Revision of 12 May 2025
1. General provisions
1.1. This document defines the Policy of Limited Liability Company Kompleksnye Resheniya (hereinafter — LLC KR) regarding the processing of personal data (hereinafter — the Policy).
1.2. This Policy uses the terms and definitions listed in Table 1. Other terms used in this Policy are applied in the meanings defined by the legislation of the Russian Federation, other regulatory legal acts, and national standards in the field of processing and protection of personal data.
Table 1 — List of terms and definitions
| Term |
Definition |
Source |
| Automated processing of personal data |
Processing of personal data using computing equipment |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Blocking of personal data |
Temporary suspension of personal data processing (except in cases where processing is necessary to clarify the personal data) |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Personal data information system |
A set of personal data contained in databases and the information technologies and technical means that ensure their processing |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Depersonalisation of personal data |
Actions as a result of which it becomes impossible, without the use of additional information, to determine the belonging of personal data to a specific personal data subject |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Processing of personal data |
Any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion, and destruction of personal data |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Processing of personal data without the use of automation tools |
Actions with personal data, such as use, clarification, distribution, and destruction of personal data in respect of each of the personal data subjects, which are carried out with the direct participation of a person |
Decree of the Government of the Russian Federation No. 687 of 15.09.2008 "On approval of the Regulation on the specifics of processing personal data carried out without the use of automation tools" |
| Operator |
A state body, municipal body, legal entity or individual that, independently or jointly with other persons, organises and (or) carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with personal data |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Personal data |
Any information relating directly or indirectly to a specified or determinable individual (the personal data subject) |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Provision of personal data |
Actions aimed at disclosing personal data to a specific person or a specific group of persons |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Distribution of personal data |
Actions aimed at disclosing personal data to an indefinite group of persons |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
| Computing equipment |
A set of software and hardware elements of data processing systems capable of functioning independently or as part of other systems |
GOST R 50739-95 |
| Destruction of personal data |
Actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed |
Federal Law No. 152-FZ of 27.06.2006 "On Personal Data" |
1.3. This Policy is developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter — the Federal Law "On Personal Data"), Decrees of the Government of the Russian Federation No. 687 of 15.09.2008 "On approval of the Regulation on the specifics of processing personal data carried out without the use of automation tools", No. 1119 of 01.11.2012 "On approval of the requirements for the protection of personal data during their processing in personal data information systems", and other regulatory legal acts of the Russian Federation.
1.4. This Policy, and all additions and amendments to it, are approved by order of LLC KR.
1.5. The Policy is to be published on the official website of LLC KR https://fleetcare.ru/ (hereinafter — the official website) and in the personal account of the online service for managing vehicle fleets https://frocket.ru/ (hereinafter — the online service).
1.6. The provisions of the Policy apply to all relations connected with the processing of personal data carried out at LLC KR, both with and without the use of automation tools.
1.7. The Policy applies to all employees of LLC KR.
2. Information about the operator
The operator processing personal data is Limited Liability Company "Kompleksnye Resheniya", PSRN 5137746044244. Registered address: 115191, Moscow, B. Tulskaya St., 43. Registration number in the register of operators processing personal data: 77-24-157749
3. Purposes of processing personal data
- personnel and accounting records management;
- attracting and selecting candidates for employment at LLC KR;
- organisation of the access control regime at the premises of clients and LLC KR;
- provision of services or performance of work under contracts with counterparties;
- promotion of services on the market;
- provision of access to the online service;
4. Legal grounds for processing personal data
4.1. The processing of personal data at LLC KR is based on the following regulatory acts and documents:
- the Constitution of the Russian Federation;
- the Labour Code of the Russian Federation;
- the Tax Code of the Russian Federation;
- the Civil Code of the Russian Federation;
- the Charter of LLC KR, approved by the minutes of the founders of LLC KR No. 1 of "18" October 2013;
- consent to the processing of personal data (in cases not directly provided for by the legislation of the Russian Federation but corresponding to the operator's powers);
5. Volume and categories of processed personal data, categories of personal data subjects
5.1. In accordance with the purposes of processing personal data specified in clause 2 of this Policy, LLC KR processes the following categories of personal data subjects.
Purpose: Personnel and accounting records management:
- employees of LLC KR;
- relatives of employees of LLC KR;
- former employees of LLC KR;
Purpose: Attracting and selecting candidates for employment at LLC KR;
- applicants for vacant positions at LLC KR;
Purpose: Organisation of the access control regime at the premises of clients and LLC KR;
Purpose: Provision of services or performance of work under contracts with counterparties:
- counterparties of LLC KR;
- representatives or employees of clients and counterparties of LLC KR
Purpose: Promotion of services on the market.
- visitors of the official website;
Purpose: Provision of access to the online service:
- clients of LLC KR;
- employees of a client of LLC KR;
5.2. In accordance with the purposes of processing personal data specified in clause 2 of this Policy, LLC KR processes the following lists of personal data:
Purpose: Personnel and accounting records management:
Surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; income; sex; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document details; driving licence details; details of a document identifying the person outside the Russian Federation; document details contained in the birth certificate; bank card details; settlement account number; personal account number; profession; position; information on work activity (including length of service, data on current employment indicating the name and settlement account of the organisation); attitude to military duty, information on military registration; information on education.
Purpose: Attracting and selecting candidates for employment at LLC KR:
Surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; sex; email address; phone number; identity document details; driving licence details; details of a document identifying the person outside the Russian Federation; information on work activity (including length of service, data on current employment); information on education.
Purpose: Organisation of the access control regime at the premises of clients and LLC KR:
Surname, first name, patronymic; phone number.
Purpose: Provision of services or performance of work under contracts with counterparties:
Surname, first name, patronymic; email address; phone number; position, structural unit; place of work; identity document details; driving licence details.
Purpose: Promotion of services on the market:
Surname, first name; email address; phone number. In addition, certain technologies, such as cookies (see Appendix 1 to the Policy), are used to automatically collect information from visitors of the official website.
Purpose: Provision of access to the online service:
Email address. In addition, certain technologies, such as cookies (see Appendix 1 to the Policy), are used to automatically collect information from visitors of the online service.
5.3. For each purpose of processing personal data processed at LLC KR, orders of LLC KR approve the volume, categories and lists of processed personal data, categories of personal data subjects processed in personal data information systems, methods, terms of their processing and storage, and the procedure for destroying personal data upon achievement of the processing purposes or upon the occurrence of lawful grounds.
6. Principles and conditions of processing personal data
6.1. When processing personal data at LLC KR, the following principles are observed:
- the processing of personal data is carried out on a lawful and fair basis;
- the processing of personal data is limited to achieving specific, predetermined and lawful purposes;
- the processing of personal data incompatible with the purposes of collecting personal data is not permitted;
- the merging of databases containing personal data processed for mutually incompatible purposes is not permitted;
- only personal data that meet the purposes of their processing are subject to processing;
- the content and volume of processed personal data correspond to the stated purposes of processing;
- the processed personal data are not excessive in relation to the stated purposes of their processing;
- when processing personal data, the accuracy of the personal data, their sufficiency and, where necessary, their relevance to the purposes of processing personal data are ensured;
- necessary measures are taken to delete or clarify incomplete or inaccurate personal data;
- the storage of personal data is carried out in a form that allows identification of the personal data subject for no longer than required by the purposes of processing personal data, unless the storage period is established by federal law or by a contract to which the personal data subject is a party, beneficiary or guarantor;
- processed personal data are subject to destruction or depersonalisation upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by the legislation of the Russian Federation.
6.2. LLC KR carries out automated processing of personal data, as well as processing of personal data without the use of automation tools. The set of personal data processing operations at LLC KR includes:
Purpose: Personnel and accounting records management.
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Attracting and selecting candidates for employment at LLC KR;
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Organisation of the access control regime at the premises of clients and LLC KR;
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Provision of services or performance of work under contracts with counterparties
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Promotion of services on the market.
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); use; deletion; destruction.
Purpose: Provision of access to the online service.
Collection; recording; systematisation; accumulation; storage; clarification (updating, changing); transfer (provision, access); use; deletion; destruction.
6.3. When collecting personal data, LLC KR ensures the recording, systematisation, accumulation, storage, clarification (updating, changing), and extraction of personal data using databases located within the territory of the Russian Federation.
6.4. LLC KR does not entrust the processing of personal data to other persons.
6.5. The processing of personal data is terminated upon termination of the activities of LLC KR (liquidation or reorganisation) or upon the expiry of the terms of contracts with clients of LLC KR.
6.6. Cross-border transfer of personal data is not carried out by LLC KR.
6.7. Confidentiality of personal data is ensured at LLC KR. Employees of LLC KR who have gained access to personal data do not disclose them to third parties and do not distribute personal data without the consent of the personal data subject, unless otherwise provided by federal law.
6.8. The processing of publicly available personal data is permitted at LLC KR.
6.9. The processing of personal data is carried out by LLC KR subject to the following conditions:
- the processing of personal data is necessary to achieve the purposes provided for by the law of the Russian Federation for the exercise and performance of the functions, powers and duties assigned to LLC KR by the legislation of the Russian Federation;
- the processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data;
- the processing of personal data is necessary for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, as well as for concluding a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor. A contract concluded with a personal data subject may not contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing personal data of minors (unless otherwise provided by the legislation of the Russian Federation), or provisions allowing the inaction of the personal data subject as a condition of concluding the contract.
6.10. LLC KR has the right to transfer personal data on the grounds provided for by the current legislation of the Russian Federation.
7. Implementation of measures to ensure the security of personal data taken at LLC KR
7.1. LLC KR takes or ensures the taking of necessary and sufficient legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as against other unlawful actions in relation to personal data.
Such measures at LLC KR include:
- appointment of a person responsible for organising the processing of personal data;
- issuance of local acts on personal data processing that define, for each purpose of processing personal data, the categories and list of processed personal data, the categories of subjects whose personal data are processed, the methods and terms of their processing and storage, the procedure for destroying personal data upon achievement of the purposes of their processing or upon the occurrence of other lawful grounds, as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation in the field of processing and protection of personal data and eliminating the consequences of such violations;
- implementation of internal control over the compliance of personal data processing with the legislation of the Russian Federation on personal data, the requirements for the protection of personal data, and the internal documents of LLC KR in the field of processing and protection of personal data;
- assessment of the harm that may be caused to personal data subjects in case of violation of the Federal Law "On Personal Data", the ratio of this harm to the measures taken by LLC KR to ensure the fulfilment of the obligations provided for by the Federal Law "On Personal Data";
- familiarisation of employees of LLC KR with the provisions of the legislation of the Russian Federation on personal data, the internal documents of LLC KR on personal data processing, and the requirements for the protection of personal data;
- application or ensuring the application of legal, organisational and technical measures to ensure the security of personal data in accordance with Article 19 of the Federal Law "On Personal Data", in particular:
- identification of threats to the security of personal data during their processing in the personal data information systems of LLC KR;
- implementation of technical and organisational measures to protect personal data processed in the personal data information systems of LLC KR, based on the requirements approved by Decree of the Government of the Russian Federation No. 1119 of 01.11.2012 "On approval of the requirements for the protection of personal data during their processing in personal data information systems" and the requirements of Order of the FSTEC of Russia No. 21 of 18.02.2013 "On approval of the composition and content of organisational and technical measures to ensure the security of personal data during their processing in personal data information systems", developed based on the results of:
- identification of the categories of personal data processed in the personal data information systems of LLC KR;
- determination of the required level of protection of personal data based on the analysis of current threats to the security of personal data and possible damage to personal data subjects in the event of the realisation of threats to the security of personal data;
- organisation of the security regime for the premises housing the personal data information systems, preventing the possibility of uncontrolled entry or presence in these premises of persons who do not have the right of access to them;
- ensuring the accounting and safekeeping of machine carriers of personal data;
- organisation of access to personal data processed in the personal data information systems;
- use of information protection tools that have passed the conformity assessment procedure against the requirements of the legislation of the Russian Federation in the field of information security;
- implementation of anti-virus monitoring and detection;
- use of firewall (filtering) screens;
- timely installation of updates to the software of personal data information systems and information protection tools used;
- organisation of protection of the technical means of personal data information systems.
7.2. LLC KR ensures, in accordance with the established procedure, interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on the information resources of the Russian Federation, including informing the federal executive authority responsible for security about computer incidents that resulted in the unlawful transfer (provision, distribution, access) of personal data.
8. Processing of personal data carried out without the use of automation tools.
8.1. During processing carried out without the use of automation tools, personal data are separated from other information, in particular by recording them on separate material carriers of personal data (hereinafter — material carriers), in special sections or in the fields of forms (blanks).
8.2. When recording personal data on material carriers, it is not permitted to record on a single material carrier personal data whose processing purposes are known to be incompatible. For processing various categories of personal data carried out without the use of automation tools, a separate material carrier is used for each category of personal data.
8.3. Persons carrying out the processing of personal data without the use of automation tools (including employees of LLC KR or persons carrying out such processing under a contract with LLC KR) are informed of the fact that they process personal data whose processing is carried out by LLC KR without the use of automation tools, of the categories of processed personal data, as well as of the specifics and rules of carrying out such processing established by the regulatory legal acts of the Russian Federation and the local legal acts of LLC KR.
8.4. When using standard document forms, the nature of the information in which assumes or permits the inclusion of personal data (hereinafter — standard form), the following conditions are observed:
- the standard form or documents related to it (instructions for its completion, cards, registers and journals) contain information about the purpose of processing personal data carried out without the use of automation tools, the name and address of LLC KR, the surname, first name, patronymic and address of the personal data subject, the source of obtaining the personal data, the terms of processing the personal data, the list of actions with personal data that will be performed in the course of their processing, and a general description of the personal data processing methods used by LLC KR;
- the standard form provides a field in which the personal data subject may mark their consent to the processing of personal data carried out without the use of automation tools, where written consent to the processing of personal data is required;
- the standard form is drawn up in such a way that each of the personal data subjects contained in the document is able to review their own personal data contained in the document without violating the rights and legitimate interests of other personal data subjects;
- the standard form excludes the merging of fields intended for entering personal data whose processing purposes are known to be incompatible.
8.5. In case of incompatibility of the purposes of processing personal data recorded on a single material carrier, if the material carrier does not allow processing personal data separately from other personal data recorded on the same carrier, measures are taken to ensure the separate processing of personal data, in particular:
- if it is necessary to use or distribute certain personal data separately from other personal data located on the same material carrier, a copy of the personal data subject to distribution or use is made in a manner that excludes the simultaneous copying of personal data not subject to distribution and use, and the copy of the personal data is used (distributed);
- if it is necessary to destroy or block part of the personal data, the material carrier is destroyed or blocked with prior copying of the information not subject to destruction or blocking, in a manner that excludes the simultaneous copying of the personal data subject to destruction or blocking.
8.6. Destruction or depersonalisation of part of the personal data, if the material carrier allows it, may be carried out in a manner that excludes further processing of these personal data while retaining the possibility of processing other data recorded on the material carrier (deletion, blacking out). The provisions set out in this clause and clause 7.5 of this Policy also apply where it is necessary to ensure the separate processing of personal data recorded on a single material carrier and information that is not personal data.
8.7. Clarification of personal data, when their processing is carried out without the use of automation tools, is done by updating or changing the data on the material carrier or, if this is not permitted by the technical features of the material carrier, by recording on the same material carrier information about the changes made to them, or by producing a new material carrier with the clarified personal data.
8.8. Measures to ensure the security of personal data during their processing carried out without the use of automation tools:
- the processing of personal data carried out without the use of automation tools is performed in such a way that, for each category of personal data, it is possible to determine the storage locations of the personal data (material carriers) and to establish the list of persons carrying out the processing of personal data or having access to them;
- separate storage of personal data (material carriers) whose processing is carried out for different purposes is ensured;
- when storing material carriers, conditions are observed that ensure the safekeeping of personal data and exclude unauthorised access to them. The list of measures necessary to ensure such conditions, the procedure for adopting them, and the list of persons responsible for implementing these measures are established by LLC KR.
9. Updating, correction, deletion and destruction of personal data, responses to subjects' requests for access to personal data
9.1. Rights of personal data subjects:
9.1.1. The right of the personal data subject to access their personal data:
1) The personal data subject has the right to receive information (hereinafter — the information requested by the subject) concerning the processing of their personal data, including information containing:
- confirmation of the fact of processing personal data by LLC KR;
- the legal grounds and purposes of processing personal data;
- the purposes and methods of processing personal data applied by LLC KR;
- the name and location of LLC KR, information about the persons (except employees of LLC KR) who have access to personal data or to whom personal data may be disclosed under a contract with LLC KR or on the basis of federal law;
- the processed personal data relating to the relevant personal data subject, the source of their receipt, unless a different procedure for presenting such data is provided for by federal law;
- the terms of processing personal data, including the terms of their storage;
- the procedure for the personal data subject to exercise the rights provided for by the Federal Law "On Personal Data";
- information about the cross-border data transfer that has been carried out or is intended;
- the name or surname, first name, patronymic and address of the person carrying out the processing of personal data on behalf of LLC KR, if the processing is entrusted or will be entrusted to such a person;
- information about the ways in which the operator fulfils the obligations established by Article 18.1 of the Federal Law "On Personal Data";
- other information provided for by the Federal Law "On Personal Data" or other federal laws.
2) The personal data subject has the right to receive the information requested by the subject, except in cases where the access of the personal data subject to their personal data violates the rights and legitimate interests of third parties.
3) The personal data subject has the right to demand from LLC KR the clarification of their personal data, their blocking or destruction in the event that the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect their rights.
4) The information requested by the subject must be provided to the personal data subject by LLC KR in an accessible form, and it must not contain personal data relating to other personal data subjects, except in cases where there are lawful grounds for disclosing such personal data.
5) The requested information is provided to the personal data subject or their representative by LLC KR within ten working days from the moment of application or upon receipt of the request of the personal data subject or their representative. The specified period may be extended, but by no more than five working days, if LLC KR sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information. The request must contain the number of the main identity document of the personal data subject or their representative, information about the date of issue of the said document and the authority that issued it, information confirming the participation of the personal data subject in relations with LLC KR (contract number, date of conclusion of the contract, a conditional verbal designation and (or) other information), or information otherwise confirming the fact of processing personal data by LLC KR, and the signature of the personal data subject or their representative (hereinafter — the information required for the request). The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation. LLC KR provides the information to the personal data subject or their representative in the form in which the relevant appeal or request was sent, unless otherwise specified in the appeal or request.
6) If the information requested by the subject, as well as the processed personal data, were provided for review to the personal data subject upon their request, the personal data subject has the right to reapply to LLC KR or send a repeated request in order to obtain the information requested by the subject and to review such personal data no earlier than thirty days after the initial appeal or the sending of the initial request, unless a shorter period is established by federal law, by a regulatory legal act adopted in accordance with it, or by a contract to which the personal data subject is a party, beneficiary or guarantor.
7) The personal data subject has the right to reapply to LLC KR or send a repeated request in order to obtain the information requested by the subject, as well as to review the processed personal data, before the expiry of the period specified in subclause 6 of clause 8.1.1 of this Regulation, in the event that such information and (or) processed personal data were not provided to them for review in full following the consideration of the initial appeal. The repeated request, along with the information required for the request, must contain a justification for sending the repeated request.
8) LLC KR has the right to refuse the personal data subject to fulfil a repeated request that does not comply with the conditions of a repeated request. Such a refusal must be reasoned. The obligation to provide evidence of the validity of the refusal to fulfil a repeated request rests with LLC KR.
9.1.2. Processing of personal data for the purposes of political campaigning is not carried out by LLC KR;
9.1.3. The right to appeal against the actions or inaction of LLC KR:
1) If the personal data subject believes that LLC KR processes their personal data in violation of the requirements of the Federal Law "On Personal Data" or otherwise violates their rights and freedoms, the personal data subject has the right to appeal against the actions or inaction of LLC KR to the authorised body for the protection of the rights of personal data subjects or in court.
2) The personal data subject has the right to the protection of their rights and legitimate interests, including compensation for losses and (or) compensation for moral harm in court.
9.2. Obligations of the operator:
9.2.1. Obligations of the operator when collecting personal data:
1) When collecting personal data, LLC KR provides the personal data subject, upon their request, with the requested information concerning the processing of their personal data in accordance with part 7 of Article 14 of the Federal Law "On Personal Data".
2) If the provision of personal data and (or) LLC KR obtaining consent to the processing of personal data are mandatory in accordance with federal law, LLC KR explains to the personal data subject the legal consequences of refusing to provide their personal data and (or) to give consent to their processing.
3) If personal data are obtained not from the personal data subject, LLC KR, before starting the processing of such personal data, provides the personal data subject with the following information (hereinafter — the information communicated when obtaining personal data not from the subject):
- the name, or the surname, first name, patronymic and address of LLC KR;
- the purpose of processing personal data and its legal basis;
- the list of personal data;
- the presumed users of the personal data;
- the rights of the personal data subject established by the Federal Law "On Personal Data";
- the source of obtaining the personal data.
4) LLC KR does not provide the subject with the information communicated when obtaining personal data not from the subject in cases where:
- the personal data subject is notified of the processing of their personal data by LLC KR;
- the personal data were obtained by LLC KR on the basis of federal law or in connection with the performance of a contract to which the personal data subject is a party, beneficiary or guarantor;
- the personal data were made publicly available by the personal data subject or obtained from a publicly available source;
- LLC KR processes personal data for statistical or other research purposes, for the exercise of the professional activity of a journalist, or scientific, literary or other creative activity, provided that this does not violate the rights and legitimate interests of the personal data subject;
- providing the personal data subject with the information communicated when obtaining personal data not from the subject violates the rights and legitimate interests of third parties.
9.2.2. Obligations of the operator upon an appeal to it by the personal data subject or upon receipt of a request from the personal data subject or their representative, as well as from the authorised body for the protection of the rights of personal data subjects:
1) LLC KR communicates, in accordance with the established procedure, to the personal data subject or their representative information about the presence of personal data relating to the relevant personal data subject, and also provides the opportunity to review these personal data upon the appeal of the personal data subject or their representative, or within ten working days from the date of receipt of the request of the personal data subject or their representative. The specified period may be extended, but by no more than five working days, if LLC KR sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information.
2) In case of refusal to provide information about the presence of personal data about the relevant personal data subject or personal data to the personal data subject or their representative upon their appeal or upon receipt of the request of the personal data subject or their representative, LLC KR provides a written reasoned response within a period not exceeding ten working days from the day of the appeal of the personal data subject or their representative or from the date of receipt of the request of the personal data subject or their representative. The specified period may be extended, but by no more than five working days, if LLC KR sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information.
3) LLC KR provides the personal data subject or their representative with free-of-charge access to review the personal data relating to that personal data subject. Within a period not exceeding seven working days from the day the personal data subject or their representative provides information confirming that the personal data are incomplete, inaccurate or irrelevant, LLC KR makes the necessary changes to them. Within a period not exceeding seven working days from the day the personal data subject or their representative provides information confirming that such personal data were unlawfully obtained or are not necessary for the stated purpose of processing, LLC KR destroys such personal data. LLC KR notifies the personal data subject or their representative of the changes made and the measures taken, and takes reasonable measures to notify third parties to whom the personal data of this subject were transferred.
4) LLC KR communicates the necessary information to the authorised body for the protection of the rights of personal data subjects, at the request of this body, within ten working days from the date of receipt of such a request. The specified period may be extended, but by no more than five working days, if LLC KR sends the authorised body for the protection of the rights of personal data subjects a reasoned notice indicating the reasons for extending the period for providing the requested information.
9.2.3. Obligations of the operator to eliminate violations of the law committed during the processing of personal data, and to clarify, block and destroy personal data:
1) In case of detection of unlawful processing of personal data upon the appeal of the personal data subject or their representative, or upon the request of the personal data subject or their representative, or of the authorised body for the protection of the rights of personal data subjects, LLC KR blocks the unlawfully processed personal data relating to that personal data subject, or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of LLC KR) from the moment of such an appeal or of receiving the said request, for the period of verification. In case of detection of inaccurate personal data upon the appeal of the personal data subject or their representative, or upon their request or the request of the authorised body for the protection of the rights of personal data subjects, LLC KR blocks the personal data relating to that personal data subject, or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of LLC KR) from the moment of such an appeal or of receiving the said request, for the period of verification, provided that the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
2) In case of confirmation of the fact of inaccuracy of personal data, LLC KR, on the basis of the information provided by the personal data subject or their representative or by the authorised body for the protection of the rights of personal data subjects, or of other necessary documents, clarifies the personal data or ensures their clarification (if the processing of personal data is carried out by another person acting on behalf of LLC KR) within seven working days from the day of submission of such information, and lifts the blocking of the personal data.
3) In case of detection of unlawful processing of personal data carried out by LLC KR or by a person acting on behalf of LLC KR, LLC KR, within a period not exceeding three working days from the date of this detection, terminates the unlawful processing of personal data or ensures the termination of the unlawful processing of personal data by the person acting on behalf of LLC KR. If it is impossible to ensure the lawfulness of the processing of personal data, LLC KR, within a period not exceeding ten working days from the date of detection of the unlawful processing of personal data, destroys such personal data or ensures their destruction. LLC KR notifies the personal data subject or their representative of the elimination of the violations committed or of the destruction of the personal data and, if the appeal of the personal data subject or their representative or the request of the authorised body for the protection of the rights of personal data subjects was sent by the authorised body for the protection of the rights of personal data subjects, that body as well.
4) In case of establishment of the fact of unlawful or accidental transfer (provision, distribution, access) of personal data that resulted in a violation of the rights of personal data subjects, LLC KR is obliged, from the moment such an incident is detected by the operator, the authorised body for the protection of the rights of personal data subjects or another interested party, to notify the authorised body for the protection of the rights of personal data subjects:
- within twenty-four hours, about the incident that occurred, the presumed causes that led to the violation of the rights of personal data subjects, the presumed harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the relevant incident, and also to provide information about the person authorised by LLC KR to interact with the authorised body for the protection of the rights of personal data subjects on matters connected with the detected incident;
- within seventy-two hours, about the results of the internal investigation of the detected incident, and also to provide information about the persons whose actions caused the detected incident (if any).
5) In case of achievement of the purpose of processing personal data, LLC KR terminates the processing of personal data or ensures its termination (if the processing of personal data is carried out by another person acting on behalf of LLC KR) and destroys the personal data or ensures their destruction (if the processing of personal data is carried out by another person acting on behalf of LLC KR) within a period not exceeding thirty days from the date of achievement of the purpose of processing personal data, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, by another agreement between LLC KR and the personal data subject, or unless LLC KR is entitled to process personal data without the consent of the personal data subject on the grounds provided for by the Federal Law "On Personal Data" or other federal laws.
6) In case of withdrawal by the personal data subject of consent to the processing of their personal data, LLC KR terminates their processing or ensures the termination of such processing (if the processing of personal data is carried out by another person acting on behalf of LLC KR) and, if the retention of personal data is no longer required for the purposes of processing personal data, destroys the personal data or ensures their destruction (if the processing of personal data is carried out by another person acting on behalf of LLC KR) within a period not exceeding thirty days from the date of receipt of the said withdrawal, unless otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor, by another agreement between LLC KR and the personal data subject, or unless LLC KR is entitled to process personal data without the consent of the personal data subject on the grounds provided for by the Federal Law "On Personal Data" or other federal laws.
7) In case of an appeal by the personal data subject to LLC KR with a demand to terminate the processing of personal data, the operator is obliged, within a period not exceeding ten working days from the date of receipt by the operator of the relevant demand, to terminate their processing or ensure the termination of such processing (if such processing is carried out by a person processing personal data), except in the cases provided for by the Federal Law "On Personal Data". The specified period may be extended, but by no more than five working days, if the operator sends the personal data subject a reasoned notice indicating the reasons for extending the period for providing the requested information.
8) In the absence of the possibility of destroying personal data within the specified period, LLC KR blocks such personal data or ensures their blocking (if the processing of personal data is carried out by another person acting on behalf of LLC KR) and ensures the destruction of the personal data within a period of no more than six months, unless another period is established by federal laws.
9.3. The rules for considering requests of personal data subjects or their representatives at LLC KR, as well as the forms for considering the relevant requests of personal data subjects or their representatives, are approved by order of LLC KR.
10. Liability
10.1. Persons guilty of violating the requirements of the Federal Law "On Personal Data" bear the liability provided for by the legislation of the Russian Federation.
10.2. Moral harm caused to a personal data subject as a result of a violation of their rights, a violation of the rules for processing personal data established by the Federal Law "On Personal Data", as well as the requirements for the protection of personal data established in accordance with the Federal Law "On Personal Data", is subject to compensation in accordance with the legislation of the Russian Federation. Compensation for moral harm is carried out regardless of the compensation for property damage and the losses incurred by the personal data subject.
Appendix 1
Data when using the official website and the online service.
1. When using the official website and the online service, cookies (hereinafter — "cookie files") may be automatically transmitted to LLC KR.
2. Cookie files are fragments of data stored in the browser of a computer, mobile phone or other device.
3. Information that may be transmitted via cookie files:
- IP address;
- MAC address;
- User session identifier;
- Information about the software and hardware used;
4. The use of cookie files does not provide access to any data other than the data stored in the cookie file.
5. Essential cookie files are stored indefinitely. Session cookie files are stored for the duration of the user session.
6. Disabling cookie files may lead to the inoperability of some sections of the official website and the online service.
7. Types of cookie files used:
1) Essential cookie files. Necessary to ensure the operability of the official website and the online service, some parts of which cannot function without the use of these files;
2) Functional cookie files. Allow settings to be remembered and information already provided by users to be saved (for example, login, user name, etc.);
3) Analytical cookie files. Third-party software Yandex Metrica is used. The composition and conditions of collecting depersonalised data are determined directly by the rights holders and may include:
- request data (time, referrer, IP address);
- operating system data (type, version, screen resolution);
- device data and its location, browser data (type, version, cookie);
The operator is not responsible for the manner in which depersonalised data are used by third parties.
Log in
Technology core
Maintenance & repair
Tyre service & seasonal storage
Insurance
Monitoring & geo-analytics
Document management & reporting
Submit a request
