Legal information
Documents
Constituent documents, registration certificates and personal data processing policy
Maintenance request
Report an accident
Send a message
Personal data processing policy
1. General provisions
1.1. This document defines the Policy of Limited Liability Company Kompleksnye Resheniya (hereinafter — LLC KR) regarding the processing of personal data (hereinafter — the Policy).
1.2. This Policy uses the terms and definitions listed in Table 1. Other terms used in this Policy are applied in the meanings defined by the legislation of the Russian Federation, other regulatory legal acts, and national standards in the field of processing and protection of personal data.
Table 1 — List of terms and definitions
| Term | Definition | Source |
|---|---|---|
| Automated processing of personal data | Processing of personal data using computing equipment | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Blocking of personal data | Temporary suspension of personal data processing (except in cases where processing is necessary to clarify the personal data) | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Personal data information system | A set of personal data contained in databases and the information technologies and technical means that ensure their processing | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Depersonalisation of personal data | Actions as a result of which it becomes impossible, without the use of additional information, to determine the belonging of personal data to a specific personal data subject | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Processing of personal data | Any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion, and destruction of personal data | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Processing of personal data without the use of automation tools | Actions with personal data, such as use, clarification, distribution, and destruction of personal data in respect of each of the personal data subjects, which are carried out with the direct participation of a person | Decree of the Government of the Russian Federation No. 687 of 15.09.2008 "On approval of the Regulation on the specifics of processing personal data carried out without the use of automation tools" |
| Operator | A state body, municipal body, legal entity or individual that, independently or jointly with other persons, organises and (or) carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with personal data | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Personal data | Any information relating directly or indirectly to a specified or determinable individual (the personal data subject) | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Provision of personal data | Actions aimed at disclosing personal data to a specific person or a specific group of persons | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Distribution of personal data | Actions aimed at disclosing personal data to an indefinite group of persons | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Computing equipment | A set of software and hardware elements of data processing systems capable of functioning independently or as part of other systems | GOST R 50739-95 |
| Destruction of personal data | Actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed | Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
1.3. This Policy is developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter — the Federal Law "On Personal Data"), Decrees of the Government of the Russian Federation No. 687 of 15.09.2008 "On approval of the Regulation on the specifics of processing personal data carried out without the use of automation tools", No. 1119 of 01.11.2012 "On approval of the requirements for the protection of personal data during their processing in personal data information systems", and other regulatory legal acts of the Russian Federation.
1.4. This Policy, and all additions and amendments to it, are approved by order of LLC KR.
1.5. The Policy is to be published on the official website of LLC KR https://fleetcare.ru/ (hereinafter — the official website) and in the personal account of the online service for managing vehicle fleets https://frocket.ru/ (hereinafter — the online service).
1.6. The provisions of the Policy apply to all relations connected with the processing of personal data carried out at LLC KR, both with and without the use of automation tools.
1.7. The Policy applies to all employees of LLC KR.
2. Information about the operator
The operator processing personal data is Limited Liability Company "Kompleksnye Resheniya", PSRN 5137746044244. Registered address: 115191, Moscow, B. Tulskaya St., 43. Registration number in the register of operators processing personal data: 77-24-157749
3. Purposes of processing personal data
4. Legal grounds for processing personal data
4.1. The processing of personal data at LLC KR is based on the following regulatory acts and documents:
5. Volume and categories of processed personal data, categories of personal data subjects
5.1. In accordance with the purposes of processing personal data specified in clause 2 of this Policy, LLC KR processes the following categories of personal data subjects.
Purpose: Personnel and accounting records management:
Purpose: Attracting and selecting candidates for employment at LLC KR;
Purpose: Organisation of the access control regime at the premises of clients and LLC KR;
Purpose: Provision of services or performance of work under contracts with counterparties:
Purpose: Promotion of services on the market.
Purpose: Provision of access to the online service:
5.2. In accordance with the purposes of processing personal data specified in clause 2 of this Policy, LLC KR processes the following lists of personal data:
Purpose: Personnel and accounting records management:
Surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; income; sex; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document details; driving licence details; details of a document identifying the person outside the Russian Federation; document details contained in the birth certificate; bank card details; settlement account number; personal account number; profession; position; information on work activity (including length of service, data on current employment indicating the name and settlement account of the organisation); attitude to military duty, information on military registration; information on education.
Purpose: Attracting and selecting candidates for employment at LLC KR:
Surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; sex; email address; phone number; identity document details; driving licence details; details of a document identifying the person outside the Russian Federation; information on work activity (including length of service, data on current employment); information on education.
Purpose: Organisation of the access control regime at the premises of clients and LLC KR:
Surname, first name, patronymic; phone number.
Purpose: Provision of services or performance of work under contracts with counterparties:
Surname, first name, patronymic; email address; phone number; position, structural unit; place of work; identity document details; driving licence details.
Purpose: Promotion of services on the market:
Surname, first name; email address; phone number. In addition, certain technologies, such as cookies (see Appendix 1 to the Policy), are used to automatically collect information from visitors of the official website.
Purpose: Provision of access to the online service:
Email address. In addition, certain technologies, such as cookies (see Appendix 1 to the Policy), are used to automatically collect information from visitors of the online service.
5.3. For each purpose of processing personal data processed at LLC KR, orders of LLC KR approve the volume, categories and lists of processed personal data, categories of personal data subjects processed in personal data information systems, methods, terms of their processing and storage, and the procedure for destroying personal data upon achievement of the processing purposes or upon the occurrence of lawful grounds.
6. Principles and conditions of processing personal data
6.1. When processing personal data at LLC KR, the following principles are observed:
6.2. LLC KR carries out automated processing of personal data, as well as processing of personal data without the use of automation tools. The set of personal data processing operations at LLC KR includes:
Purpose: Personnel and accounting records management.
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Attracting and selecting candidates for employment at LLC KR;
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Organisation of the access control regime at the premises of clients and LLC KR;
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Provision of services or performance of work under contracts with counterparties
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Promotion of services on the market.
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Provision of access to the online service.
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); transfer (provision, access); use; deletion; destruction.
6.3. When collecting personal data, LLC KR ensures the recording, systematisation, accumulation, storage, clarification (updating, changing), and extraction of personal data using databases located within the territory of the Russian Federation.
6.4. LLC KR does not entrust the processing of personal data to other persons.
6.5. The processing of personal data is terminated upon termination of the activities of LLC KR (liquidation or reorganisation) or upon the expiry of the terms of contracts with clients of LLC KR.
6.6. Cross-border transfer of personal data is not carried out by LLC KR.
6.7. Confidentiality of personal data is ensured at LLC KR. Employees of LLC KR who have gained access to personal data do not disclose them to third parties and do not distribute personal data without the consent of the personal data subject, unless otherwise provided by federal law.
6.8. The processing of publicly available personal data is permitted at LLC KR.
6.9. The processing of personal data is carried out by LLC KR subject to the following conditions:
6.10. LLC KR has the right to transfer personal data on the grounds provided for by the current legislation of the Russian Federation.
7. Implementation of measures to ensure the security of personal data taken at LLC KR
7.1. LLC KR takes or ensures the taking of necessary and sufficient legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as against other unlawful actions in relation to personal data.
Such measures at LLC KR include:
7.2. LLC KR ensures, in accordance with the established procedure, interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing the federal executive authority responsible for security about computer incidents that resulted in the unlawful transfer (provision, distribution, access) of personal data.
8. Processing of personal data carried out without the use of automation tools.
8.1. During processing carried out without the use of automation tools, personal data are separated from other information, in particular by recording them on separate material carriers of personal data (hereinafter — material carriers), in special sections or in the fields of forms (blanks).
8.2. When recording personal data on material carriers, it is not permitted to record on a single material carrier personal data whose processing purposes are known to be incompatible. For processing various categories of personal data carried out without the use of automation tools, a separate material carrier is used for each category of personal data.
8.3. Persons carrying out the processing of personal data without the use of automation tools (including employees of LLC KR or persons carrying out such processing under a contract with LLC KR) are informed of the fact that they process personal data whose processing is carried out by LLC KR without the use of automation tools, of the categories of processed personal data, as well as of the specifics and rules of carrying out such processing established by the regulatory legal acts of the Russian Federation and the local legal acts of LLC KR.
8.4. When using standard document forms, the nature of the information in which assumes or permits the inclusion of personal data (hereinafter — standard form), the following conditions are observed:
8.5. In case of incompatibility of the purposes of processing personal data recorded on a single material carrier, if the material carrier does not allow processing personal data separately from other personal data recorded on the same carrier, measures are taken to ensure the separate processing of personal data, in particular:
8.6. Destruction or depersonalisation of part of the personal data, if the material carrier allows it, may be carried out in a manner that excludes further processing of these personal data while retaining the possibility of processing other data recorded on the material carrier (deletion, blacking out). The provisions set out in this clause and clause 7.5 of this Policy also apply where it is necessary to ensure the separate processing of personal data recorded on a single material carrier and information that is not personal data.
8.7. Clarification of personal data, when their processing is carried out without the use of automation tools, is done by updating or changing the data on the material carrier or, if this is not permitted by the technical features of the material carrier, by recording on the same material carrier information about the changes made to them, or by producing a new material carrier with the clarified personal data.
8.8. Measures to ensure the security of personal data during their processing carried out without the use of automation tools:
9. Updating, correction, deletion and destruction of personal data, responses to subjects' requests for access to personal data
9.1. Rights of personal data subjects:
9.1.1. The right of the personal data subject to access their personal data:
1) The personal data subject has the right to receive information (hereinafter — the information requested by the subject) concerning the processing of their personal data, including information containing:
2) The personal data subject has the right to receive the information requested by the subject, except in cases where the access of the personal data subject to their personal data violates the rights and legitimate interests of third parties.
3) The personal data subject has the right to demand from LLC KR the clarification of their personal data, their blocking or destruction in the event that the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect their rights.
4) The information requested by the subject must be provided to the personal data subject by LLC KR in an accessible form, and it must not contain personal data relating to other personal data subjects, except in cases where there are lawful grounds for disclosing such personal data.
5) The requested information is provided to the personal data subject or their representative by LLC KR within ten working days from the moment of application or upon receipt of the request of the personal data subject or their representative. The specified period may be extended, but by no more than five working days, if LLC KR sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information. The request must contain the number of the main identity document of the personal data subject or their representative, information about the date of issue of the said document and the authority that issued it, information confirming the participation of the personal data subject in relations with LLC KR (contract number, date of conclusion of the contract, a conditional verbal designation and (or) other information), or information otherwise confirming the fact of processing personal data by LLC KR, and the signature of the personal data subject or their representative (hereinafter — the information required for the request). The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation. LLC KR provides the information to the personal data subject or their representative in the form in which the relevant appeal or request was sent, unless otherwise specified in the appeal or request.
6) If the information requested by the subject, as well as the processed personal data, were provided for review to the personal data subject upon their request, the personal data subject has the right to reapply to LLC KR or send a repeated request in order to obtain the information requested by the subject and to review such personal data no earlier than thirty days after the initial appeal or the sending of the initial request, unless a shorter period is established by federal law, by a regulatory legal act adopted in accordance with it, or by a contract to which the personal data subject is a party, beneficiary or guarantor.
7) The personal data subject has the right to reapply to LLC KR or send a repeated request in order to obtain the information requested by the subject, as well as to review the processed personal data, before the expiry of the period specified in subclause 6 of clause 8.1.1 of this Regulation, in the event that such information and (or) processed personal data were not provided to them for review in full following the consideration of the initial appeal. The repeated request, along with the information required for the request, must contain a justification for sending the repeated request.
8) LLC KR has the right to refuse the personal data subject to fulfil a repeated request that does not comply with the conditions of a repeated request. Such a refusal must be reasoned. The obligation to provide evidence of the validity of the refusal to fulfil a repeated request rests with LLC KR.
9.1.2. Processing of personal data for the purposes of political campaigning is not carried out by LLC KR;
9.1.3. The right to appeal against the actions or inaction of LLC KR:
1) If the personal data subject believes that LLC KR processes their personal data in violation of the requirements of the Federal Law "On Personal Data" or otherwise violates their rights and freedoms, the personal data subject has the right to appeal against the actions or inaction of LLC KR to the authorised body for the protection of the rights of personal data subjects or in court.
2) The personal data subject has the right to the protection of their rights and legitimate interests, including compensation for losses and (or) compensation for moral harm in court.
9.2. Obligations of the operator:
9.2.1. Obligations of the operator when collecting personal data:
1) When collecting personal data, LLC KR provides the personal data subject, upon their request, with the requested information concerning the processing of their personal data in accordance with part 7 of Article 14 of the Federal Law "On Personal Data".
2) If the provision of personal data and (or) LLC KR obtaining consent to the processing of personal data are mandatory in accordance with federal law, LLC KR explains to the personal data subject the legal consequences of refusing to provide their personal data and (or) to give consent to their processing.
3) If personal data are obtained not from the personal data subject, LLC KR, before starting the processing of such personal data, provides the personal data subject with the following information (hereinafter — the information communicated when obtaining personal data not from the subject):
4) LLC KR does not provide the subject with the information communicated when obtaining personal data not from the subject in cases where:
9.2.2. Obligations of the operator upon an appeal to it by the personal data subject or upon receipt of a request from the personal data subject or their representative, as well as from the authorised body for the protection of the rights of personal data subjects:
1) LLC KR communicates, in accordance with the established procedure, to the personal data subject or their representative information about the presence of personal data relating to the relevant personal data subject, and also provides the opportunity to review these personal data upon the appeal of the personal data subject or their representative, or within ten working days from the date of receipt of the request of the personal data subject or their representative. The specified period may be extended, but by no more than five working days, if LLC KR sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information.
2) In case of refusal to provide information about the presence of personal data about the relevant personal data subject or personal data to the personal data subject or their representative upon their appeal or upon receipt of the request of the personal data subject or their representative, LLC KR provides a written reasoned response within a period not exceeding ten working days from the day of the appeal of the personal data subject or their representative or from the date of receipt of the request of the personal data subject or their representative. The specified period may be extended, but by no more than five working days, if LLC KR sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information.
3) LLC KR provides the personal data subject or their representative with free-of-charge access to review the personal data relating to that personal data subject. Within a period not exceeding seven working days from the day the personal data subject or their representative provides information confirming that the personal data are incomplete, inaccurate or irrelevant, LLC KR makes the necessary changes to them. Within a period not exceeding seven working days from the day the personal data subject or their representative provides information confirming that such personal data were unlawfully obtained or are not necessary for the stated purpose of processing, LLC KR destroys such personal data. LLC KR notifies the personal data subject or their representative of the changes made and the measures taken, and takes reasonable measures to notify third parties to whom the personal data of this subject were transferred.
4) LLC KR communicates the necessary information to the authorised body for the protection of the rights of personal data subjects, at the request of this body, within ten working days from the date of receipt of such a request. The specified period may be extended, but by no more than five working days, if LLC KR sends the authorised body for the protection of the rights of personal data subjects a reasoned notice indicating the reasons for extending the period for providing the requested information.
9.2.3. Obligations of the operator to eliminate violations of the law committed during the processing of personal data, and to clarify, block and destroy personal data:
1) In case of detection of unlawful processing of personal data upon the appeal of the personal data subject or their representative, or upon the request of the personal data subject or their representative, or of the authorised body for the protection of the rights of personal data subjects, LLC KR blocks the unlawfully processed personal data relating to that personal data subject, or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of LLC KR) from the moment of such an appeal or of receiving the said request, for the period of verification. In case of detection of inaccurate personal data upon the appeal of the personal data subject or their representative, or upon their request or the request of the authorised body for the protection of the rights of personal data subjects, LLC KR blocks the personal data relating to that personal data subject, or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of LLC KR) from the moment of such an appeal or of receiving the said request, for the period of verification, provided that the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
2) In case of confirmation of the fact of inaccuracy of personal data, LLC KR, on the basis of the information provided by the personal data subject or their representative or by the authorised body for the protection of the rights of personal data subjects, or of other necessary documents, clarifies the personal data or ensures their clarification (if the processing of personal data is carried out by another person acting on behalf of LLC KR) within seven working days from the day of submission of such information, and lifts the blocking of the personal data.
3) In case of detection of unlawful processing of personal data carried out by LLC KR or by a person acting on behalf of LLC KR, LLC KR, within a period not exceeding three working days from the date of this detection, terminates the unlawful processing of personal data or ensures the termination of the unlawful processing of personal data by the person acting on behalf of LLC KR. If it is impossible to ensure the lawfulness of the processing of personal data, LLC KR, within a period not exceeding ten working days from the date of detection of the unlawful processing of personal data, destroys such personal data or ensures their destruction. LLC KR notifies the personal data subject or their representative of the elimination of the violations committed or of the destruction of the personal data and, if the appeal of the personal data subject or their representative or the request of the authorised body for the protection of the rights of personal data subjects was sent by the authorised body for the protection of the rights of personal data subjects, that body as well.
4) In case of establishment of the fact of unlawful or accidental transfer (provision, distribution, access) of personal data that resulted in a violation of the rights of personal data subjects, LLC KR is obliged, from the moment such an incident is detected by the operator, the authorised body for the protection of the rights of personal data subjects or another interested party, to notify the authorised body for the protection of the rights of personal data subjects:
5) In case of achievement of the purpose of processing personal data, LLC KR terminates the processing of personal data or ensures its termination (if the processing of personal data is carried out by another person acting on behalf of LLC KR) and destroys the personal data or ensures their destruction (if the processing of personal data is carried out by another person acting on behalf of LLC KR) within a period not exceeding thirty days from the date of achievement of the purpose of processing personal data, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, by another agreement between LLC KR and the personal data subject, or unless LLC KR is entitled to process personal data without the consent of the personal data subject on the grounds provided for by the Federal Law "On Personal Data" or other federal laws.
6) In case of withdrawal by the personal data subject of consent to the processing of their personal data, LLC KR terminates their processing or ensures the termination of such processing (if the processing of personal data is carried out by another person acting on behalf of LLC KR) and, if the retention of personal data is no longer required for the purposes of processing personal data, destroys the personal data or ensures their destruction (if the processing of personal data is carried out by another person acting on behalf of LLC KR) within a period not exceeding thirty days from the date of receipt of the said withdrawal, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, by another agreement between LLC KR and the personal data subject, or unless LLC KR is entitled to process personal data without the consent of the personal data subject on the grounds provided for by the Federal Law "On Personal Data" or other federal laws.
7) In case of an appeal by the personal data subject to LLC KR with a demand to terminate the processing of personal data, the operator is obliged, within a period not exceeding ten working days from the date of receipt by the operator of the relevant demand, to terminate their processing or ensure the termination of such processing (if such processing is carried out by a person processing personal data), except in the cases provided for by the Federal Law "On Personal Data". The specified period may be extended, but by no more than five working days, if the operator sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information.
8) In the absence of the possibility of destroying personal data within the specified period, LLC KR blocks such personal data or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of LLC KR) and ensures the destruction of the personal data within a period of no more than six months, unless another period is established by federal laws.
9.3. The rules for considering requests of personal data subjects or their representatives at LLC KR, as well as the forms for considering the relevant requests of personal data subjects or their representatives, are approved by order of LLC KR.
10. Liability
10.1. Persons guilty of violating the requirements of the Federal Law "On Personal Data" bear the liability provided for by the legislation of the Russian Federation.
10.2. Moral harm caused to a personal data subject as a result of a violation of their rights, a violation of the rules for processing personal data established by the Federal Law "On Personal Data", as well as the requirements for the protection of personal data established in accordance with the Federal Law "On Personal Data", is subject to compensation in accordance with the legislation of the Russian Federation. Compensation for moral harm is carried out regardless of the compensation for property damage and the losses incurred by the personal data subject.
Appendix 1
Data when using the official website and the online service.
1. When using the official website and the online service, cookies (hereinafter — "cookie files") may be automatically transmitted to LLC KR.
2. Cookie files are fragments of data stored in the browser of a computer, mobile phone or other device.
3. Information that may be transmitted via cookie files:
4. The use of cookie files does not provide access to any data other than the data stored in the cookie file.
5. Essential cookie files are stored indefinitely. Session cookie files are stored for the duration of the user session.
6. Disabling cookie files may lead to the inoperability of some sections of the official website and the online service.
7. Types of cookie files used:
1) Essential cookie files. Necessary to ensure the operability of the official website and the online service, some parts of which cannot function without the use of these files;
2) Functional cookie files. Allow settings to be remembered and information already provided by users to be saved (for example, login, user name, etc.);
3) Analytical cookie files. Third-party software Yandex Metrica is used. The composition and conditions of collecting depersonalised data are determined directly by the rights holders and may include:
The operator is not responsible for the manner in which depersonalised data are used by third parties.
By continuing to use our site, you consent to the processing of cookies and user data for the purpose of the site's operation. If you do not want your data to be processed, please leave the site.
Request
Log in
