Privacy policy

Политика Некоммерческого партнерства «Уральский биомедицинский кластер» в отношении обработки персональных данных

1. General Provisions

1.1. This Policy of the Non-Profit Partnership “Ural Biomedical Cluster” OGRN 1106600004972 regarding the processing of personal data (hereinafter, respectively, the Policy and the Operator) was developed in accordance with the requirements of clause 2, part 1, article 18.1 of the Federal Law of July 27, 2006 No. 152-FZ “On Personal data" (hereinafter referred to as the Personal Data Law) in order to ensure the protection of the rights and freedoms of a person and citizen when processing his personal data when using the Operator’s Website, including the protection of rights to privacy, personal and family secrets.
1.2. The Policy uses concepts in the sense as they are defined in clause 1.6 of the Policy. The Policy applies to relationships in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
1.3. The operator, independently or jointly with other persons, organizes the processing of personal data, and also determines the purposes of processing personal data, determines the actions (operations) performed with personal data.
1.4. The Policy applies to all personal data processed by the Operator.
1.5. In accordance with the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in the public domain on the Internet information and telecommunications network on the Site.
1.6. Basic concepts used in the Policy:
1.6.1. Personal data — any information relating to a directly or indirectly identified or identified User of the Site;
1.6.2. Website – a set of logically interconnected web pages (web documents) located on the Internet at the address: https://urbiomed.ru/ ; 
1.6.3. User – any person who provided information to the Operator using the Site;
1.6.4. Information system of personal data — a set of personal data contained in databases and information technologies and technical means that ensure their processing;
1.6.5. Processing of personal data is any action (operation) or set of actions (operations) with personal data performed using automation tools or without their use. Processing of personal data includes, inter alia:
• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (update, change);
• extraction;
• usage;
• transmission (distribution, provision, access);
• depersonalization;
• blocking;
• removal;
• destruction.
1.6.6. Automated processing of personal data — processing of personal data using computer technology;
1.6.7. Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons;
1.6.8. Providing personal data — actions aimed at disclosing personal data to a certain person or a certain circle of persons;
1.6.9. Depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the ownership of personal data to a specific subject of personal data;
1.6.10. Blocking of personal data — temporary cessation of processing of personal data (except for cases where processing is necessary to clarify personal data);
1.6.11. Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material media of personal data are destroyed;
1.6.12. Cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
1.6.13. The user is an individual (subject of personal data).
1.6.14. Personal data information system is a set of personal data contained in databases and information technologies and technical means that ensure their processing.
1.7. Basic rights and obligations of the Operator and User.
The operator has the right:
- to independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
- entrust the processing of personal data to another person with the consent of the subject of personal data, unless otherwise provided by federal law, on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules for processing personal data provided for by the Law on Personal Data, maintain the confidentiality of personal data, and take the necessary measures aimed at ensuring the fulfillment of the obligations provided for by the Law on Personal Data;
- if the subject of personal data withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal Data.
The operator is obliged to:
- organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
- respond to requests and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
1.7.1. The user has the right to:
- receive information regarding the processing of his personal data, except in cases provided for by federal laws. The information is provided to the subject of personal data by the Operator in an accessible form, and it should not contain personal data relating to other subjects of personal data, except in cases where there are legal grounds for the disclosure of such personal data. The list of information and the procedure for obtaining it is established by the Law on Personal Data;
- require the operator to clarify his personal data, block it or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as take measures provided by law to protect their rights;
- give prior consent to the processing of personal data in order to promote goods, works and services on the market;

2. Purposes of processing personal data

2.1. The Processing of personal data by the Operator is carried out for the following purposes:
2.1.1. Establishing feedback with Users, including processing questions and requests from Users;
2.1.2. Providing Users with access to information and materials contained on the Site;
2.1.3. Informing Users about goods, services, advertising and other events of the Operator;
2.1.4. Other purposes necessary for the Operator to comply with the legislation on personal data.
2.2. Only personal data that meets the purposes of their processing are subject to processing.

3. Scope and categories of personal data processed

3.1. The Operator processes the following personal data of Users:
3.1.1. Full Name;
3.1.2. telephone;
3.1.3. email address;
3.1.4. position held;
3.1.5. other personal data provided by Users when using the Operator’s website and (or) posted by the Operator on the website in accordance with the requirements of current legislation.
3.2. The operator collects and processes anonymized data about visitors (including cookies) using Internet statistics and advertising services (Yandex Metrica, Google Analytics and others).
3.3. The operator does not process special categories of personal data provided for by the Personal Data Law.
3.4. The operator does not process the biometric categories of personal data provided for by the Personal Data Law.
3.5. The content and volume of personal data processed must correspond to the stated purposes of processing provided for in Section. 2 of this Policy. The personal data processed should not be redundant in relation to the stated purposes of their processing.

4. Procedure and conditions for processing personal data

4.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
4.2. The processing of personal data is carried out by the Operator with the consent of the Users to the processing of their personal data, as well as without it in cases provided for by law. The User's consent to the processing of personal data is considered received by the Operator from the moment the User puts a special mark in the appropriate field of the personal data collection form posted on the Operator's Website.
4.3. The Operator carries out Automated processing of personal data.
4.4. The operator processes personal data in a form that allows identifying the subject of personal data, no longer than required for the purposes of processing personal data. 
4.5. Disclosure to third parties and dissemination of personal data without the consent of the subject of personal data is not permitted, unless otherwise provided by federal law. Consent to the processing of personal data authorized by the subject of personal data for distribution is issued separately from other consents of the subject of personal data to the processing of his personal data.
4.6. The transfer of personal data to the bodies of inquiry and investigation, and to other authorized bodies is carried out in accordance with the requirements of the legislation of the Russian Federation.
4.7. When the goals of processing personal data are achieved, as well as in the event that the User withdraws consent to their processing, personal data is subject to destruction, except in cases provided for by law.
4.8. The operator implements the following requirements for the protection of personal data:
4.8.1. requirements for maintaining the confidentiality of personal data;
4.8.2. requirements to ensure that the subject of personal data exercises his rights, including the right to access information;
4.8.3. requirements to ensure the accuracy of personal data, and, where necessary, relevance in relation to the purposes of processing personal data (with the adoption (ensuring the adoption) of measures to delete or clarify incomplete or inaccurate data);
4.8.4. requirements for the protection of personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data;
4.8.5. other requirements provided for by law.
4.9. The operator takes the following measures necessary and sufficient to ensure the fulfillment of the obligations provided for by law regarding the procedure for processing and protecting personal data:
4.9.1. appointment of a person responsible for ensuring the security of personal data;
4.9.2. determining the list of employees authorized to work with personal data;
4.9.3. approval of this Policy regarding the processing of personal data and ensuring their security;
4.9.4. application of legal, organizational and technical measures to ensure the security of personal data, in particular:
- identification of threats to the security of personal data during their processing in the Personal Data Information System;
- application of organizational and technical measures to ensure the security of personal data during their processing in the Personal Data Information System, necessary to fulfill the requirements for the protection of personal data, the implementation of which ensures the levels of personal data security established by the Government of the Russian Federation;
- application of procedures for assessing the compliance of information security means that have been completed in accordance with the established procedure;
- establishing rules for access to personal data processed in the Personal Data Information System;
- control over the measures taken to ensure the security of personal data and the level of security of the Personal Data Information System;
4.9.5. implementation of internal control of compliance of the processing of personal data with the Law on Personal Data and regulations adopted in accordance with it, requirements for the protection of personal data, the Operator’s policy regarding the processing of personal data, local acts of the Operator;
4.9.6. familiarization of employees directly involved in the processing of personal data with the provisions of the legislation of the Russian Federation on personal data, including the requirements for the protection of personal data, as well as with this Policy.
4.10. The Operator has the right to transfer the User’s personal data to third parties in the following cases:
4.10.1. The user has expressed consent to such actions;
4.10.2. The transfer is necessary in order for the Operator to fulfill the agreement concluded with the User;
4.10.3. The transfer is necessary in order to provide the User, upon his request, with access to certain services of the Site; 
4.10.4. The transfer is provided for by current legislation;
4.10.5. The transfer of personal data is carried out for statistical or other research purposes, with the exception of the purposes specified in Article 15 of the Law on Personal Data, subject to the mandatory anonymization of personal data.
4.11. When collecting personal data of Users, the Operator ensures recording, systematization, accumulation, storage, clarification (updating, changing), retrieving personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.
4.12. The operator stores personal data in a form that allows identifying the subject of personal data for no longer than required by each purpose for processing personal data, unless the storage period for personal data is established by federal law or agreement.
4.13. Personal data processed in personal data information systems are stored during the storage periods for documents for which these periods are provided for by the legislation on archival affairs in the Russian Federation (Federal Law of October 22, 2004 No. 125-FZ “On Archival Affairs in the Russian Federation”, List of standard management archival documents generated in the course of the activities of state bodies, local governments and organizations, indicating their storage periods (approved by Order of the Federal Archives of December 20, 2019 N 236)).
4.14. The operator stops processing personal data in the following cases:
• the fact of their unlawful processing is revealed. Deadline: within 3 working days from the date of detection;
• the purpose of their processing has been achieved;
• the consent of the personal data subject to the processing of the specified data has expired or been revoked, when, according to the Personal Data Law, the processing of this data is permitted only with consent.
4.15. When the goals of processing personal data are achieved, as well as in the event that the subject of personal data withdraws consent to their processing, the Operator stops processing this data, unless:
• otherwise provided by the agreement to which the subject of personal data is a party, beneficiary or guarantor;
• The operator does not have the right to process without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws;
• otherwise is not provided for in another agreement between the Operator and the subject of personal data.
5.12. When the User contacts the Operator with a request to stop processing personal data within a period not exceeding 10 business days from the date the Operator receives the corresponding request, the processing of personal data is terminated, except for cases provided for by the Law on Personal Data. This period may be extended, but not more than five working days. To do this, the Operator must send the User a reasoned notice indicating the reasons for the extension of the period.

5. The procedure for interaction between Users and the Operator

5.1. Confirmation of the fact of processing of personal data by the Operator, legal grounds and purposes of processing personal data, as well as other information specified in Part 7 of Art. 14 of the Law on Personal Data are provided by the Operator to the User or his representative within 10 working days from the receipt of the request of the user or his representative. This period may be extended, but not more than five working days. To do this, the Operator should send the User a reasoned notice indicating the reasons for extending the period for providing the requested information.
5.2. The User's request must contain the information provided for in Part 3 of Art. 14 of the Law on Personal Data and be sent to the email address: info@uphc.ru. 
5.3. Users have the right to send requests for clarification, updating of personal data, applications for withdrawal of consent to the processing of personal data to the email address specified in clause 5.2 of the Policy.
5.4. The operator provides the information specified in Part 7 of Art. 14 of the Law on Personal Data, to the User or his representative in the form in which the corresponding request was sent, unless otherwise specified in the request.
5.5. If the User’s request does not reflect all the necessary information in accordance with the requirements of the Personal Data Law or the subject does not have access rights to the requested information, then a reasoned refusal is sent to him.
5.6. The User’s right to access his personal data may be limited in accordance with Part 8 of Art. 14 of the Law on Personal Data, including if the personal data subject’s access to his personal data violates the rights and legitimate interests of third parties.
5.7. If inaccurate personal data is identified when contacting the User or his representative or at their request or at the request of Roskomnadzor, the Operator blocks personal data related to this User from the moment of such contact or receipt of the specified request for the period of verification, if blocking personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
If the fact of inaccuracy of personal data is confirmed, the Operator, based on the information provided by the User or his representative or Roskomnadzor, or other necessary documents, clarifies the personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
5.8. If unlawful processing of personal data is detected upon an appeal (request) from the User or his representative or Roskomnadzor, the Operator shall block unlawfully processed personal data relating to this subject of personal data from the moment of such appeal or receipt of the request.

6. Legal grounds for processing personal data

6.1. The legal basis for the processing of personal data is a set of regulatory legal acts, in pursuance of which and in accordance with which the Operator processes personal data, including:
- the Constitution of the Russian Federation;
- Civil Code of the Russian Federation;
- Federal Law No. 14-FZ dated 02/08/1998 “On Limited Liability Companies”;
- Federal Law of July 27, 2006 No. 152-FZ “On Personal Data”;
- other regulatory legal acts regulating relations related to the activities of the Operator.
6.2. The legal basis for the processing of personal data is also:
- the charter of the NP “Ural Biomedical Cluster”;
- agreements concluded between the Operator and Users;
- consent of Users to the processing of their personal data