1.1. LLC "UCMS Group" (hereinafter the Company) is a registered Operator processing personal data - registration entry in the Register of Operators No. 09-0036557, Order No. 22.
1.2. This Personal Data Processing Policy (hereinafter the Policy) has been developed in accordance with the requirements of clause 2 of part 1 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter the Personal Data Law), as well as other regulatory legal acts in the field of personal data protection and processing, in order to ensure the protection of the rights and freedoms of individuals and citizens when their personal data is processed, including the protection of the rights to privacy, personal and family secrecy.
1.3. This document is the Company's general Policy on personal data processing. At the same time, the Company has developed a separate Policy on the processing of personal data of the Company's employees (for internal use).
1.4. The Policy applies to relations in the field of personal data processing that arose at the Company both before and after the approval of this Policy.
1.5. In fulfilment of the requirements of part 2 of Article 18.1 of the Personal Data Law, this Policy is published for public access on the Company's website (/).
1.6. This edition of the Policy is put into effect by order of the general director No. 1 of 27.05.2025 and comes into force on 27.05.2025.
1.7. The Company has the right to amend this Policy unilaterally. When amendments are made, the date of the last update of the edition is indicated in the Policy header. This Policy applies to third parties from the moment it is posted on the website.
Name:LLC "UCMS Group"
Legal address:26 Leninskaya Sloboda St., room 4N/1, Danilovsky municipal district, Moscow 115280
Postal (actual) address: 26 Leninskaya Sloboda St., bldg. 5, Simonov Plaza business centre, office 2709, Moscow 115280
Telephone +7 (495) 225-87-39
Email address info.ru@ucmsgroup.ru
INN 7713574071
OGRN 1057749551419
4.1. Personal data processing is limited to achieving specific, predetermined and lawful purposes. The Company does not allow personal data processing that is incompatible with the purposes of collecting personal data.
4.2. Only personal data of certain categories of subjects that meet the established processing purposes is subject to processing.
4.3. The content and scope of the personal data processed correspond to the stated processing purposes. The personal data processed must not be excessive in relation to the stated purposes of its processing.
4.4. The Company does not process biometric personal data (information characterising the physiological and biological characteristics of a person on the basis of which their identity can be established).
4.5. The Company does not carry out cross-border data transfer.
Categories of personal data- are defined in the Policy on the processing of personal data of employees (document for internal use).
Categories of subjects whose personal data is processed:Employees; Relatives of employees; Former employees.
Legal basis for personal data processing:
List of actions: collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
Categories of personal data:surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; income; gender; email address; residential address; registered address; phone number; SNILS; INN; citizenship; identity document data; driving licence data; identity document data issued outside the Russian Federation; data contained in the birth certificate; bank card details; current account number; personal account number; profession; position; employment history (including length of service and data on current employment indicating the name and current account of the organisation); attitude to military duty, military registration data; education data.
Special categories of personal data:health data.
Categories of subjects whose personal data is processed:Employees; Relatives of employees; Former employees; Counterparties; Representatives of counterparties; Clients; Employees of Clients.
Legal basis for personal data processing:
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
Categories of personal data:surname, first name, patronymic; year of birth; month of birth; date of birth; place of birth; registered address; INN; identity document data.
Categories of subjects whose personal data is processed:Counterparties; Representatives of counterparties; Clients.
Legal basis for personal data processing:personal data processing is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to exercise and perform the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
Categories of personal data:surname, first name, patronymic; email address; phone number; position; data collected through analytics programmes.
Categories of subjects whose personal data is processed:Counterparties; Representatives of counterparties; Clients; Website visitors.
Legal basis for personal data processing:personal data processing is carried out with the consent of the data subject to the processing of their personal data.
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); blocking; deletion; destruction; dissemination.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
Categories of personal data- are defined in the Policy on the processing of personal data of employees (document for internal use).
Categories of subjects whose personal data is processed:Employees.
Legal basis for personal data processing:personal data processing is carried out with the consent of the data subject to the processing of their personal data.
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
Categories of personal data- are defined in the Policy on the processing of personal data of employees (document for internal use).
Categories of subjects whose personal data is processed:Employees.
Legal basis for personal data processing:personal data processing is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to exercise and perform the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet;
Categories of personal data:surname, first name, patronymic; year of birth; month of birth; date of birth; email address; phone number; SNILS; citizenship; profession; employment history (including length of service and data on current employment indicating the name and current account of the organisation); attitude to military duty, military registration data; education data; photo and video image of the face; as well as foreign language skills.
Categories of subjects whose personal data is processed:Applicants.
Legal basis for personal data processing:personal data processing is carried out with the consent of the data subject to the processing of their personal data.
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
Categories of personal data: surname, first name, patronymic; email address; phone number; position.
Categories of subjects whose personal data is processed:Counterparties; Representatives of counterparties; Clients.
Legal basis for personal data processing:personal data processing is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to exercise and perform the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
Categories of personal data- are defined in the Policy on the processing of personal data of employees (document for internal use).
Categories of subjects whose personal data is processed:Employees; Relatives of employees.
Legal basis for personal data processing:personal data processing is carried out with the consent of the data subject to the processing of their personal data.
List of actions:collection; recording; systematisation; accumulation; storage; clarification (updating, modification); extraction; use; blocking; deletion; destruction.
Processing methods:mixed; with transfer over the internal network of the legal entity; with transfer over the internet.
6.1.1. The Company processes personal data in accordance with the requirements of the legislation of the Russian Federation.
6.1.2. Personal data processing is carried out with the consent of the data subjects to the processing of their personal data, and also without such consent in cases provided for by the legislation of the Russian Federation.
6.1.3. The Company's employees are authorised to process personal data in accordance with the current order on authorisation to process personal data.
6.1.4. Personal data processing for each purpose of processing is carried out by the following methods:
6.1.5. Personal data processing for each processing purpose specified in clause 5 of the Policy is carried out by:
6.1.6. Disclosure of personal data to third parties and dissemination of personal data without the consent of the data subject are not allowed, unless otherwise provided by federal law. Consent to the processing of personal data authorised by the data subject for dissemination is drawn up separately from other consents of the data subject to the processing of their personal data.
6.1.7. Transfer of personal data to bodies of inquiry and investigation, the Federal Tax Service, the Pension Fund of the Russian Federation, the Social Insurance Fund and other authorised executive bodies and organisations is carried out in accordance with the requirements of the legislation of the Russian Federation.
The Company takes the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access to it, destruction, modification, blocking, dissemination and other unauthorised actions, including:
6.3.1. Personal data of subjects may be obtained, further processed and transferred for storage both on paper and in electronic form.
6.3.2. Personal data recorded on paper is stored in lockable cabinets or lockable rooms with restricted access rights for the established retention periods (Federal Law No. 125-FZ of 22.10.2004 "On Archiving in the Russian Federation", the List of standard management archival documents generated in the course of the activities of state bodies, local authorities and organisations, indicating their retention periods (approved by Order of Rosarkhiv No. 236 of 20.12.2019)).
6.3.3. Personal data of subjects processed using automation tools for different purposes is stored in different electronic folders on the Company's servers.
6.3.4. The retention period for personal data processed in personal data information systems corresponds to the retention period for personal data on paper.
6.3.5. Storing and placing documents containing personal data in open electronic catalogues (file-sharing services) in personal data information systems is not allowed.
6.3.6. The Company stores personal data in a form that allows the data subject to be identified for no longer than required by each purpose of personal data processing, unless the retention period for personal data is established by federal law or a contract.
6.4.1. Termination of personal data processing is carried out at the Company in the following cases:
6.4.2. When the purposes of personal data processing are achieved, as well as if the data subject withdraws consent to their processing (Appendix 1), the Company stops processing this data if:
6.4.3. The data subject has the right to apply to the Company with a demand to stop processing their personal data (Appendix 2). In this case personal data processing stops within a period not exceeding 10 working days from the date the demand is received, except for cases provided for by the Personal Data Law.
6.5.1. The data subject has the right to apply to the Company with a request for information concerning the processing of their personal data (part 7 of Article 14 of the Personal Data Law). The Company provides this information to the data subject or their representative within a period not exceeding 10 working days from the day of the application or receipt of the request (Appendix 3) from the data subject or their representative. This period may be extended, but by no more than 5 working days, if the operator sends the data subject a reasoned notification indicating the reasons for extending the period for providing the requested information.
6.5.2. The Company provides the data subject (or their representative duly authorised by a power of attorney or by law) with the opportunity to review the personal data relating to that data subject free of charge.
6.5.3. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
6.5.4. The Company provides the information specified in part 7 of Article 14 of the Personal Data Law to the data subject or their representative in the form in which the relevant application or request was sent, unless otherwise stated in the application or request.
6.5.5. If the application (request) of the data subject does not contain all the necessary information in accordance with the requirements of the Personal Data Law, or the subject does not have access rights to the requested information, they are sent a reasoned refusal.
6.5.6. The data subject's right to access their personal data may be restricted in accordance with part 8 of Article 14 of the Personal Data Law, including where the data subject's access to their personal data violates the rights and legitimate interests of third parties.
6.6.1. Personal data is blocked if inaccurate personal data is identified or unlawful personal data processing is identified on the application (request) of the data subject or their representative or Roskomnadzor.
6.6.2. Blocking periods: personal data is blocked from the moment of the application/request of the data subject or their representative or at the request of Roskomnadzor, for the period of the check, if blocking the personal data does not violate the rights and legitimate interests of the data subject or third parties.
6.6.3. Unblocking is possible on the basis of information or other necessary documents provided by the data subject or their representative or by Roskomnadzor, within seven working days from the day such information is provided.
6.7.1. If the Company, Roskomnadzor or another interested person identifies a fact of unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has resulted in a violation of the rights of data subjects, the Company:
6.8.1. Conditions and periods for the destruction of personal data at the Company:
6.8.2. When the purpose of personal data processing is achieved, as well as if the data subject withdraws consent to their processing, the personal data is subject to destruction if:
6.8.3. The responsible persons, procedure and methods for destroying personal data are established in the Company's local regulations.
Processing of personal data of visitors to the Company's website is carried out in accordance with theTerms of Personal Data Processing for Website Visitors.
8.1. Control over the fulfilment of the requirements of this Policy is exercised by the person responsible for organising personal data processing - the Company's general director.
8.2. Liability for violation of the requirements of the legislation of the Russian Federation and the Company's regulations in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.
