- Home
- Service Rules
- Personal Data Protection and Processing Policy
Personal Data Protection and Processing Policy
1. General Provisions
1.1. This Personal Data Processing Policy (hereinafter the Policy) has been prepared in accordance with paragraph 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other regulatory legal acts of the Russian Federation concerning personal data protection and processing. It applies to all personal data (hereinafter the Data) that PLATEZHNAYA KOMPANIYA BYSTRYKH PLATEZHEY LLC (hereinafter the Operator) may obtain from a personal data subject who is a user of the website (https://vepay.online) and a client (customer of services) of the Operator.1.2. The Operator protects the personal data it processes against unauthorised access and disclosure, unlawful use or loss in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.
1.3. Amendments to the Policy
1.3.1. The Operator may amend this Policy. When amendments are made, the date of the latest revision is indicated in the Policy heading. A new version of the Policy takes effect when published on the website, unless that version provides otherwise.
2. Terms and Abbreviations
- Personal data (PD) means any information relating to a directly or indirectly identified or identifiable individual (personal data subject). - Personal data processing means any action (operation) or set of actions (operations) performed on personal data, with or without automated tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, alteration), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data.- Automated personal data processing means personal data processing using computer equipment.
- Personal data information system (PDIS) means the personal data contained in databases together with the information technologies and technical resources used to process them.
- Personal data made publicly available by the personal data subject means PD to which access for an unlimited number of persons has been granted by the personal data subject or at their request.
- Blocking personal data means temporarily suspending personal data processing, except where processing is necessary to clarify personal data.
- Destruction of personal data means actions that make it impossible to restore the content of personal data in a personal data information system and/or destroy physical media containing personal data.
- Operator means an organisation that, independently or jointly with others, organises personal data processing and determines the purposes of processing, the personal data to be processed and the actions (operations) performed on personal data. The Operator is VEPAY Limited Liability Company, located at: Office 302, 127 Karla Marksa Street, Kirov, Russia.
3. Personal Data Processing
3.1. Obtaining PD.3.1.1. All PD should be obtained from the data subject directly. If the subject’s PD can only be obtained from a third party, the subject must be notified or their consent must be obtained.
3.2. Processing PD.
3.2.1. Personal data are processed:
– with the personal data subject’s consent to the processing of their personal data;
– where personal data processing is necessary to exercise and fulfil functions, powers and duties imposed by Russian law;
– where access to the personal data for an unlimited number of persons has been granted by the personal data subject or at their request (hereinafter personal data made publicly available by the personal data subject).
3.2.2. Purposes of personal data processing:
– conducting civil-law relations.
3.2.3. Categories of personal data subjects. The PD of the following data subjects are processed:
– individuals in civil-law relations with the Operator.
3.2.4. PD processed by the Operator:
– data obtained in the course of civil-law relations.
3.2.5. Personal data are processed:
– using automated tools;
3.3. Storage of PD.
3.3.1. Subjects’ PD may be obtained electronically.
3.3.2. Subjects’ PD processed using automated tools for different purposes are stored in separate folders.
3.3.3. Documents containing PD must not be stored or placed in publicly accessible electronic directories (file-sharing repositories) in the PDIS.
3.3.4. PD are stored in a form that permits identification of the data subject for no longer than required for the purposes of processing. They must be destroyed once those purposes have been achieved or are no longer necessary.
3.4. Destruction of PD.
3.4.1. PD on electronic media are destroyed by erasing or formatting the media.
3.4.2. Destruction of PD is documented in a media destruction report.
3.5. Transfer of PD.
3.5.1. The Operator does not transfer PD to third parties except as provided for by Russian law.
4. Personal Data Protection
4.1. In accordance with regulatory requirements, the Operator has established a personal data protection system (PDPS) comprising legal, organisational and technical protection subsystems.4.2. The legal protection subsystem comprises legal, organisational, administrative and regulatory documents supporting the establishment, operation and improvement of the PDPS.
4.3. The organisational protection subsystem covers the PDPS management structure, the permissions system and information protection when working with employees, partners and third parties.
4.4. The technical protection subsystem comprises technical, software and combined hardware/software tools that protect PD.
4.5. The principal PD protection measures used by the Operator are:
4.5.1. Appointing a person responsible for PD processing who organises PD processing, training and instruction, and internal monitoring of compliance with PD protection requirements by the organisation and its employees.
4.5.2. Identifying relevant threats to PD security during processing in the PDIS and developing PD protection measures and activities.
4.5.3. Developing a personal data processing policy.
4.5.4. Establishing access rules for PD processed in the PDIS and ensuring that all actions performed on PD in the PDIS are logged and recorded.
4.5.5. Assigning individual passwords for employees to access the information system in accordance with their job responsibilities.
4.5.6. Using information protection tools that have undergone conformity assessment in accordance with the prescribed procedure.
4.5.7. Using certified antivirus software with regularly updated databases.
4.5.8. Maintaining conditions that safeguard PD and prevent unauthorised access.
4.5.9. Detecting incidents of unauthorised access to personal data and taking appropriate measures.
4.5.10. Restoring PD modified or destroyed as a result of unauthorised access.
4.5.11. Training the Operator’s employees directly involved in personal data processing on Russian personal data legislation, including personal data protection requirements, documents defining the Operator’s personal data processing policy and internal regulations on personal data processing.
4.5.12. Conducting internal monitoring and audits.
5. Principal Rights of the Data Subject and Duties of the Operator
5.1. Principal rights of the data subject. The subject has the right to access their personal data and the following information:– confirmation that the Operator processes their PD;
– the legal grounds and purposes of PD processing;
– the purposes and methods of PD processing used by the Operator;
– the Operator’s name and location;
– personal data processing periods, including retention periods;
– the procedure for exercising the data subject’s rights under the Federal Law.
The subject also has the right to:
– contact the Operator and submit requests;
– appeal against the Operator’s actions or omissions.
5.2. Duties of the Operator. The Operator must:
– provide information about PD processing when collecting PD;
– notify the subject if PD were obtained from a source other than the data subject;
– explain to the subject the consequences of refusing to provide PD;
– publish or otherwise provide unrestricted access to the document defining its PD processing policy and to information on the PD protection requirements it implements;
– take, or ensure the taking of, the necessary legal, organisational and technical measures to protect PD against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions involving PD;
– respond to requests and enquiries from data subjects, their representatives and the authority responsible for protecting data subjects’ rights.
