This is an English translation provided for convenience. The Russian version is the legally binding text.
1. General provisions
1.1.This Policy sets out the procedure and conditions for processing personal data at Outsourcing Company LLC (hereinafter the Operator, ITWONLINE) and the measures taken to protect it.
1.2.The Policy has been developed in accordance with Russian Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (hereinafter the Personal Data Law) and the regulations adopted under it.
1.3.The Policy applies to all personal data processed by the Operator, including data received through the websites itwonline.ru, itwonline.net and their subdomains (hereinafter the Website), by phone, email, messengers and in the course of performing contracts.
1.4.The Policy is published on the Website in the public domain in accordance with Part 2 of Article 18.1 of the Personal Data Law.
2. Operator details
| Full name | Outsourcing Company Limited Liability Company (ООО «Аутсорсинговая компания») |
| Short name | OOO AK (ООО «АК») |
| INN / KPP | 2317063010 / 231701001 |
| OGRN | 1122367002010, registered on April 24, 2012 |
| Registered address | 5 Golubye Dali St., 56, Adler district, Sochi, Krasnodar Krai, 354382, Russia |
| Address for written requests | The registered address above |
| Office | 42k5 Gastello St., Sochi, Russia |
| Email for personal data requests | sales@itwonline.ru |
| Phone | +7 988 233-20-89 |
| Person responsible for organizing personal data processing | CEO Alexander V. Bobov |
3. Definitions
Personal data means any information relating directly or indirectly to an identified or identifiable individual (data subject).
Processing of personal data means any operation or set of operations performed on personal data: collection, recording, organization, accumulation, storage, clarification (updating, alteration), retrieval, use, transfer (provision, access), depersonalization, blocking, erasure, destruction.
Automated processing means processing of personal data using computer equipment.
Assignment means a contract or other instrument under which the Operator entrusts personal data processing to another person, or another operator entrusts processing to the Operator.
Cookie means a small piece of data that the Website stores in the visitor's browser.
Other terms are used as defined in the Personal Data Law.
4. Legal grounds for processing
- Constitution of the Russian Federation;
- Federal Law No. 152-FZ of July 27, 2006 “On Personal Data”;
- Civil Code, Labor Code and Tax Code of the Russian Federation;
- Federal Law No. 402-FZ of December 6, 2011 “On Accounting”;
- Federal Law No. 38-FZ of March 13, 2006 “On Advertising”;
- Federal Law No. 125-FZ of October 22, 2004 “On Archiving in the Russian Federation”;
- contracts between the Operator and the data subject or their employer;
- the data subject's consent to processing, given separately from other documents in accordance with Article 9 of the Personal Data Law.
5. Purposes of processing, categories of data subjects, data and retention periods
5.1.The Operator processes only the personal data needed for a specific purpose. Processing incompatible with the purposes of collection is not allowed.
5.2.The Operator does not process special categories of personal data (concerning race, nationality, political views, religious beliefs, health or intimate life) or biometric personal data, except where expressly required by law in the context of employment.
| Purpose | Data subjects | Data | Legal ground | Period |
|---|---|---|---|---|
| Handling Website requests, consultations, preparing commercial proposals | Website visitors, prospective clients and their representatives | Full name; phone; email; preferred contact method; organization name; industry; content of the request | Consent (Art. 6(1)(1)) | 3 years from the last request or until consent is withdrawn |
| Concluding and performing contracts | Clients, counterparties and their representatives | Full name; position; phone; email; power of attorney details; sole proprietor details | Contract (Art. 6(1)(5)); legitimate interest (Art. 6(1)(7)) | Term of the contract and 5 years after it ends |
| Technical support and handling requests from clients' users | Clients' employees | Full name; position; phone; email; accounts in the client's systems; content of the request | Contract with the client; client's assignment (Art. 6(3)) | Term of the contract, after which data is returned to the client or destroyed |
| Marketing and information mailings | Persons who have consented to receive advertising | Full name; phone; email | Separate consent (Art. 6(1)(1); Art. 18(1) of the Advertising Law) | Until consent is withdrawn |
| Traffic analysis and Website improvement | Website visitors | Cookie identifiers; IP address; information about the browser, device and actions on the Website | Consent via the cookie banner | Until consent is withdrawn, no longer than 1 year |
| HR and accounting, compliance with labor law | Employees, former employees, their relatives where required by law | Data required by the Labor Code and tax and insurance legislation | Law (Art. 6(1)(2)); employment contract | Periods set by archiving legislation |
| Recruitment | Job candidates | Full name; contacts; education and work experience from the CV | Consent (Art. 6(1)(1)) | Until the vacancy is closed; with the candidate's consent, up to 1 year |
6. Processing procedure and conditions
6.1.The Operator processes personal data both with and without automation.
6.2.The Operator performs the following operations: collection, recording, organization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), blocking, erasure, destruction.
6.3.When collecting personal data of Russian citizens, including through the Website, recording, organization, accumulation, storage, clarification and retrieval are carried out using databases located in the Russian Federation (Part 5 of Article 18 of the Personal Data Law).
6.4.Cross-border transfer of personal data is not carried out. Should such a need arise, the Operator will notify Roskomnadzor in advance and amend this Policy.
6.5.If the data subject chooses a messenger for communication (Max, Telegram, WhatsApp), correspondence takes place through that service on its owner's terms. The Operator does not transfer data from its databases to messengers beyond what is needed to respond to the request.
6.6.Processing ends when its purposes are achieved, the period expires, consent is withdrawn (unless there are other legal grounds), unlawful processing is detected or the Operator is liquidated.
6.7.Personal data is destroyed within the periods set by Article 21 of the Personal Data Law. Destruction is confirmed by a certificate and a log extract in accordance with the Requirements approved by Roskomnadzor Order No. 179 of October 28, 2022.
7. Processing personal data on behalf of clients
7.1.When maintaining clients' IT infrastructure, the Operator's staff may gain access to personal data processed by the client: 1C databases, email, file storage, CCTV recordings and call recordings.
7.2.In such cases the client remains the personal data operator, and ITWONLINE processes the data only on the client's instructions (Part 3 of Article 6 of the Personal Data Law). The terms of the assignment, the list of operations and protection requirements are set out in the contract with the client.
7.3.The Operator does not use clients' data for its own purposes, does not copy it outside the client's systems without written instructions, maintains confidentiality and the protection measures under Article 19 of the Personal Data Law, and informs the client of incidents within the period set by the contract.
8. Cookies and analytics
8.1.The Website uses two types of cookies.
| Type | Purpose | When enabled |
|---|---|---|
| Essential | Operation of the Website and forms, remembering your cookie banner choice | Always |
| Analytics | Visit statistics via Yandex Metrica (Yandex LLC, data stored in Russia) | Only after you click “Accept all” |
8.2.The analytics counter is not loaded until the visitor consents. The visitor can withdraw consent by deleting cookies in the browser settings; the Website will ask for consent again on the next visit.
8.3.The Operator does not use advertising or retargeting cookies.
9. Transfer of personal data to third parties
9.1.The Operator transfers personal data to third parties only where there is a legal ground and only to the extent necessary for the purpose.
9.2.Personal data may be processed on the Operator's behalf by:
- the Website hosting provider with servers in Russia;
- a request tracking service (CRM) with data stored in Russia;
- an email service with data stored in Russia;
- a mailing service, only for persons who have consented to receive advertising;
- Yandex LLC, Yandex Metrica service, if analytics cookies are accepted.
9.3.Persons processing data on the Operator's behalf must comply with the principles, rules and protection measures set out in the Personal Data Law.
9.4.The Operator provides personal data to government authorities (tax and law enforcement authorities, courts) in the cases and manner prescribed by law.
9.5.The Operator does not sell personal data or make it publicly available.
10. Rights of the data subject
The data subject has the right to:
- receive information about the processing of their personal data to the extent provided by Part 7 of Article 14 of the Personal Data Law;
- demand that data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- withdraw consent to personal data processing and consent to receive advertising;
- demand that processing of their personal data stop;
- appeal against the Operator's actions or inaction to Roskomnadzor or in court;
- protect their rights and legitimate interests, including claiming damages and compensation for moral harm in court.
11. Requests and withdrawal of consent
11.1.A request or withdrawal of consent can be sent to sales@itwonline.ru or by letter to the registered address given in Section 2.
11.2.The request must contain information identifying the data subject and their relationship with the Operator (Part 3 of Article 14 of the Personal Data Law). An electronic request is signed with an electronic signature in accordance with the law.
11.3.The Operator responds within 10 business days of receipt. This period may be extended by no more than 5 business days with a reasoned notice to the data subject.
11.4.When consent is withdrawn, the Operator stops processing and destroys the data within 30 days unless there are other legal grounds for processing. On a demand to stop processing, the Operator stops it within 10 business days in accordance with Part 5.1 of Article 21 of the Personal Data Law.
11.5.You can unsubscribe from marketing mailings at any time by replying to a message or writing to the email given in clause 11.1. Mailings stop immediately.
12. Personal data protection measures
The Operator takes legal, organizational and technical measures under Articles 18.1 and 19 of the Personal Data Law, including:
- appointing a person responsible for organizing personal data processing;
- approving internal regulations on personal data processing and protection and familiarizing employees with them;
- assessing the harm that may be caused to data subjects in accordance with Roskomnadzor Order No. 178 of October 27, 2022;
- identifying security threats and the protection level of information systems in accordance with Government Decree No. 1119 of November 1, 2012 and applying measures under FSTEC Order No. 21 of February 18, 2013;
- restricting access: only employees who need data to perform their duties are granted access;
- using antivirus protection, firewalls, backups and access logging;
- keeping records of storage media containing personal data;
- carrying out internal audits of compliance with the law.
13. Incident response
13.1.If unlawful or accidental transfer of personal data that violated data subjects' rights is detected, the Operator notifies Roskomnadzor in accordance with Part 3.1 of Article 21 of the Personal Data Law:
- within 24 hours: about the incident, its presumed causes, the harm, the measures taken and a contact person;
- within 72 hours: about the results of the internal investigation and the persons whose actions caused the incident, if identified.
13.2.The Operator cooperates with GosSOPKA, the state system for detecting and responding to computer attacks, as prescribed by law.
14. Final provisions
14.1.The Operator may amend the Policy. A new version takes effect when published on the Website unless otherwise stated in it.
14.2.The Policy is reviewed when legislation changes and at least once a year.
14.3.Compliance with the Policy is monitored by the person responsible for organizing personal data processing.
14.4.The previous version of the Policy published on the Website ceases to apply from the date of publication of this version.