Personal Data Processing Policy of GAZ Group Commercial Vehicles OOO

General Provisions

The present document determines the Personal Data Processing Policy of GAZ Group - Commercial Vehicles OOO in relation to the employees of GAZ Group – Commercial Vehicles OOO, as well as other subjects not being under employment relationship with GAZ Group - Commercial Vehicles OOO.
The Personal Data Processing Policy of GAZ Group – Commercial Vehicles OOO determines the basic principles, the goals, the conditions and the ways of personal data processing; the lists of subjects and personal data, processed by GAZ Group – Commercial Vehicles OOO; functions of the personal data subjects’ rights, as well as the requirements to the personal data protection, implemented by GAZ Group – Commercial Vehicles OOO.

Goals of Personal Data Processing

GAZ Group – Commercial Vehicles ООО performs the personal data processing in order to fulfill the employment agreements, execution of the civil law contracts, the clients’ database updating, promotion of GAZ-brand goods and related jobs and services (including news, actions and discounts, new GAZ-brand products, as well as quizzes within Service Quality Assessment Program) in the market.

Legal Feasibility of Personal Data Processing

The Personal Data Processing is performed by GAZ Group – Commercial Vehicles ООО based on Clause 23.24 of the RF Constitution, Clause 85-90 of the RF Labor Code dated 30.12.2001 No 197-ФЗ, p.p. 1,2 of Clause 6 of Federal Law dated 27.07.2006 No 152-ФЗ “Personal Data” based on consent of the subject to provide their personal data for processing, as well as in order to fulfill the functions, the authorities and the obligations of GAZ Group – Commercial Vehicles OOO charged by the legislation of the Russian Federation.

List of Personal Data Categories to be processed

GAZ Group – Commercial Vehicles ООО processes the personal data, which are needed and sufficient to fulfill the obligations of GAZ Group – Commercial Vehicles OOO charged by the legislation of the Russian Federation, as well as specified in the forms of consent for personal data processing, filled in by the personal data subject in order to reach the goals specified in p.2 of the present Policy. The content and volume of the processed personal data comply with the specified processing goals. The list of the personal data categories is as follows: Full name, phone number, email etc.

Conditions for Personal Data Processing

The Personal Data Processing is carried out by GAZ Group – Commercial Vehicles OOO based on the subject’s consent for processing of their personal data, until otherwise provided by the applicable legislation of the Russian Federation in the sphere of the personal data.
GAZ Group – Commercial Vehicles ООО shall not disclose or distribute the subject’s personal data to a third party without the subject’s consent. Commercial Vehicles – GAZ Group OOO is entitled to assign the personal data processing to another body with a consent of the personal data subject based on the agreement concluded with this body. The agreement shall include the list of actions (operations) with the personal data to be performed by the body, dealing with the personal data processing; goals of processing, obligations of this body to support the confidentiality of the personal data and ensure the personal data protection during processing, as well as requirements to processed personal data protection in compliance with clause 19 of Federal Law “Personal data”.
The subject’s personal data storage is performed in such a way that allows to identify the personal data subject, no longer than required by the processing goals in compliance with the storage period provided by the legislation of the Russian Federation and normative documents of GAZ Group – Commercial Vehicles OOO. The processed personal data are subject to destruction or depersonalization upon reaching the processing goals or in case of loss of needs to reach these goals, unless otherwise provided by the applicable legislation.

Applicable Administrative and Technical Procedures for Personal Data Protection

In process of the personal data processing, GAZ Group – Commercial Vehicles OOO performs the necessary and sufficient administrative and technical procedures for personal data protection against illegal or accidental access, destruction, alteration, blocking, copying, submission, distribution, as well as other illegal actions in relation to the personal data, including:
assignment of the responsible person for arrangement of the personal data processing; local administrative and normative documents on personal data protection; familiarization of the persons allowed to operate with personal data, local administrative and normative documents on personal data protection; tracking of persons allowed to operate with the personal data; access limitation to the premises of personal data processing and storage; storage of hard or electronic copies of the personal data in the special locked premises; periodical monitoring of actions on the personal data protection level support; implementation of the authorization system and user’s access control to the personal data system; implementation of protective communication channels during personal data transfer via Internet; usage of the Antivirus protection; certified FSTEC control means for information protection against illegal access.

Rights of Personal Data Subjects

The personal data subjects have the right to have:

  • a complete information about their personal data processed in GAZ Group – Commercial Vehicles OOO;
  • an access to their personal data, including the right to get the copy of any record containing their personal data except for the cases provided by the federal law;
  • a specification of their personal data, their blocking or a specification in case, if the personal data are incomplete, obsolete, received illegally or not necessary for the declared processing;
  • a call-off of the consent for the personal data processing; taking the legal actions related to protection of one’s rights;
  • an appeal of actions or inactions of GAZ Group – Commercial Vehicles OOO performed in violation of the RF legislation requirements related to personal data protection to the authorized body on the personal data subject’s rights protection, or to the court;
  • an exercise оf rights provided by the legislation of the Russian Federation

Operator’s Obligations

In case if the illegal personal data processing is identified after the addressing of the personal data subject or their representative, GAZ Group – Commercial Vehicles OOO blocks the illegally processed personal data related to this personal data subject, or ensures this blockage (if the personal data processing is carried out by the other body based on the Management’s assignment) since such addressing or corresponding request for the audit period takes place.
In case if inaccurate personal data was identified after addressing of the personal data subject or their representative or based on their request, GAZ Group – Commercial Vehicles OOO is obliged to block the personal data related to this personal data subject, or provide their blockage (if the personal data is processed by the other body, acting under the assignment of GAZ Group – Commercial Vehicles OOO ) since the addressing of the corresponding request for the audit period takes place if the personal data blockage does not violate the rights and legal interests of the personal data subject or a third party. If the personal data inaccuracy is confirmed, GAZ Group Commercial Vehicles OOO specifies the personal data or ensures their specification (if the personal data is processed by the other body acting under the assignment of GAZ Group – Commercial Vehicles OOO) based on the information provided by the personal data subject or their representative, or the other needed documents, within seven working days since the date of submission of such information, and cancels the personal data blockage.
In case if the personal data is illegally processed by GAZ Group Commercial Vehicles OOO or by the other body, acting under the assignment of GAZ Group – Commercial Vehicles OOO, GAZ Group – Commercial Vehicles OOO is obliged to stop illegal personal data processing or ensure such stop of the illegal personal data processing by the body, acting under the assignment of GAZ Group – Commercial Vehicles OOO within the period not exceeding three working days.
In case if the personal data processing cannot be justified, the Department is obliged to destruct such personal data or ensure such a destruction within the period not exceeding ten working days since the date of identification of the illegal personal data processing. GAZ Group – Commercial Vehicles OOO is obliged to inform the personal data subject or their representative about elimination of such violations or the personal data destruction. However, if the address of the personal data subject or their representative or the request of the authorized body on the personal data subject’s rights protection are sent by the authorized body on the personal data subject’s rights protection, this body shall also be informed.
In case if the goals of personal data processing was reached, GAZ Group Commercial Vehicles OOO is obliged to stop the personal data processing or ensure such a stop (if the personal data processing is carried out by the body acting under the assignment of GAZ Group – Commercial Vehicles OOO) and destruct the personal data or ensure this destruction (if the personal data processing is carried out by the body acting under the assignment of GAZ Group – Commercial Vehicles OOO) within the period not exceeding thirty days since the personal data processing goals are reached, unless otherwise not provided by the agreement, the party of which, the beneficiary or guarantor under which is the personal data subject; the other agreement between the Department and the personal data subject, or if GAZ Group – Commercial Vehicles OOO is not entitled to process personal data without the personal data subject’s consent on the basis provided by the federal legislation.

Liability for Personal Data Processing Violation

The employees of GAZ Group –Commercial Vehicles OOO, being delinquent for violation of Federal Law “Personal Data” and related laws and regulations, bear financial, disciplinary, administrative, civil and criminal liability in accordance to the procedure applicable by the legislation of the Russian Federation.