1. General conditions
1.2. The policy was developed in order to implement the requirements of legislation in the field of processing and ensuring the security of personal data and is aimed at protecting the rights and liberties of man and citizen when processing their personal data by the company.
1.3. The policy sets:
- purposes of personal data processing;
- classification of personal data and the subjects of personal data;
- General principles of personal data processing;
- the main participants of the personal data processing management system;
- the main approaches to the system of the processing of personal data.
1.4.List of terms and definitions.
- Company (operator of personal data processing) – QForm company (Self-employed Person Zuev, A.O., TIN 560504932981) that processes personal data, as well as determines the purpose of processing personal data, the composition of personal data to be processed, and actions performed with personal data.
- Personal data - any information related directly or indirectly to a specific individual (subject of personal data);
- Processing of personal data – any action (operation) of the Company or a set of actions (operations), performed using automation tools or without using such tools, with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access) to third parties, depersonalization, blocking, deletion and destruction of personal data;
- Automated processing of personal data - processing of personal data using computer technology;
- Distribution of personal data– actions aimed at disclosure of personal data to third parties with whom the operator has a contractual relationship;
- A personal data subject - an individual who is directly or indirectly identified using personal data.
2. Purposes of personal data processing.
2.1. The company processes personal data for the purpose of:
- conclusion of any agreements with the subject of personal data and fulfillment of contractual obligations in order to carry out permitted economic activities provided in the registration documents;
- providing the personal data subject with information about products, services and events posted on third-party websites with which the company has a contractual relationship;
- fulfillment of the company's obligations within the framework of the services provided on the basis of concluded agreements (fulfillment of contractual obligations);
- technical administration of site pages;
- managing the client base;
- making payments to customers;
- handling of complaints, applications of citizens;
- sending of notifications, emails about promotions, provided services/works, etc.
3. Classification of personal data and of personal data subjects.
3.1. Personal data refers to any information related directly or indirectly to a specific individual (the subject of personal data) processed by the company in order to achieve predetermined goals.
3.2. The company does not process any special categories of personal data related to race and nationality, political views, religious and philosophical beliefs, intimate life, criminal records of individuals, unless otherwise established by the legislation of the Russian Federation.
3.3. The company processes personal data of the following categories of personal data subjects:
individuals who have purchased or intend to purchase services on their own behalf or on behalf of legal entities provided by the Company, services of third parties with whom the Company has a contractual relationship;
other individuals who have expressed their consent to processing by the Company of their personal data.
4. General principles of personal data processing
4.1. The company processes personal data on the basis of general principles:
- legality of pre-defined specific purposes and methods of processing personal data;
- ensuring proper protection of personal data;
- compliance of the purposes of personal data processing with the goals previously defined and declared when collecting personal data;
- compliance of the volume, nature and methods of personal data processing with the purposes of personal data processing;
- reliability of personal data, their sufficiency for processing purposes, inadmissibility of processing personal data that is excessive in relation to the purposes stated when collecting personal data;
- inadmissibility of combining databases containing personal data that are processed for purposes that are incompatible with each other;
- storage of personal data in a form that allows to identify the subject of personal data, no longer than the purpose of their processing requires;
- destruction or depersonalization of personal data after achieving the goals of their processing, if the period of storage of personal data is not established by the legislation of the Russian Federation, a contract to which the subject of personal data is a party;
- ensuring the confidentiality and security of personal data processed.
4.2. Within the confines of the processing of personal data:
4.2.1. The subject of personal data has the right to:
- receive information regarding the processing of their personal data in the manner, form, and time frame established by the Law for Personal Data Protection;
- request clarification of your personal data, its blocking or destroying if the personal data is incomplete, outdated, unreliable, illegally obtained, unnecessary for the declared purpose or is used for purposes that were not declared previously when the personal data subject gave consent to the processing of personal data;
- take legal measures to protect his rights;
- withdraw your consent to the processing of personal data. At the same time, the withdrawal of consent to the processing of personal data means the cancellation of services provided by the Company.
4.2.2. The company has the right to:
- process the personal data of the subject in accordance with the declared purpose;
- demand from the subject of personal data to provide reliable personal data necessary for the execution of contracts, provision of services, identification of the subject of personal data, as well as in other cases required by the Law on personal data;
- process publicly available personal data of individuals;
- entrust the processing of personal data to a third party with the consent of the personal data Subject;
- update or modify this agreement at any time. Continuing to use the Company's services after making changes and publishing them on the Company's website means that the personal data subject agrees to the processing of his personal data under the new conditions.
5. Organization of the personal data processing management system.
5.1. The processing of personal data of the subject is carried out with its consent to the processing of personal data, as well as without it in cases stipulated by the Law for Personal Data Protection. The consent is expressed through the site form (checkbox), by clicking it.
5.2. The company has the right to entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by the federal law. Such processing of personal data is carried out only on the basis of an agreement concluded between the Company and a third party, which must specify:
- list of actions (operations) with personal data that will be performed by a third party that processes personal data;
- purposes of personal data processing;
- obligations of the third party to respect the confidentiality of personal data and ensure their security during processing, as well as requirements for the protection of processed personal data.
5.3. The company transfers personal data to state authorities within their powers in accordance with the legislation of the Russian Federation.
5.4. The company is responsible to the personal data subject for the actions of the persons to whom the Company entrusts the processing of the personal data of the subject, to the extent that provided in the agreement between the Company and third parties.
5.5. Access to the processed personal data is provided only to those employees of the Company who need it in connection with the performance of their official duties and in compliance with the principles of personal responsibility.
5.6. Personal data processing is stopped when achieving goals of such processing, and at the termination of the period provided by law, the agreement or the consent of personal data subject to the processing of personal data.
5.7. The processing of personal data is carried out confidentially, which means the obligation not to disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation.
5.8. The company ensures the security of processed personal data within the framework of organizational, technical and legal measures for the protection of information constituting a trade secret, taking into account the requirements of the Law for Personal Data Protection and the legal acts adopted in accordance with it.
5.9. The company is not responsible for the use (both legal and illegal) by third parties of Information posted by the personal data subject on third party sites with which the operator does not have a contractual relationship, including its reproduction.
6. Final provision
6.1. The policy is publicly available and is subject to posting on the Company's official website https://app.qform.io.