REGULATION ON PERSONAL DATA OF SUBJECTS OF PERSONAL DATA - PASSENGERS AND VISITORS OF THE STATE ENTERPRISE KO "AUTO STATION"
1. GENERAL PROVISIONS
1.1. The Regulation of SE KP "Bus Station" (hereinafter - the Regulation) defines the procedure for processing and protecting personal data of subjects of personal data - passengers and visitors of the SE KP "Bus Station.
1.2. This Regulation has been developed in accordance with the Constitution of the Russian Federation, Federal Law of July 27, 2006 No. 152-ФЗ “On Personal Data”, Federal Law of July 27, 2006 No. 149-ФЗ “On Informatization, Information Technologies and Information Protection”, Decrees of the Government of the Russian Federation dated November 17, 2007 No. 781 “On approval of the Regulation on ensuring the security of personal data when processing it in personal data information systems” and Government Decree dated September 15, 2008 No. 687 “On approval of the Regulation on the peculiarities of processing personal data carried out without the use of automation "and other regulatory acts in force in the Russian Federation in the field of personal data.
1.3. The following terms and definitions are used in this Regulation:
SE KO "Avtovokzal" - an operator, legal entity that sells tickets for bus services of Carriers and for this purpose collects, stores, accumulates, clarifies, blocks, deletes and transfers personal data. The subjects of personal data (hereinafter referred to as SPD) are individuals: passengers and visitors of the SE “Bus Station”. Passenger - an individual who is transported by a vehicle on the basis of a passenger transportation agreement, who buys a ticket for this transportation at bus stations, bus stations or cash points of ticket sales of SE KO Avtovokzal and for which he provides his personal data. A visitor is an individual who uses other services of GP KO Avtovokzal and its tenants in territories belonging to GP KP Avtovokzal. Personal data of the subject of personal data - any information relating directly or indirectly to a specific or determinable natural person (subject of personal data). A special category of personal data is personal data regarding race, nationality, political views, religious or philosophical beliefs, state of health, intimate life.
Processing of personal data - the collection, storage, accumulation, clarification, use, extraction, blocking, deletion and transfer or any other use of personal data of the subject of personal data in accordance with the law.
Protection of personal data SPD - the activity of SE KO "Bus Station" to ensure the security of personal data through local regulation of the processing of personal data and organizational and technical measures of confidentiality of information.
Confidentiality of personal data is a requirement for a person who has access to personal data to comply with the requirement not to allow their dissemination without the consent of the personal data subject or other legal grounds.
Ticket - a transportation document purchased at bus stations, bus stations or cash points of ticket sales of SE KO Avtovokzal, certifying the conclusion of a passenger carriage agreement.
2. PERSONAL DATA PROCESSING
2.1. The processing of personal data of Passengers is carried out on the basis of agreements concluded between Passengers and SE KO "Bus Station", Carriers and GP KO "Bus Station".
2.1.1. The carrier is a party to the passenger carriage agreement and carries out its transportation directly, and bears all the consequences arising from this obligation. The Carrier instructed SE KO Avtovokzal to sell tickets to Passengers on the basis of agreements between them, to collect, store, accumulate, clarify, use, extract, block, delete and transmit personal data, as well as provide services for boarding passengers and other services on his flights.
2.1.2. SE KO "Bus Station", having fulfilled the function of boarding the Passenger on the bus, transfer the boarding list (list of ticket sales) to the Carrier. These landing statements are kept by the Carrier, which independently ensures compliance with the safety requirements of the Passenger’s personal data in accordance with the legislation of the Russian Federation in the field of personal data, including Article 19 of the Federal Law No. 152 “On Personal Data”.
2.2. In order to ensure the rights and freedoms of a person and a citizen, SE KO "Bus Station" and its representatives are obliged to comply with the following general requirements when processing personal data of a Passenger:
2.2.1. The processing of the Passenger’s personal data is carried out solely to ensure compliance with laws and other regulatory legal acts, to facilitate the fulfillment of contractual obligations in accordance with the legislation of the Russian Federation.
2.2.2. When determining the volume and content of the personal data processed by the Passenger of the SE KO "Bus Station" should be guided by the legislation of the Russian Federation in the field of personal data.
2.2.3. The receipt and use of personal data of SPD is carried out only after familiarization and consent of SPD with this provision, with the exception of the following cases:
1) the processing of personal data is necessary to achieve the goals stipulated by the international treaty of the Russian Federation or the law, to carry out and fulfill the functions, powers and duties assigned to the operator by the legislation of the Russian Federation;
2) the processing of personal data is necessary for the administration of justice, the execution of a judicial act, an act of another body or official to be executed in accordance with the legislation of the Russian Federation on enforcement proceedings (hereinafter - the execution of a judicial act);
3) the processing of personal data is necessary for the fulfillment of the powers of federal executive bodies, bodies of state extra-budgetary funds, executive bodies of state power of the constituent entities of the Russian Federation, local authorities and the functions of organizations involved in the provision of state and municipal services provided for by the Federal Law July 27, 2010 N 210-ФЗ "On the organization of the provision of state and municipal services", including registration of entities that personal data on a single portal of state and municipal services and (or) regional portals of state and municipal services;
(as amended by the Federal Law of 05.04.2013 N 43-ФЗ)
4) the processing of personal data is necessary for the execution of a contract to which either the beneficiary or guarantor is a personal data subject, including if the operator exercises his right to assign rights (claims) under such an agreement, as well as to conclude an agreement on the initiative of the personal data subject or contract under which the personal data subject will be the beneficiary or guarantor;
(Clause 5 as amended by the Federal Law of December 21, 2013 N 363-ФЗ)
5) the processing of personal data is necessary to protect the life, health or other vital interests of the subject of personal data, if obtaining the consent of the subject of personal data is impossible;
6) the processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties or to achieve socially significant goals, provided that this does not violate the rights and freedoms of the subject of personal data;
7) the processing of personal data is necessary for the professional activities of a journalist and (or) the legitimate activities of the media or scientific, literary or other creative activities, provided that this does not violate the rights and legitimate interests of the subject of personal data;
8) the processing of personal data is carried out for statistical or other research purposes, except for the purposes specified in Article 15 of this Federal Law, subject to the mandatory depersonalization of personal data;
9) the processing of personal data is carried out, access to an unlimited number of persons to which is provided by the subject of personal data or at his request (hereinafter - personal data made publicly available by the subject of personal data);
10) the processing of personal data subject to publication or mandatory disclosure in accordance with federal law.
2.2.4. The receipt and use of special categories of personal data of personal data subjects is carried out only after familiarization and consent of the personal data subject with this provision, with the exception of the following cases:
1) personal data is made publicly available by the subject of personal data;
1.1) the processing of personal data is necessary in connection with the implementation of international agreements of the Russian Federation on readmission;
2) the processing of personal data is necessary to protect the life, health or other vital interests of the subject of personal data or the life, health or other vital interests of others, and obtaining the consent of the subject of personal data is impossible;
3) the processing of personal data is necessary to establish or exercise the rights of the subject of personal data or third parties, as well as in connection with the administration of justice;
4) the processing of personal data is carried out in accordance with the legislation of the Russian Federation on defense, on security, on countering terrorism, on transport security, on countering corruption, on operational-search activity, on enforcement proceedings, and the criminal executive legislation of the Russian Federation;
Consent to the processing of personal data may be revoked by the subject of personal data.
All personal data of the Passenger should be obtained from him, except when the ticket is purchased by a third party for the Passenger, provided that the third party provides the original documents necessary to purchase the ticket.
2.2.6. SE KO "Avtovokzal" provides registration and accounting of all actions performed with personal data, with the exception of automated processing of personal data.
2.2.7. When making decisions affecting the interests of SPD, the SE Avtovokzal does not have the right to rely on personal data of SPD obtained solely as a result of their automated processing without written notice or consent to such actions.
2.2.9. When issuing a ticket, the Passenger provides GP Avtovokzal full and reliable information about himself.
2.3. The processing of personal data of Visitors is carried out in connection with the installation of a video surveillance system at bus stations, bus stations and cash points of ticket sales. The use of the specified personal data is carried out on the same grounds (indicated above) as the processing of the data of the Passengers.
3. PERSONAL DATA PROTECTION ORGANIZATION
3.1. All employees with access to personal data of personal data subjects are required to sign a non-disclosure agreement for personal data.
3.2. The protection of the personal data of the subjects of personal data from their unlawful use or loss is provided by SE KO "Bus Station" in the manner prescribed by the legislation of the Russian Federation.
3.3. Subject to protection:
1) information about the personal data of the subject;
2) personal data contained in electronic media.
3.4. Responsible persons of structural units that process personal data in personal data information systems and computer-based storage media provide protection in accordance with the legislation of the Russian Federation in the field of personal data.
4. PERSONAL DATA COLLECTION
4. SE KO "Avtovokzal" carries out the processing of personal data in cases stipulated by law, as well as for the purpose of fulfillment by the Carrier of the passenger carriage agreement.
5. STORAGE AND STORAGE OF PERSONAL DATA
5.1. Information about the Passengers is stored on the server of the SE “Bus Station”.
5.2. The storage period for personal data can be no longer than what is required by the purpose of processing personal data, namely 1 month from the moment the bus was sent on the flight for which the ticket was purchased.
5.3. SE KO "Bus Station" takes all necessary measures to protect personal data stored on the server from unauthorized access to them.
5.4. Access to the Passenger’s personal data is provided by the employees of the SE “Bus Station”, based on the Order.
5.5. The Passenger’s personal data must be deleted after the expiration of the storage period specified in clause 5.2. of this Regulation, as well as upon achieving the processing goals or in case of loss of need to achieve them.
6. TRANSFER OF PERSONAL DATA
6.1. SE KO "Bus Station" transfers the personal data of Passengers to the operator of operation of the Unified State Information System for Ensuring Transport Security, in accordance with Federal Law-16 "On Transport Security".
6.2. Also, SE KO Avtovokzal transmits personal data of Passengers to the drivers of carriers on paper in the form of a “Landing sheet”, which is used to board Passengers on a bus and transfer them directly to the carrier’s driver.
6.3. When transferring the personal data of Passengers, GP KO "Bus Station" complies with the following requirements:
6.2.1. Does not disclose the Passenger’s personal data to a third party without the written consent of the subject or his legal representative, with the exception of cases provided for in clause 6.1., As well as when it is necessary to prevent threats to the life and health of the subject when official requests are received in accordance with the provisions of the Federal Law “ On operational-search measures ”, upon receipt of official inquiries from tax authorities, bodies of the Pension Fund of Russia, bodies of the Federal Social Insurance, judicial authority s, as well as in cases provided for by other federal laws and other regulatory acts.
6.2.2. GP KO "Bus Station" in each case makes an independent assessment of the seriousness, inevitability, the degree of such a threat. If the person making the request is not authorized to receive personal data of the subject of personal data, or there is no written consent of the subject of personal data to provide his personal information, or there is no threat to the life or health of the subject of personal data, SE KO Avtovokzal is obliged to refuse to provide personal data to a person. The requestor is given a written notice of refusal to provide personal data.
6.2.3. It warns persons who receive personal data of personal data subjects from the SE KO "Bus Station" that these data can only be used for the purposes for which they were communicated, and require these persons to confirm that this rule has been observed. Persons receiving Passenger’s personal data are required to comply with confidentiality requirements.
6.2.4. Permits access to the personal data of personal data subjects only to specially authorized persons, while these persons should be entitled to receive only those personal data of personal data subjects that are necessary to perform specific functions. Persons receiving personal data of subjects of personal data are required to comply with confidentiality requirements.
6.3. If GP KO “Avtovokzal” provides services to legal entities or individuals on the basis of concluded agreements (or other grounds) and by virtue of these agreements they must have access to personal data of the Passenger, then the relevant data are provided to GP KO “Avtovokzal” only after signing with them an agreement containing conditions for ensuring the security of personal data during their processing, as well as the implementation of the requirements for the protection of personal data received in accordance with the legislation of the Russian Federation in rsonal data, including Article 19 of the Federal Law No. 152 "On Personal Data".