+7 (499) 372-02-70 info@rt-mt.ru
EN
  • Main
  • Personal data processing policy

Policy on the processing of personal data on the website of JSC 'RT-MedTech'

1. General Provisions

1.1. The Operator's Policy regarding the processing of personal data (hereinafter referred to as the Policy) has been developed to ensure the protection of the rights and freedoms of the subject of personal data when processing his personal data, including the protection of the rights to privacy, personal and family secrets.

1.2. Key concepts used in the Policy:

  • Personal data – any information related to a directly or indirectly identified or identifiable individual (subject of personal data);
  • Processing of personal data – any action (operation) or set of actions (operations) performed with the use of automation tools or without the use of such tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;
  • Automated processing of personal data – processing of personal data using computer technology;
  • Dissemination of personal data – actions aimed at disclosing personal data to an indefinite number of persons;
  • Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons;
  • Blocking of personal data – temporary cessation of processing of personal data (except in cases where processing is necessary to clarify personal data);
  • Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which tangible media of personal data are destroyed;
  • Depersonalization of personal data – actions as a result of which it becomes impossible to determine the ownership of personal data by a specific subject of personal data without the use of additional information;
  • Personal data operator – joint-stock company RT-Medical Technologies (JSC RT-MedTech) (hereinafter also referred to as the Company, Operator) – a legal entity that independently organizes and carries out the processing of personal data, and also determines the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data.
  • User – the subject of personal data, the website visitor.
  • Cookies – data that is automatically transferred to the Company during the use of the website using the software installed on the User’s device, including the IP address, geographic location, information about the browser and type of operating system of the User’s device, technical characteristics of the equipment and software used by the User, date and time of access to the Sites.

1.3. The operator who has gained access to personal data is obliged to maintain the confidentiality of personal data – not to disclose to third parties or distribute personal data without the consent of the subject of personal data (hereinafter also the User), unless otherwise provided by federal law.

1.4. The User has the right to receive information regarding the processing of his/her personal data, including:

  • confirmation of the fact of personal data processing by the Operator;
  • legal grounds and purposes of personal data processing;
  • purposes and methods of personal data processing used by the Operator;
  • name and location of the Operator, information about persons (except for the Operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Operator or on the basis of federal law;
  • processed personal data related to the relevant subject of personal data, the source of their receipt, unless another procedure for submitting such data is provided for by federal law;
  • periods of personal data processing, including their storage periods;
  • the procedure for the User to exercise the rights provided for by Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter referred to as the Law on Personal Data);
  • information on the methods of fulfilling the Operator's obligations established by Article 18.1 of the Law on Personal Data;
  • other information provided for by the Law on Personal Data or other federal laws.

1.5. The User has the right to demand that the Operator clarify his personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also to take measures provided by law to protect his rights.

1.6. The User has the right to protect his rights and legitimate interests, including compensation for damages and (or) compensation for moral damage in court.

1.7. The personal data operator has the right to:

  • defend their interests in court;
  • provide personal data of subjects to third parties, if this is provided for by current legislation (tax, law enforcement agencies, etc.);
  • refuse to provide personal data in cases provided for by law;
  • use the User's personal data without his consent in cases provided for by law.

1.8. When collecting personal data, the Operator is obliged to provide the User, at his request, with the information stipulated by Part 7 of Article 14 of the Law on Personal Data.

1.9. When collecting personal data, including via the Internet information and telecommunications network, the Operator is obliged to ensure the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for the cases specified in paragraphs 2, 3, 4, 8 of Part 1 of Article 6 of the Law on Personal Data.

2. Purposes of collecting personal data

2.1. The processing of personal data is limited to achieving specific, predetermined and legitimate purposes. Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted.

2.2. The purposes of processing the Operator's personal data include:

  • establishing and maintaining communication between the User and the Company;
  • consulting on the provision of services by the Company;
  • identifying the User on the website, providing the User with the opportunity to fully use the website;
  • sending advertising messages, informational mailings about the products and services of the Company and its partners by phone number, to the User's email address;
  • conclusion, execution and termination of civil contracts;
  • statistical and other research based on anonymized information provided by the User;
  • modernization of the website by processing requests and applications from the User, as well as for the purpose of recording telephone conversations with the Company;
  • improving the quality of service;
  • ensuring compliance with laws.

3. Legal grounds for processing personal data

3.1. The legal basis for processing personal data is a set of legal acts, pursuant to which and in accordance with which the Operator processes personal data:

  • The Constitution of the Russian Federation,
  • The Civil Code of the Russian Federation,
  • The Federal Law of the Russian Federation of 27.07.2006 No. 152-FZ "On Personal Data",
  • The Federal Law of the Russian Federation of 27.07.2006 No. 149-FZ "On Information, Information Technologies and the Protection of Information",
  • other applicable regulatory legal acts of the Russian Federation,
  • the statutory documents of the Company,
  • local legal acts of the Company,
  • agreements concluded between the Company and the User,
  • User Consent to the Processing of Personal Data.

4. Volume of personal data processed, categories of personal data subjects.

4.1. The content and volume of personal data processed correspond to the stated purposes of processing. The processed personal data must not be excessive in relation to the stated purposes of their processing.

4.2. Processing of personal data is permitted in the following cases:

  • personal data is processed with the consent of the User to the processing of his personal data;
  • personal data processing is necessary for the performance of an agreement to which the User is a party or a beneficiary or guarantor, as well as for the conclusion of an agreement on the initiative of the User or an agreement under which the User will be a beneficiary or guarantor. The agreement concluded with the User may not contain provisions that limit the rights and freedoms of the User as a subject of personal data, establish cases of processing personal data of minors, unless otherwise provided by the legislation of the Russian Federation, as well as provisions that allow the User's inaction as a condition for concluding an agreement;
  • the processing of personal data is necessary to protect the life, health or other vital interests of the subject of personal data, if it is impossible to obtain the consent of the subject of personal data;
  • the processing of personal data is necessary to exercise the rights and legitimate interests of the Operator or third parties or to achieve socially significant goals, provided that this does not violate the rights and freedoms of the User as a subject of personal data;
  • the processing of personal data is carried out for statistical or other research purposes, with the exception of the purposes specified in Article 15 of the Law on Personal Data, subject to mandatory depersonalization of personal data;
  • the processing of personal data is subject to publication or mandatory disclosure in accordance with federal by law.

4.3. The categories of personal data subjects include the Operator's clients and counterparties (individuals), representatives/employees of the Operator's clients and counterparties (legal entities).

4.4. The Operator processes the following personal data obtained when filling out the feedback form on the Operator's website:

Personal data category List of personal data Processing method
general personal data - last name, first name, patronymic;
- phone numbers (home, mobile, work);
- email address (work, personal). 		using automation tools

5. Procedure and conditions for processing personal data

5.1. The User accepts the terms of the Policy and gives the Company informed and informed consent to process their personal data on the terms stipulated by the Policy and the Law. The User is considered to have given consent to the processing of their personal data:

  • when filling out the feedback form, at the time of clicking the button confirming the submission of the application;
  • when subscribing to receive information and news materials from the Company by filling out the form for subscribing to the mailing list. The User is considered to have given consent to the processing of their personal data by checking the box: "I agree with the terms of processing personal data" or in check boxes of similar content;
  • during any use of the site - for personal data that is automatically transferred to the Company during the use of the site using the software installed on the User's device. The User is deemed to have given consent to the processing of their personal data at the time of starting to use the site.

5.2. The Operator processes personal data - operations performed using automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction of personal data.

5.3. The collection of personal data, as well as other information that does not relate to personal data, is carried out on the site, by the User filling out the feedback form or in another accessible way using the functionality of the site. For the purposes of this paragraph, other information means any data that is not related to identifying data, including: additional data, including information about technical devices, the User's actions on the site, time, date, etc. (cookies);

5.4. Personal data shall be processed in compliance with the principles and rules stipulated by the Law on Personal Data.

5.5. The Operator's processing of personal data shall be limited to achieving specific, predetermined and legitimate purposes. Only personal data that meet the purposes of their processing shall be processed. The content and volume of personal data processed shall correspond to the stated purposes of processing.

5.6. The consent to the processing of personal data provided by the User in accordance with this Policy is valid from the date of such consent and for the period necessary to achieve the purposes of processing personal data or until the User revokes such consent, unless otherwise provided by the current legislation of the Russian Federation. The consent to the processing of personal data provided by the User in accordance with this Policy may be revoked by the User at any time. The User may revoke the consent previously provided to the Company for the processing of personal data in one of the following ways:

5.6. 1. by sending a corresponding application by mail to the address: 119311, Moscow, Vernadsky Ave. 8A, pom. 1/13/5;

5.6. 2. by sending a corresponding application in the form of an electronic document to the email address: info@rt-mt.ru.

5.7. When storing personal data, the Personal Data Operator is obliged to use databases located on the territory of the Russian Federation, in accordance with Part 5 of Article 18 of the Law on Personal Data.

5.8. Personal data must be stored in a form that allows identifying the subject of personal data, no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor. The processed personal data are subject to destruction or depersonalization upon achieving the processing purposes or in the event of loss of need to achieve these purposes, unless otherwise provided by federal law.

5.9. The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, expiration of the consent or revocation of the consent of the subject of personal data to the processing of his personal data, as well as the detection of unlawful processing of personal data.

5.10. The Operator is obliged not to disclose to third parties or distribute personal data without the consent of the personal data subject, unless otherwise provided by federal law.

Consent to the processing of personal data permitted by the personal data subject to distribution is drawn up separately from other consents of the personal data subject to the processing of his personal data. The Operator is obliged to provide the personal data subject with the opportunity to determine the list of personal data for each category of personal data specified in the consent to the processing of personal data permitted by the personal data subject to distribution. The transfer (distribution, provision, access) of personal data permitted by the personal data subject to distribution must be terminated at any time at the request of the personal data subject. This request must include the last name, first name, patronymic (if any), contact information (phone number, email address or postal address) of the personal data subject, as well as a list of personal data whose processing is subject to termination. The personal data specified in this request may only be processed by the Operator to whom it is sent.

5.11. The Operator is obliged to take measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it. The Operator determines the composition and list of measures independently.

5.12. When processing personal data, the Operator takes the necessary legal, organizational and technical measures or ensures their adoption to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data.

6. Updating, correcting, deleting and destroying personal data, responding to requests from subjects for access to personal data

6.1. The Operator is obliged to notify the personal data subject or his representative in the manner prescribed by Article 14 of the Law on Personal Data about the availability of personal data related to the relevant personal data subject, and also provide an opportunity to familiarize themselves with this personal data upon request of the personal data subject or his representative or within ten working days from the date of receipt of the request of the personal data subject or his representative. The specified period may be extended, but not more than by five working days if the Operator sends a reasoned notice to the personal data subject indicating the reasons for extending the period for providing the requested information.

6.2. The Operator is obliged to provide the personal data subject or his representative with the opportunity to familiarize themselves with the personal data related to this personal data subject free of charge. Within a period not exceeding seven working days from the date of provision by the personal data subject or his/her representative of information confirming that the personal data are incomplete, inaccurate or outdated, the Operator is obliged to make the necessary changes to them. Within a period not exceeding seven working days from the date of provision by the personal data subject or his/her representative of information confirming that such personal data were illegally obtained or are not necessary for the stated purpose of processing, the Operator is obliged to destroy such personal data. The Operator is obliged to notify the personal data subject or his/her representative of the changes made and the measures taken and to take reasonable measures to notify third parties to whom the personal data of this subject were transferred.

6.3. In the event of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the subject of personal data or his representative or the authorized body for the protection of the rights of subjects of personal data, or other necessary documents, is obliged to clarify the personal data or ensure their clarification (if the processing of personal data is carried out by another person acting on behalf of the Operator) within seven working days from the date of submission of such information and remove the blocking of personal data.

6.4. The Operator is obliged to stop processing personal data or ensure that the person acting on behalf of the Operator stops processing personal data:

- in the event of detection of unlawful processing of personal data carried out by the Operator or a person acting on behalf of the Operator, within a period not exceeding three business days from the date of such detection;

- in the event of withdrawal by the subject of personal data of consent to the processing of his personal data;

- in the event of achievement of the purpose of processing personal data and to destroy the personal data or ensure their destruction (if the processing of personal data is carried out by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date of achievement of the purpose of processing personal data. If it is impossible to destroy personal data within the specified period, the Operator blocks such personal data and ensures the destruction of personal data within a period not exceeding six months, unless another period is established by federal laws.

6.5. In the event that a fact of unlawful or accidental transfer (provision, distribution, access) of personal data is established, resulting in a violation of the rights of personal data subjects, the Operator is obliged, from the moment such incident is identified by the Operator, the authorized body for the protection of the rights of personal data subjects or another interested party, to notify the authorized body for the protection of the rights of personal data subjects:

- within twenty-four hours of the incident that occurred, of the alleged causes that resulted in the violation of the rights of personal data subjects and the alleged harm caused to the rights of personal data subjects, of the measures taken to eliminate the consequences of the relevant incident, and also provide information about the person authorized by the Operator to interact with the authorized body for the protection of the rights of personal data subjects on issues related to the identified incident;

- within seventy-two hours of the results of the internal investigation of the identified incident, and also provide information about the persons whose actions caused the identified incident (if any).

6.6. If a personal data subject applies to the Operator with a request to stop processing personal data, the Operator is obliged to stop processing them or ensure that such processing is stopped (if such processing is carried out by the person processing the personal data) within a period not exceeding ten working days from the date of receipt of the relevant request, except for cases stipulated by the Law on Personal Data. The specified period may be extended, but not more than by five working days if the Operator sends a reasoned notice to the personal data subject stating the reasons for extending the period for providing the requested information.

6.7. After the expiration of the regulatory storage period for documents containing the personal data of the subject, or upon the occurrence of other legal grounds, the documents are subject to destruction.

6.8. For these purposes, the Operator creates an expert commission and conducts an examination of the value of the documents.

6.9. Based on the results of the examination, documents containing personal data of the subject in electronic form and subject to destruction are erased from the information carriers or the carriers themselves on which the information is stored are physically destroyed.