PRIVACY POLICY
AND PROCESSING OF PERSONAL DATA OF VISITORS OF THE WEBSITE HTTPS://SECRA.RU, CLIENTS OF LLC “IC”AR BMSTU NAMED AFTER N.E. BAUMAN”
GENERAL PROVISIONS
1.1 This privacy and personal data processing policy (hereinafter referred to as the Policy) has been drawn up in accordance with the requirements of the Federal Law of 27.07.2006 No. 152-FZ “On personal data” and defines the procedure for processing personal data and measures to ensure the security of personal data of LLC “IC “AR BMSTU named after N.E. BAUMAN” (TIN 9701125029, OGRN 5187746002428, 105005, Moscow, Academician Tupolev Embankment, 15, bldg. 22, room 2n/2), hereinafter jointly and individually referred to as the Operator.
1.2 The Operator sets as its most important goal and condition for the implementation of its activities the observance of the rights and freedoms of man and citizen when processing his personal data, including the protection of the rights to privacy, personal and family secrets.
1.3 This Operator policy regarding the processing of personal data (hereinafter referred to as the Policy) applies to all information that the Operator may receive about visitors to the website https://secra.ru (hereinafter also referred to as the Site), about clients of LLC “IC “AR MSTU IM. N.E. BAUMAN”.
1.4 Personal data is confidential, strictly protected information and is subject to all requirements established by the Operator’s internal documents for the protection of confidential information.
1.5 This Policy does not apply to, and the Operator does not control and is not responsible for, third-party websites that the User may access via links available on the Site. Such websites may collect or request other personal data from the User, and may also perform other actions.
BASIC CONCEPTS USED IN POLITICS
2.1 Automated processing of personal data – processing of personal data using computer technology.
2.2 Blocking of personal data – temporary cessation of processing of personal data (except in cases where processing is necessary to clarify personal data).
2.3 Website – a collection of graphic and informational materials, as well as computer programs and databases, ensuring their availability on the Internet at the network address https://secra.ru.
2.4 Personal data information system is a set of personal data contained in databases and the information technologies and technical means that ensure their processing.
2.5 Depersonalization of personal data – actions as a result of which it is impossible to determine without the use of additional information the ownership of personal data by a specific User or other subject of personal data.
2.6 Processing of personal data – any action (operation) or set of actions (operations) performed with the use of automation tools or without the use of such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
2.7 Operator – LLC “IC “AR BAUMAN MGTU”, independently or jointly with other persons, organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data.
2.8 Personal data – any information relating directly or indirectly to a specific or determinable User of the website https://secra.ru, a client of the Operator.
2.9 User – any visitor to the website https://secra.ru, a client of the Operator.
2.10 Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.11 Dissemination of personal data – any actions aimed at disclosing personal data to an indefinite number of persons (transfer of personal data) or familiarizing an unlimited number of persons with personal data, including the publication of personal data in the media, posting in information and telecommunications networks or providing access to personal data in any other way.
2.12 Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign government body, foreign individual or foreign legal entity.
2.13 Destruction of personal data – any actions as a result of which personal data are destroyed irrevocably with the impossibility of further restoration of the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.
2.14 Subject of personal data — users of the Site, clients of LLC “IC “AR BAUMAN MGTU”.
RIGHTS AND RESPONSIBILITIES OF THE OPERATOR AND THE SUBJECT OF PERSONAL DATA
3.1 The operator has the right:
1) independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” and regulatory legal acts adopted in accordance with it, unless otherwise provided by Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” or other federal laws;
2) entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data stipulated by Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”;
3) in the event of the personal data subject’s withdrawal of consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”.
3.2 The operator is obliged to:
1) organize the processing of personal data in accordance with the requirements of the Federal Law of 27.07.2006 No. 152-FZ “On Personal Data”;
2) respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data”;
3) notify the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) at the request of this body of the necessary information within 10 days from the date of receipt of such request;
4) report the fact of unlawful or accidental transfer (provision, distribution, access) of personal data, which resulted in the violation of the rights of personal data subjects, to the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) in the manner and within the timeframes stipulated by Federal Law No. 152-FZ of 27.07.2006 “On the Protection of Personal Data”.
3.3 Subjects of personal data have the rights provided for by Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and other regulatory legal acts governing the processing of personal data, including the right to:
1) receive information concerning the processing of his personal data, except for cases stipulated by federal laws. Information is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data related to other personal data subjects, except for cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”;
2) demand that the operator clarify his personal data, block it or destroy (delete) it, including in cases where the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also take measures provided by law to protect his rights;
3.4 Responsibility for violation of the requirements of the legislation of the Russian Federation and regulatory acts of LLC “IC “AR MSTU named after N.E. BAUMAN”, in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.
PURPOSES OF PERSONAL DATA PROCESSING AND LEGAL BASIS FOR PERSONAL DATA PROCESSING
4.1 The legal basis for the processing of personal data is the set of regulatory legal acts, in pursuance of which and in accordance with which the Operator processes personal data, including:
Constitution of the Russian Federation;
Civil Code of the Russian Federation;
Federal Law of 08.02.1998 N 14-FZ “On Limited Liability Companies”;
other regulatory legal acts governing relations related to the activities of the Operator.
4.2. The legal basis for processing personal data also includes:
agreements concluded between the Operator and personal data subjects;
consent of personal data subjects to the processing of their personal data.
4.3 The Operator processes personal data for the following purposes:
ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation;
carrying out activities in accordance with the charter of LLC “IC “AR MSTU IM. N.E. BAUMAN”;
informing the Subject of personal data by sending emails, messages (including the WhatsApp messenger (owned by Meta Platforms Inc., recognized as extremist and banned in the Russian Federation) and Telegram, providing the Subject of personal data with access to services, information and/or materials contained on the Website of LLC “IC “AR MSTU IM. N.E. BAUMAN”;
conclusion and execution of civil law contracts;
promotion of the Operator’s goods, works, and services on the market by establishing direct contacts with potential consumers using communication tools;
informing the subject of personal data by sending emails and messages;
providing access to the subject of personal data to services, information and/or materials contained on the Website of LLC “IC “AR MSTU named after N.E. BAUMAN”.
4.4 The operator processes personal data provided in connection with the conclusion of an agreement to which the subject of personal data is a party, if the personal data is not distributed and is not provided to third parties without the consent of the subject of personal data and is used by the operator exclusively for the execution of the said agreement and the conclusion of agreements with the subject of personal data
4.5 The Operator has the right to send the personal data subject notifications about new products and services, special offers and various events. The personal data subject can always refuse to receive informational messages by sending the Operator an email to info@secra.ru and/or bmstu.secra@gmail.com with the subject line “Refusal to receive notifications about new products, services and special offers”.
INFORMATION ABOUT “COOKIES”
5.1 A cookie is a small piece of data, which often contains a unique anonymous identifier, sent by a web server and stored on the hard drive of the User’s device. The web client (usually a web browser) sends this piece of data to the web server as part of an HTTP request each time an attempt is made to open a page of the website.
5.2 Cookies are widely used by website owners in order to make websites work, or to make them work more efficiently, as well as to obtain analytical information.
5.3 Some content or applications on the Site, including advertising, may be served by independent third parties. They may place cookies on the User’s device for their own purposes. The Site does not control the tracking technologies used by these third parties or how they may be used, and is not responsible for any actions or policies of third parties. You can prevent the placement of such third-party cookies and tracking by adjusting or changing your browser settings accordingly. For more information, the User should refer to the instructions of their browser.
5.4 When visiting a page with content inserted, for example, from the websites YouTube, RuTube or Vimeo, these service providers may create their own cookies in the User’s browser. The Site does not control the use of these cookies and cannot access them due to the specifics of how cookies work – only the party that originally created them has access to them. More detailed information about these cookies is posted on third-party websites.
COLLECTION AND USE OF INFORMATION
6.1 Cookies are used for various purposes, including to:
to make it easier for the Site Owner to obtain information about Users’ visits to the Site.
analyze generalized and other information not related to the identification of individual Users (for example, about the operating system, browser version and the URL from which the transition to this page of the Site was made, including from an email or advertisement);
analyze information about Users’ visits to pages to improve the Site and routes of visiting Sites;
assist the User in obtaining the necessary information;
provide personalized content focused on the interests of Users;
determine the number of visitors and how they use the Site in order to improve the effectiveness of the Site and to better understand the interests of the Site’s audience.
COOKIE LIFE
7.1 Some cookies are valid from the moment the User logs into the Site until the end of a specific browser session. When the browser is closed, these files become unnecessary and are automatically deleted. Such cookies are called “session cookies”.
7.2 Some cookies are stored on the device between browser sessions – they are not deleted after the browser is closed. Such cookies are called “persistent”. The storage period of persistent cookies on the device varies for different cookies. The Site uses persistent cookies for various purposes: for example, the frequency of Users’ visits to the Site, changes in the nature of Site use, and to evaluate the effectiveness of the information posted.
7.3 Cookies may be placed on the User’s device by the Site administration. These cookies are called “first-party cookies”. Some cookies may be placed on the User’s device by other operators. Such cookies are called “third-party” cookies (see clause 5 of this Privacy Policy).
USE OF WEB TRACKING AND COOKIES
8.1 The Site does not use programs to collect personal data or IP addresses of individuals. The data is used exclusively in an anonymous manner in aggregate form for statistical purposes, as well as for the development of the Site.
8.2 The website does not create an individual profile of Users’ online activities. The content of persistent cookies is limited to an identification number. Name, email address, IP address, etc. are not saved. Exception: Google Analytics cookies.
8.3 Google Analytics cookies may be used in small quantities. These cookies use the IP address to recognize the User, but do not personally identify the User. In other words, the information is collected anonymously. Cookies collect information about how Users use the Site, which is then used to compile reports. Alternatively, the User can opt out of Google Analytics cookies to track your activity across all websites by following this link: Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout)
VOLUME AND CATEGORIES OF PROCESSED PERSONAL DATA, CATEGORIES OF PERSONAL DATA SUBJECTS
9.1 The Operator may process personal data of the following categories of personal data subjects:
9.1.1 Operator’s Clients (individuals):
last name, first name, patronymic;
date and place of birth;
passport details;
registration address at the place of residence;
contact details;
photographs with the consent of the subject of personal data;
other personal data provided by clients and counterparties (individuals) necessary for the conclusion and execution of contracts.
9.1.2 Users of the Site:
last name, first name, patronymic;
contact details;
delivery address in case of concluding civil law contracts;
anonymized data about visitors to the Site (including cookies) using Internet statistics services (Yandex Metrica and others).
The Operator processes biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which his identity can be established) in accordance with the legislation of the Russian Federation.
PROCEDURE FOR COLLECTING, STORING, TRANSFERRING AND OTHER TYPES OF PROCESSING PERSONAL DATA
10.1 The processing of personal data is carried out in accordance with the requirements of the legislation of the Russian Federation with the consent of the subjects of personal data to the processing of their personal data, as well as without such consent in cases stipulated by the legislation of the Russian Federation.
10.2 The operator carries out both automated and non-automated processing of personal data.
10.3 The Operator processes the User’s personal data only if they are filled in and/or sent by the User independently through special forms located on the website https://secra.ru. By filling in the relevant forms and/or sending their personal data to the Operator, the User expresses their consent to the Policy.
10.4 The operator processes the personal data of the client of LLC “IC “AR MSTU named after N.E. BAUMAN”, obtained upon conclusion of civil law contracts, subject to the client’s consent.
10.5 Only employees of the Operator whose job responsibilities include processing personal data are allowed to process personal data.
10.6 The processing of personal data is carried out by:
obtaining personal data in oral and written form directly from the subjects of personal data;
use of other methods of processing personal data.
10.7 The Operator processes anonymized data about the User if this is permitted in the User’s browser settings (the storage of cookies and the use of JavaScript technology are enabled).
10.8 Anonymized data of Users collected using Internet statistics services are used to collect information about the actions of Users on the site, improve the quality of the site and its content.
10.9 Processing of personal data permitted for distribution from among the special categories of personal data specified in Part 1 of Article 10 of the Federal Law of 27.07.2006 No. 152-FZ “On the Protection of Personal Data” is permitted if the conditions stipulated by Article 10.1 of the said law are met.
10.10 The User’s consent to the processing of personal data permitted for distribution is drawn up separately from other consents to the processing of his personal data. In this case, the conditions stipulated, in particular, by Art. 10.1 of the Federal Law of 27.07.2006 No. 152-FZ “On the Protection of Personal Data” are observed. The requirements for the content of such consent are established by the authorized body for the protection of the rights of personal data subjects.
10.10 When collecting personal data, including through the Internet information and telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.
10.11 The security of personal data processed by the Operator is ensured by implementing legal, organizational and technical measures necessary to fully comply with the requirements of current legislation in the field of personal data protection, including by taking measures to prevent unauthorized persons from accessing personal data and using secure data transmission channels to servers.
10.12 The operator shall store personal data in a form that allows the subject of the personal data to be identified, within the time limits established by federal law or within the limitation period.
10.13 When processing personal data, the accuracy of the personal data, its sufficiency, and, where necessary, relevance in relation to the purposes of processing the personal data are ensured.
10.14 The subject of personal data may at any time revoke consent to the processing of personal data by means of a personal application sent (submitted) to the Operator’s address specified in the Policy.
10.15 In the event that inaccuracies are discovered in personal data, the subject of personal data may send a notification to the Operator by email to the Operator’s address info@secra.ru and/or bmstu.secra@gmail.com with the subject line “Updating personal data”.
10.16 In the event of confirmation of the fact of inaccuracy of personal data or illegality of their processing, the personal data are subject to updating by the Operator.
10.17 The personal data of the subject of personal data will never, under any circumstances, be transferred to third parties, except in cases stipulated by the current legislation of the Russian Federation.
10.18 Processed personal data are subject to destruction or depersonalization upon the occurrence of the following conditions:
10.18.1 achieving the purposes of processing personal data or maximum storage periods;
10.18.2. loss of the need to achieve the purposes of processing personal data;
10.18.3. provision by the subject of personal data or his legal representative of confirmation that the personal data were obtained illegally or are not necessary for the stated purpose of processing;
10.18.4. impossibility of ensuring the legality of the processing of personal data;
10.18.5. revocation by the subject of personal data of consent to the processing of personal data if the storage of personal data is no longer required for the purposes of processing personal data.
CROSS-BORDER TRANSFER OF PERSONAL DATA
11.1 Cross-border transfer of personal data is carried out taking into account the conditions and restrictions established by the Federal Law of 27.07.2006. No. 152-FZ “On Personal Data”. Before the start of the cross-border transfer of personal data, an assessment is made of the measures taken by the third party/other person (if applicable), to whom the cross-border transfer of personal data is planned, to ensure the confidentiality and security of personal data. The Operator notifies the relevant supervisory authority of the planned cross-border transfer of personal data in the manner prescribed by the legislation of the Russian Federation.
FINAL PROVISIONS
12.1 The Policy is an internal document of the Operator, but is publicly available and posted on the Website.
12.2 The policy is subject to change and supplementation in the event of the emergence of new legislative acts and special regulatory documents on the processing and protection of personal data.
12.3 The subject of personal data may obtain any clarifications on issues of interest regarding the processing of his personal data by contacting the Operator via e-mail: info@secra.ru and/or bmstu.secra@gmail.com.
12.4 The Policy is valid indefinitely until it is replaced by a new version.
12.5 The current version of the Policy is freely available on the Internet at https://secra.ru/policy/.