Approved

President of IT Innovations Fund

__________________ (I.E. Kalashnikova)

Order number 20-U

dated March 01, 2019

POLICY

of IT Innovations Fund

in relation to the processing of personal data

Saint-Petersburg, Russia

2019

  1. GENERAL PROVISIONS

1.1 This new version of the Policy on the processing of personal data of IT Innovations Fund (TIN 7813292056) (hereinafter referred to as the “Policy”) was developed in accordance with the requirements of the Federal Law of the Russian Federation No. 152 from July 27, 2006 “On Personal Data” (as amended by the Federal Law of 31.12.2017 No. 498) (hereinafter - the “Federal Law”), and approved by the Order of the President of IT Innovations Fund from March 01, 2019 No. 20-U.

1.2. The purpose of the Policy is to ensure the protection of the rights and freedoms of a person and a citizen in the processing of his personal data by IT Innovations Fund (hereinafter referred to as the “Fund” or “Operator”), including the protection of privacy rights, personal and family secrets.

1.3. Main terms used in the Policy:

1.4. Basic responsibilities of the Operator

The operator must:

- provide the subject of personal data with information concerning the processing of his personal data upon his request or legally provide a refusal;

1.5. Basic rights of the subjects of personal data:

The subject of personal data has the right to:


2. PURPOSE OF PERSONAL DATA COLLECTION

2.1. The Fund collects and stores personal data of employees, visitors to the Portal, including participants in contests, pitch sessions and other events organized and held by the Fund, representatives of legal entities, Fund employees or applicants for filling vacant positions of the Fund, as well as personal data of other personal subjects data received from counterparties of the Fund, necessary for the execution of agreements or treaties to which or on which the beneficiary is the subject of personal data.

2.2. The Fund carries out the processing of personal data in order to:

2.3. The collection of personal data of potential participants / participants of the Events through the Portal is carried out by self-filling the personal information field on the Portal with the relevant subject, including when he completes a contact form for filing an application for registration at the Event, and entering data about his last name, first name and patronymic (if available), age, contact phone number, e-mail address, place of work and position, information about education, address locations of work and place of residence, information on accounts in social networks, information about interests, information about membership in clubs, associations and unions.

The collection of personal data of other subjects of personal data provided for in this Policy is carried out in direct interaction with the relevant subject of personal data.

3. LEGAL BASIS OF PERSONAL DATA PROCESSING

The Fund processes the personal data of the subjects guided by:

4. VOLUME AND CATEGORIES OF PROCESSED PERSONAL DATA, CATEGORIES OF PERSONAL DATA SUBJECTS

4.1. The Fund processes personal data of the following categories of subjects:

4.2. The Fund processes personal data in the following categories and in the following scope:


5. ORDER AND TERMS OF PROCESSING OF PERSONAL DATA

5.1. The Fund carries out the processing of personal data in the presence of at least one of the following conditions:

5.2. When processing of personal data is being executed by the Fund, confidentiality of personal data is respected: personal data is not disclosed to third parties, is not otherwise distributed without the consent of the Personal Data Subject, except as required by the current legislation of the Russian Federation.
The inclusion by the Fund of personal data of the Subjects in publicly accessible sources of personal data is possible only if there are requirements of federal legislation, or if the Subject of personal data is obtained.

5.3. The Fund does not process special categories of personal data relating to race, nationality, political views, religious and philosophical beliefs, health status, intimate life of personal data subjects.
5.4. Biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established and which are used by the Fund to identify the identity of the subject of personal data) is not processed by the Fund.

5.5. The Fund collects, records, organizes, accumulates, stores, refines (updates, changes), retrieves, uses, transfers (distributes, provides, accesses), remodel, blocks, deletes and destroys personal data.

5.6. The processing of personal data by the Fund is carried out in the following ways:

5.7. The Fund has the right to entrust the processing of personal data to another person only with the consent of the Personal Data Subject, unless otherwise provided by federal law, on the basis of an agreement concluded with this person (hereinafter referred to as the Fund’s instructions). At the same time, the Fund obliges the person who performs the processing of personal data on behalf of, to comply with the principles and rules for the processing of personal data provided for by federal law. In the event that the Fund entrusts the processing of personal data to another person, the responsibility to the subject of personal data for the actions of the said person lies with the Fund. The person who processes personal data on behalf of the Fund is responsible to the Fund.

5.8. The provision of the processed personal data by the Fund is carried out in accordance with the legislation of the Russian Federation:

5.8.1. In order to fulfill the Fund's civil liabilities, it is intended to carry out cross-border transfer of personal data to individuals-participants (representatives of participating organizations) of Events organized and conducted by the Fund on the basis of transactions, of which (the Customer) is a foreign legal entity.Cross-border transfer of personal data is carried out in order to select candidates for passing the relevant stage of the Event, as well as to determine the winner of the relevant Event. Cross-border transmission can be made in respect of personal data provided to the Fund when the Personal Data Subjects fill out information fields on the Portal, including when filling out a contact form, as well as submitting an application for registration to participate in the Events. The composition of such personal data includes data on: surname, name, patronymic (if available), age, contact telephone number, e-mail address, place of work and position held, information about education, address of work location and place of residence, account information in social networks, information about interests, information about membership in clubs, associations and unions.
In the case of a cross-border transfer of personal data by a person who received personal data, they are collected, recorded, organized, accumulated, stored, updated (modified, modified), used, deleted and destroyed personal data.

Prior to the commencement of the cross-border transfer of personal data, the Fund is obliged to ensure that the foreign state, to the territory of which the transfer of personal data is carried out, ensures adequate protection of the rights of personal data subjects.

Cross-border transfer of personal data on the territory of foreign countries that do not provide adequate protection of the rights of personal data subjects may be carried out by the Fund in the following cases:

5.9. The Fund has the right to transfer personal data to bodies of inquiry and investigation, other authorized bodies on the grounds stipulated by the legislation of the Russian Federation.
5.10. Access to processed personal data is provided only to those employees of the Fund who need it in connection with the performance of their official duties and in compliance with the principles of personal responsibility.

5.11. The Fund provides separate storage of personal data and their material carriers, which are processed for different purposes and which contain different categories of personal data.

5.12. The processing of personal data by the Fund is terminated in the following cases:

5.13. Personal data, the processing time (storage) of which has expired, must be destroyed, unless otherwise provided by federal law. Storage of personal data after the termination of their processing is allowed only after their anonymization.

When storing personal data, the Fund is obliged to ensure the use of databases located on the territory of the Russian Federation, except for the cases provided for in paragraph 2, 3, 4, 8, part 1 of art. 6 of the Federal Law.

The retention period for personal data is:

5.14. The rules for working with personal data and their material carriers without the use of automation tools are defined in accordance with the “Provision on peculiarities of personal data processing carried out without the use of automation tools”, Decree of the Government of the Russian Federation from February 15, 2008 No. 687.

The processing of personal data of the Personal Data Subject is considered implemented without the use of automation tools, if such actions with personal data, such as use, clarification, distribution, destruction of personal data in relation to each of the personal data subjects, are carried out with the direct participation of a person. A document containing personal data is a tangible medium with information recorded in it in any form containing personal data in the form of text (or) their combination.
5.14.1. The processing of personal data is carried out in respect of personal data and must be separated from other information by fixing them on separate material carriers, in special sections or in the form fields.

When recording personal data on tangible media, it is not allowed to record personal data on one tangible medium, the processing purposes of which are not compatible. Standard forms of documents should be designed in such a way that each of the subjects of personal data contained in the document has the opportunity to get acquainted with their personal data contained in the document without violating the rights and legitimate interests of other subjects of personal data.
Documents containing personal data are stored in cabinets locked with a key.

5.14.2. When working with documents containing personal data, an employee of the Fund is obliged to exclude the possibility of familiarization, viewing of these documents by other persons who are not authorized to work with them. When transferring documents containing personal data outside the Fund for business purposes, the Fund employee must take all possible measures to prevent the loss (loss, theft) of such documents.

When working with personal data of personal data subjects, as well as with their carriers, the Fund:


6. ACTUALIZATION, CORRECTION, DELETION AND DESTRUCTION OF PERSONAL DATA, RESPONSES TO REQUESTS OF SUBJECTS OF PERSONAL DATA.

6.1. In the event of confirmation of the fact of inaccuracy of personal data or the illegality of their processing, personal data are subject to updating by the Fund and processing must be terminated, respectively.
6.2. The Fund provides the subject of personal data or his legal representative information relating to the processing of his personal data, withdrawal of consent and access of the subject of personal data to his data, on the relevant request or request of the subject of personal data or his legal representative.

6.3 The information is provided in an accessible form and does not contain personal data relating to other subjects of personal data, except in cases where there are legal grounds for disclosing such personal data.

6.4 The request of the subject of personal data to receive information concerning the processing of his personal data by the Fund must contain:

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

6.5. The Fund considers the appeal of the subject of personal data and provides an answer to it within 30 days from the date of receipt of the corresponding request in a form similar to the form of the received request.

6.6. When achieving the purposes of processing personal data, as well as in the case of a withdrawal by the subject of personal data of consent for their processing, personal data are subject to destruction, in the terms established by the legislation of the Russian Federation

6.7. Destruction at the end of the processing of personal data on electronic media is carried out by mechanical violation of the integrity of the media, which does not allow reading or restoring personal data, or by removing electronic media from electronic media using methods and means of guaranteed removal of residual information.

6.8. Destruction at the end of the processing of personal data on paper media is carried out by grinding into small parts using a Schröder, which eliminates the possibility of subsequent recovery of information.

6.9. The rules for processing requests for a personal data subject or an authorized body for the protection of the rights of personal data subjects are the Annex to this Policy and its integral part.


7. FINAL PROVISIONS

7.1. This Policy may be revised in the event of changes in the norms of the current legislation of the Russian Federation, processes and methods for processing personal data, categories of personal data subjects, as well as goals for processing personal data.

7.2. All employees of the Company must be familiar with this Policy.

7.3. In order to ensure unrestricted access to this Policy, it is subject to publication - posting on the Fund Portal.