegal actions in respect of personal data.
5.12. To provide for protection of the subjects’ personal data the Company implements the following measures:
— person responsible for organization of personal data processing and protection is appointed;
— personal data protection system is implemented in the information systems of the Company to provide for personal data security in compliance with the requirements of the current legislation of the Russian Federation;
— all media with personal data both paper and electronic are subject to accounting, and strict requirements to storage and destruction are applicable to them;
— all personal data are backed up and, in case of their modification or destruction, the Company is always able to restore them, except for the cases of withdrawal of consent to data processing by the personal data subject;
— pass control is established at the territory of the Company;
— minimal necessary number of employees of the Company has access to personal data and only for the purposes of performance of their job duties;
— confidential information non-disclosure conditions are included into the employment agreements concluded with all employees of the Company who have access to the subjects’ personal data;
— the Company systematically and continuously trains its employees involved in personal data processing;
— the Company constantly improves the level of security of the subjects’ personal data using the internal control system and, in case of discrepancies, eliminates their causes as soon as possible.
6. Terms of Processing and Storage of Personal Data. Personal Data Destruction Procedure
6.1. Personal data are stored in the Company in the form that allows identifying the personal data subject for no longer than required for the objectives of personal data processing unless the term for storing the personal data is established by the federal law or the contract to which the personal data subject is a party, a beneficiary or a surety.
6.2. The terms of storage of personal data are determined in the Register of Personal Data Processing Processes in the Company. Personal data are stored by the Company only at the territory of the Russian Federation.
6.3. The Company provides for separate storage of personal data on different tangible media which are processed with different objectives as determined by this Policy.
6.4. The heads of structural divisions of the Company shall control storage and use of tangible media with personal data not allowing unauthorized use, specification, dissemination and destruction of personal data on these media.
6.5. The term of storage of personal data entered into the information systems of the Company shall correspond to the term of storage of paper originals.
6.6. The condition of termination of personal data processing in the Company is achievement of objectives of personal data processing, expiration of consent or withdrawal of consent to the personal data subject to personal data processing, liquidation of the Company and detection of illegal personal data processing.
6.7. If the fact of illegal personal data processing is proven, the Company shall terminate such personal data processing.
6.8. In case of achievement of objectives of personal data processing and withdrawal of consent to processing by the personal data subject, the personal data are subject to destruction unless the Company has other legal grounds to continue personal data processing. Such grounds are:
— presence in the contract to which the personal data subject is a party, a beneficiary or a surety of condition on continuation of personal data processing after achievement of objectives of processing;
— availability with the Company of the right to process personal data without the consent of the subject on the grounds stipulated by Federal Law No. 152 “On Personal Data” or other federal laws;
— presence in other agreement between the Company and the personal data subject of condition on continuation of personal data processing after achievement of objectives of processing.
6.9. Upon expiration of processing term, the personal data on electronic media shall be destroyed by mechanical integrity violation of the media not allowing to read or restore the personal data or by deleting from electronic media using the methods and means of guaranteed deletion of residual information.
6.10. Upon expiration of processing term, the personal data on paper media shall be destroyed in compliance with the rules of the Company established for document flow and archiving. The structural division of the Company responsible for document flow and archiving shall systematically control and separate the expired documents containing personal data subject to destruction.
7. Consideration of Requests of Personal Data Subjects or their Representatives
7.1. The personal data subject or his/her legal representative shall be entitled to receive information related to processing of his/her personal data, including that containing:
— confirmation of the fact of personal data processing by the Company;
— legal grounds and objectives of personal data processing;
— methods of personal data processing;
— name and location of the Company, data on the persons who have access to personal data or to whom the personal data may be disclosed on the basis of the contract with the Company or on the basis of federal law;
— the list of processed personal data related to the respective subject and the source of receipt;
— terms of personal data processing, including their storage terms;
— procedure for exercise by the personal data subject of rights stipulated by Federal Law No. 152 “On Personal Data”;
— information on actual or expected cross-border transfer of data;
— information on methods of performance by the Company of the obligations established by Article 18.1 of Federal Law No. 152 “On Personal Data”;
— other data stipulated by Federal Law No. 152 “On Personal Data” or other federal laws.
7.2. The personal data subject or his/her legal representative shall be entitled to demand from the Company specification, blocking or destruction of personal data if personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the declared objective of processing and to take measures stipulated to protect his/her rights.
7.3. The data specified in Clause 7.1. hereof shall be provided to the personal data subject by the Company in an accessible form and shall not contain the personal data related to other personal data subjects, except for the cases when there are legal grounds to disclose such personal data.
7.4. The data specified in Clause 7.1. hereof shall be provided to the personal data subject or his/her representative by the Company within ten business days from the moment of inquiry or receipt by the Company of request from the subject or his/her representative. The inquiry or request may be sent to the address of the Company set forth in Clause 1.1. hereof or by e-mail: feedback@hh.ru The request shall contain:
— number of the main identity paper of the personal data subject or his/her legal representative;
— data on the date of issue of such paper and issuing authority;
— data confirming participation of the personal data subject in relations with the Company or data otherwise proving the fact of personal data processing by the Company;
— signature of the personal data subject or his/her representative.
7.5. If the data specified in Clause 7.1. hereof and the processed personal data were provided for familiarization to the personal data subject at his/her request, the personal data subject may contact the Company again or send it a repeated request to get such data and familiarize with such personal data not earlier than thirty days after the initial inquiry or sending the initial request unless a shorter term is established by the federal law, legal instrument adopted thereunder or a contract to which the personal data subject is a party, a beneficiary or a surety.
7.6. The personal data subject may contact the Company again or send it a repeated request to get the data specified in Clause 7.1. hereof and to familiarize with the processed personal data before expiration of the term specified in Clause 7.5. hereof in case if such data and/or processed personal data were not provided to him/her for familiarization in full following consideration of the initial inquiry. Repeated request shall contain, along with the data specified in Clause 7.4. hereof, justification of the repeated request.
7.7. The Company may refuse the personal data subject to execute the repeated request not meeting the conditions stipulated by Clause 7.5. and Clause 7.6. hereof. Such refusal shall be grounded. The Company shall be obliged to provide evidence of justification refusal to execute the repeated request.
7.8. The right of the personal data subject to access his/her data may be restricted in compliance with the requirements of the legislation of the Russian Federation, including if access of the personal data subject to his/her data violates the rights and legal interests of third parties.