Privacy policy

POLICY
regarding personal data processing
in LIMITED LIABILITY COMPANY "UK "ALLIANCE"

1. Basic Terms and Definitions

Automated processing of personal data – processing of personal data using computer technology.

Blocking of personal data – temporary suspension of personal data processing (unless processing is necessary to clarify personal data).

Personal data information system – a set of personal data contained in databases and information technologies and technical means that ensure their processing.

Anonymization of personal data – actions as a result of which it becomes impossible to determine the ownership of personal data by a specific personal data subject without using additional information.

Processing of personal data – any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data.

Personal data operator (operator) – a state body, municipal body, legal entity, or individual independently or jointly with other persons organizing and/or carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data.

Personal data – any information relating directly or indirectly to a specific or identifiable individual (subject of personal data);

Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific circle of persons.

Dissemination of personal data – actions aimed at disclosing personal data to an indefinite circle of persons.

Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual, or a foreign legal entity.

Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which physical media of personal data are destroyed.

2. General Provisions

2.1. This Policy regarding personal data processing in LLC "UK "ALLIANCE" (hereinafter – Policy) is an official document that defines general principles, purposes, and procedure for processing, volume, and categories of processed personal data (hereinafter – PDn), as well as information on measures implemented to ensure PDn security.

2.2. This Policy applies to all employees of LLC "UK "ALLIANCE" (hereinafter – Operator), as well as to employees of third-party organizations interacting with the Operator on the basis of relevant contracts, regulatory, legal, and organizational documents.

2.3. This Policy comes into force from the moment of its approval and is effective indefinitely until replaced by a new Policy.

3. Purposes of PDn Collection

3.1. The Operator processes PDn exclusively for the following purposes:

- maintaining personnel, accounting, and military registration;

- fulfillment by the Operator of the employer's function, registration of labor relations, and provision of working conditions established by the legislation of the Russian Federation;

- implementation of activities provided for by the Operator's Charter;

- fulfillment of contractual obligations.

4. Legal Grounds for PDn Processing

4.1. The Operator processes PDn in accordance with the following legal acts:

- Art. 65, 86-90 of the Labor Code of the Russian Federation;

- Tax Code of the Russian Federation;

- Housing Code of the Russian Federation;

- Federal Law No. 167-FZ "On Mandatory Pension Insurance in the Russian Federation";

- Federal Law No. 402-FZ "On Accounting";

- Federal Law No. 255-FZ "On Mandatory Social Insurance in Case of Temporary Disability and in Connection with Motherhood";

- Federal Law No. 326-FZ "On Mandatory Medical Insurance in the Russian Federation";

- Decree of Goskomstat of the Russian Federation No. 1 "On Approval of Unified Forms of Primary Accounting Documentation for Labor and its Payment";

- Anti-terrorism protection requirements for hotels and other accommodation facilities, approved by Decree of the Government of the RF dated 14.04.2017 No. 447;

- Decree of the Government of the RF dated 18.11.2020 No. 1853 "On Approval of Rules for Provision of Hotel Services in the Russian Federation";

- Contract for the provision of hotel services (Registration Card);

- Federal Law dated 24.11.1996 No. 132-FZ "On the Fundamentals of Tourism Activities in the Russian Federation";

- Decree of the Government of the RF dated 18.11.2020 No. 1860 "On Approval of the Regulation on Classification of Hotels";

- Federal Law dated 18.07.2006 No. 109-FZ "On Migration Registration of Foreign Citizens and Stateless Persons in the Russian Federation";

- Decree of the Government of the RF dated 15.01.2007 No. 9 "On Procedure for Migration Registration of Foreign Citizens and Stateless Persons in the Russian Federation";

- Charter of the organization.

5. Scope and Categories of Processed PDn, Categories of PDn Subjects

5.1. The Operator processes the following categories of PDn:

6. Procedure and Conditions for PDn Processing

6.1. PDn processing is carried out on a lawful and fair basis.

6.2. PDn processing is limited to achieving specific, predetermined, and legitimate goals. Processing incompatible with the purposes of PDn collection is not permitted.

6.3. Combining databases containing PDn processed for incompatible purposes is not allowed.

6.4. Only PDn that meet the purposes of their processing are subject to processing.

6.5. The content and scope of processed PDn comply with stated processing goals and are not excessive.

6.6. When processing PDn, accuracy, sufficiency, and relevance are ensured. Necessary measures are taken to delete or update incomplete or inaccurate data.

6.7. Publicly available sources of PDn may be created to support the Operator's activities. PDn are included in public sources only with written consent.

6.8. PDn storage is carried out in a form that allows identifying the PDn subject no longer than required by the processing goals, unless otherwise provided by law or contract. Upon reaching goals or loss of necessity, PDn are destroyed or anonymized.

7. Conditions and Time Limits for Termination of Personal Data Processing

7.1. The Operator terminates PDn processing in the following cases:

- achievement of processing goals or maximum storage periods – within 30 days;

- loss of necessity to achieve processing goals – within 30 days;

- provision by the PDn subject of information confirming that PDn were illegally obtained or not necessary – within 7 days;

- impossibility of ensuring lawful processing – within 10 days;

- withdrawal of consent by the PDn subject – within 30 days;

- expiration of limitation periods for relevant legal relationships.

7.2. Pursuant to Art. 21, Part 5 of Federal Law No. 152-FZ "On Personal Data", the Operator does not terminate processing or destroy PDn if provided by law or contract, or if processing periods established by law have not expired.

8. PDn Security Measures

8.1. PDn security is ensured by implementing legal, organizational, and technical measures required to meet legal requirements.

8.2. The Operator takes necessary measures to protect PDn from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions.

8.3. Organizational and technical measures include appointing responsible persons, restricting access, training employees, storing physical media securely, implementing firewall, antivirus, password protection, and cryptographic measures.

9. Rights of Personal Data Subjects

9.1. The PDn subject has the right to receive information regarding the processing of their PDn, including confirmation of processing, legal grounds, purposes, methods, storage periods, etc.

9.2. The PDn subject has the right to require clarification, blocking, or destruction of incomplete, outdated, inaccurate, or illegally obtained PDn.

9.3. The PDn subject has the right to appeal actions/inactions of the Operator to Roskomnadzor or in court.

9.4. The PDn subject has the right to protect their rights and legitimate interests, including compensation for damages and moral harm in court.

10. Updating, Correction, Deletion, Destruction of PDn

10.1. Upon submission of facts regarding incomplete, outdated, inaccurate, or illegally obtained PDn, the Operator updates data or stops unlawful processing.

10.2. Upon achieving processing goals or withdrawal of consent, PDn are deleted/destroyed, unless otherwise required by law or contract.

11. Final Provisions

11.1. Control over compliance with this Policy is carried out by the person responsible for organizing PDn processing.

11.2. Other rights and obligations of the Operator are determined by legislation in the field of personal data protection.

11.3. Persons guilty of violating rules governing PDn processing and protection bear responsibility established by federal laws.

List of Personal Data Processed by the Operator