1. GENERAL PROVISIONS
1.1 This Personal Data Processing Policy (hereinafter - the Policy) adopted by JSC "GC MELKOM" (OGRN 1236900001766, TIN 6950267331, legal address: Russia, 170100, Tver region, Tver, Vokzalnaya street, 9, floor 3, room/cabinet 4/31) (hereinafter - JSC "GC MELKOM"), defines the basic principles, objectives, procedure and conditions of processing of personal data of subjects, measures to ensure the security and protection of personal data.
1.2 This Policy is developed in accordance with the requirements of the Constitution of the Russian Federation, based on the requirements of the Federal Law of the Russian Federation dated July 27, 2006 № 152-FZ "On Personal Data" and other legislative and regulatory legal acts of the Russian Federation in the field of personal data and published for unrestricted access on the website of JSC "GC MELKOM" at the address: MELKOM.ru.
1.3 When processing personal data, JSC "GC MELKOM" proceeds from the need to ensure the protection of human and civil rights and freedoms in accordance with the requirements of the legislation of the Russian Federation, guarantees the observance of confidentiality in respect of the personal data received, taking into account the provisions of this Policy and undertakes to use them only for the purposes specified in the Policy.
1.4 Compliance with the Policy is the main condition for processing personal data and is mandatory for all employees of MELKOM Group JSC.
1.5 The Policy is aimed at ensuring the protection of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy, personal and family secrecy, defining the policy of JSC "SC MELKOM" as an operator in relation to the processing of personal data. The Policy regulates the relations of JSC "GC MELKOM" and citizens arising in connection with the processing of their personal data by JSC "GC MELKOM" with or without the use of means of automation.
2. TERMS AND DEFINITIONS, COMPOSITION OF PERSONAL DATA
2.1 The terms and definitions used in the Policy shall be interpreted in accordance with the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" (hereinafter - the Federal Law "On Personal Data") and other regulatory legal acts of the Russian Federation.
2.2 Personal data - any information relating to a directly or indirectly defined or identifiable natural person (subject of personal data) (hereinafter - PD).
Personal Data and their categories may differ in terms of the degree of definiteness and identifiability of the subject of Personal Data and depend on the actual possibility of identifying a specific person and citizen (subject) on their basis.
Data that does not determine the identity of a person or citizen, or does not allow to determine such identity even with the application of any procedures, is not personal data, and its processing is not related to the need to comply with the legislation of the Russian Federation on personal data. Such data may include such information as gender, age, position, occupation, profession, hobbies, etc., and information that appears due to the widespread penetration of the Internet into everyday life, as long as such information does not allow for the identification of a person and citizen.
2.3 Processing of personal data (hereinafter - processing of personal data) - any action (operation) or set of actions (operations) performed with or without the use of automation means with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
2.4 Operator is a state or municipal authority, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out processing of personal data, as well as determining the purposes of personal data processing, composition of personal data subject to processing, actions (operations) performed with personal data. For the purposes of the Policy, the operator is MELKOM Group JSC.
2.5 Data subjects are defined or identifiable (identifiable) natural persons. MELKOM Group JSC processes and protects personal data (including surname, name, patronymic, date of birth, place of work, profession, position, contact phone number, e-mail address, etc.) of customers and counterparties of MELKOM Group JSC, consumers of goods produced and supplied by MELKOM Group JSC. ) customers and counterparties of JSC "GC MELKOM", consumers of goods produced and supplied by JSC "GC MELKOM", participants of events organized by JSC "GC MELKOM", employees of counterparties, employees of potential counterparties, visitors to the website(s) of JSC "GC MELKOM", as well as personal data received at the address of the corporate mail of JSC "GC MELKOM" ending with @grotexmed. com (hereinafter referred to as "Corporate Mail"), subjects who have expressed their consent to the processing of personal data (hereinafter referred to as "Consent") by sending information through the selected forms on the pages of the Website, sending an e-mail, filling out the consent in writing. The moment of acceptance of the Consent is marking the appropriate field in the Form and clicking on the button for sending the Form on any page of the Website, as well as clicking on the button for sending an e-mail containing the subject's personal data to the Corporate Mail address, receiving the written consent.
2.6 During the use of the site of JSC "GK MELKOM", reading texts and downloading other information, there is an automatic registration of certain data about the computer from which the site visitor browses the site of JSC "GK MELKOM". When using the site, JSC "GC MELKOM" collects the following information:
date and time of visiting the site;
the number of visited pages, their names, as well as the duration of viewing;
IP-address assigned to the Internet access device;
type of browser and operating system;br
URL of the site from which the transition was made.
3. CONDITIONS AND PURPOSES OF PERSONAL DATA PROCESSING
3.1 JSC "GK MELKOM" processes personal data for the purpose of production of pharmaceutical products, chemical products, wholesale of pharmaceutical and medical products, trade and procurement and trade and intermediary activities, including in the foreign market, as well as in the domestic market, marketing analysis and research, marketing and advertising activities, research and development in the field of natural (chemical, biological, medical, pharmaceutical) sciences.
3.2 By receiving Personal Data from individuals specified in this Policy and starting their processing, MELKOM Group JSC becomes an operator. Processing of Personal Data shall be carried out by JSC "GC MELKOM" in compliance with the principles, conditions and rules stipulated by the legislation on Personal Data, as well as in accordance with this Policy in the following main cases:
3.2.1 Processing of personal data shall be carried out with the consent of the PD subject to the processing of his/her PD. In order to include any Personal Data in publicly available sources of Personal Data and/or to transfer Personal Data to third parties, it is necessary to obtain said consent in writing or in the form of an e-mail, or to obtain consent via the website. This includes, in particular, the processing of personal data:
participants of educational and scientific events held by or with its direct participation in order to take into account the number of participants, to analyze their professional interests, to ensure the current level of security in JSC "SC "SC "MELKOM", including the current admission regime and control of its observance, video surveillance and video recording on the territory and in the premises on/in which JSC "SC "MELKOM" is located; to provide information about the events held by JSC "SC "MELKOM", conducted research, implemented projects and their results managers, representatives, employees of organizations, legal entities - counterparties or potential counterparties under contracts, agreements and contracts (hereinafter collectively - contracts), customers, consumers, visitors to the site of JSC "SC MELKOM" in order to prepare for the conclusion of contracts and execution of such contracts, keeping records of concluded contracts, in order to analyze, research the quality, level of activity performed by JSC "SC MELKOM"; sending reference and marketing information to users of the site by sending messages to the e-mail address specified by the site visitor; providing users with an opportunity for feedback from JSC "GK MELKOM"; providing users of the site with consultations on issues related to the goods produced by JSC "GK MELKOM", for marketing activities and support of users of the site, as well as for other purposes not contrary to the current legislation of the Russian Federation and the terms of agreements between JSC "GK MELKOM" and JSC "GK MELKOM". 3.2.2 Processing of Personal Data is necessary for the implementation and fulfillment of the functions, powers and duties assigned by the legislation of the Russian Federation to JSC "GK MELKOM" as an operator.
3.2.3 The processing of personal data is necessary for production, business, scientific, research activities, provided that the rights and legitimate interests of the subject of personal data are not violated;
3.2.4. Processing of personal data is carried out for statistical or other research purposes.
3.3 All the above-mentioned Personal Data of the subjects shall be processed to the extent and within the timeframes stipulated by the respective consents to the processing of Personal Data, including those expressed in the text of civil law contracts, and/or regulatory legal acts, and/or local normative acts of JSC "SC MELKOM", and/or arising from such regulatory legal acts and local normative acts of JSC "SC MELKOM", or within the timeframes required to achieve the above-mentioned purposes. The above conditions of processing of Personal Data are not exhaustive. The provided consents for processing of Personal Data may supplement or otherwise change the purposes, scope, methods and terms of processing of Personal Data.
3.4 Processing of other persons' Personal Data shall be carried out in the presence of their consent if they actually interact with MELKOM SC JSC, including in the form of arising or existing legal relations. Unless otherwise specified in the Policy, concluded contracts or consents to the processing of Personal Data provided by the subjects of Personal Data, MELKOM SC JSC shall use such Personal Data exclusively for the purposes for which they were provided to MELKOM SC JSC.
3.5 Employees of MELKOM GC JSC, who process Personal Data on behalf of MELKOM GC JSC, shall, in advance, prior to the commencement of processing of Personal Data, make sure of its admissibility and legality, make sure that MELKOM GC JSC possesses the relevant authorities and/or consents of the subjects of Personal Data. In the absence of such authorities and/or consents, the specified employee of MELKOM SC JSC shall ensure that the consent is obtained from the subject whose PD processing is planned. In this regard, he/she may:
in various electronic registration forms, e-mail correspondence, telephone conversations, and personal meetings, to obtain consents to the processing of personal data from the relevant subjects of personal data with mandatory recording of such consent in any form that allows to confirm the fact of its receipt, including subsequent personal confirmation of the provision of consents by such subjects in writing; use the recommended form of written consent, which can be obtained from his/her immediate superior, the head of the service to which the employee is assigned or from the Financial Service of JSC "SC MELKOM" Legal Department. 3.6 Whenever it is impossible to obtain the necessary consent for processing of personal data and there are reasonable grounds to believe that processing of personal data may violate the rights of the subject(s) of personal data, the relevant employee of MELKOM GC JSC shall notify his/her immediate superior and the head of the service to which the employee is assigned about it by any fixed method (on paper, by corporate e-mail, by fax, by SMS) in order to develop a reasonable approach to processing of personal data or to establish the impossibility of their processing.
Heads of structural subdivisions of JSC "MELKOM SC", in whose direct activities the processing of personal data of subjects takes place, shall ensure that all necessary measures are taken to comply with the legality of processing of personal data, including obtaining consents for processing and, if necessary, development of local regulations defining the conditions for processing of personal data of the relevant groups of subjects. These powers may be delegated by the heads of structural subdivisions of MELKOM GC JSC to other employees of MELKOM GC JSC.
3.7 Unless otherwise specified, by providing his/her personal data to JSC "MELKOM GC", the subject of personal data accepts the terms and conditions of the Policy and thereby freely, of his/her own free will and in his/her own interest disposes of them, realizes the consequences of their provision and expresses his/her consent to their processing for the purposes for which they are provided, as well as for the purposes of compliance by JSC "MELKOM GC" with regulatory and non-regulatory legal acts adopted in the Russian Federation; execution of decisions, instructions and requests of public authorities exercising certain functions and powers. The scope of processed personal data in this case is limited to the data provided by the data subjects by their own consent, the period of processing of personal data is not limited until the data subject declares withdrawal of his/her consent to the processing of his/her personal data. In spite of the wide list of actions permissible with the Personal Data, for the performance of which such consent is given, when processing the Personal Data, JSC "GC MELKOM" limits itself to the achievement of specific, predetermined, legitimate purposes and does not allow the redundancy of their processing. MELKOM SC JSC does not sell or make available for use the Personal Data in any objective form. Processing of Personal Data in JSC "SC MELKOM" beyond the above cases, in the absence of consent of the subjects of Personal Data for their processing, is prohibited.
3.8 The person responsible for organization of personal data processing in JSC "SC MELKOM" is an employee appointed by the order of the General Director of JSC "SC MELKOM".
4. ACCESS TO PERSONAL DATA
4.1 Only those persons who are specified or defined in the Policy or internal local acts of JSC "SC MELKOM", persons who have been delegated the relevant powers in accordance with the procedure established by this Policy are allowed to process personal data in JSC "SC MELKOM".
4.2 Other employees of JSC "MELKOM GC" may get access to PD for the purpose of reading and preparation of methodological, analytical, summary and other materials in terms of issues related to the activities of such persons or structural subdivisions of JSC "MELKOM GC" to which they belong. Access of third party employees to the data may be realized only on condition that JSC "SC "MELKOM" provides obligations of such persons to maintain confidentiality, non-disclosure of the relevant data to other persons.
4.3 Persons guilty of violating the procedure for processing of Personal Data shall bear responsibility provided for by the legislation of the Russian Federation. Disciplinary penalties may be imposed on employees of MELKOM SC JSC who violated the procedure for processing Personal Data.
5. PECULIARITIES OF PERSONAL DATA PROTECTION
5.1 Personal data protection is the adoption of legal, organizational and technical measures aimed at:
ensuring the protection of personal data from unauthorized access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions in relation to personal data;
observance of confidentiality of personal data;
realization of the right of access to personal data.
5.2 MELKOM SC JSC shall ensure the effective operation of the PD protection system, which includes organizational and (or) technical measures determined taking into account the current threats to PD security and information technologies used in information systems.
5.3 The protection of Personal Data stored in electronic databases and information systems of MELKOM SC JSC from unauthorized access, distortion and destruction of information, as well as from other unlawful actions, is ensured by differentiation of access rights using account and password systems.
5.4 The organization of storage of personal data in JSC "MELKOM GC" is carried out in a manner that prevents their loss or misuse.
5.5 In order to regulate access of employees of MELKOM SC JSC to Personal Data, documents, including electronic ones, other tangible media, databases and information systems containing Personal Data, in order to exclude unauthorized access of third parties, employees who process Personal Data in MELKOM SC JSC ex officio shall comply with and ensure:
strictly selective and reasonable distribution of documents, other material carriers containing PD between employees;
rational placement of employees' workplaces, which excludes uncontrolled use of PD;
knowledge of the requirements of regulatory legal and local normative acts on information protection and preservation of confidentiality of such information;
availability of necessary conditions in the premises for working with documents, other material carriers, databases and information systems containing personal data;
defining and regulating the composition of employees authorized to access databases and information systems containing personal data;
organization of the procedure for destruction of material media containing personal data and its observance;
timely detection of violations of the requirements of the authorization system for access to personal data;
work in the structural subdivision to prevent the loss and disclosure of personal data when working with them;
limiting access to documents, other tangible media, databases and information systems containing personal data.
5.6 All measures to ensure the confidentiality of PDs during their processing shall apply to both tangible media and PDs submitted in electronic format.
5.7 The personal data protection measures applied in JSC "MELKOM Group" include:
appointment of a responsible person for organization of personal data processing;
application of legal, technical and organizational measures to ensure the security of personal data;
assessment of harm that may be caused to the subjects of personal data in case of violation of legal requirements, correlation of harm and security measures taken by JSC "SC "MELKOM";
use of secured premises with delimited access for placement of servers of information systems of personal data, as well as use of lockable cabinets for storage of paper carriers of personal data;
familiarization of employees of JSC "SC MELKOM", directly processing personal data, with the provisions of the legislation of the Russian Federation on personal data;
control over the measures taken to ensure the security of personal data.
6. LOG INFORMATION, COOKIES AND WEB BEACONS TECHNOLOGY
6.1 The site(s) of JSC "GK MELKOM" collects typical session log information, including IP-address, browser type and language, as well as data on the time of visit and the address of the websites from which links were clicked. In order to ensure effective management of the site and to assist in customizing the user interface, JSC "GK MELKOM" may use cookies (small text files stored in the visitor's browser) or web beacons (web beacons - electronic images) in conjunction with tracking pixels that allow the site to count the number of visitors to a particular page and provide access to certain cookies. The type of information collected is used solely for statistical purposes. JSC "GK MELKOM" does not use personal data for the purposes of personal identification of any of its users. However, when authorizing registered users on the site, JSC "GK MELKOM" may use this information in combination with information obtained through data analysis tools and cookies in order to analyze how the user uses the site.
6.2 By using the site, the user agrees to allow MELKOM Group S.A. to download cookies to the user's device under the conditions described above.
6.3 The user has the possibility to manage cookies by accessing the browser settings. If cookies are deleted, all data on the User's preferences will be deleted, including the preference to refuse cookies. If cookies are blocked, the changes may affect the user interface and some components of the website may become inaccessible.
7. RIGHTS AND OBLIGATIONS OF THE PERSONAL DATA SUBJECT
7.1 The subject of personal data has the right:
to demand clarification of his personal data, their updating, blocking or destruction;
to receive a list of his personal data processed by JSC "SC MELKOM", the source of their receipt, information on the terms of processing of his personal data, including the terms of their storage, and other information on the processing of his personal data;
demand notification of all persons to whom his/her incorrect or incomplete personal data were previously communicated about all corrections or additions made;
appeal in accordance with the established procedure against unlawful acts or omissions in the processing of his/her personal data.
7.2 Data subjects undertake to provide only accurate data about themselves.
7.3 Consent to the processing of personal data shall be given by the Data Subjects for the entire period of time required by MELKOM Group JSC to achieve the purposes of processing.
7.4 Consent to the processing of personal data may be withdrawn by the Data Subject by sending a written application to the address of JSC "MELKOM Group": 195279 Russia, St. Petersburg, Industrial Avenue, 71, Building 2, Liter A or to the Corporate Mail address (grtx@grotexmed.com).
7.5 Persons who transferred information to JSC "SC MELKOM" through the website about another subject of personal data, without the consent of the subject whose personal data were transferred, shall be liable in accordance with the laws of the Russian Federation.
8. FINAL PROVISIONS
8.1 This Policy is subject to change or amendment in cases of introduction of relevant changes or amendments to the current legislation of the Russian Federation on personal data, as well as may be changed at any time at the discretion of JSC "GC MELKOM". The current version of the Policy of JSC "SC MELKOM" is always available for viewing by an unlimited number of persons on the website at the address: MELKOM.ru.
8.2 All relations involving JSC "GC MELKOM" concerning the processing and protection of personal data and not directly reflected in this Policy shall be regulated in accordance with the provisions of the current legislation of the Russian Federation on personal data.
8.3 Control over the execution of the requirements of this Policy shall be exercised by the person responsible for organizing the processing of personal data of MELKOM Group JSC.