Personal Data Processing Policy

1. General provisions

1.1.This document defines the Policy of INKC LIMITED LIABILITY COMPANY regarding the processing of personal data (hereinafter referred to as the Policy). 1.2. The terms and definitions given in Table 1 are used in this Policy. Other terms used in this Policy are used in the meanings defined by the legislation of the Russian Federation, other regulatory legal acts, and national standards in the field of personal data processing and protection.

Table 1 – List of terms and definitions.

The term	Definition	A source
Automated processing of personal data	Processing of personal data using computer technology	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Blocking of personal data	Temporary termination of personal data processing (except in cases where processing is necessary to clarify personal data	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Personal Data Information System	The totality of personal data contained in databases and information technologies and technical means that ensure their processing	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Depersonalization of personal data	Actions that make it impossible to determine whether personal data belongs to a specific personal data subject without using additional information	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Processing of personal data	Any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Operator	A state body, a municipal body, a legal entity or an individual who independently or jointly with other persons organize and (or) process personal data, as well as determine the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Personal data	Any information related directly or indirectly to a specific or identifiable natural person (personal data subject)	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Provision of personal data	Actions aimed at disclosing personal data to a specific person or a specific group of people	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Dissemination of personal data	Actions aimed at disclosing personal data to an unspecified group of people	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Computer hardware	A set of software and technical elements of data processing systems capable of operating independently or as part of other systems	GOST R 50739-95
Destruction of personal data	Actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed	Federal Law No. 152-FZ of 06.27.2006 "On Personal Data"
Processing of personal data without using automation tools	Actions with personal data, such as the use, clarification, dissemination, destruction of personal data in relation to each of the subjects of personal data, which are carried out with the direct participation of a person	Decree of the Government of the Russian Federation dated 09/15/2008 No. 687 "On Approval of the Regulation on the Specifics of Personal Data Processing carried out without the use of automation tools"

1.3. This Policy has been developed on the basis of the following regulatory legal acts:

• Federal Law No. 152-FZ of 06.27.2006 "On Personal Data";
• Decree of the Government of the Russian Federation dated 11/01/2012 No. 1119 "On Approval of Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems";
• Decree of the Government of the Russian Federation dated 09/15/2008 No. 687 "On Approval of the Regulation on the Specifics of Personal Data Processing carried out without the use of automation tools".

1.4. This Policy, all additions and changes to it are approved by the order of INKC LLC.

1.5. The Policy is subject to publication on the official website of the LIMITED LIABILITY COMPANY INKC.

1.6. The provisions of the Policy apply to all relations related to the processing of personal data carried out in INKC LIMITED LIABILITY COMPANY, both with and without the use of automation tools.

1.7. The Policy applies to all employees of INKC LIMITED LIABILITY COMPANY.

2. Purposes of personal data processing

2.1The purposes of PD processing in the LIMITED LIABILITY COMPANY "INKC" are:

• ensuring compliance with the tax legislation of the Russian Federation;
• maintaining personnel and accounting records;
• promotion of goods, works, and services on the market.

3.Legal grounds for processing personal data

3.1The following regulations and documents are the basis for the processing of personal data in INKC LIMITED LIABILITY COMPANY:

• The Constitution of the Russian Federation;
• The Labor Code of the Russian Federation;
• The Tax Code of the Russian Federation;
• The Civil Code of the Russian Federation;
• Federal Law No. 326-FZ dated 29.11.2010 "On Compulsory Medical Insurance in the Russian Federation";
• Federal Law No. 165-FZ of 07/16/1999 "On the basics of Compulsory Social Insurance";
• Federal Law No. 167-FZ dated December 15, 2001 "On Compulsory Pension Insurance in the Russian Federation";
• Federal Law No. 255-FZ of December 29, 2006 "On Compulsory social insurance in case of temporary disability and in connection with maternity";
• Federal Law No. 166-FZ dated December 15, 2001 "On State Pension Provision in the Russian Federation";
• Federal Law No. 53-FZ dated 28.03.1998 "On Military Duty and Military Service";
• Federal Law No. 402-FZ dated 06.12.2011 "On Accounting";
• Resolution of the Government of the Russian Federation dated December 27, 2006 No. 719 "On approval of the Regulations on Military Registration";
• Federal Law No. 400-FZ dated December 28, 2013 "On Insurance Pensions";
• contracts concluded between the operator and the subject of personal data;
• consent to the processing of personal data (in cases not directly provided for by the legislation of the Russian Federation, but corresponding to the authority of the operator);
• The Charter;
• Consent of the personal data subject to the processing of his personal data;
• the processing of personal data is carried out with the consent of the personal data subject to the processing of his personal data;
• the processing of personal data is necessary to achieve the goals stipulated by an international treaty of the Russian Federation or a law, to carry out and fulfill the functions, powers and duties assigned to the operator by the legislation of the Russian Federation;
• the processing of personal data is necessary for the execution of a judicial act, an act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;
• personal data is being processed that is subject to publication or mandatory disclosure in accordance with federal law;
• personal data is processed for statistical or other research purposes, with the exception of the purposes specified in Article 15 of the Federal Law "On Personal Data", subject to mandatory depersonalization of personal data.

4. Scope and categories of personal data processed, categories of subjects of personal data

4.1. In accordance with the purposes of personal data processing specified in clause 2 of this Policy of the INKC LIMITED LIABILITY COMPANY, the following categories of personal data subjects are processed:

• relatives of the employees;
• employees;
• dismissed employees;
• relatives of dismissed employees;
• site visitors.

4.2. For each purpose of processing personal data processed in INKC LIMITED LIABILITY COMPANY, the orders of INKC LIMITED LIABILITY COMPANY approve the volume, categories and lists of personal data processed, categories of subjects of personal data processed in personal data information systems, methods, terms of their processing and storage, and the procedure for destruction. personal data when the purposes of processing are achieved or when legitimate grounds arise.

4.3.On the websites of INKC LIMITED LIABILITY COMPANY, one or more third-party metric programs are used to promote goods, works, and services on the market: Yandex. Metrica.

The composition and conditions for collecting depersonalized data using third-party software (Yandex.Metrica) are determined directly by their copyright holders and may include: browser data (type, version, cookie), device data and its location, operating system data (type, version, screen resolution), request data (time, traffic source, IP address).

The Operator is not responsible for the use of anonymized data by third parties (Yandex.Metrica).

Disabling cookies may result in the inability to access parts of the site that require authorization.

5. Principles and conditions of personal data processing

5.1.When processing personal data in INKC LIMITED LIABILITY COMPANY, the following principles are observed:

• personal data is processed on a lawful and fair basis;
• the processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes;
• processing of personal data incompatible with the purposes of personal data collection is not allowed;
• it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
• only personal data that meets the purposes of their processing is subject to processing;
• the content and volume of personal data processed correspond to the stated purposes of processing;
• the personal data being processed is not redundant in relation to the stated purposes of their processing;
• the processing of personal data ensures the accuracy of personal data, their sufficiency and, where appropriate, relevance to the purposes of personal data processing;
• necessary measures are being taken to delete or clarify incomplete or inaccurate personal data;
• personal data is stored in a form that makes it possible to identify the subject of personal data, no longer than the purposes of personal data processing require, unless the period of personal data storage is established by federal law, an agreement to which the personal data subject is a party, beneficiary or guarantor.; the processed personal data is subject to destruction or depersonalization upon achievement of the processing objectives or in case of loss of the need to achieve these objectives, unless otherwise provided by the legislation of the Russian Federation.

5.2. INKC LIMITED LIABILITY COMPANY carries out both automated processing of personal data and without the use of automation tools. The set of personal data processing operations in the INKC LIMITED LIABILITY COMPANY includes: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), deletion, destruction, blocking, depersonalization.

5.3.When collecting personal data, INKC LIMITED LIABILITY COMPANY ensures the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data using databases located on the territory of the Russian Federation.

5.4. INKC LIMITED LIABILITY COMPANY does not entrust the processing of personal data to third parties.

5.5.Termination of the processing of personal data is carried out upon termination of the activities of the LIMITED LIABILITY COMPANY INKC (liquidation or reorganization).

5.6.There is no cross-border transfer of personal data by INKC LIMITED LIABILITY COMPANY.

5.7. INKC LIMITED LIABILITY COMPANY ensures confidentiality of personal data. Employees of the INKC LIMITED LIABILITY COMPANY who have gained access to personal data do not disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law. 

5.8.Processing of other categories of personal data is carried out by INKC LIMITED LIABILITY COMPANY in compliance with the following conditions:

• the processing of personal data is necessary to achieve the goals stipulated by an international treaty of the Russian Federation or a law, to carry out and fulfill the functions, powers and duties assigned to the operator by the legislation of the Russian Federation;
• the processing of personal data is carried out with the consent of the personal data subject to the processing of his personal data;
• the processing of personal data is necessary for the execution of a judicial act, an act of another body or official subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings;
• personal data is being processed that is subject to publication or mandatory disclosure in accordance with federal law;
• personal data is processed for statistical or other research purposes, with the exception of the purposes specified in Article 15 of the Federal Law "On Personal Data", subject to mandatory depersonalization of personal data.

6. Implementation of measures to ensure the security of personal data taken by INKC LIMITED LIABILITY COMPANY

6.1. INKC LIMITED LIABILITY COMPANY takes or ensures the adoption of necessary and sufficient legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions regarding personal data.

Such measures in the INKC LIMITED LIABILITY COMPANY include:

• appointment of a person responsible for organizing the processing of personal data;
• publication of local acts on personal data processing, defining for each purpose of personal data processing the categories and list of personal data being processed, the categories of subjects whose personal data are being processed, the methods and timing of their processing and storage, the procedure for destroying personal data when the purposes of their processing are achieved or when other legal grounds arise, as well as local acts establishing procedures, aimed at preventing and detecting violations of the legislation of the Russian Federation in the field of personal data processing and protection, and eliminating the consequences of such violations;
• implementation of internal control over the compliance of personal data processing with the legislation of the Russian Federation on personal data, requirements for personal data protection, and internal documents of INKC LIMITED LIABILITY COMPANY in the field of personal data processing and protection;
• assessment of the harm that may be caused to personal data subjects in case of violation of the Federal Law "On Personal Data", the ratio of this harm and the measures taken by INKC LIMITED LIABILITY COMPANY aimed at ensuring the fulfillment of obligations stipulated by the Federal Law "On Personal Data";
• familiarization of employees of INKC LIMITED LIABILITY COMPANY with the provisions of the legislation of the Russian Federation on personal data, internal documents of INKC LIMITED LIABILITY COMPANY on personal data processing, and requirements for personal data protection;
• the application or enforcement of legal, organizational and technical measures to ensure the security of personal data in accordance with art.19 of the Federal Law "On Personal Data", in particular:
• identification of threats to the security of personal data during their processing in the information systems of personal data of the LIMITED LIABILITY COMPANY INKC;
• implementation of technical and organizational measures to protect personal data processed in the information systems of the INKC LIMITED LIABILITY COMPANY, based on the requirements, approved by Decree of the Government of the Russian Federation No. 1119 dated 11/01/2012 "On Approval of Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems" and the Requirements of the FSTEC of Russia Order No. 21 dated 02/18/2013 "On Approval of the Composition and Content of Organizational and Technical measures to ensure the security of Personal data during their Processing in Personal Data Information Systems" developed by according to the results:
• definitions of the categories of personal data processed in the information systems of the personal data of the LIMITED LIABILITY COMPANY INKC;
• determining the level of security of personal data during their processing in personal data information systems based on the analysis of current threats to personal data security and possible damage to personal data subjects during the implementation of threats to personal data security;
• organization of a security regime for the premises in which personal data information systems are located, preventing the possibility of uncontrolled entry or stay in these premises who do not have the right to access these premises;  ensuring the accounting and safety of personal data storage media;
• organization of access to personal data processed in personal data information systems;
• the use of information security tools that have passed the procedure for assessing compliance with the requirements of the legislation of the Russian Federation in the field of information security;
• the implementation of antivirus monitoring and detection;
• the use of firewall security (filtering) screens;
• timely installation of updates the software used for personal data information systems and information security tools;
• organization of protection of technical means of personal data information systems.

6.2. INKC LIMITED LIABILITY COMPANY shall, in accordance with the established procedure, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing the federal executive governmental body authorized in the field of security about computer incidents that have resulted in the unlawful transfer (provision, dissemination, access) of personal data. data.

7. Personal data processing performed without the use of automation tools

7.1. Personal data, when processed without the use of automation tools, is separated from other information, in particular by recording them on separate tangible personal data carriers (hereinafter referred to as tangible media), in special sections or in the fields of forms (forms).

7.2. When recording personal data on tangible media, it is not allowed to record personal data on one tangible medium, the purposes of processing which are obviously incompatible. For the processing of various categories of personal data carried out without the use of automation tools, a separate physical medium is used for each category of personal data.

7.3. Persons who process personal data without the use of automation tools (including employees of the INKC LIMITED LIABILITY COMPANY or persons who perform such processing under an agreement with the INKC LIMITED LIABILITY COMPANY) have been informed of the fact that they are processing personal data, which is processed by the INKC LIMITED LIABILITY COMPANY without the use of automation tools, categories of personal data being processed, as well as the specifics and rules of such processing, established by the regulatory legal acts of the Russian Federation, as well as the local legal acts of the LIMITED LIABILITY COMPANY INKC. 

7.4. When using standard forms of documents, the nature of the information in which presupposes or allows the inclusion of personal data in them (hereinafter referred to as the standard form), the following conditions are met:

• the standard form or related documents (instructions for completing it, cards, registers and journals) contain information about the purpose of personal data processing carried out without the use of automation tools, the name(s) and address of the INKC LIMITED LIABILITY COMPANY, the surname, first name, patronymic and address of the personal data subject, the source of personal data, the timing of personal data processing, the list of actions with personal data that will be performed during their processing, a general description of the methods of personal data processing used by INKC LIMITED LIABILITY COMPANY;
• the standard form provides a field in which the personal data subject can put a mark on his consent to the processing of personal data carried out without the use of automation tools, if necessary, to obtain written consent to the processing of personal data;
• the standard form is drawn up in such a way that each of the subjects of personal data contained in the document has the opportunity to get acquainted with their personal data contained in the document without violating the rights and legitimate interests of other subjects of personal data;
• the standard form excludes combining fields intended for entering personal data, the purposes of processing which are obviously incompatible.

7.5. If the purposes of processing personal data recorded on one physical medium are incompatible, if the physical medium does not allow processing personal data separately from other personal data recorded on the same medium, measures are taken to ensure separate processing of personal data, in particular:

• if it is necessary to use or distribute certain personal data separately from other personal data located on the same physical medium, the personal data to be distributed or used is copied in a way that excludes simultaneous copying of personal data not subject to distribution and use, and a copy of the personal data is used (distributed);
• if it is necessary to destroy or block part of the personal data, the material medium is destroyed or blocked with preliminary copying of information that is not subject to destruction or blocking, in a way that excludes simultaneous copying of personal data that is subject to destruction or blocking.

8. Updating, correction, deletion and destruction of personal data, responding to requests from subjects for access to personal data

8.1.Rights of personal data subjects:

8.1.1. The right of the personal data subject to access his personal data:

1. The personal data subject has the right to receive information (hereinafter referred to as the information requested by the subject) concerning the processing of his personal data, including information containing:
   • confirmation of the processing of personal data by INKC LIMITED LIABILITY COMPANY;
   • legal grounds and purposes of personal data processing;
   • purposes and methods of personal data processing used by INKC LIMITED LIABILITY COMPANY;
   • the name and location of the INKC LIMITED LIABILITY COMPANY, information about persons (with the exception of employees of the INKC LIMITED LIABILITY COMPANY) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the INKC LIMITED LIABILITY COMPANY or on the basis of federal law;
   • processed personal data related to the relevant personal data subject, the source of their receipt, unless a different procedure for submitting such data is provided for by federal law;
   • the timing of personal data processing, including the duration of their storage;
   • the procedure for the implementation of personal data by the subject the rights provided for by the Federal Law "On Personal Data";
   • information about the performed or about the intended cross-border data transfer;
   • the name or surname, first name, patronymic and address of the person who processes personal data on behalf of INKC LIMITED LIABILITY COMPANY, if the processing has been or will be entrusted to such a person;
   • information on how the operator performs the duties established by Article 18.1 of the Federal Law "On Personal Data";
   • other information provided by the Federal Law "On Personal Data" or other federal laws.
2. The personal data subject has the right to receive the information requested by the subject, except in cases where the access of the personal data subject to his personal data violates the rights and legitimate interests of third parties.
3. The personal data subject has the right to require INKC LIMITED LIABILITY COMPANY to clarify his personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as to take legal measures to protect his rights.
4. The information requested by the subject must be provided to the subject of personal data from INKC LIMITED LIABILITY COMPANY in an accessible form, and it must not contain personal data related to other personal data subjects, except in cases where there are legitimate grounds for the disclosure of such personal data.
5. The requested information is provided to the personal data subject or his representative by INKC LIMITED LIABILITY COMPANY within 10 business days from the moment of the request or upon receipt of the request from the personal data subject or his representative. The specified period may be extended, but not for more than 5 business days if the LIMITED LIABILITY COMPANY INKC sends a reasoned notification to the subject of personal data indicating the reasons for extending the deadline for providing the requested information. The request must contain the number of the main identity document of the personal data subject or his representative, information about the date of issue of the specified document and the issuing authority, information confirming the participation of the personal data subject in relations with the Limited LIABILITY COMPANY INKC (contract number, date of conclusion of the contract, conventional word designation and (or) other information), or information otherwise confirming the processing of personal data by INKC LIMITED LIABILITY COMPANY, signature of the personal data subject or his representative (hereinafter referred to as the information required for the request). The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation. INKC LIMITED LIABILITY COMPANY provides information to the personal data subject or his representative in the form in which the relevant request or request is sent, unless otherwise specified in the request or request.
6. If the information requested by the subject, as well as the personal data being processed, has been provided to the personal data subject for review upon his request, the personal data subject has the right to contact INKC LIMITED LIABILITY COMPANY again or send a repeat request in order to receive the information requested by the subject and familiarize himself with such personal data no earlier than 30 days after the initial request or sending the initial request, unless a shorter period is established by federal law, a regulatory legal act adopted in accordance with it or an agreement to which the personal data subject is a party or beneficiary or guarantor.
7. The personal data subject has the right to re-apply to INKC LIMITED LIABILITY COMPANY or send a repeat request in order to obtain the information requested by the subject, as well as to familiarize himself with the personal data being processed before the expiration of the period specified in subparagraph 6 of paragraph 8.1.1. of these Regulations, if such information and (or) the personal data being processed The data was not provided to him for review in full based on the results of consideration of the initial appeal. The repeated request, along with the information necessary for the request, must contain a justification for sending the repeated request.
8. INKC LIMITED LIABILITY COMPANY has the right to refuse a personal data subject to fulfill a repeated request that does not comply with the terms of the repeated request. Such a refusal must be motivated. The obligation to provide evidence of the validity of the refusal to fulfill the repeated request lies with the LIMITED LIABILITY COMPANY INKC.

8.1.2.The right to appeal against the actions or omissions of INKC LIMITED LIABILITY COMPANY:

1. If the personal data subject believes that the INKC LIMITED LIABILITY COMPANY is processing his personal data in violation of the requirements of the Federal Law "On Personal Data" or otherwise violates his rights and freedoms, the personal data subject has the right to appeal the actions or omissions of the INKC LIMITED LIABILITY COMPANY to the authorized body for protection of the rights of personal data subjects or in court.
2. The personal data subject has the right to protect his rights and legitimate interests, including compensation for damages and (or) compensation for moral damage in court.

8.2. Operator 's responsibilities:

8.2.1. Duties of the operator when collecting personal data:

1. When collecting personal data, INKC LIMITED LIABILITY COMPANY provides the personal data subject, upon his request, with the requested information regarding the processing of his personal data in accordance with Part 7 of Article 14 of the Federal Law "On Personal Data".
2. If the provision of personal data and (or) consent to the processing of personal data by INKC LIMITED LIABILITY COMPANY is mandatory in accordance with federal law, INKC LIMITED LIABILITY COMPANY explains to the personal data subject the legal consequences of refusing to provide his personal data and (or) consent to their processing.
3. If personal data is not received from the personal data subject, INKC LIMITED LIABILITY COMPANY, prior to the start of processing such personal data, provides the personal data subject with the following information (hereinafter referred to as information provided upon receipt of personal data not from the personal data subject):
• name or surname, first name, patronymic and address of INKC LIMITED LIABILITY COMPANY;
• purpose of personal data processing and its legal basis;
• list of personal data;
• the intended users of personal data;
• the rights of the personal data subject established by the Federal Law "On Personal Data";
• the source of personal data.
4. INKC LIMITED LIABILITY COMPANY does not provide the subject with information provided upon receipt of personal data not from the subject of personal data, in cases where:
• the personal data subject has been notified about the processing of his personal data by the LIMITED LIABILITY COMPANY INKC;
• personal data was obtained by INKC LIMITED LIABILITY COMPANY on the basis of a federal law or in connection with the performance of a contract to which the personal data subject is a party or beneficiary or guarantor;
• the processing of personal data authorized by the personal data subject for dissemination is carried out in compliance with prohibitions and the conditions stipulated in Article 10.1 of 27.06.2006 № 152-FZ "On personal data";
• INKC LIMITED LIABILITY COMPANY processes personal data for statistical or other research purposes, for the professional activity of a journalist or scientific, literary or other creative activities, provided that the rights and legitimate interests of the personal data subject are not violated;
• providing the personal data subject with information information provided upon receipt of personal data not from the personal data subject violates the rights and legitimate interests of third parties.

8.2.2. Obligations of the operator when contacting the personal data subject or when receiving a request from the personal data subject or his representative, as well as the authorized body for the protection of the rights of personal data subjects:

1. INKC LIMITED LIABILITY COMPANY informs the personal data subject or his representative in accordance with the established procedure about the availability of personal data related to the relevant personal data subject, and also provides an opportunity to get acquainted with these personal data when contacting the personal data subject or his representative, or within 10 business days from the date of receipt of the request from the personal data subject or his representative. The specified period may be extended, but not for more than 5 business days if the LIMITED LIABILITY COMPANY INKC sends a reasoned notification to the subject of personal data indicating the reasons for extending the deadline for providing the requested information.
2. In case of refusal to provide information about the availability of personal data about the relevant personal data subject or personal data to the personal data subject or his representative, upon their request or upon receipt of a request from the personal data subject or his representative, INKC LIMITED LIABILITY COMPANY shall provide a reasoned response in writing within a period not exceeding 10 business days. days from the date of the request of the personal data subject or his representative, or from the date of receipt of the request of the personal data subject or his representative. The specified period may be extended, but not for more than 5 business days if the LIMITED LIABILITY COMPANY INKC sends a reasoned notification to the subject of personal data indicating the reasons for extending the deadline for providing the requested information.
3. INKC LIMITED LIABILITY COMPANY provides free of charge to the personal data subject or his representative the opportunity to get acquainted with personal data related to this personal data subject. Within a period not exceeding 7 business days from the date on which the personal data subject or his representative provides information confirming that the personal data is incomplete, inaccurate or outdated, INKC LIMITED LIABILITY COMPANY makes the necessary changes to them. Within a period not exceeding 7 business days from the date of submission by the personal data subject or his representative of information confirming that such personal data was unlawfully obtained or is not necessary for the stated purpose of processing, INKC LIMITED LIABILITY COMPANY destroys such personal data. INKC LIMITED LIABILITY COMPANY notifies the personal data subject or his representative of the changes made and the measures taken and takes reasonable measures to notify third parties to whom the personal data of this subject has been transferred.
4. INKC LIMITED LIABILITY COMPANY shall inform the authorized body for the protection of the rights of personal data subjects upon request of this body of the necessary information within 10 working days from the date of receipt of such request. The specified period may be extended, but not for more than 5 working days if INKC LIMITED LIABILITY COMPANY sends a reasoned notification to the authorized body for the protection of the rights of personal data subjects, indicating the reasons for extending the deadline for providing the requested information.

8.2.3.The operator's obligations to eliminate violations of the law committed during the processing of personal data, to clarify, block and destroy personal data:

1. In case of detection of unlawful processing of personal data when contacting the subject of personal data or his representative, or at the request of the subject of personal data or his representative or the authorized body for the protection of the rights of personal data subjects, the LIMITED LIABILITY COMPANY INKC blocks the unlawfully processed personal data related to this personal data subject, or ensures their blocking (if personal data is processed by another person, acting on behalf of the INKC LIMITED LIABILITY COMPANY) from the moment of such request or receipt of the specified request for the verification period. In case of detection of inaccurate personal data when contacting a personal data subject or his representative, or at their request or at the request of the authorized body for the protection of the rights of personal data subjects, INKC LIMITED LIABILITY COMPANY blocks personal data related to this personal data subject, or ensures their blocking (if personal data is processed by another person, acting on behalf of the INKC LIMITED LIABILITY COMPANY) from the moment of such request or receipt of the specified request for the verification period, if the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
2. In case of confirmation of the inaccuracy of personal data, INKC LIMITED LIABILITY COMPANY, based on information provided by the personal data subject or his representative or the authorized body for the protection of the rights of personal data subjects, or other necessary documents, clarifies the personal data or ensures their clarification (if personal data is processed by another person, acting on behalf of the INKC LIMITED LIABILITY COMPANY) within 7 business days from the date of submission of such information and removes the blocking of personal data.
3. In case of detection of unlawful processing of personal data carried out by INKC LIMITED LIABILITY COMPANY or a person acting on behalf of INKC LIMITED LIABILITY COMPANY, INKC LIMITED LIABILITY COMPANY shall terminate the unlawful processing within a period not exceeding 3 business days from the date of this detection. personal data or ensures the termination of the unlawful processing of personal data by a person acting on behalf of the LIMITED LIABILITY COMPANY INKC. If it is impossible to ensure the legality of the processing of personal data, INKC LIMITED LIABILITY COMPANY, within a period not exceeding 10 business days from the date of detection of the unlawful processing of personal data, destroys such personal data or ensures their destruction. INKC LIMITED LIABILITY COMPANY notifies the personal data subject or his representative about the elimination of violations or the destruction of personal data, and if the request of the personal data subject or his representative or the request of the authorized body for the protection of the rights of personal data subjects has been sent by the authorized body for the protection of the rights of personal data subjects, also the specified body.
4. If the fact of unlawful or accidental transfer (provision, dissemination, access) of personal data is established, which has resulted in a violation of the rights of personal data subjects, INKC LIMITED LIABILITY COMPANY is obliged, from the moment such incident is identified, by the operator, the authorized body for the protection of the rights of personal data subjects or another interested person, to notify the authorized body for the protection of the rights of personal data subjects. data:
• within 24 hours about the incident, about the alleged causes that led to the violation of the rights of personal data subjects, and about the alleged harm caused to the rights of personal data subjects, about the measures taken to eliminate the consequences of the relevant incident, as well as provide information about the person authorized by the LIMITED LIABILITY COMPANY INKC to cooperate with the authorized body for the protection of the rights of personal data subjects on issues related to the identified incident;
• within 72 hours on the results of the internal investigation of the identified incident, as well as provide information about the persons whose actions caused the identified incident (if any).
5. If the purpose of personal data processing is achieved, INKC LIMITED LIABILITY COMPANY stops processing personal data or ensures its termination (if personal data processing is carried out by another person acting on behalf of INKC LIMITED LIABILITY COMPANY) and destroys personal data or ensures their destruction (if personal data processing is carried out by another person acting on behalf of INKC LIMITED LIABILITY COMPANY). on behalf of the INKC LIMITED LIABILITY COMPANY) on time, not exceeding 30 days from the date of achievement of the purpose of processing personal data, unless otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor, or by another agreement between the LIMITED LIABILITY COMPANY INKC and the personal data subject, or if the LIMITED LIABILITY COMPANY INKC" does not have the right to process personal data without the consent of the personal data subject on the grounds provided for by the Federal Law "On Personal Data" or other federal laws.
6. If the personal data subject withdraws consent to the processing of his personal data, the INKC LIMITED LIABILITY COMPANY stops processing them or ensures the termination of such processing (if the processing of personal data is carried out by another person acting on behalf of the INKC LIMITED LIABILITY COMPANY) and if the storage of personal data is no longer required for the purposes of processing of personal data, destroys personal data or ensures their destruction (if the processing of personal data is carried out by another person, acting on behalf of the INKC LIMITED LIABILITY COMPANY) within a period not exceeding 30 days from the date of receipt of the said review, unless otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor, or another agreement between the INKC LIMITED LIABILITY COMPANY and the subject of personal data, or if the LIMITED LIABILITY COMPANY INKC is not entitled to process personal data without the consent of the subject of personal data on the grounds of, provided for by the Federal Law "On Personal Data" or other federal laws.
7. If a personal data subject applies to INKC LIMITED LIABILITY COMPANY with a request to terminate the processing of personal data, the operator must, within a period not exceeding 10 business days from the date of receipt by the operator of the relevant request, terminate their processing or ensure the termination of such processing (if such processing is carried out by a person who processing personal data), except in cases stipulated by the Federal Law "On Personal Data". The specified period may be extended, but not for more than 5 working days if the operator sends a reasoned notification to the personal data subject indicating the reasons for extending the deadline for providing the requested information.
8. If it is not possible to destroy personal data within the specified period, INKC LIMITED LIABILITY COMPANY blocks such personal data or ensures their blocking (if personal data is processed by another person acting on behalf of INKC LIMITED LIABILITY COMPANY) and ensures the destruction of personal data on time no more than 6 months, unless otherwise specified by federal laws.

8.3.The rules for reviewing requests from personal data subjects or their representatives in the INKC LIMITED LIABILITY COMPANY, as well as the forms for reviewing relevant requests from personal data subjects or their representatives, are approved by order of the INKC LIMITED LIABILITY COMPANY.

9. Liability

9.1. Persons guilty of violating the requirements of the Federal Law "On Personal Data" are liable in accordance with the legislation of the Russian Federation.

9.2. Moral damage caused to a personal data subject as a result of violation of his rights, violation of the rules for processing personal data established by the Federal Law "On Personal Data", as well as the requirements for personal data protection established in accordance with the Federal Law "On Personal Data", is subject to compensation in accordance with the legislation of the Russian Federation.. Compensation for moral damage is carried out independently of compensation for property damage and losses incurred by the personal data subject.