CIR — Center for Innovation and Research
RU← Home
Legal information

Personal Data Processing Policy for the Website

Download the Policy (PDF) · Download the Consent to Personal Data Processing (PDF)

1. GENERAL PROVISIONS

1.1. This document (the “Policy”) sets out the policy concerning the processing of personal data of users of the website of Акционерное общество «Центр Исследований и Разработок» (the “Operator”) in the information and telecommunications network Internet at https://cir-innovations.ru.

1.2. This Policy has been developed pursuant to Clause 2 of Part 1 of Article 18.1 of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” and the Recommendations on Preparing a Document Defining an Operator’s Personal Data Processing Policy, in accordance with the procedure established by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.

1.3. In compliance with Part 2 of Article 18.1 of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”, this Policy is made publicly available on the Operator’s Website on the Internet.

1.4. The terms contained in Article 3 of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” are used in this Policy with the same meanings.

1.5. The following terms are also used in this Policy:

User means any person who visits the Website and uses its information, materials, and services. A Website User is a personal data subject within the meaning of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.

Personal Data Subject means an individual to whom personal data relates directly or indirectly, that is, any information that makes it possible to identify that individual. Legal entities, including state and municipal authorities, cannot be personal data subjects.

Website Services means interactive software components on Website pages that are used to integrate with information systems and provide Website Users with certain means of accessing information on the Website.

Personal Data means any information relating directly or indirectly to an identified or identifiable individual (personal data subject);

Personal Data Operator (Operator) means Акционерное общество «Центр Исследований и Разработок» (АО «ЦИР», Taxpayer Identification Number (ИНН) 7708419659), which independently or jointly with other persons arranges and/or carries out personal data processing and determines the purposes of personal data processing, the personal data to be processed, and the actions (operations) performed with personal data;

Personal Data Processing means any action (operation) or set of actions (operations) performed with personal data, whether or not by automated means. Personal data processing includes, without limitation, collection, recording, systematization, accumulation, storage, clarification (updating or alteration), retrieval, use, transfer (dissemination, provision, or access), depersonalization, blocking, deletion, and destruction;

Automated Personal Data Processing means personal data processing using computer equipment;

Personal Data Dissemination means actions aimed at disclosing personal data to an indefinite number of persons;

Personal Data Provision means actions aimed at disclosing personal data to a specific person or a specific group of persons;

Personal Data Blocking means the temporary suspension of personal data processing, except where processing is required to clarify personal data;

Personal Data Destruction means actions resulting in the impossibility of restoring the contents of personal data in a personal data information system and/or the destruction of physical media containing personal data;

Personal Data Depersonalization means actions resulting in the impossibility of determining, without additional information, that personal data relates to a particular personal data subject;

Personal Data Information System means a set of personal data contained in databases and the information technologies and technical means that enable its processing;

Cross-Border Transfer of Personal Data means the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign individual, or a foreign legal entity;

Website means a collection of computer programs and other information contained in an information system, access to which is provided through the Internet and which is available at https://cir-innovations.ru/.

1.6. Rights and obligations of the Operator.

1.6.1. The Operator shall:

1.6.2. The Operator may:

1.7. Rights and obligations of the User.

1.7.1. The User shall:

1.7.2. The User may:

The Operator and Users also have other rights and obligations provided by the legislation of the Russian Federation.

2. PURPOSES OF PERSONAL DATA PROCESSING

2.1. Personal data processing is limited to achieving specific, predetermined, and lawful purposes. Personal data may not be processed in a manner incompatible with the purposes for which it was collected. Personal data processed must not be excessive in relation to the stated purposes of processing.

Only personal data that corresponds to the purposes of processing shall be processed.

2.2. The Operator processes a User’s personal data for the following purposes:

2.2.1. Identifying a User registered on the Website in order to:

2.2.2. Informing the User about operation of the Website and its Services and monitoring and improving the quality of the Services.

2.2.3. Providing the User with access to personalized Website resources.

2.2.4. Establishing contact with the User, including sending notices and enquiries concerning use of the Website, provision of services, performance of work, and processing the User’s enquiries and applications.

2.2.5. Determining the User’s location to ensure security and prevent fraud involving the User’s personal data on the Website.

2.2.6. Creating an account to access the Services where the User has consented to creation of an account.

2.2.7. Providing effective customer and technical support to the User where issues arise in connection with use of the Website.

2.2.8. Sending advertising to the User with the User’s prior consent.

3. LEGAL GROUNDS FOR PERSONAL DATA PROCESSING

3.1. The Operator processes personal data on the following legal grounds:

4. PROCEDURE AND CONDITIONS FOR PERSONAL DATA PROCESSING, INCLUDING THE USE OF COOKIES

4.1. The Operator processes personal data in accordance with the requirements of the legislation of the Russian Federation in the following ways:

4.2. The Operator uses cookies and similar technologies to process a User’s personal data in accordance with Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”.

Cookies are small text files stored on a User’s device when the User visits the Website.

4.3. Cookies transmitted to a Personal Data Subject’s devices may be used to provide personalized Website functions, to display personalized advertising to the Personal Data Subject, for statistical and research purposes, and to improve operation of the Website.

4.3.1. The Operator uses cookies exclusively for the following purposes:

4.3.2. Personal data processing through strictly necessary cookies is carried out without obtaining separate User consent in the cases provided by the legislation of the Russian Federation.

4.3.3. Personal data processing through analytics and marketing cookies is carried out only after the User’s prior consent has been obtained.

4.4. The Personal Data Subject understands that the hardware and software used to visit websites on the Internet may support blocking cookies for all or selected websites and deleting cookies previously received.

4.4.1. When a User first visits the Website, the User is given an opportunity to consent to the use of cookies through an appropriate interface (cookie banner).

4.4.2. The User may:

4.4.3. The User may independently manage cookies through browser settings, including by deleting cookies previously stored and blocking their use.

4.4.4. Disabling strictly necessary cookies may limit the functionality of the Website.

4.4.5. The Operator records the User’s consent, and the User may withdraw it at any time by changing the Website or browser settings.

4.5. The Operator may make certain Website functions available only where the Personal Data Subject’s device is configured to accept cookies.

4.6. The structure, content, and technical parameters of cookies are determined by the Operator and may change without prior notice to the Personal Data Subject.

4.7. The following categories of data may be processed through cookies:

4.8. For analytics and Website improvement purposes, the Operator may use third-party services, such as web analytics systems. Where such services are used, the Operator ensures compliance with the applicable legislation of the Russian Federation, including requirements governing cross-border transfers of personal data.

4.8.1. Before commencing a cross-border transfer of personal data, the Operator shall ensure that the foreign state to whose territory the personal data is to be transferred provides reliable protection of the rights of personal data subjects.

4.8.2. A cross-border transfer of personal data to the territory of a foreign state that does not meet the requirements stated above may be carried out only where the personal data subject has given written consent to the cross-border transfer of their personal data and/or where required to perform a contract to which the personal data subject is a party.

4.9. Use of Yandex Forms

To collect and process Users’ personal data when they complete forms placed on the Website at https://cir-innovations.ru/, the Operator uses the Yandex Forms service.

Personal data processing through Yandex Forms is carried out in accordance with the terms of use of Yandex services and the requirements of the legislation of the Russian Federation governing personal data. Yandex ensures the confidentiality and security of the personal data processed in accordance with the applicable requirements of the legislation of the Russian Federation.

5. BLOCKING, CLARIFICATION, AND DESTRUCTION OF PERSONAL DATA. RESPONSES TO USERS’ REQUESTS FOR ACCESS TO PERSONAL DATA

5.1. Where unlawful personal data processing is identified following an enquiry or request from a User or the User’s representative, or a request from the authority responsible for protecting the rights of personal data subjects, the Operator shall block, or arrange for the blocking of, the unlawfully processed personal data relating to the relevant User from the time of the enquiry or receipt of the request for the duration of the review.

Where inaccurate personal data is identified following an enquiry or request from a User or the User’s representative, or a request from the authority responsible for protecting the rights of personal data subjects, the Operator shall block, or arrange for the blocking of, the personal data relating to that User from the time of the enquiry or receipt of the request for the duration of the review, provided that blocking the personal data does not infringe the rights and legitimate interests of the User or third parties.

5.2. Where the inaccuracy of personal data is confirmed, the Operator shall clarify, or arrange for the clarification of, the personal data on the basis of information provided by the User or the User’s representative, the authority responsible for protecting the rights of personal data subjects, or other necessary documents, within seven business days after such information is provided.

5.3. Where unlawful personal data processing is identified, the Operator shall cease, or arrange for the cessation of, such unlawful processing within three business days after it is identified. Where it is impossible to ensure lawful processing, the Operator shall destroy, or arrange for the destruction of, that personal data within ten business days after the unlawful processing is identified.

5.4. When the purpose of personal data processing has been achieved, the Operator shall destroy, or arrange for the destruction of, the personal data within thirty days after the purpose is achieved, unless otherwise provided by a contract to which the User is a party, beneficiary, or guarantor, another agreement between the Operator and the User, or unless the Operator is entitled to process the personal data without the User’s consent on the grounds provided by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” or other federal laws.

5.5. Where the User withdraws consent to the processing of their personal data and retention of the personal data is no longer required for the purposes of processing, the Operator shall destroy, or arrange for the destruction of, the personal data within thirty days after receipt of the withdrawal, unless otherwise provided by a contract to which the User is a party, beneficiary, or guarantor, another agreement between the Operator and the User, or unless the Operator is entitled to process the personal data without the User’s consent on the grounds provided by Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” or other federal laws.

5.6. Within seven business days after a User or the User’s representative provides information confirming that personal data was obtained unlawfully or is not required for the stated processing purpose, the Operator shall destroy that personal data.

5.7. Personal data processed shall be destroyed where it is no longer required to achieve the processing purposes, unless otherwise provided by federal law.

6. PERSONAL DATA PROTECTION

6.1. The Operator takes the legal, organizational, and technical measures necessary to protect personal data against unlawful or accidental access, destruction, alteration, blocking, dissemination, and other unauthorized actions, including by:

7. FINAL PROVISIONS

7.1. The Operator may send advertising and informational communications to a Personal Data Subject by email, SMS, and push notification only with the Personal Data Subject’s prior consent to receive advertising in accordance with Part 1 of Article 18 of Federal Law No. 38-FZ dated 13 March 2006 “On Advertising”. Consent to receive advertising communications from the Operator by email, SMS, and push notification shall be given in writing or electronically by selecting the relevant checkbox on the Website.

7.2. A Personal Data Subject may opt out of advertising communications by following the relevant link in an email received from the Operator, sending an opt-out notice to the support service at the Operator’s address: 101000, Moscow, intracity territory of the Krasnoselsky Municipal District, 13 Milyutinsky Lane, Building 1, Premises I, or submitting a corresponding request to the Operator by email at info@cir-innovations.ru.

7.3. In compliance with Part 2 of Article 18.1 of Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”, this Policy is available at the Operator’s premises and is made publicly available on the Website on the Internet.