Privacy Policy

1. Basic Terms and Definitions

Automated processing of personal data is the processing of personal data using computing technology.

Blocking of personal data is the temporary cessation of processing personal data (except in cases where processing is necessary to clarify personal data).

Information system of personal data is a collection of personal data contained in databases and the information technologies and technical means that ensure their processing.

Anonymization of personal data is actions that make it impossible to determine the ownership of personal data to a specific subject without using additional information.

Processing of personal data is any action (operation) or set of actions (operations) performed with personal data using automation tools or without such tools, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data.

Personal data operator (operator) is a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and/or carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed with personal data.

Personal data is any information relating to an identified or identifiable individual (subject of personal data);

Provision of personal data is actions aimed at disclosing personal data to a specific person or a specific circle of persons.

Distribution of personal data is actions aimed at disclosing personal data to an indefinite circle of persons.

Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual, or a foreign legal entity.

Destruction of personal data is actions that make it impossible to restore the content of personal data in the information system of personal data and/or result in the destruction of physical carriers of personal data.

Mixed processing of personal data is the processing of personal data using automation tools, as well as without them.

Cookies are a small piece of data sent by a web server and stored on the user’s automated device.

Data collection form is a tool that allows obtaining information from users in a structured form. Such forms can be online tools or printed forms.

2. General Provisions

• This Policy regarding the processing of personal data in LLC “Hotel Onegin” (hereinafter referred to as the Policy) is an official document that defines the general principles, purposes, and procedures for processing personal data (hereinafter referred to as PD), as well as information about the implemented measures for the protection of PD.
• This Policy applies to all employees of LLC “Hotel Onegin” (hereinafter referred to as the Operator), as well as to employees of third-party organizations interacting with the Operator based on relevant contracts, regulatory, legal, and organizational documents.
• This Policy comes into force from the moment of its approval and is valid indefinitely until it is replaced by a new Policy.
• Principles of processing personal data:
• The processing of personal data by the Operator is carried out in accordance with the following principles:
• Legality and fair basis for processing personal data. The Operator takes all necessary measures to comply with the requirements of legislation, does not process personal data in cases where such processing is not permitted by legislation, and does not use personal data to the detriment of the User.
• Processing only those personal data that correspond to the previously declared purposes of their processing. Compliance of the content and volume of processed personal data with the stated purposes of processing. Prevention of processing personal data that is incompatible with the purposes of collecting personal data, as well as excessive in relation to the stated purposes of their processing.
• The Operator processes personal data exclusively for the purposes of fulfilling contractual obligations to the User. Ensuring the accuracy, adequacy, and relevance of personal data concerning the purposes of processing personal data. The Operator takes all reasonable measures to maintain the relevance of the processed personal data, including, but not limited to, the implementation of the right of each Subject to access their personal data and request the Operator to clarify, block, or destroy them in cases where the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purposes of processing.
• Storage of personal data in a form that allows identifying the User of personal data no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by legislation, contract, or by the party to which the User of personal data is a beneficiary. For clients, contractors, and counterparties, the period is determined by the achievement of the goals of the concluded contract.
• Prohibition of combining databases created for incompatible purposes in the information systems of personal data.
• Data collection forms:
• Online forms. They contain control elements (lists, switches, buttons, checkboxes) that simplify data entry and modification.
• Printed forms. They have a standard structure and format, which facilitates the collection and organization of data.

3. Purposes of collecting PD

The Operator processes PD exclusively for the following purposes:

• Ensuring personnel work and accounting; establishing labor relations with employees. (the following PD is processed: last name, first name, patronymic, month of birth, place of birth, social status, income, date of birth, marital status, residential address, identity document data, TIN, phone number, SNILS, citizenship, gender, education information, bank card details).
• Ensuring the conditions of labor established by the legislation of the Russian Federation. (the following PD is processed: last name, first name, patronymic, month of birth, place of birth, income, date of birth, marital status, residential address, identity document data, TIN, phone number, SNILS, citizenship, gender, education information, bank card details).
• Compliance with the requirements of the Labor Code of the Russian Federation (the following PD is processed: last name, first name, patronymic, month of birth, place of birth, income, date of birth, marital status, residential address, identity document data, TIN, phone number, SNILS, citizenship, gender, education information, bank card details);
• Compliance with tax legislation in connection with the calculation and payment of personal income tax, as well as the unified social tax. (the following PD is processed: last name, first name, patronymic, date of birth, residential address, identity document data, TIN, SNILS, bank card details);
• Compliance with pension legislation when forming and submitting personalized data about each income recipient considered when calculating insurance contributions for mandatory pension insurance and ensuring payments according to the requirements of Russian legislation (the following PD is processed: last name, first name, patronymic, date of birth, residential address, identity document data, TIN, SNILS, bank card details).
• Performing the functions of the employer (the following PD is processed: last name, first name, patronymic, date of birth, residential address, identity document data, TIN, SNILS, bank card details).
• Recruitment (selection of candidates for vacant positions), compliance with regulatory legal acts of the Russian Federation, local acts; establishing communication with the subject; sending letters, responses to the subject; ensuring a personnel reserve, assisting in employment, assisting in choosing a suitable position, (the following PD is processed: last name, first name, patronymic, month of birth, place of birth, social status, income, date of birth, marital status, residential address, identity document data, TIN, phone number, SNILS, citizenship, gender, education information, bank card details).
• Interaction with the Operator through the website; booking rooms.
• To provide services to the client, to fulfill contractual obligations (the following PD is processed: last name, first name, patronymic, date of birth, residential address, identity document data, TIN, phone number, citizenship, gender, bank card details, email, social media username (in case the user is authorized through social media accounts).

The confidentiality of personal data and other User Data is maintained, except in cases where the specified data is publicly available.

The Operator has the right to keep an archival copy of personal data and other Data, including after the deletion of the User’s account.

The Operator does not disclose personal data to third parties and does not distribute personal data without the consent of the Subject of personal data, unless otherwise provided by federal laws. The Operator has the right to transfer personal data and other User Data without the consent of the User to the following persons:

• State authorities, including law enforcement and investigative authorities, and local government bodies upon their motivated request.
• Social fund, tax authorities – for the purpose of maintaining tax accounting, accounting, and compliance with pension legislation.
• Partners of the Operator for the purpose of fulfilling contractual obligations to the User, sending newsletters, sending SMS notifications.
• In other cases, directly provided for by current legislation.

The Operator has the right to transfer personal data and other Data to third parties not specified in paragraph 3.4. of this Policy in the following cases:

• The User has expressed consent to such actions.
• The transfer is necessary within the framework of the activities of the individual entrepreneur.

Access to information systems containing personal data is provided by a password system. Passwords are set by authorized employees of the Operator and communicated individually to the employees of the Operator who have access to personal data/Data; additionally, an antivirus system is used for information carriers that are accessible to a limited circle of persons. The internal information systems of the Operator are protected from leakage and intrusion by third parties and are stored in a locked cabinet at the Operator’s premises.

Upon receiving a request from the Operator for personal data containing the withdrawal of the subject’s consent to the processing of personal data, the Operator is obliged to delete personal data within 30 (thirty) calendar days from the moment of receipt. In this case, the Operator has the right to request from the subject of personal data the following information (documents):

• a handwritten signed document (its scanned copy) containing the withdrawal of consent to the processing of personal data;
• Full name;
• Data of the identity document
• Email

4. Legal grounds for processing personal data

The operator processes personal data in accordance with the following regulatory and legal acts:

• Consent to the processing of employees’ personal data,
• Consent to the processing of hotel guests’ personal data,
• Consent to the processing of job applicants’ personal data,
• Paragraph 28 of the Government Resolution of the Russian Federation dated 15.01.2007 No. 9 “On the procedure for migration registration of foreign citizens and stateless persons in the Russian Federation.”
• Articles 23, 24 of the Constitution of the Russian Federation;
• Labor Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Federal Law dated 15.12.2001 No. 167-FZ “On mandatory pension insurance in the Russian Federation”;
• Articles 15 and 36.19 of the Federal Law dated 07.05.1998 No. 75-FZ “On non-state pension funds”;
• Federal Law dated 29.12.2006 No. 255-FZ “On mandatory social insurance in case of temporary disability and in connection with maternity”;
• Article 8 of the Federal Law dated 31.05.1996 No. 61-FZ “On Defense”;
• Article 9 of the Federal Law dated 26.02.1997 No. 31-FZ “On mobilization preparation and mobilization in the Russian Federation”;
• Government Resolution of the Russian Federation dated
• 09.10.2015 No. 1085 (as amended on 30.11.2018) “On approval of the Rules for providing hotel services in the Russian Federation”; Federal Law dated 29.11.2010 No. 326-FZ “On mandatory medical insurance in the Russian Federation”;
• Articles 13, Articles 92–94 of the Federal Law dated 21.11.2011 No. 323-FZ “On the fundamentals of health protection of citizens in the Russian Federation”;
• Commercial contracts (Service Agreement (registration card);
• Charter of LLC “Hotel Onegin.”

5. Regulations on the organization and processing of personal data. Volume and categories of processed personal data, categories of personal data subjects

The operator processes the following categories of personal data:

Category of personal data subjects	Category of processed personal data	Volume of processed personal data
Employees, former employees	OTHER categories	Less than 100,000 subjects
Candidates for vacant positions	OTHER categories	Less than 100,000 subjects
Website visitors	OTHER categories	Less than 100,000 subjects
Clients	OTHER categories	More than 100,000 subjects

6. Procedure and conditions for processing personal data

Processing of personal data is carried out on a lawful and fair basis.

Processing of personal data is limited to achieving specific, predetermined, and lawful purposes. Processing of personal data incompatible with the purposes of collection is not permitted.

Combining databases containing personal data, the processing of which is carried out for incompatible purposes, is not allowed.

Only personal data that meets the purposes of their processing shall be processed.

The content and volume of processed personal data correspond to the stated purposes of processing and are not excessive in relation to the stated purposes of their processing.

When processing personal data, accuracy, sufficiency, and, where necessary, relevance to the purposes of processing personal data are ensured. Necessary measures are taken to delete or clarify incomplete or inaccurate data.

For the purposes of information support of the Operator, publicly available sources of personal data of the Operator may be created (including directories, electronic databases, pages of the Operator’s website in the information and telecommunications network “Internet”). Only personal data specified by the personal data subject in the written consent to include their personal data in publicly available sources may be included.

For statistical purposes and analysis of the website’s operation, the Operator processes data such as IP address, browser information, data from cookies using the Yandex.Metrica metric service.

In case of refusal to process cookies, the User must stop using the website or disable the use of cookies in the browser settings; some functions of the website may become unavailable.

Some cookies may be stored only with the consent of the personal data subject. Additionally, when the personal data subject first visits the Operator’s website, permission is requested to save cookies.

Storage of personal data is carried out in a form that allows identifying the personal data subject, no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by federal law, contract, or by the party to which the personal data subject is a beneficiary or guarantor. Processed personal data shall be destroyed or anonymized upon achieving the purposes of processing or in case of loss of necessity to achieve these purposes, unless otherwise provided by federal law.

7. Conditions and terms for termination of processing personal data

The operator terminates the processing of personal data in the following cases:

• achievement of the purposes of processing personal data or maximum storage periods – within 30 days;
• loss of necessity to achieve the purposes of processing personal data – within 30 days;
• provision by the personal data subject or their legal representative of information confirming that the personal data was obtained unlawfully or is not necessary for the stated purpose of processing – within 7 days;
• inability to ensure the legality of processing personal data – within 10 days;
• withdrawal by the personal data subject of consent to process personal data, if the retention of personal data is no longer required for the purposes of processing personal data – within 30 days;

In accordance with Article 21, Part 5 of the Federal Law dated July 27, 2006 No. 152-FZ “On Personal Data,” the Operator does not terminate the processing of personal data of the Subject and does not destroy them in the following cases:

• unless otherwise provided by the contract, of which the Subject is a party, beneficiary, or guarantor;
• The Operator has the right to process personal data without the consent of the Subject on the grounds provided by federal laws;
• the terms for processing the personal data of the Subject established by federal laws of the Russian Federation and other regulatory acts have not expired.

8. Measures to ensure the security of personal data

The security of personal data processed by the Operator is ensured by implementing legal, organizational, technical, and software measures necessary and sufficient to meet the requirements of legislation in the field of personal data protection.

The Operator takes necessary organizational and technical measures to ensure the security of personal data from accidental or unauthorized access, destruction, alteration, blocking access, and other unauthorized actions.

The Operator takes the following organizational and technical measures:

• appointment of officials responsible for organizing processing and ensuring the security of personal data;
• limiting and regulating the composition of employees of the Operator who have access to personal data;
• familiarization of employees of the Operator with the requirements of federal legislation and local regulatory acts on processing and protecting personal data;
• ensuring accounting and storage of physical carriers of personal data and their circulation, excluding theft, substitution, unauthorized copying, and destruction;
• identification of threats to the security of personal data during their processing in information systems of personal data (hereinafter – ISPD), formation of threat models based on them;
• development of a protection system for personal data based on the threat model for the corresponding level of security of personal data during their processing in ISPD;
• checking the readiness and effectiveness of the use of information protection means;
• implementation of a permission system for user access to ISPD information resources, software and hardware means of processing and protecting information;
• registration and accounting of user actions in ISPD;
• password protection of user access to ISPD;
• use of cryptographic protection means for ensuring the security of personal data when transmitted over open communication channels, where necessary;
• implementation of antivirus control, prevention of the introduction of malicious programs (viruses) and software backdoors into the corporate network;
• use of firewall means where necessary;
• use of intrusion detection means in the corporate network, which violate or create prerequisites for violating established requirements for ensuring the security of personal data, where necessary;
• training of employees of the Operator using information protection means applied in ISPD on the rules of working with them;
• accounting of applied information protection means, operational and technical documentation for them;
• use of information protection means that have undergone the established conformity assessment procedure where necessary;
• monitoring user actions in ISPD, conducting investigations into violations of personal data security requirements;
• placement of technical means for processing personal data within the protected area;
• maintenance of technical security means, alarm systems in a state of constant readiness.

9. Rights of Personal Data Subjects

The data subject has the right to receive information regarding the processing of their personal data, including information that contains:

• confirmation of the fact of processing of personal data by the Operator;
• the legal grounds and purposes of processing personal data;
• the purposes and methods of processing personal data used by the Operator;
• the name and location of the Operator, information about individuals (excluding the Operator’s employees) who have access to personal data or to whom personal data may be disclosed based on a contract with the Operator or federal law;
• the personal data processed that relate to the relevant data subject, the source of their acquisition, unless another method of providing such data is provided by federal law;
• the procedure for exercising the rights of the data subject provided for by the Federal Law “On Personal Data”;
• порядок осуществления субъектом ПДн прав, предусмотренных Федеральным законом «О персональных данных»;
• information about the completed or anticipated cross-border transfer of personal data;
• the name or surname, first name, patronymic, and address of the person processing personal data on behalf of the Operator, if the processing has been or will be entrusted to such a person;
• other information provided for by the Federal Law “On Personal Data” or other federal laws.

The data subject has the right to demand that the Operator clarify their personal data, block or destroy it in case the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, as well as to take legal measures to protect their rights.

If the data subject believes that the Operator is processing their personal data in violation of the requirements of the Federal Law “On Personal Data” or otherwise violating their rights and freedoms, the data subject has the right to appeal the actions or inaction of the Operator to a higher authority for the protection of the rights of data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media – Roskomnadzor) or in court.

The data subject has the right to protect their rights and legitimate interests, including the right to compensation for damages and/or moral harm in court.

10. Scope and Categories of Processed Personal Data, Categories of Personal Data Subjects.

Other rights and obligations of the Operator are defined by the Federal Law “On Personal Data” and other regulatory legal acts in the field of personal data protection.

The list, categories, and volume of personal data processed by the Operator are determined in accordance with the legislation of the Russian Federation, local regulatory acts of the Operator, and documents prepared on their basis separately for each process related to the processing of personal data, taking into account the purposes indicated in Section 3.