Personal Data Processing Policy

1. Basic Terms and Definitions

Automated processing of personal data is the processing of personal data using computing technology.

Blocking of personal data is the temporary cessation of processing personal data (except in cases where processing is necessary to clarify personal data).

Information system of personal data is a collection of personal data contained in databases and the information technologies and technical means that ensure their processing.

Anonymization of personal data is actions that result in the inability to determine the ownership of personal data to a specific subject without the use of additional information.

Processing of personal data is any action (operation) or a set of actions (operations) performed with personal data using automation tools or without such tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data.

Personal data operator (operator) is a state body, municipal body, legal entity, or individual that independently or jointly with others organizes and/or carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed with personal data.

Personal data is any information relating to an identified or identifiable individual (subject of personal data);

Provision of personal data is actions aimed at disclosing personal data to a specific person or a specific group of persons.

Distribution of personal data is actions aimed at disclosing personal data to an indefinite group of persons.

Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual, or a foreign legal entity.

Уничтожение персональных данных — действия, в результате которых становится невозможным восстановить содержание персональных данных в информационной системе персональных данных и (или) в результате которых уничтожаются материальные носители персональных данных.

Destruction of personal data is actions that make it impossible to restore the content of personal data in the information system of personal data and/or result in the destruction of physical carriers of personal data.

Mixed processing of personal data is the processing of personal data using automation tools as well as without them.

Cookies are a small piece of data sent by a web server and stored on the user’s automated location.

2. General Provisions

• This Policy regarding the processing of personal data at LLC “Hotel Onegin” (hereinafter referred to as the Policy) is an official document that defines the general principles, purposes, and procedures for processing personal data (hereinafter referred to as PD), as well as information about the implemented measures for the protection of PD.
• This Policy applies to all employees of LLC “Hotel Onegin” (hereinafter referred to as the Operator), as well as to employees of third-party organizations interacting with the Operator based on relevant contracts, regulatory, legal, and organizational documents.
• This Policy comes into effect from the moment of its approval and is valid indefinitely until replaced by a new Policy.

3. Purposes of PD Collection

Personal data is processed for the purposes of:

• Ensuring personnel management and accounting; establishing labor relations with employees.
• Ensuring the conditions of labor established by the legislation of the Russian Federation.
• Compliance with the requirements of the Labor Code of the Russian Federation.
• Compliance with the requirements of tax legislation regarding the calculation and payment of personal income tax, as well as the unified social tax.
• Performing the functions of the employer.
• Исполнение Обществом функции работодателя (обрабатываются следующие ПДн: фамилия, имя, отчество, дата рождения, адрес места жительства, данные документа, удостоверяющего личность, ИНН, СНИЛС, реквизиты банковской карты).
• Recruitment (selection of candidates for vacant positions), compliance with regulatory legal acts of the Russian Federation, local acts; establishing communication with the subject; sending letters, responses to the subject; ensuring a personnel reserve, assisting in employment, assisting in choosing a suitable position.
• Interacting with the Operator via the website; booking rooms.
• To provide services to the client, to fulfill contractual obligations.

4. Legal Grounds for Processing PD

The Operator processes PD in accordance with the following regulatory and legal acts:

• Consent to the processing of personal data of employees.
• Consent to the processing of personal data of hotel guests,
• Consent to the processing of personal data of job applicants,
• Paragraph 28 of the Government Decree of the Russian Federation dated 15.01.2007 No. 9 “On the Procedure for Migration Registration of Foreign Citizens and Stateless Persons in the Russian Federation”
• Articles 23, 24 of the Constitution of the Russian Federation;
• Labor Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Federal Law dated 15.12.2001 No. 167-FZ “On Mandatory Pension Insurance in the Russian Federation”;
• Articles 15 and 36.19 of the Federal Law dated 07.05.1998 No. 75-FZ “On Non-State Pension Funds”;
• Federal Law dated 29.12.2006 No. 255-FZ “On Mandatory Social Insurance in case of Temporary Disability and in connection with Maternity”;
• Article 8 of the Federal Law dated 31.05.1996 No. 61-FZ “On Defense”;
• Article 9 of the Federal Law dated 26.02.1997 No. 31-FZ “On Mobilization Preparation and Mobilization in the Russian Federation”;
• Government Decree of the Russian Federation dated 09.10.2015 No. 1085 (as amended on 30.11.2018) “On Approval of the Rules for Providing Hotel Services in the Russian Federation”;
• Federal Law dated 29.11.2010 No. 326-FZ “On Mandatory Medical Insurance in the Russian Federation”;
• Articles 13, 92–94 of the Federal Law dated 21.11.2011 No. 323-FZ “On the Fundamentals of Health Protection for Citizens in the Russian Federation”;
• Commercial contracts (Service Agreement (registration card);
• Charter of LLC “Hotel Onegin.”

5. Volume and categories of personal data processed, categories of data subjects

The operator processes the following categories of personal data:

Category of data subjects	Category of processed personal data	Volume of processed personal data
Employees, former employees	OTHER categories	Fewer than 100,000 subjects
Candidates for vacant positions	OTHER categories	Fewer than 100,000 subjects
Website visitors	OTHER categories	Fewer than 100,000 subjects
Clients	OTHER categories	Fewer than 100,000 subjects

6. Procedure and conditions for processing personal data

• Personal data is processed on a lawful and fair basis.
• The processing of personal data is limited to achieving specific, predetermined, and lawful purposes. Processing of personal data that is incompatible with the purposes of collection is not permitted.
• Combining databases containing personal data processed for incompatible purposes is not allowed.
• Обработке подлежат только ПДн, которые отвечают целям их обработки.
• Only personal data that meets the purposes of processing is subject to processing.
• The content and volume of processed personal data correspond to the stated purposes of processing and are not excessive in relation to those purposes.
• When processing personal data, accuracy, sufficiency, and, where necessary, relevance to the purposes of processing are ensured. Necessary measures are taken to delete or clarify incomplete or inaccurate data.
• Для ведения статистики и анализа работы сайта Оператор обрабатывает такие данные, как IP-адрес, информацию о браузере, данные из файлов «cookie» с использованием метрических сервиса Яндекс Метрика.
• For the purpose of providing information to the Operator, publicly accessible sources of the Operator’s personal data may be created (including directories, electronic databases, and the Operator’s website pages on the information and telecommunications network “Internet”). Only personal data specified by the data subject in written consent for inclusion in publicly accessible sources may be included.
• For statistical purposes and analysis of website performance, the Operator processes data such as IP address, browser information, and data from cookies using metrics services like Google Analytics and Yandex Metrica.
• If the user refuses to process cookies, they must stop using the website or disable cookies in their browser settings; some website functions may become unavailable.
• Some cookies may only be stored with the consent of the data subject. Additionally, when the data subject first visits the Operator’s website, permission is requested to store cookies.
• Personal data is stored in a form that allows identification of the data subject for no longer than required for the purposes of processing, unless the storage period is established by federal law, contract, or other legal obligations. Processed personal data must be destroyed or anonymized upon achieving the processing purposes or when there is no longer a need to achieve those purposes, unless otherwise provided by federal law.

7. Conditions and terms for terminating the processing of personal data

• The Operator processes personal data in accordance with the following regulatory and legal acts:
• achieving the purposes of processing personal data or maximum storage periods – within 30 days;
• loss of necessity to achieve the purposes of processing personal data – within 30 days;
• provision by the data subject or their legal representative of information confirming that the personal data was obtained unlawfully or is not necessary for the stated purpose of processing – within 7 days;
• impossibility of ensuring the legality of processing personal data – within 10 days;
• withdrawal of consent by the data subject for processing personal data, if storage of personal data is no longer required for the purposes of processing – within 30 days;
• expiration of limitation periods for legal relations within which personal data processing is carried out or was carried out.
• In accordance with Article 21, Part 5 of Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006, the Operator does not terminate the processing of personal data of the Subject and does not destroy it in the following cases:
• unless otherwise provided by the contract to which the Subject is a party, beneficiary, or guarantor;
• The Operator has the right to process personal data without the Subject’s consent on the grounds provided by federal laws;the terms for processing the Subject’s personal data established by federal laws of the Russian Federation and other regulatory acts have not expired.
• the terms for processing the Subject’s personal data established by federal laws of the Russian Federation and other regulatory acts have not expired.
• The Operator assumes that the data subject provides accurate and reliable information, and during interaction with the Operator, timely notifies the Operator’s representatives of changes to their personal data.

8. Measures to ensure the security of personal data

• The security of personal data processed by the Operator is ensured by implementing legal, organizational, technical, and software measures necessary and sufficient to meet the requirements of legislation in the field of personal data protection.
• The Operator takes necessary organizational and technical measures to ensure the security of personal data from accidental or unauthorized access, destruction, alteration, blocking access, and other unauthorized actions.
• The Operator takes the following organizational and technical measures:
• назначение должностных лиц, ответственных за организацию обработки и обеспечении безопасности ПДн;
• appointment of officials responsible for organizing processing and ensuring the security of personal data;
• ensuring the accounting and storage of physical carriers of personal data and their circulation, excluding theft, substitution, unauthorized copying, and destruction;
• identifying threats to the security of personal data during their processing in information systems of personal data (hereinafter – ISPD); forming threat models based on them;
• developing a personal data protection system based on threat models for the corresponding level of personal data security during their processing in ISPD;
• checking the readiness and effectiveness of information protection measures;
• implementing a permission system for user access to ISPD information resources, software and hardware processing, and information protection means;
• registering and accounting for user actions in ISPD;
• password protection for user access to ISPD;
• using cryptographic protection means when necessary to ensure the security of personal data during transmission over open communication channels;
• implementing antivirus control, preventing the introduction of malicious software (viruses) and backdoor programs into the corporate network;
• using firewall means when necessary;
• using intrusion detection means in the corporate network when necessary, which violate or create prerequisites for violating established personal data security requirements;
• training employees of the Operator using information protection means applied in ISPD on the rules of working with them;
• обучение работников Оператора, использующих средства защиты информации, применяемые в ИСПДн, правилам работы с ними;
• accounting for applied information protection means, operational and technical documentation for them;
• using information protection means that have undergone the established conformity assessment procedure when necessary;
• monitoring user actions in ISPD, conducting investigations into violations of personal data security requirements;
• placing technical means of processing personal data within the protected area;
• training employees of the Operator using information protection means applied in ISPD on the rules of working with them;
• maintaining technical security means and alarm systems in a state of constant readiness.

9. Rights of Personal Data Subjects

• The data subject has the right to receive information regarding the processing of their personal data, including the following:
• confirmation of the fact that their personal data is being processed by the Operator;
• the legal grounds and purposes for processing personal data;
• the purposes and methods used by the Operator for processing personal data;
• the name and location of the Operator, information about individuals (excluding the Operator’s employees) who have access to personal data or to whom personal data may be disclosed based on a contract with the Operator or federal law;
• the personal data being processed that pertains to the respective data subject, the source of their acquisition, unless another method of providing such data is specified by federal law;
• the duration of personal data processing, including the duration of their storage;
• the procedure for exercising the rights of the data subject as provided by the Federal Law “On Personal Data”;
• information about any completed or anticipated cross-border transfer of personal data;
• the name or surname, first name, patronymic, and address of the person processing personal data on behalf of the Operator, if the processing has been or will be entrusted to such a person;
• other information provided by the Federal Law “On Personal Data” or other federal laws.
• The data subject has the right to demand that the Operator clarify their personal data, block or destroy it in case the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, as well as to take legal measures to protect their rights.
• If the data subject believes that the Operator is processing their personal data in violation of the requirements of the Federal Law “On Personal Data” or otherwise infringes their rights and freedoms, the data subject has the right to appeal the actions or inaction of the Operator to a higher authority for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media – Roskomnadzor) or in court.
• The data subject has the right to protect their rights and legitimate interests, including the right to compensation for damages and/or moral harm in court.

10. Final Provisions

The enforcement of the requirements of this Policy is monitored by the person responsible for organizing the processing of personal data.

• individuals – employees of the Operator;
• individuals – representatives of the Operator’s employees;
• individuals – relatives of the Operator’s employees;
• individuals – candidates considered by the Operator for employment contracts;
• individuals – employees of contractors and third parties;
• individuals – visitors of catering establishments owned by the Operator or third parties with whom the Operator has civil law contracts;
• individuals – visitors of the Operator’s websites and mobile applications;
• individuals who have entered into civil law transactions with the Operator;
• individuals – representatives/employees of the Operator’s clients and contractors;
• individuals in the chain of owners/participants of the Operator’s contractors;
• individuals who were previously employed by the Operator;
• lawyers, notaries interacting with the Operator;
• authors of written and other appeals to the Operator;
• other personal data subjects (to ensure the realization of the processing purposes indicated in Section 3).

The list, categories, and volume of personal data processed by the Operator are determined in accordance with the legislation of the Russian Federation, local regulatory acts of the Operator, and documents prepared on their basis separately for each process related to the processing of personal data, taking into account the purposes indicated in Section 3.

11. Procedure and Conditions for Processing Personal Data

General Procedure for Processing Personal Data

• When organizing the processing of personal data, the Operator complies with the following conditions:
• Personal data processing is carried out on a legal basis;
• Personal data processing is limited to achieving the purposes. Processing of personal data incompatible with the purposes of collection is not allowed;
• Combining databases containing personal data, the processing of which is carried out for incompatible purposes, is not allowed;
• Processing of personal data is permissible only in relation to personal data that meets the established purposes;
• The content and volume of processed personal data correspond to the stated purposes. Processed personal data is not excessive in relation to the established purposes;
• When processing personal data, the accuracy, sufficiency, and relevance of personal data concerning the purposes of processing are ensured;
• The content and volume of processed personal data correspond to the declared purposes of processing personal data;
• Storage of personal data is carried out in a form that allows identifying the data subject, no longer than is necessary to achieve the stated purpose, unless otherwise provided by law and this Policy.
• Upon achieving the stated purposes or in case of loss of necessity to achieve these purposes, the obtained personal data shall be destroyed unless otherwise provided by applicable law.

The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of processing personal data and is responsible to the Operator. The Operator is responsible to the data subject for the actions of the authorized person to whom the Operator entrusted the processing of personal data.

• Updating, correcting, deleting, and destroying personal data.
• Upon achieving the purposes of processing personal data, as well as in the event of the data subject withdrawing consent for their processing, personal data shall be destroyed.
• The basis for the destruction of personal data is:
• achieving the purpose of processing personal data;
• loss of necessity in achieving the purpose of processing personal data;
• withdrawal by the data subject of consent for the processing of their personal data, except in cases where the processing of such personal data is mandatory in accordance with the legislation of the Russian Federation or the contract.
• In case of confirmation of the inaccuracy of personal data, personal data shall be updated, and in case of unlawful acquisition and processing, it shall be terminated and subsequently destroyed.
• Consent of the data subject for the processing of their personal data is obtained on the grounds provided for by the Federal Law of 27.07.2006 N 152-FZ “On Personal Data” and/or applicable legislation of the Russian Federation.

12. Measures Taken by the Operator to Protect Personal Data.

• The Operator takes necessary and sufficient organizational and technical measures to protect the personal data of data subjects from unauthorized or accidental access, destruction, alteration, blocking, copying, distribution, as well as from other unlawful actions by third parties.
• The main methods and means of ensuring the security of personal data include:
• appointment by the Operator of a person responsible for organizing the processing of personal data;
• issuance by the Operator of documents defining the Operator’s policy regarding the processing of personal data (Policy), local acts on the processing of personal data defining for each purpose of processing the categories and list of processed personal data, categories of subjects whose personal data is processed, methods, terms of their processing and storage, the procedure for destroying personal data upon achieving the purposes of their processing or upon the occurrence of other legal grounds (including Regulations on processing and protection of personal data), as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation, eliminating the consequences of such violations (including Regulations for incident management in security).

Such documents and local acts cannot contain provisions limiting the rights of personal data subjects, as well as imposing on the Operator powers and obligations not provided for by the legislation of the Russian Federation.

• Application of legal, organizational, and technical measures to ensure the security of personal data in accordance with applicable legislation, including:
• the application of organizational and technical measures to ensure the security of personal data during the processing of personal data in information systems of personal data, necessary to fulfill the requirements for the protection of personal data, compliance with which ensures the established levels of security for personal data as determined by the Government of the Russian Federation.
• the application of means of information protection that have passed the established conformity assessment procedure;
• taking into account machine carriers of personal data;
• detecting unauthorized access to personal data and taking measures to prevent unauthorized access;
• restoring personal data modified or destroyed due to unauthorized access;
• establishing access rules to personal data processed in the information system of personal data, as well as ensuring registration and accounting of all actions taken with personal data in the information system of personal data.
• monitoring the measures taken to ensure the security of personal data and the level of security of information systems of personal data.
• conducting internal control and/or audit of compliance of personal data processing with current legislation, requirements for the protection of personal data, the Operator’s policy regarding personal data processing, local acts of the Operator;
• familiarizing the Operator’s employees directly involved in the processing of personal data with the provisions of the legislation of the Russian Federation on personal data, including requirements for the protection of personal data, documents defining the Operator’s policy regarding personal data processing, local acts on personal data processing, and/or training of such employees.
• Ensuring unrestricted access to the document defining the Operator’s policy regarding personal data processing, to information on the implemented requirements for the protection of personal data. Publication in relevant information and telecommunications networks (including on the pages of the Operator’s website in the information and telecommunications network “Internet”) of the document defining the Operator’s policy regarding personal data processing and information on the implemented requirements for the protection of personal data, as well as ensuring access to this document using means of the relevant information and telecommunications network.
• The Operator has the right to take other measures necessary to protect personal data in accordance with applicable legislation and local regulatory acts of the Operator.

13. Final Provisions

Control over compliance with the requirements of this Policy is carried out by the person responsible for organizing the processing of personal data.

Other rights and obligations of the Operator are determined by the Federal Law “On Personal Data” and other regulatory legal acts in the field of personal data protection.

Officials guilty of violating the norms regulating the processing and protection of personal data shall bear material, disciplinary, administrative, civil, or criminal liability in the manner established by federal laws.