01General provisions
This is an English translation provided for convenience. In case of any discrepancy, the Russian version prevails. This Personal Data Processing Policy (hereinafter, the “Policy”) has been developed in pursuance of the requirements of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter, “152-FZ”), as well as the subordinate regulations of the Government of the Russian Federation, the FSB of Russia (Federal Security Service), the FSTEC of Russia (Federal Service for Technical and Export Control) and Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media, the Russian data protection authority) governing the processing and protection of personal data.
The Policy defines the procedure for processing personal data and the measures to ensure their security taken by ARTVISION LLC (ООО «АРТВИЖН») (hereinafter, the “Operator”) with respect to individuals whose personal data are processed by the Operator in connection with the use of the website artvision.ai (hereinafter, the “Website”) and the software products of the ArchiMed ecosystem.
The Policy applies to all of the Operator’s processes involving the collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer, depersonalization, blocking, deletion and destruction of personal data, whether carried out with or without the use of automation tools.
By using the Website, submitting a request via the feedback form or otherwise providing their personal data to the Operator, the personal data subject confirms that they have read this Policy and agree to its terms.
02Key terms
The following key terms are used in this Policy as defined in Article 3 of 152-FZ:
- Personal data — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).
- Operator — a state body, municipal body, legal entity or natural person that organizes and/or carries out the processing of personal data and also determines the purposes of processing, the composition of the personal data and the actions performed with them.
- Processing of personal data — any action (operation) or set of actions performed with personal data, with or without the use of automation tools.
- Automated processing of personal data — processing of personal data by means of computer technology.
- Dissemination of personal data — actions aimed at disclosing personal data to an indefinite range of persons.
- Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific range of persons.
- Blocking of personal data — temporary suspension of the processing of personal data (except where processing is necessary to update the personal data).
- Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the information system and/or as a result of which the tangible media of personal data are destroyed.
- Depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine whether personal data belong to a specific data subject.
- Personal data information system — the totality of personal data contained in databases and of the information technologies and technical means that ensure their processing.
- Cookies — a small piece of data sent by a web server and stored on the User’s device.
03Information about the Operator
The operator of personal data is:
The Operator is included in the Register of Operators Processing Personal Data maintained by Roskomnadzor, on the basis of the notification it has submitted (Article 22 of 152-FZ).
04Principles and legal grounds for processing
The Operator processes personal data on the basis of the following principles (Article 5 of 152-FZ):
- lawfulness and fairness of the purposes and methods of processing;
- consistency of the purposes of processing with the declared purposes and the powers of the Operator;
- consistency of the volume and nature of the personal data processed with the declared purposes of processing;
- accuracy of personal data and their sufficiency for the purposes of processing; inadmissibility of excessive processing;
- lawfulness of the organizational and technical measures to ensure the security of personal data;
- striving to continuously improve the knowledge of the Operator’s employees in the field of personal data security;
- destruction or depersonalization of personal data once the purposes of processing have been achieved or where achieving them is no longer necessary.
The legal grounds for the processing of personal data by the Operator are:
- the Constitution of the Russian Federation;
- the Civil Code and the Labor Code of the Russian Federation;
- Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;
- Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and Protection of Information”;
- Federal Law No. 38-FZ of 13 March 2006 “On Advertising”;
- Resolutions of the Government of the Russian Federation No. 1119 of 1 November 2012 and No. 687 of 15 September 2008;
- the charter of ARTVISION LLC, contracts with counterparties, and the consents of data subjects to the processing of their personal data.
05Categories of data subjects and personal data processed
5.1. Categories of data subjects
- visitors to the Website and users of the feedback forms;
- representatives of the Operator’s customers, counterparties and partners;
- employees of the Operator and candidates applying for vacant positions;
- users of ArchiMed software products (accounts of technical specialists and administrators).
5.2. Personal data processed
The Operator processes only the amount of personal data necessary to achieve the purposes specified in Section 6.
- Website visitors and applicants: last name, first name, patronymic (if any); position, organization name; email address; phone number; message content, subject of the inquiry; IP address, browser and operating system type, cookie identifiers, pages visited, referral source, date and time of the visit.
- Counterparties: data necessary for the conclusion and performance of contracts, including full name, position, details of an identity document (where necessary), and contact details.
- Candidates and employees: data whose composition is established by the Labor Code of the Russian Federation and the Operator’s internal documents.
- Users of ArchiMed products: accounts (login, password hash), user name, job role, corporate email, and information necessary for the operation of the customer’s information systems.
The Operator does not process special categories of personal data (racial or national origin, political, religious or philosophical beliefs, health status, intimate life) or biometric personal data, except in cases expressly provided for by law and subject to the data subject’s written consent.
Patients’ medical data processed in the information systems of customers (healthcare organizations) are not transferred to the Operator in the course of providing maintenance and support services. With respect to the customer’s personal data information system, the Operator acts solely as a software supplier; the relevant healthcare organization acts as the operator of such data.
06Purposes of personal data processing
The Operator processes personal data for the following purposes:
- identification of a data subject who has contacted the Operator via the Website or by other means;
- responding to data subjects’ requests, and sending commercial proposals and information materials upon request;
- conclusion and performance of contracts with counterparties, including the supply of software and the provision of maintenance and technical support services;
- organizing the participation of data subjects in webinars, demonstrations, conferences and other events of the Operator;
- fulfillment of the employer’s obligations under labor law, and maintenance of HR records;
- exercise of the rights and legitimate interests of the Operator within the limits established by law;
- analysis of Website traffic, improvement of its operation, and detection and elimination of technical faults;
- sending advertising and marketing messages — only with the data subject’s explicitly expressed consent.
07Conditions and procedure of processing
The Operator processes personal data in compliance with the conditions set out in Article 6 of 152-FZ; processing is permitted in the following cases:
- processing is carried out with the consent of the data subject to the processing of their personal data;
- processing is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to perform the functions, exercise the powers and fulfill the duties of the Operator;
- processing is necessary for the performance of a contract to which the data subject is a party or under which the data subject is a beneficiary;
- processing is necessary to exercise the rights and legitimate interests of the Operator or third parties or to achieve socially significant purposes, provided that the rights and freedoms of the data subject are not violated;
- processing is necessary for statistical or other research purposes, subject to mandatory depersonalization of the personal data.
The Operator processes personal data both with and without the use of automation tools (on paper). Personal data are collected in the territory of the Russian Federation; the recording, systematization, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation, in accordance with Part 5 of Article 18 of 152-FZ.
08Transfer of personal data to third parties
The Operator does not sell personal data or transfer them to third parties for marketing or other commercial purposes without obtaining the explicit consent of the data subject.
The transfer of personal data to third parties is permitted in the following cases:
- the data subject has given consent;
- the transfer is necessary for the performance of a contract to which the data subject is a party (for example, the transfer of data to contractors implementing software products);
- the transfer is provided for by the laws of the Russian Federation (to government authorities, including upon requests from courts, the prosecutor’s office, investigative authorities, Roskomnadzor or the tax service);
- the data are transferred to processors acting on behalf of the Operator under a contract that ensures the confidentiality and security of personal data (Part 3 of Article 6 of 152-FZ).
Persons processing personal data on behalf of the Operator (hosting provider, email delivery service provider, payment service provider, IT contractors) are prohibited from transferring personal data to other persons without the Operator’s written consent.
09Cross-border transfer
The Operator does not carry out cross-border transfers of personal data. All servers on which personal data of citizens of the Russian Federation are processed and stored are located in the territory of the Russian Federation.
Should a cross-border transfer become necessary, the Operator undertakes to notify Roskomnadzor in advance in the manner established by Article 12 of 152-FZ and to make sure that the receiving party ensures adequate protection of the personal data.
11Retention periods and conditions
The Operator stores personal data for the period necessary to achieve the purposes of processing, unless a different period is established by the laws of the Russian Federation or by a contract with the data subject.
- data of Website visitors who have submitted a request — up to 3 years from the date of their last contact, or until consent is withdrawn;
- counterparty data — for the term of the contract and 5 years after its expiry (for accounting and tax reporting purposes);
- data of candidates for vacant positions — up to 1 year from receipt of the résumé;
- employee data — in accordance with the List of Standard Archival Documents and the Labor Code of the Russian Federation;
- cookies — for the period set for the respective type of cookie (from the duration of the session up to 13 months).
Once the purposes of processing have been achieved, or upon withdrawal of the data subject’s consent, personal data are destroyed (or depersonalized) within a period not exceeding 30 days, unless a different period is established by law or contract.
12Security measures
The Operator takes the necessary organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying and dissemination, as well as against other unlawful actions of third parties (Article 19 of 152-FZ, Resolution of the Government of the Russian Federation No. 1119, FSTEC of Russia Order No. 21).
In particular, the Operator:
- has appointed a person responsible for organizing the processing of personal data;
- has approved internal regulations (policies, instructions, procedures) on the processing and protection of personal data;
- familiarizes employees who process personal data with the requirements of the law and the internal regulations;
- uses information security tools that have passed conformity assessment in the established manner (certified by the FSTEC of Russia and the FSB of Russia);
- keeps records of machine media containing personal data, controls access to the personal data information system, and registers and records user actions;
- ensures data backup, anti-virus protection, firewalling and intrusion detection;
- ensures the physical protection of the places where tangible media containing personal data are stored;
- carries out internal control and/or audits of the compliance of personal data processing with legal requirements.
The security level of the Operator’s personal data information system has been determined in accordance with Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012.
13Rights of the personal data subject
The personal data subject has the right (Article 14 of 152-FZ) to:
- receive information about the fact that the Operator processes their personal data, about the purposes, methods and periods of processing, the name of the Operator, the sources from which the personal data were obtained, and the persons who have access to the personal data;
- demand that personal data be updated, blocked or destroyed if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the declared purpose of processing;
- withdraw consent to the processing of personal data at any time;
- appeal against the actions (or inaction) of the Operator to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court;
- demand the cessation of the processing of personal data for the purpose of promoting goods, works and services on the market;
- protect their rights and legitimate interests, including the right to compensation for losses and/or non-pecuniary (moral) damage.
14Procedure for submitting requests and inquiries
Requests and inquiries relating to the processing of personal data are to be sent to the Operator in one of the following ways:
- by email to privacy@artvision.ai;
- by post to: ARTVISION LLC (ООО «АРТВИЖН»), Premises 23N, 11 bldg. 1, Serebryakova proezd, Sviblovo Municipal District, Moscow 129343, Russia;
- by phone at +7 (495) 481-01-64 (business hours: Mon–Fri, 09:00–18:00 Moscow time, UTC+3).
A request (inquiry) from a personal data subject must contain:
- the number of the main identity document of the data subject or their representative, and information on the date of issue of that document and the issuing authority;
- information confirming the data subject’s participation in relations with the Operator (contract number, date of conclusion, other information), or information otherwise confirming the fact that the Operator processes the personal data;
- the signature of the data subject or their representative.
A request may be sent in the form of an electronic document signed with an electronic signature in accordance with the laws of the Russian Federation.
The Operator responds to a request within a period not exceeding 10 working days from the date of its receipt. This period may be extended, but by no more than 5 working days, provided that the data subject is sent a reasoned notice of the extension.
15Changes to the Policy
The Operator has the right to amend this Policy at its own discretion, including in connection with changes in the laws of the Russian Federation.
A new version of the Policy comes into force from the moment it is posted at artvision.ai/legal/privacy, unless otherwise provided by the new version. The current version is always available at that address. The date of the latest version is indicated in the header of the document.
16Contacts for requests
The supervisory authority for the protection of the rights of personal data subjects is the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), website rkn.gov.ru.