Policy on personal data processing of the All-Russian NGO "Russian Geographical Society" – the RGS

1.1. The Policy of the All-Russian NGO "Russian Geographical Society" on personal data processing has been developed in accordance with the requirements of Part 2 of Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data" and is intended to provide unrestricted access to information regarding the processing of personal data, as well as to information about the requirements being implemented to protect personal data at the All-Russian NGO "Russian Geographical Society".

1.2. This Policy describes the procedure for processing and protecting personal data of individuals in connection with the implementation of employment relationship, the conclusion of contracts, and the fulfillment of contractual obligations of the All-Russian NGO "Russian Geographical Society", the implementation of the statutory activities of the organization.

1.3. Personal data belongs to the category of confidential information and is protected from unauthorized, including accidental, access to it.

1) personal data is any information relating directly or indirectly to a specific or identifiable natural person (subject of personal data);

2) operator is a state body, municipal body, legal entity or individual who independently or jointly with other persons organizes and/or process personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;

3) personal data processing is any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;

4) automated personal data processing is processing of personal data using computer technology;

5) dissemination of personal data is actions aimed at disclosing personal data to an unspecified group of persons;

6) provision of personal data is actions aimed at disclosure of personal data to a certain person or a certain circle of persons;

7) blocking of personal data is temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data);

8) destruction of personal data is actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the material carriers of personal data are destroyed;

9) depersonalization of personal data is actions as a result of which it becomes impossible to determine the ownership of personal data by a specific personal data subject without using additional information;

10) personal data information system is a set of personal data contained in databases and information technologies and technical means that ensure their processing;

11) transborder transfer of personal data is the transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.

3.1. The processing of personal data at the All-Russian NGO "Russian Geographical Society" is based on the following principles:

— the existence of legitimate grounds for the processing of personal data; the processing of personal data is limited by achieving specific, predetermined, and legitimate goals;

— preventing the consolidation of databases containing personal data, the processing of which is carried out for incompatible purposes;

— processing only those personal data that meet the purposes of their processing; compliance of the content and volume (avoiding redundancy) of the processed personal data with the stated purposes of processing;

— ensuring the accuracy of personal data, their sufficiency, and, if necessary, their relevance to the purposes of personal data processing;

— personal data is stored in a form that makes it possible to identify the subject of personal data for no longer than the purposes of personal data processing require, unless the period of personal data storage is established by the legislation of the Russian Federation, an agreement to which the personal data subject is a party, beneficiary or guarantor.

3.2. Personal data processing at the All-Russian NGO "Russian Geographical Society" may be carried out in the following cases:

— the subject's consent to the processing of their personal data has been obtained;

— the processing of personal data is necessary for the implementation and fulfillment of the functions, powers, and duties assigned to the operator by the legislation of the Russian Federation;

— personal data is processed in connection with the personal data subject's participation in civil and arbitration proceedings;

— the processing of personal data is necessary for the execution of a judicial act in accordance with the legislation of the Russian Federation on enforcement proceedings;

— the processing of personal data is necessary for the performance of a contract to which the personal data subject is a party or beneficiary or guarantor, as well as for the conclusion of a contract on the initiative of the personal data subject;

— the processing of personal data is necessary to protect the life, health or other vital interests of the personal data subject, if it is impossible to obtain the consent of the personal data subject;

— the processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant goals, provided that the rights and freedoms of the subject are not violated.;

— personal data is processed for statistical or other research purposes, subject to mandatory depersonalization of personal data;

— personal data that is being processed is subject to publication or mandatory disclosure in accordance with the legislation of the Russian Federation.

4.1. In order to comply with the requirements of the legislation of the Russian Federation in the field of personnel records, including assistance to employees in finding employment, obtaining education and promotion, ensuring the personal safety of employees, monitoring the quantity and quality of work performed, and ensuring the safety of property, payment of wages and other payments due to the employee in accordance with the legislation of the Russian Federation or the contract, implementation of tax and social deductions provided for by the legislation of the Russian Federation, the All-Russian NGO "Russian Geographical Society" processes personal data of employees:

1) Last name, first name, patronymic, sex;

2) Date and place of birth;

3) Information about citizenship;

4) Information about education;

5) Profession, qualification, position;

6) Marital status, family composition;

7) Passport data;

8) Address, phone number;

9) Information about military registration;

10) Information about awards, promotions, and honorary titles;

11) Information about social status;

12) Pension, medical insurance, INN, and SNILS data;

13) Income, deductions;

14) Vacation information;

15) Bank details;

16) Photograph.

The basis for processing personal data is the Labor Code of the Russian Federation; the Tax Code of the Russian Federation; Federal Law No. 27-FZ dated April 1, 1996 "On Individual (Personalized) Accounting in the Compulsory Pension Insurance System"; Federal Law No. 402-FZ dated 06/12/2011 "On Accounting"; Federal Law No. 53-FZ dated 28/03/1998 "On Military Duty and Military Service"; Contract; Consent of the subject.

The processing of information on the health status of employees is carried out in individual cases in accordance with the legislation of the Russian Federation on state social assistance, labor legislation, and pension legislation of the Russian Federation.

Personal data is processed using automation tools or without the use of such tools.

The period of processing personal data is limited to achieving the stated goal. The storage period of personal data is 75 years EPK from the date of termination of the employment relationship. The destruction of personal data is carried out within the time limits established by law after the expiration of the storage period or upon the occurrence of other legal grounds.

4.2. In order to comply with the requirements of the legislation of the Russian Federation in the field of personnel records, the All-Russian NGO "Russian Geographical Society" processes personal data of close relatives of employees:

1) Last name, first name, patronymic;

2) Degree of kinship;

3) Year of birth.

The basis for processing personal data is the Labor Code of the Russian Federation.

Personal data is processed using automation tools or without the use of such tools.

The period of processing personal data is limited to achieving the stated goal. The storage period of personal data is 75 years EPK from the date of termination of the employment relationship with the employee. The destruction of personal data is carried out within the time limits established by law after the expiration of the storage period or upon the occurrence of other legal grounds.

4.3. In order to carry out personnel selection, including selection for vacant positions; maintaining a personnel reserve; and employing those who have successfully been selected to fill vacant positions, the All-Russian NGO “Russian Geographical Society” processes the personal data of applicants for vacant positions:

1) Last name, first name, patronymic, sex;

2) Date and place of birth;

3) Information about citizenship;

4) Information about education;

5) Profession, qualification, position;

6) Information about employment;

7) Marital status, family composition;

8) Passport data;

9) Address, phone number;

10) Information about military registration;

11) Information about awards, promotions, and honorary titles;

12) Information about social status;

13) Pension, medical insurance, INN, and SNILS data.

The basis for processing personal data is the Labor Code of the Russian Federation; Consent of the subject.

Personal data is processed using automation tools or without the use of such tools.

The period of processing personal data is limited to achieving the stated goal. The retention period for personal data of applicants included in the personnel reserve is 5 years (if included in the personnel reserve) from the date of the relevant decision. The destruction of personal data is carried out within the time limits established by law after the expiration of the retention period, upon receipt of the withdrawal of the subject's consent, or upon the occurrence of other legal grounds.

4.4. In order to comply with the requirements of the legislation of the Russian Federation in the field of tax and accounting, including making settlements with personal data subjects; processing primary accounting documents; and exercising due diligence, the All-Russian NGO “Russian Geographical Society” processes the personal data of counterparties and their representatives.:

1) Last name, first name, patronymic;

2) Date and place of birth;

3) Address;

4) Passport data;

5) Contact information (phone, e-mail);

6) Pension, medical insurance, INN, OGRN data (for individual entrepreneurs);

7) Bank details.

The basis for processing personal data is the Tax Code of the Russian Federation; Federal Law No. 402-FZ dated 06/12/2011 "On Accounting"; Contract; Consent of the subject.

Personal data is processed using automation tools or without the use of such tools.

The period of processing personal data is limited to achieving the stated goal. The retention period for personal data of applicants included in the personnel reserve is 5 years (if included in the personnel reserve) from the date of the relevant decision. The destruction of personal data is carried out within the time limits established by law after the expiration of the retention period, upon receipt of the withdrawal of the subject's consent, or upon the occurrence of other legal grounds.

4.5. In order to carry out the activities stipulated by the Charter of the All-Russian NGO "Russian Geographical Society", including to solve the issues of forming, supporting, and directing public initiatives for a comprehensive study of the geographical, ethnocultural, and historical identity of Russia for a more complete and in-depth understanding of its role and place in the modern world; stimulating and organizing the active participation of society in environmental protection, the formation of a responsible attitude to the environment; preservation, use, and popularization of the geographical, historical, and cultural heritage of Russia as a matter of national pride, preservation, and enhancement of the traditions of the Russian Geographical Society; obtaining, analyzing, and distributing reliable global and national geographical, ecological, ethnographic, and statistical information in Russia and abroad; promoting the development of geography and related sciences about nature and society, scientific creativity, dissemination and practical implementation of the achievements of Russian science; assistance in improving the quality of geographical and environmental education; assistance in preserving the natural and cultural heritage of Russia, organizing educational tourism in Russia, the All-Russian NGO "Russian Geographical Society" processes personal data of members of the non-governmental organization, participants in events, and users of services:

1) Last name, first name, patronymic;

2) Photograph;

3) Date of birth;

4) Place of birth;

5) The registration address and the actual place of residence;

6) Data of the document certifying the identity (series, number, issued by whom and when, subdivision code);

7) Citizenship;

8) Contact information (phone number, email address, etc.);

9) Place of work, position, field of activity.

The basis for processing personal data is Federal Law No. 82-FZ dated May 19, 1995 "On Public Associations", Application for membership in the All-Russian NGO "Russian Geographical Society", Consent of the subject.

Personal data is processed using automation tools or without the use of such tools.

The period of processing personal data is limited to achieving the stated goal. In case of loss of the need to achieve the stated goal, personal data shall be destroyed. The destruction of personal data is carried out within the time limits established by law upon the loss of the Society membership or upon receipt of the withdrawal of the subject's consent or upon the occurrence of other legal grounds.

5.1. Personal data is collected directly from the personal data subject themselves. If the provision of personal data and/or consent to the processing of personal data by the operator is mandatory in accordance with the legislation of the Russian Federation, the legal consequences of refusal to provide such data and/or consent to their processing are explained to the personal data subject.

5.2. Obtaining personal data from other persons is possible only if there are legitimate grounds. When receiving personal data from other persons, except in cases when personal data was obtained as part of an order for processing personal data or when consent was obtained by the transferring party, it is necessary to notify the subject about this.

5.3. When collecting personal data, including through the information and telecommunications network “Internet”, recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation is ensured.

6.1. When processing personal data at the All-Russian NGO "Russian Geographical Society", the following actions are performed: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), blocking, deletion, destruction.

6.2. The processing of personal data may be entrusted to a third party with the consent of the personal data subject or on the grounds provided for by the legislation of the Russian Federation. A person tasked with the processing personal data is not required to obtain the subject's consent to process their personal data.

6.3. In case of confirmation of the inaccuracy of personal data, such personal data must be updated within seven working days.

6.4. If the fact of illegality of personal data processing is revealed, such personal data must be destroyed within three days.

7.1. Personal data is stored in a form that makes it possible to identify the subject of personal data, no longer than the purposes of personal data processing require, unless the period of personal data storage is established by the legislation of the Russian Federation or by an agreement to which the subject of personal data is a party.

7.2. Personal data is stored ensuring their confidentiality.

7.3. Personal data is transferred for archival storage in accordance with the legislation of the Russian Federation on archival affairs, destroyed or depersonalized upon achievement of the processing objectives or in case of loss of the need to achieve these objectives, unless otherwise provided by the legislation of the Russian Federation or by an agreement to which the personal data subject is a party.

8.1. The transfer of personal data to a third party is carried out only with the consent of the personal data subject or in cases expressly provided for by the legislation of the Russian Federation.

8.2. The transfer of personal data to a state authority, a local government authority, a security and law enforcement agency, a state institution and a foundation, as well as to another authorized body is permitted on the grounds provided for by the legislation of the Russian Federation.

8.3. Disclosure of personal data to a third party without the consent of the relevant subject is not allowed, except in cases where it is necessary to protect the life, health or other vital interests of the personal data subject.

8.4. Disclosure of personal data to a third party for commercial purposes without the consent of the relevant subject is prohibited. The processing of personal data for the purpose of promoting goods, works, and services on the market, as well as for political campaigning purposes, is carried out only with the prior consent of the subject.

8.5. There is no transborder transfer of personal data on the territory of foreign states.

9.1. The processing of personal data authorized by the personal data subject for dissemination is carried out in compliance with the requirements provided for by the legislation of the Russian Federation on personal data.

9.2. The subject consents to the processing of personal data authorized for dissemination, separately from other consents of the personal data subject to the processing of their personal data.

9.3. If their personal data is disclosed by the subjects themselves to an unspecified group of persons using the functionality of the Website or the service of the All-Russian NGO "Russian Geographical Society" without providing appropriate consent, further dissemination by other operators of personal data is possible only on the basis of the consent of the relevant subject to the processing of personal data authorized for distribution.

9.4. In consent to the processing of personal data authorized by the personal data subject for dissemination, the personal data subject has the right to establish prohibitions on the transfer (other than granting access) of this personal data by the operator to an unlimited number of persons, as well as prohibitions on processing or conditions for processing (other than gaining access) of this personal data by an unlimited number of persons.

10.1. If the purpose of personal data processing is achieved, the processing of such personal data must be terminated, and the personal data must be destroyed within thirty days from the date of achievement of the purpose of personal data processing, unless otherwise provided by an agreement to which the personal data subject is a party, beneficiary or guarantor, or by another agreement between the operator and the personal data subject, or if the operator has no right to process personal data without the consent of the personal data subject on the grounds provided for by the legislation of the Russian Federation.

10.2. If the subject withdraws consent to the processing of their personal data, the processing of such personal data must be terminated, and if the storage of personal data is no longer required for the purposes of personal data processing, such personal data must be destroyed within thirty days from the date of receipt of the said withdrawal, unless otherwise provided by the contract the party to which, the beneficiary or the guarantor of which is the subject of personal data, by any other agreement between the operator and the personal data subject, or if the operator has no right to process personal data without the consent of the personal data subject on the grounds provided for by the legislation of the Russian Federation.

10.3. In case of detection of unlawful processing of personal data, the processing of such personal data must be terminated within three working days. If it is impossible to ensure the legality of the processing of personal data, personal data must be destroyed within two hundred working days from the date of detection of unlawful processing.

10.4. If it is not possible to destroy personal data within the period specified in paragraphs 10.1-10.3, such personal data must be blocked and destroyed within a period of no more than six months, unless another period is established by the legislation of the Russian Federation.

11.1. The right of access to personal data processed at the All-Russian NGO "Russian Geographical Society" is granted to:

— Executive Director of the All-Russian NGO "Russian Geographical Society";

— employees at the All-Russian NGO "Russian Geographical Society", for whom the processing of personal data is necessary in connection with the performance of their official duties;

— third parties who process personal data on behalf of the All-Russian NGO "Russian Geographical Society", on the basis of a contract (assignment) concluded with this person.

11.2. The access of employees at the All-Russian NGO "Russian Geographical Society" to personal data is granted by the management in a separate internal act.

12.1. Any subject whose personal data is processed at the All-Russian NGO "Russian Geographical Society" has the right to access their personal data, including the following information:

— confirmation of the processing of personal data;

— legal grounds and purposes of personal data processing;

— purposes and methods of personal data processing used;

— the name and location of the operator, information about persons (with the exception of the operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the operator or on the basis of the legislation of the Russian Federation;

— a list of processed personal data related to the relevant subject, and the source of their receipt;

— terms of personal data processing and storage periods;

— the procedure for the exercise by the subject of the rights provided for by the legislation of the Russian Federation;

— information about the transborder data transfer that has been carried out or is expected to be carried out;

— the name of the person who processes personal data on behalf of the operator, if the processing is entrusted to a third party;

— information on how the operator performs the duties established by Article 18.1 of Federal Law No. 152-FZ "On Personal Data".

12.2. The All-Russian NGO "Russian Geographical Society" provides the information specified in clause 12.1 within ten working days from the date of receipt of the request from the subject or their legal representative in the form in which the relevant request was received (unless otherwise specified in the request). The response to the request should not contain personal data related to other subjects of personal data, except in cases where there are legitimate grounds for the disclosure of such personal data. The deadline for responding to a request may be extended, but not more than five working days if the operator sends a reasoned notification to the subject, indicating the reasons for extending the deadline for providing the requested information.

12.3. The request of the subject or their representative must contain:

— the number of the main document certifying the identity of the subject or their representative;

— information about the date of issue of the specified document and the issuing authority;

— information about the date of issue of the specified document and the issuing authority;

— information confirming the subject's participation in relations with the All-Russian NGO "Russian Geographical Society" (contract number, date of conclusion of the contract, or other information), or information otherwise confirming the processing of personal data by the All-Russian NGO "Russian Geographical Society";

— the signature of the personal data subject or their representative.

12.4. The subject has the right to re-apply to the All-Russian NGO "Russian Geographical Society" with a request for the information specified in clause 12.1, no earlier than thirty days after the initial request or sending the initial request.

12.5. The subject has the right to request clarification of their personal data, their blocking or destruction in the event that the personal data processed at the All-Russian NGO "Russian Geographical Society" is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing by the All-Russian NGO "Russian Geographical Society".

12.6. The subject has the right to withdraw their consent to the processing of personal data, if such consent has been given. The withdrawal of consent is sent by the subject to the address of the All-Russian NGO "Russian Geographical Society" and must contain the information specified in clause 12.3. In case of withdrawal of the subject's consent to the processing of personal data, the All-Russian NGO "Russian Geographical Society" has the right to continue processing personal data without the subject's consent, provided there are grounds provided for by the legislation of the Russian Federation or an agreement to which the personal data subject is a party, beneficiary or guarantor.

13.1. In order for the All-Russian NGO “Russian Geographical Society” to fulfill the obligations stipulated by the legislation of the Russian Federation on personal data, the following measures are taken:

— appointment of a person responsible for organizing the processing of personal data;

— publication of documents defining personal data processing policy, local acts on personal data processing, as well as local acts establishing procedures aimed at preventing and detecting violations of the legislation of the Russian Federation and eliminating the consequences of such violations;

— the application of legal, organizational, and technical measures to ensure the security of personal data;

— implementation of internal control over the compliance of personal data processing with the requirements of the legislation of the Russian Federation;

— assessment of the harm that may be caused to personal data subjects in case of violation of the legislation of the Russian Federation;

— familiarization of the employees at the All-Russian NGO “Russian Geographical Society” with the provisions of the legislation of the Russian Federation and local acts of the All-Russian NGO “Russian Geographical Society”.

13.2. In case of detection of the fact of unlawful or accidental transfer (provision, dissemination, access) of personal data, which has resulted in violation of the rights of personal data subjects, the All-Russian NGO "Russian Geographical Society" notifies Roskomnadzor:

— within 24 hours of the identification of the incident, the alleged causes that led to the violation of the rights of personal data subjects, and the alleged harm caused to the rights of personal data subjects, the measures taken to eliminate the consequences of the incident, including information about the person authorized to interact on issues related to the identified incident.;

— within 72 hours from the moment of revealing the results of the internal investigation of the incident, as well as the persons whose actions caused the incident (if there are any).

14.1. When processing personal data, the necessary legal, organizational, and technical measures are taken to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions with respect to personal data.

14.2. In order to ensure the security of personal data, the following activities are carried out at the All-Russian NGO "Russian Geographical Society":

— identification of threats to the security of personal data during their processing in information systems;

— the application of organizational and technical measures to ensure the security of personal data during their processing in information systems that ensure compliance with the requirements for established levels of security;

— assessment of the effectiveness of measures taken to ensure the security of personal data processed in personal data information systems;

— accounting of machine-readable personal data mediums;

— detection of unauthorized access to personal data and response to these incidents;

— recovery of personal data modified or destroyed due to unauthorized access to them;

— establishment of rules for access to personal data processed in personal data information systems;

— registration and accounting of actions performed with personal data in personal data information systems;

— control over the measures taken to ensure the security of personal data in accordance with the established level of personal data security.

For violation of the requirements established by the legislation of the Russian Federation, the Regulation on the Processing and Protection of Personal Data, and other local acts of the All-Russian NGO "Russian Geographical Society", employees and other persons who have gained access to personal data are subject to disciplinary, administrative, civil, and criminal liability in accordance with the Federal Laws of the Russian Federation.

16.1. The access to this policy is provided to all interested parties, including subjects of personal data and authorities performing control and supervisory functions in the field of personal data.

16.2. This Policy comes into force from the moment of its approval and is valid indefinitely. Changes to the Policy are introduced by separate acts of the All-Russian NGO "Russian Geographical Society". The current version of the Policy, as well as notifications of Policy changes, are posted on the official website of the All-Russian NGO "Russian Geographical Society".

Name: All-Russian non-governmental organization "Russian Geographical Society".

Abbreviated name: All-Russian NGO "Russian Geographical Society".

INN: 7812011023.

KPP: 783801001.

OGRN: 1037858010970.

Legal address: 190031, St. Petersburg, Pereulok Grivtsova, 10A

Mailing address for requests: Moscow, Novaya Ploshchad, 10, Stroenie 2.