1. General provisions
1.1 The policy of the Limited Liability Company “VISA PRO INDONESIA” (hereinafter referred to as “Operator”) regarding the processing of personal data (hereinafter referred to as “Policy”) is developed in order to ensure the protection of the rights and freedoms of the subject of personal data during the processing of his/her personal data, including the protection of the rights to privacy, personal and family secrecy.
1.2 The Policy is developed in accordance with the provisions of the Federal Law dated July 27, 2006 N 152-FZ “On Personal Data” (hereinafter – the Federal Law “On Personal Data”) and the recommendations of the Federal Service for Supervision of Communications, Information Technology and Mass Communications dated July 31, 2017. “Recommendations on drafting a document defining the operator’s policy regarding the processing of personal data in the manner prescribed by the Federal Law dated July 27, 2006 N 152-FZ “On Personal Data”.
1.3 Basic concepts used in the Policy:
1.3.1 Personal data – any information relating to a directly or indirectly defined or identifiable natural person (subject of personal data).
1.3.2 Processing of personal data – any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools. Processing of personal data includes, but is not limited to:
- collection;
- recording;
- systematizing;
- accumulation;
- storage;
- clarification (update, change);
- extraction;
- utilization;
- transfer (distribution, provision, access);
- depersonalization;
- blocking;
- deletion;
- destruction.
1.3.3 Automated processing of personal data – processing of personal data by means of computer equipment.
1.3.4 Dissemination of personal data – actions aimed at disclosure of personal data to an indefinite number of persons.
1.3.5. Provision of personal data – actions aimed at disclosure of personal data to a certain person or a certain circle of persons.
1.3.6. Blocking of personal data – temporary cessation of personal data processing (except for cases when processing is necessary to clarify personal data).
1.3.7 Destruction of personal data – actions, as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed.
1.3.8 Impersonalization of personal data – actions as a result of which it becomes impossible to determine, without the use of additional information, whether personal data belong to a particular subject of personal data.
1.3.9. Personal data operator (operator) – a state authority, municipal authority, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out processing of personal data, as well as determining the purposes of personal data processing, composition of personal data subject to processing, actions (operations) performed with personal data.
1.4 The Operator, having obtained access to personal data, is obliged to observe confidentiality of personal data – not to disclose to third parties and not to disseminate personal data without the consent of the subject of personal data, unless otherwise provided by federal law.
1.5 The subject of personal data has the right to receive information regarding the processing of his/her personal data, including information containing:
- confirmation of the fact of personal data processing by the Operator;
- legal grounds and purposes of personal data processing;
- purposes and methods of personal data processing applied by the Operator;
- name and location of the Operator, information about persons (except for the Operator’s employees) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Operator or on the basis of federal law;
- personal data being processed relating to the respective personal data subject, the source of their obtaining, unless another procedure for submission of such data is provided for by the federal law;
- the terms of personal data processing, including the terms of their storage;
- the procedure for exercising by the subject of personal data the rights provided for by the federal law;
- information on the realized or expected trans-border data transfer;
- name or surname, first name, patronymic and address of the person processing personal data on behalf of the Operator, if the processing is or will be entrusted to such a person;
- other information stipulated by the Federal Law “On Personal Data” or other federal laws.
1.6 The subject of personal data has the right to demand from the Operator to clarify his/her personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect his/her rights.
1.7 The personal data operator has the right to:
- defend its interests in court;
- provide personal data of the subjects to third parties, if it is provided for by the current legislation (tax, law enforcement agencies, etc.);
- refuse to provide personal data in cases stipulated by the legislation;
- use personal data of the subject without his/her consent in cases stipulated by the legislation.
1.8 When collecting personal data, the Operator is obliged to provide the subject of personal data, upon his/her request, with the information stipulated by Article 14.7 of the Federal Law “On Personal Data”.
1.9. When collecting personal data, including through the information and telecommunications network “Internet”, the operator is obliged to ensure the recording, systematization, accumulation, storage, clarification (update, change), extraction of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, except for cases specified in paragraphs 2, 3, 4, 8 of Part 1 of Article 6 of the Federal Law “On Personal Data”.
2. Purposes of personal data collection
The site collects and stores only the personal information that is necessary for the provision of services or execution of agreements and contracts with the User, except in cases where the legislation provides for mandatory storage of personal information for a period of time specified by law.
The Site processes the User’s personal information for the following purposes:
- Registration/authorization of the User on the Site/mobile application, identification of the User registered on the Site/mobile application;
- Providing the User with access to personalized resources of the Website;
- Establishing feedback with the User, including sending notifications, requests regarding the use of the Site/mobile application, including to the specified e-mail address and/or cell phone number, conclusion, execution of contracts, processing of requests and applications from the User;
- Determination of the User’s location to ensure security, fulfillment of contracts;
- Confirmation of reliability and completeness of personal information provided by the User;
- Improvement of the Website/mobile application services, convenience of their use, development of new services and services;
- Promotion of goods;
- Transmission and receipt of information about goods, services, as well as promotions, discounts, news via communication channels (including sms-messages);
- Conducting statistical and other research on the basis of anonymized personal data;
- Providing the User with effective customer and technical support in case of problems related to the use of the Website/mobile application.
3. Legal basis of personal data processing
3.1 The legal basis for personal data processing is:
- A set of legal acts, in pursuance of which and in accordance with which the Operator processes personal data: Constitution of the Russian Federation; Articles 86 – 90 of the Labor Code of the Russian Federation, contracts concluded between the Operator and the subject of personal data;
- consent to the processing of personal data (in cases not directly provided for by the legislation of the Russian Federation, but corresponding to the Operator’s powers).
4. Scope and categories of processed personal data, categories of personal data subjects
4.1 The content and scope of processed personal data correspond to the stated purposes of processing. Processed personal data shall not be redundant in relation to the stated purposes of their processing.
4.2 The categories of personal data subjects processed by the Operator include:
- natural persons – employees of the Operator;
- natural persons – applicants for vacant positions of the Operator;
- natural persons – employees of the Operator’s contractors;
- individuals – employees of the Operator’s contractors;
- natural persons – clients of the Operator.
4.3 The lists of categories of personal data processed by the Operator for each category of personal data subjects are listed on the website of the Federal Service for Supervision of Communications, Information Technology and Mass Media in the Register of Operators Processing Personal Data under registration number No. 2940572.
4.4 Processing of special categories of personal data concerning racial, national origin, political views, religious or philosophical beliefs, state of health, intimate life is allowed:
- in case the personal data subject has given his/her consent in writing to the processing of his/her personal data;
- in accordance with the legislation on state social assistance, labor legislation, pension legislation of the Russian Federation.
4.5 Processing of biometric personal data may be carried out only with the written consent of the personal data subject