This is an unofficial English translation provided for convenience. In case of any discrepancy, the Russian-language original at https://r2ctech.ru/privacy.html prevails.
Personal Data Processing Policy
R2C Technology LLC (the “Operator”) has developed this Personal Data Processing Policy (the “Policy”) in accordance with Federal Law No. 152-FZ “On Personal Data” dated 27 July 2006, taking into account amendments to personal data legislation, including requirements to submit a notice of intent to process personal data, a separate notice of intent to carry out cross-border transfer of personal data, as well as other mandatory requirements of the legislation of the Russian Federation.
This Policy defines the procedure for processing personal data and the measures taken by R2C Technology LLC to ensure the security of personal data, including when using the websites https://r2ctech.ru and https://r2ctech.com.
1. General provisions
1.1. This Policy applies to all information that the Operator may obtain about visitors of the websites https://r2ctech.ru and https://r2ctech.com, clients, counterparties, representatives of counterparties, and other personal data subjects whose data is processed by the Operator in connection with its activities.
1.2. The Operator ensures that personal data is processed on a lawful and fair basis, limits processing to the achievement of specific, predetermined and lawful purposes, does not permit processing incompatible with the purposes of its collection, and takes the necessary legal, organizational and technical measures to protect personal data.
1.3. This Policy is a publicly available document and is subject to unrestricted publication on the internet.
1.4. The Operator organizes the processing of personal data in compliance with localization requirements for the personal data of citizens of the Russian Federation, using databases located within the territory of the Russian Federation, unless otherwise provided by the legislation of the Russian Federation.
1.5. In cases provided for by the legislation of the Russian Federation, the Operator submits to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) a notice of intent to process personal data, and, in the case of cross-border transfer of personal data, a separate notice of intent to carry out such a transfer.
2. Key definitions
2.1. Automated processing of personal data — processing of personal data using computer technology.
2.2. Blocking of personal data — the temporary suspension of processing of personal data (except where processing is necessary to clarify personal data).
2.3. Website — a collection of graphic and informational materials, as well as computer programs and databases, that ensure their availability on the internet at the network addresses https://r2ctech.ru and https://r2ctech.com.
2.4. Personal data information system — a collection of personal data contained in databases and the information technologies and technical means ensuring its processing.
2.5. De-identification of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine that personal data belongs to a specific user or other personal data subject.
2.6. Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), de-identification, blocking, deletion, and destruction of personal data.
2.7. Operator — a government body, municipal body, legal entity or individual that, independently or jointly with others, organizes and/or carries out the processing of personal data, and determines the purposes of processing, the composition of the personal data to be processed, and the actions (operations) performed with personal data.
2.8. Personal data — any information relating directly or indirectly to an identified or identifiable user of the websites https://r2ctech.ru and https://r2ctech.com.
2.9. Personal data permitted by the subject for distribution — personal data to which access by an unlimited number of persons has been granted by the personal data subject by giving consent to the processing of personal data permitted for distribution, in the manner prescribed by the Law on Personal Data.
2.10. User — any visitor of the websites https://r2ctech.ru and https://r2ctech.com.
2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Distribution of personal data — any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data accessible to an unlimited number of persons, including publication of personal data in the mass media, posting on information and telecommunications networks, or otherwise providing access to personal data.
2.13. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, to a foreign individual, or to a foreign legal entity.
2.14. Destruction of personal data — any actions as a result of which personal data is irrevocably destroyed with no possibility of further restoring its content in the personal data information system, and/or the physical media containing personal data are destroyed.
3. Rights and obligations of the Operator
3.1. The Operator has the right to:
- obtain reliable information and documents containing personal data from the personal data subject;
- continue processing personal data without the consent of the personal data subject where grounds provided for by the legislation of the Russian Federation exist;
- independently determine the composition and list of measures necessary and sufficient to fulfil the obligations provided for by personal data legislation.
3.2. The Operator is obliged to:
- provide the personal data subject with information relating to the processing of their personal data, in the cases and manner provided for by the legislation of the Russian Federation;
- consider requests from personal data subjects and their legal representatives within the time limits established by the legislation of the Russian Federation;
- take measures necessary and sufficient to fulfil the obligations provided for by the personal data legislation of the Russian Federation;
- publish or otherwise provide unrestricted access to this Policy;
- take measures to identify, prevent and remedy violations of personal data legislation;
- in the event of incidents related to unlawful transfer (provision, distribution, access) of personal data, notify Roskomnadzor within the time limits and in the manner established by the legislation of the Russian Federation;
- cease processing personal data and destroy personal data in the cases provided for by the legislation of the Russian Federation.
3.3. The Operator appoints a person responsible for organizing the processing of personal data. Information about such person, including their position and contact details, is approved by an internal act of the Operator and provided upon request of the personal data subject or an authorized body in the cases provided for by law.
3.4. The Operator keeps records of requests from personal data subjects regarding the processing of personal data and ensures the storage of relevant information for the periods established by internal documents and applicable regulatory requirements.
4. Rights of personal data subjects
4.1. A personal data subject has the right to:
- obtain information relating to the processing of their personal data, except in cases provided for by federal laws;
- demand that the Operator clarify their personal data, block it, or destroy it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or is not necessary for the stated purpose of processing;
- withdraw consent to the processing of personal data;
- demand that processing of personal data be discontinued in the cases provided for by law;
- appeal against actions or omissions of the Operator to Roskomnadzor or in court;
- exercise other rights provided for by the legislation of the Russian Federation.
4.2. The personal data subject is obliged to provide the Operator with accurate personal data and promptly report any changes thereto, where this is necessary for the relevant purpose of processing.
5. Principles of personal data processing
5.1. The processing of personal data is carried out on a lawful and fair basis.
5.2. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes.
5.3. Processing of personal data incompatible with the purposes of its collection is not permitted, nor is processing of personal data excessive in relation to the stated purposes.
5.4. When processing personal data, the accuracy, sufficiency and relevance of personal data in relation to the purposes of processing are ensured.
5.5. Personal data is stored in a form that allows the personal data subject to be identified for no longer than is required by the purposes of processing, unless a different storage period is established by federal law, an agreement, or another legal basis.
6. Purposes of personal data processing
The Operator processes personal data for the following purposes:
| Purpose of processing | Categories of subjects | List of personal data | Legal basis | Processing / retention period | Actions with data |
|---|---|---|---|---|---|
| Handling inquiries received via the website, email, or other communication channels | Website visitors, representatives of clients and counterparties | Full name; email address; phone number; information contained in the inquiry | Consent of the personal data subject; measures for concluding and performing an agreement | Until the purpose of the inquiry is achieved; if an agreement is concluded — for the term of the agreement and the document retention period | Collection, recording, systematization, accumulation, storage, clarification, use, deletion, destruction |
| Informing about the Operator's products, services, news and offers | Website users, clients, prospective clients | Full name; email address; phone number | Prior consent of the personal data subject to receive informational and marketing communications | Until consent is withdrawn by the personal data subject | Collection, recording, systematization, accumulation, storage, use, deletion, destruction |
| Conclusion, performance and administration of agreements | Clients, counterparties, representatives of counterparties | Full name; position; contact details; other information necessary for the conclusion and performance of an agreement | Agreement; measures taken at the subject's request prior to concluding an agreement; legal requirements | Term of the agreement and retention periods established by Russian law | Collection, recording, systematization, accumulation, storage, clarification, use, transfer in cases provided for by law or agreement, deletion, destruction |
Consent to the processing of personal data, where such consent is mandatory, is executed separately from other documents, unless otherwise expressly provided by the legislation of the Russian Federation.
7. Legal grounds for processing personal data
7.1. The legal grounds for processing personal data are:
- consent of the personal data subject;
- the necessity of processing for the conclusion and performance of an agreement to which the personal data subject is a party, beneficiary, or guarantor;
- the necessity of processing to fulfil obligations imposed on the Operator by the legislation of the Russian Federation;
- other grounds provided for by the legislation of the Russian Federation.
8. Procedure and conditions for processing personal data
8.1. The Operator processes personal data both with and without the use of automation tools.
8.2. The Operator does not disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law, an agreement with the personal data subject, or where required to achieve the purposes of processing on an appropriate legal basis.
8.3. Access to personal data is granted only to authorized employees of the Operator and other persons who require such access to perform their duties and who have been granted such access on a lawful basis.
8.4. When entrusting the processing of personal data to a third party, the Operator concludes a corresponding agreement (an instruction for the processing of personal data) specifying the list of actions to be performed with personal data, the purposes of processing, requirements for ensuring the confidentiality and security of personal data, and other mandatory conditions provided for by the legislation of the Russian Federation.
8.5. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions.
8.6. Upon discovering an instance of unlawful or accidental transfer of personal data that resulted in a violation of the rights of personal data subjects, the Operator acts in accordance with the procedure established by the legislation of the Russian Federation, including sending notifications to Roskomnadzor within the established time limits:
- within 24 hours of discovering the incident, it sends an initial notification to Roskomnadzor specifying information about the incident to the extent provided for by the legislation of the Russian Federation;
- within 72 hours it conducts an internal investigation and sends Roskomnadzor a final notification with the results of the investigation, including information about the causes of the incident, the measures taken, and the persons whose personal data was affected.
8.7. A personal data subject may send a request to update personal data, withdraw consent to the processing of personal data, discontinue the processing of personal data, or obtain clarifications on matters relating to the processing of personal data to the email address: request@r2ctech.ru.
8.8. A response to a request from a personal data subject is provided within the time limits established by the legislation of the Russian Federation, unless a different period is provided for by federal law.
8.9. Personal data is subject to destruction or de-identification upon achievement of the purposes of processing, upon the loss of the need to achieve those purposes, upon withdrawal of consent by the personal data subject where no other lawful grounds for processing exist, and in other cases provided for by the legislation of the Russian Federation.
9. Cross-border transfer of personal data
9.1. The Operator does not carry out cross-border transfer of personal data, except where such a transfer is necessary and carried out in compliance with the requirements of the legislation of the Russian Federation.
9.2. Before commencing a cross-border transfer of personal data, the Operator, in the cases provided for by law, sends a separate notification to Roskomnadzor and performs other actions provided for by law.
9.3. When using external services and service providers, the Operator ensures verification of the legal grounds for the transfer of personal data, the status of the relevant country, and compliance with the mandatory requirements of the legislation of the Russian Federation.
10. Confidentiality of personal data
10.1. The Operator and other persons who have gained access to personal data are obliged not to disclose it to third parties and not to distribute personal data without the consent of the personal data subject, unless otherwise provided by federal law.
11. Contact information
11.1. To submit inquiries regarding the processing of personal data, a personal data subject may use the email address: request@r2ctech.ru.
11.2. Additional information about the Operator, including information about the person responsible for organizing the processing of personal data, is provided upon request in the cases and manner provided for by the legislation of the Russian Federation.
12. Final provisions
12.1. This Policy remains in effect until a new version is approved.
12.2. The Operator has the right to amend this Policy. A new version of the Policy takes effect from the moment it is published on the Operator's website, unless otherwise provided by the new version of the Policy.
12.3. The current version of the Policy is subject to publication on the internet at the address designated by the Operator for publishing the personal data processing policy.