Personal Data Processing Policy

This Personal Data Processing Policy (hereinafter referred to as the Policy) has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter referred to as the Federal Law "On Personal Data") and is intended to determine the procedure for processing personal data and measures to ensure the security of personal data about individuals who It can be obtained by RTMT LLC.

If possible, the Policy also takes into account the provisions of other legislation applicable to the operator's activities in the field of personal data processing, for example, the European General Data Protection Regulation (hereinafter — GDPR).

If you have any questions related to the Policy, including questions about our processing of your personal data and their protection, you can send us an email. info@rtmt.ru

The policy is available at: https://www.rtmt.org//policy/

1. Basic concepts

1.1. Personal data – any information relating directly or indirectly to a specific or identifiable Personal Data Subject.

1.2. Website – a set of graphic and informational materials, as well as computer programs and databases that ensure their availability on the website on the Internet at https://www.rtmt.ru /, on all subdomains created based on it, as well as https://www.rtmt.org /

1.3. Personal data processing is any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including:

collecting;
record;
systematization;
accumulation;
keeping;
clarification (update, change);
extraction;
usage;
transmission (distribution, provision, access);
depersonalization;
blocking;
removal;
destruction of personal data.

1.4. Automated personal data processing is the processing of personal data using computer technology.

1.5. Provision of personal data – actions aimed at disclosing personal data to a certain person or a certain circle of persons.

1.6. Blocking of personal data is the temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data).

1.7. Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed.

1.8. Depersonalization of personal data is an action that makes it impossible to determine the identity of personal data to a specific Personal Data Subject without using additional information.

1.09. Personal data information system is a set of personal data contained in databases and information technologies and technical means that ensure their processing.

1.10. Cross–border transfer of personal data is the transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.

1.11. Personal data operator is an Organization that independently or jointly with other persons organizes and/or performs the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, and actions (operations) performed with personal data.

1.12. The subject of personal data is an individual to whom the relevant personal data relate.

1.13. The User is an individual to whom the relevant personal data relates, who views the content of the website and/or uses the functionality of the website.

1.14. The Buyer is any capable natural person who has accepted the offer.

2. General provisions

2.1. The Policy is intended to inform the personal data subject about the Operator's actions to collect, process and protect personal data of subjects in order to achieve the stated goals of personal data processing on the website https://www.rtmt.org/. By clicking the “Submit” button, the personal data subject confirms that he has read the text of the consent to the processing of personal data and the Policy.

2.2. The cases of personal data processing to which the Policy applies are listed in the section "Purpose of processing and composition of information about personal data subjects that the Operator receives and processes".

2.3. The transfer of personal information by the Personal Data Subject means the unconditional consent of the Personal data Subject to the terms of the Privacy Policy and the conditions for processing his personal data specified therein. In case of disagreement with the terms of the Policy, the Personal Data Subject must refrain from transferring personal information to the Operator.

2.4. The Policy (including any of its parts) may be changed by the Operator without any special notice and without payment of any compensation in this regard. The new version of the Policy comes into force from the moment it is posted on the Operator's website.

2.5. By accepting the terms of the Policy, the Personal Data Subject expresses his consent to the processing of data about the Personal Data Subject by the Operator for the purposes provided for in the Policy.

WEBSITE ANALYTICS

2.6. The following third-party tools are used to analyze the use of the Site: Yandex.Metrica https://yandex.ru/legal/confidential /

2.7. Using the Website and its services using a web browser that accepts cookie data means that the personal data subject agrees that the Operator can collect and process cookie data in order to improve the Website, its content, and its functionality. Disabling and/or blocking the web browser's cookie acceptance option by the Personal Data Subject means that the Subject's use of personal data on the Site may be limited, in particular, to some of its functions.

2.8. Notification of Cookies

By visiting the Site, the Personal Data Subject agrees that the Operator uses certain monitoring and tracking technologies, such as cookies, beacons, pixels, tags, and scripts (collectively, "Cookies"). These technologies are used to secure, maintain and improve the Operator's Website, to optimize offers and marketing activities (for example, to track User preferences, improve security, identify technical issues, and monitor and improve overall efficiency).

2.9. Cookies are small text files that are stored via a browser on your computer or mobile device. They allow websites to store information such as user preferences. Cookies are classified as "session cookies", which are automatically deleted when the browser is closed, or "permanent cookies", which remain on the device of the Personal Data Subject until the Personal Data Subject deletes them or they expire.

2.10. Types of Cookies and similar technologies.

Technical/necessary cookies are necessary for the normal operation of certain areas of the Site. They allow you to distribute the load on servers, collect information about User preferences regarding the use of cookies, and so on. Cookies in this category include both session files and persistent cookies. Without these files, the Site does not work properly or does not work.

Analytical cookies are designed to collect information about how visitors use the Site.

Such data consists of connections, technical and aggregated usage data such as IP addresses, the date and time of the usage mark, the corresponding cookies and pixels installed on such a device or with which interaction is carried out through it, as well as recorded activity (sessions, clicks, use of functions, registered actions, movement mice and other interactions).

The operator can use analytical tools and corresponding cookies from various service providers, the main ones being: Yandex.Metrica, provided by YANDEX LLC:https://yandex.ru/legal/confidential/

Third-party cookies are used to embed third-party elements into a Website, such as feedback forms that allow the exchange of website content.

2.11. Cookie file management. Refusal to install cookies.

2.11.1. The personal data subject may prohibit the installation of some or all cookies.

2.11.2. Most browsers accept cookies automatically, but the Personal Data Subject has the option to control browser settings to block or delete cookies. Additional instructions for deleting cookies in the browser settings of the Personal Data Subject

2.12. The Operator does not verify the accuracy of the personal information provided by the Personal Data Subject.

3. The purpose of processing and the composition of information about personal data subjects that the Operator receives and processes

Goal 1.

Categories of subjects whose personal data aboutprocessed by: Site users, clients.

PD category: last name, first name, patronymic; email address; phone number; delivery address.

For what purpose: making and submitting an application on the Website in order to receive advice through feedback and further provision of services.

Processing methods: collection; recording; systematization; accumulation; storage; clarification (updating, modification); extraction; use; transfer (provision, access); blocking; deletion; destruction of personal data.

Processing and storage period: 5 years from the date of receipt or receipt from the personal data subject of a request to terminate processing/revoke consent or from the date of termination of the Operator's activities

The procedure for the destruction of personal data upon expiration of the processing period or upon the occurrence of other legal grounds: The Operator deletes personal data from the database.

Goal 2.

Categories of subjects whose personal data is processed: Counterparties; Representatives of counterparties; Beneficiaries under contracts;

PD category: last name, first name, patronymic; e-mail address; phone number; identity document data; bank card details; current account number; personal account number;

For what purpose: the conclusion and execution of a civil contract with the Subject of personal data.

The procedure for the destruction of personal data upon expiration of the processing period or upon the occurrence of other legal grounds: The Operator deletes personal data from the database.

Goal 3.

Categories of subjects whose personal data is processed: subjects of personal data - users of the Website, clients.

PD category: last name, first name, patronymic, phone number, e-mail.

For what purpose: sending messages, notifications, requests, responses, documents, advertising or informational messages to the Subject of personal data.

At the same time, the PD subject can refuse to receive such information at any time by sending an email to the Operator. info@rtmt.ru marked “Unsubscribe from informational and promotional mailing lists".

The procedure for the destruction of personal data upon expiration of the processing period or upon the occurrence of other legal grounds: The Operator deletes personal data from the database.

Goal 4.

Categories of subjects whose personal data is processed: subjects of personal data - users of the Website, clients.

PD category: name, phone number, photo image, email.

For what purpose: to promote services on the market in the form of collecting reviews, comments and other ways.

Processing methods: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (access, provision), blocking, deletion, destruction of personal data.

The procedure for the destruction of personal data upon expiration of the processing period or upon the occurrence of other legal grounds: The operator deletes personal data from the database

Goal 5.

Categories of subjects whose personal data is processed: employees who are in an employment relationship, job seekers, former employees.

PD category: Personal data that is not special or biometric: last name, first name, patronymic; date of birth; place of birth; e-mail address; place of residence; registration address; phone number; SNILS; INN; citizenship; identity document data; driver's license data; bank card details; billing account number accounts; personal account number; profession; position; information about work (including work experience, current employment data, indicating the name and current account of the organization); information about education;

For what purpose: Maintaining personnel and accounting records. The conclusion and execution of an employment contract, the exercise by the employer of the functions, duties and powers assigned to him by law within the framework of the employment relationship.

Processing methods: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, depersonalization, transfer (access, provision), blocking, deletion, destruction of personal data.

The procedure for the destruction of personal data upon expiration of the processing period or upon the occurrence of other legal grounds: The Operator deletes personal data from the database.

Goal 6.

Categories of subjects whose personal data is processed: subjects of personal data - Clients.

PD category: last name, first name, patronymic; email address; phone number; delivery address

For what purpose: Provision of services in the field of medical equipment sales

The procedure for the destruction of personal data upon expiration of the processing period or upon the occurrence of other legal grounds: The operator deletes personal data from the database

Goal 7.

Categories of subjects whose personal data is being processed: Site visitors;

PD category: information collected through metric programs; information about the web browser; IP address; location data; software and hardware specifications; access time; cookies;

For what purpose: Ensuring the smooth operation of the website, its functions, the formation of customer statistics on the use of sections of the website and its services

The procedure for the destruction of personal data upon expiration of the processing period or upon the occurrence of other legal grounds: The Operator deletes personal data from the database.

3.2. If it is necessary to use personal information about users (buyers) for purposes not provided for in the Policy, the Operator requests the consent of the user (buyer) for such actions.

4. Legal grounds for personal data processing

4.1. The Policy has been developed in accordance with Clause 2, Part 1, Article 18.1 of the Federal Law "On Personal Data".

4.2. The Policy contains information subject to disclosure in accordance with Part 1 of Article 14 of the Federal Law "On Personal Data" and is a publicly available document.

4.3. Legal grounds for personal data processing:

the processing of personal data is carried out with the consent of the personal data subject to the processing of his personal data;
The processing of personal data is necessary for the performance of an agreement to which the personal data subject is a party or beneficiary or guarantor, as well as for the conclusion of an agreement on the initiative of the personal data subject or an agreement under which the personal data subject will be the beneficiary or guarantor.

4.4. The Operator processes personal information, including personal data, only if:

4.4.1. processing is necessary to achieve its goals and fulfill contractual obligations of the Operator to the Subjects of personal data.

4.4.2. Processing is necessary to comply with legal obligations.

4.4.3. when required by applicable law, processing is necessary to ensure the legitimate interests of the Operator if such processing does not significantly affect the interests, fundamental rights and freedoms of the Personal Data Subject. When processing personal information on this basis, the Operator will always strive to maintain a balance between its legitimate interests and protecting the confidentiality of the Personal Data Subject.

5. The rights of the subjects of personalavailable data

5.1. In accordance with the Federal Law "On Personal Data", the personal data subject has the following rights when processing personal data:

the right to access personal data;
the right to clarify personal data;
the right to block and delete personal data;
the right to appeal against our actions or our omissions;
the right to appeal against decisions taken solely on the basis of
automated processing of their personal data;
the right to withdraw consent.

6. Request for additional information to identify the personal data subject

6.1. During the exercise of the rights of the Personal Data Subject, the Operator may request additional information that will allow the Operator to reliably identify the Personal Data Subject.

6.2. The Operator will not be able to exercise the rights of the Personal Data Subject if, in response to the request, he does not provide additional information for his identification.

Conditions for providing information on the rights of a Personal data subject

6.3. Information related to the exercise of the rights of the Personal Data Subject is provided free of charge. If the request is clearly unreasonable or excessive, in particular due to its repetitive nature, the Operator refuses to respond or charges a fee for providing the requested information.

The right to access personal data

6.4. The personal data subject has the right to receive reliable information from the Operator about the processing of his personal data, and, if possible, access to personal data and the following information:

6.4.1. confirmation of the fact of personal data processing by the operator;

6.4.2. legal grounds and purposes of personal data processing;

6.4.3. purposes and methods of personal data processing used by the operator;

6.4.4. the name and location of the operator, information about persons (with the exception of the operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the operator or on the basis of federal law;

6.4.4. processed personal data related to the Subject, the source of their receipt;

6.4.5. terms of personal data processing, including the terms of their storage;

6.4.6. the procedure for exercising your rights in accordance with 152-FZ;

6.4.7. information about the completed or proposed cross-border data transfer;

6.4.8. the name or surname, first name, patronymic and address of the person who processes personal data on behalf of the operator, if the processing is or will be entrusted to such a person.

The right to clarify personal data

6.5. The personal data subject has the right to require the Operator to clarify his personal data, which is processed by the Operator.

6.6. The Operator is obliged to clarify the personal data or ensure that it is clarified (if the processing of personal data is carried out by another person acting on behalf of the operator) within 7 working days from the date of submission of such information.

The right to block and delete personal data

6.7. The personal data subject has the right to require the Operator to block and delete his personal data processed by the Operator.

6.8. If the Operator is unable to delete personal data, he has the right to block them for up to 6 months and find a solution to delete them during this period. The Operator also has the right, instead of deleting, to depersonalize personal data so that it is impossible to determine whose they are.

6.9. After blocking, deleting or depersonalizing your personal data, the Operator notifies the Personal Data Subject about this.

The right to appeal against the actions or omissions of the Operator

6.10. The personal data subject has the right to object to the processing of his personal data in response to the actions or omissions of the Operator. To do this, the Subject of personal data can contact the territorial authority of Roskomnadzor in his region.

The right to withdraw consent

6.11. If the Subject's data is processed on the basis of consent, the Subject has the right to revoke it.

The procedure for revoking consent to the processing of personal data, updating and correcting personal data, responding to requests for access to personal data

6.12. The subject of personal data has the right at any time to revoke the consents and permissions granted for the processing of personal data, as well as to refuse to inform and distribute, by sending an e-mail message info@rtmt.ru .

6.13. The personal data subject has the right to request that personal data be deleted, corrected, updated, restricted, or objected to processing personal data when required by applicable law. The Operator responds to these requests in accordance with applicable law.

6.14. In case of confirmation of the inaccuracy of personal data or the illegality of their processing, personal data must be updated by the Operator, and processing must be terminated.

6.15. The Operator is obliged to inform the Personal Data Subject or his representative about the processing of his personal data upon his request.

6.16. Upon achievement of the purposes of personal data processing, as well as in the case of withdrawal by the User of consent to their processing, personal data is subject to destruction, unless otherwise provided by an agreement to which the Personal Data Subject is a party, beneficiary or guarantor; The Operator is not entitled to process without the consent of the Personal Data Subject on the grounds provided for by the Federal Law "On Personal data" or other federal laws; unless otherwise provided by another agreement between the Operator and the Subject of Personal data.

7. Cases when the Operator cannot exercise the rights of the Personal Data Subject

7.1. The Operator may limit the scope of the obligations and rights of the Personal Data Subject (to access, clarify, block or delete the data) in the following cases::

7.1.1. the processing of personal data, including personal data obtained as a result of operational search, counterintelligence and intelligence activities, is carried out for the purposes of national defense, state security and law enforcement;

7.1.2. personal data is processed by the authorities that detain the subject of personal data on suspicion of committing a crime, or have charged the subject of personal data in a criminal case, or have applied a preventive measure to the subject of personal data before the charge is brought, except in cases provided for by the criminal procedure legislation of the Russian Federation, if it is allowed to familiarize the suspect or the accused with such personal data;

7.1.3. personal data is processed in accordance with the legislation on countering the legalization (laundering) of proceeds from crime and the financing of terrorism.;

7.1.4. the access of the personal data subject to his personal data violates the rights and legitimate interests of third parties;

7.1.5. personal data is processed in cases stipulated by the legislation of the Russian Federation on transport security in order to ensure the stable and safe functioning of the transport complex, protect the interests of individuals, society and the state in the field of transport complex from acts of unlawful interference.

7.1.6. when the Operator has legitimate grounds to continue processing the Subject's personal data.

8. Data Security

8.1. The personal data that the Operator collects and stores is considered confidential information. They are protected from loss, alteration or unauthorized access according to the legislation of the Russian Federation in the field of personal data. To do this, the Operator applies technical means and organizational measures. We are constantly improving our data protection systems.

8.2. The Operator has implemented sufficient technical and organizational measures to protect personal data from unauthorized, accidental or unlawful destruction, loss, alteration, misuse, disclosure or access, as well as other illegal forms of processing. These security measures were implemented taking into account the state-of-the-art technology, the cost of their implementation, the risks associated with the processing and nature of personal data, including the following measures:

8.2.1. antivirus protection with updated databases;

8.2.2. limitation of the number of persons who have access to personal data.

8.3. The Operator will store personal data for as long as it is necessary to achieve the purpose for which they were collected, or to comply with the requirements of legislation and regulations.

9. Rules of procedure for responding to requests/requests from personal data subjects and their representatives, authorized bodies

9.1. The Subject may send a request either in electronic form or by e-mail. In this case, the request is signed by the PEP of the Personal Data Subject in accordance with the legislation of the Russian Federation. The Operator does not process requests related to the transfer or disclosure of Personal Data received by telephone, due to the lack of an opportunity to identify the identity of the Personal Data Subject.

9.2. The deadline for providing a response to the Personal Data Subject does not exceed 10 (ten) business days from the date of receipt of the request. In the information provided to the Subject of personal data, yesavailable in an accessible form, it does not contain personal data related to other Subjects of Personal data.

10. Transfer of personal data to third parties:

Name of the third party, INN, OGRN	Transfer purpose	Address of a third party	The amount of personal data that is transferred
Yandex LLC TAX ID: 7736207543, OGRN: 1027700229193	Implementation of the Yandex.Metrica service	16 Lva Tolstogo str., Moscow, 119021	information collected through metric programs; information about the web browser; IP address; location data; software and hardware specifications; access time; cookies;

11. Procedure for the destruction of personal data

11.1. The Operator destroys the information containing the personal data of the PD Subject on time.:

no later than 10 days from the date of the PD Subject's request,
no later than 30 days from the date of expiration of the storage period, the validity period, the achievement of the purpose of processing personal data or the loss of the need to achieve them.

11.2. Destruction occurs in one of the following ways::

11.2.1. destruction of the media on which the information containing the personal data of the PD Subject is located;

11.2.2. in order to destroy the personal data contained in the information system, the Operator performs actions as a result of which it becomes impossible to restore the content of personal data in this information system.

11.3. If personal data is processed by the Operator using automation tools, the documents confirming the destruction of personal data of personal data subjects are an act on the destruction of personal data and an upload from the event log in the personal data information system.

11.4. Drawing up an Act of destruction of personal data of the PD Subject.

The act specifies:
date, place and time of destruction;
surname and initials of the Commission members (if any);
type and number of media to be destroyed containing personal data of personal data subjects (if media are destroyed);
grounds for destruction;
the method of destruction.

11.5. The fact of destruction of media containing personal data of PD Subjects is recorded in the register of documents submitted for destruction. This document is a confidential document and, together with the certificates, is stored on an electronic medium at the Operator's place of registration.

RTMT LLC

INN: 7702508486, OGRN 1037739994874

12 Staraya Basmannaya str., building 5, office 6, Moscow, 105064, Russia