1. General provisions
1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) has been developed in pursuance of the requirements of clause 2, part 1, art. 18.1 of Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” (hereinafter referred to as the “Law”) in order to ensure the protection of the rights and freedoms of individuals and citizens in the processing of their personal data, including the protection of the rights to privacy, personal and family secrets.
1.2. The Policy applies to all personal data processed by A.MILLER JSC (hereinafter referred to as the “Operator”).
1.3. The Policy applies to relations in the field of personal data processing that arose with the Operator both before and after the approval of this Policy.
1.4. In pursuance of the requirements of part 2, art. 18.1 of the Law, this Policy is published in free access by posting it on the Operator’s website on the Internet at a-miller.com.
1.5. Basic concepts used in the Policy:
personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
personal data operator (operator) — a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and (or) carries out the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data subject to processing, and the actions (operations) performed with personal data;
personal data processing — any action (operation) or set of actions (operations) with personal data performed using automation tools or without their use. Personal data processing includes, among other things:
– collection;
– recording;
– systematization;
– accumulation;
– storage;
– clarification (updating, modification);
– extraction;
– use;
– transfer (dissemination, provision, access);
– depersonalization;
– blocking;
– deletion;
– destruction.
automated personal data processing — processing of personal data using computer technology;
dissemination of personal data — actions aimed at disclosing personal data to an indefinite circle of persons;
Head — the sole executive body of the Operator;
provision of personal data — actions aimed at disclosing personal data to a certain person or a certain circle of persons;
blocking of personal data — temporary suspension of personal data processing (except in cases where processing is necessary to clarify personal data);
destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which material carriers of personal data are destroyed;
depersonalization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the belonging of personal data to a specific personal data subject;
personal data information system — a set of personal data contained in databases and information technologies and technical means ensuring their processing.
1.6. Main rights and obligations of the Operator.
1.6.1. The Operator has the right to:
– independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
– entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Personal Data Law, maintain the confidentiality of personal data, and take the necessary measures aimed at ensuring the fulfillment of obligations provided for by the Personal Data Law;
– in the event of withdrawal by the personal data subject of consent to personal data processing, the Operator has the right to continue processing personal data without the consent of the personal data subject if there are grounds specified in the Personal Data Law.
1.6.2. The Operator is obliged to:
– organize personal data processing in accordance with the requirements of the Personal Data Law;
– respond to appeals and requests of personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
– notify the authorized body for the protection of the rights of personal data subjects (Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) at the request of this body of the necessary information within 10 working days from the date of receipt of such request. This period may be extended, but not more than by five working days. To do this, the Operator must send a reasoned notification to Roskomnadzor indicating the reasons for extending the period for providing the requested information;
– in the manner determined by the federal executive body authorized in the field of security, ensure interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including informing it about computer incidents that resulted in unlawful transfer (provision, dissemination, access) of personal data.
1.7. Main rights of the personal data subject. The personal data subject has the right to:
– receive information concerning the processing of their personal data, except in cases provided for by federal laws. Information is provided to the personal data subject by the Operator in an accessible form, and it must not contain personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for its receipt are established by the Personal Data Law;
– require the operator to clarify their personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as take measures provided by law to protect their rights;
– give preliminary consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
– appeal to Roskomnadzor or in court against unlawful actions or inaction of the Operator in the processing of their personal data.
1.8. Control over the implementation of the requirements of this Policy is carried out by the authorized person responsible for organizing personal data processing at the Operator.
1.9. Responsibility for violation of the requirements of the legislation of the Russian Federation and regulatory acts of the Operator in the field of personal data processing and protection is determined in accordance with the legislation of the Russian Federation.
2. Purposes of personal data collection
2.1. Personal data processing is limited to achieving specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of personal data collection is not allowed.
2.2. Only personal data that meets the purposes of their processing is subject to processing.
2.3. Personal data processing by the Operator is carried out for the following purposes:
– maintaining personnel and accounting records;
– recruitment of personnel (applicants) for vacant positions of the operator;
– preparation, conclusion and execution of civil law contracts;
– maintaining military records;
– ensuring compliance with the labor legislation of the Russian Federation;
– ensuring compliance with the tax legislation of the Russian Federation;
– ensuring compliance with the pension legislation of the Russian Federation;
– voluntary medical insurance;
– promotion of goods, works, services on the market.
2.4. Personal data processing may be carried out exclusively for the purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal grounds for personal data processing
3.1. The legal basis for personal data processing is a set of regulatory legal acts in pursuance of which and in accordance with which the Operator carries out personal data processing, including:
– Constitution of the Russian Federation;
– Civil Code of the Russian Federation;
– Labor Code of the Russian Federation;
– Tax Code of the Russian Federation;
– Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data”;
– Federal Law No. 402-FZ dated 06.12.2011 “On Accounting”;
– Federal Law No. 167-FZ dated 15.12.2001 “On Compulsory Pension Insurance in the Russian Federation”;
– Federal Law No. 149-FZ dated 27.07.2006 “On Information, Information Technologies and Information Protection”;
– Decree of the Government of the Russian Federation No. 719 dated 27.11.2006 “On Approval of the Regulation on Military Records”;
– Decree of the Government of the Russian Federation No. 687 dated 15.09.2008 “On Approval of the Regulation on the Specifics of Personal Data Processing Carried Out Without the Use of Automation Tools”;
– other regulatory legal acts regulating relations related to the Operator’s activities.
3.2. The legal grounds for personal data processing are also:
– Charter of the Operator;
– contracts concluded between the Operator and personal data subjects;
– consent of personal data subjects to the processing of their personal data.
4. Scope and categories of processed personal data, categories of personal data subjects
4.1. The content and scope of processed personal data must correspond to the stated purposes of processing provided for in section 2 of this Policy. Processed personal data must not be excessive in relation to the stated purposes of their processing.
4.2. The Operator may process personal data of the following categories of personal data subjects:
4.2.1. Dismissed employees, employees and their relatives — for the purpose of maintaining personnel and accounting records, including the implementation of directly related legal relations, including labor, tax, pension and insurance, as well as maintaining military records:
surname, name, patronymic; year of birth; month of birth; date of birth; place of birth; marital status; social status; income; gender; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; driver’s license data; data from the birth certificate; bank card details; settlement account number; personal account number; profession; position; information about employment history (including work experience, data on current employment indicating the name and settlement account of the organization); attitude to military duty, military registration information; education information.
4.2.2. Clients and counterparties of the Operator, including their representatives — for the purpose of carrying out statutory activities, including the preparation, conclusion and execution of contracts:
surname, name, patronymic; year of birth; month of birth; date of birth; income; email address; residential address; registration address; phone number; SNILS; INN; citizenship; identity document data; settlement account number; position.
4.2.3. Applicants — for the purpose of recruiting personnel (applicants) for vacant positions of the operator:
surname, name, patronymic; year of birth; month of birth; date of birth; marital status; gender; residential address; phone number; citizenship; profession; position; information about employment history (including work experience, data on current employment indicating the name and settlement account of the organization); attitude to military duty, military registration information; education information.
4.2.4. Employees — for the purpose of voluntary medical insurance:
surname, name, patronymic; year of birth; month of birth; date of birth; registration address; SNILS; INN; citizenship; identity document data; information about employment history (including work experience, data on current employment indicating the name and settlement account of the organization).
4.2.5. Website visitors — for the purpose of promoting goods, works, services on the market:
surname, name, patronymic; email address; phone number; information collected through metric programs.
4.3. The Operator processes personal data in the following ways:
– collection;
– recording;
– systematization;
– accumulation;
– storage;
– clarification (updating, modification);
– extraction;
– use;
– transfer (provision, access);
– blocking;
– deletion;
– destruction.
4.3. The Operator does not process special categories of personal data concerning racial or national origin, political views, religious or philosophical beliefs, state of health, or intimate life, except in cases provided for by the legislation of the Russian Federation.
5. Procedure and conditions for personal data processing
5.1. Personal data processing is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
5.2. Personal data processing is carried out with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
5.3. The Operator processes personal data for each purpose of their processing in the following ways:
– non-automated personal data processing;
– automated personal data processing with or without transmission of the received information via information and telecommunications networks;
– mixed personal data processing.
5.4. Employees of the Operator whose job responsibilities include personal data processing are allowed to process personal data.
5.5. Personal data processing for each purpose of processing specified in clause 2.3 of the Policy is carried out by:
– obtaining personal data in oral and written form directly from personal data subjects;
– entering personal data into logs, registers and information systems of the Operator;
– using other methods of personal data processing.
5.6. Disclosure of personal data to third parties and dissemination of personal data without the consent of the personal data subject is not allowed, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the personal data subject for dissemination is drawn up separately from other consents of the personal data subject to the processing of their personal data.
Requirements for the content of consent to the processing of personal data permitted by the personal data subject for dissemination are approved by Order of Roskomnadzor No. 18 dated 24.02.2021 “On Approval of Requirements for the Content of Consent to the Processing of Personal Data Permitted by the Personal Data Subject for Dissemination”.
5.7. Transfer of personal data to bodies of inquiry and investigation, the Federal Tax Service, the Social Fund of Russia and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, dissemination and other unauthorized actions, including:
– determines threats to the security of personal data during their processing;
– adopts local regulatory acts and other documents regulating relations in the field of personal data processing and protection;
– appoints persons responsible for ensuring the security of personal data in structural units and information systems of the Operator;
– creates the necessary conditions for working with personal data;
– organizes accounting of documents containing personal data;
– organizes work with information systems in which personal data is processed;
– stores personal data in conditions that ensure their preservation and exclude unlawful access to them;
– organizes training for employees of the Operator who process personal data.
5.9. The Operator stores personal data in a form that allows determining the personal data subject, no longer than required by each purpose of personal data processing, unless the storage period of personal data is established by federal law or a contract.
5.9.1. Personal data on paper media is stored by the Operator during the storage periods of documents for which these periods are provided by the legislation on archiving in the Russian Federation (Federal Law No. 125-FZ dated 22.10.2004 “On Archiving in the Russian Federation”, List of standard administrative archival documents generated in the process of activity of state bodies, local governments and organizations, indicating their storage periods (approved by Order of Rosarkhiv No. 236 dated 20.12.2019 “On Approval of the List of Standard Administrative Archival Documents Generated in the Process of Activity of State Bodies, Local Governments and Organizations, Indicating Their Storage Periods”)).
5.9.2. The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper media.
5.10. The Operator stops processing personal data in the following cases:
– a fact of their unlawful processing has been detected. Term — within three working days from the date of detection;
– the purpose of their processing has been achieved;
– the validity period has expired or the consent of the personal data subject to the processing of the specified data has been withdrawn, when, according to the Law, the processing of this data is allowed only with consent.
5.11. Upon achieving the purposes of personal data processing, as well as in the event of withdrawal by the personal data subject of consent to their processing, the Operator stops processing this data if:
– otherwise is not provided for by the contract, a party to which, a beneficiary or a guarantor under which is the personal data subject;
– the Operator is not entitled to process without the consent of the personal data subject on the grounds provided for by the Law or other federal laws;
– otherwise is not provided for by another agreement between the Operator and the personal data subject.
5.12. When the personal data subject applies to the Operator with a demand to stop processing personal data within a period not exceeding 10 working days from the date of receipt by the Operator of the relevant demand, personal data processing is stopped, except in cases provided for by the Law. This period may be extended, but not more than by five working days. To do this, the Operator must send a reasoned notification to the personal data subject indicating the reasons for extending the period.
5.13. When collecting personal data, including through the Internet information and telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases specified in the Personal Data Law.
5.14. The Operator uses the following information systems:
– 1C: Accounting;
– Corporate email;
– Kaluga Astral;
– SBIS.
6. Updating, correction, deletion, destruction of personal data, responses to requests of subjects for access to personal data
6.1. Confirmation of the fact of personal data processing by the Operator, legal grounds and purposes of personal data processing, as well as other information specified in part 7 of art. 14 of the Law, are provided by the Operator to the personal data subject or their representative within 10 working days from the moment of appeal or receipt of a request from the personal data subject or their representative. This period may be extended, but not more than by five working days. To do this, the Operator must send a reasoned notification to the personal data subject indicating the reasons for extending the period for providing the requested information.
The information provided does not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.
The request must contain:
– the number of the main document identifying the personal data subject or their representative, information about the date of issue of the specified document and the body that issued it;
– information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conditional verbal designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator;
– signature of the personal data subject or their representative.
The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
The Operator provides the information specified in part 7 of art. 14 of the Law to the personal data subject or their representative in the form in which the corresponding appeal or request was sent, unless otherwise specified in the appeal or request.
If the appeal (request) of the personal data subject does not reflect, in accordance with the requirements of the Personal Data Law, all the necessary information or the subject does not have access rights to the requested information, they are sent a reasoned refusal.
The right of the personal data subject to access their personal data may be limited in accordance with part 8 of art. 14 of the Law, including if the access of the personal data subject to their personal data violates the rights and legitimate interests of third parties.
6.2. In the event of detection of inaccurate personal data upon appeal of the personal data subject or their representative, or at their request or at the request of Roskomnadzor, the Operator blocks personal data relating to this personal data subject from the moment of such appeal or receipt of the specified request for the period of verification, if blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
In the event of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the personal data subject or their representative or Roskomnadzor, or other necessary documents, clarifies personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
6.3. In the event of detection of unlawful processing of personal data upon appeal (request) of the personal data subject or their representative or Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to this personal data subject from the moment of such appeal or receipt of the request.
6.4. When the Operator, Roskomnadzor or another interested person detects the fact of unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that resulted in a violation of the rights of personal data subjects, the Operator:
– within 24 hours — notifies Roskomnadzor of the incident, the alleged causes that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provides information about the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;
– within 72 hours — notifies Roskomnadzor of the results of an internal investigation of the detected incident and provides information about the persons whose actions caused it (if any).
6.5. Procedure for the destruction of personal data by the Operator.
6.5.1. Conditions and terms for the destruction of personal data by the Operator:
– achievement of the purpose of personal data processing or loss of the need to achieve this purpose — within 30 days;
– achievement of the maximum storage periods for documents containing personal data — within 30 days;
– provision by the personal data subject (their representative) of confirmation that the personal data was obtained illegally or is not necessary for the stated purpose of processing — within seven working days;
– withdrawal by the personal data subject of consent to the processing of their personal data, if their preservation for the purpose of their processing is no longer required — within 30 days.
6.5.2. Upon achieving the purpose of personal data processing, as well as in the event of withdrawal by the personal data subject of consent to their processing, personal data is subject to destruction if:
– otherwise is not provided for by the contract, a party to which, a beneficiary or a guarantor under which is the personal data subject;
– the Operator is not entitled to process without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
– otherwise is not provided for by another agreement between the Operator and the personal data subject.
6.5.3. Destruction of personal data is carried out by a commission created by order of the Head of the Operator.
6.5.4. Methods of destruction of personal data are established in the local regulatory acts of the Operator.
7. Final provisions
7.1. The Policy was approved by order of the Head of the Operator No. 1-PDn dated 30.07.2025, and is valid indefinitely, until the new version of the Policy comes into force.
7.2. In the event of changes in the legislation of the Russian Federation in the field of personal data protection, the Operator adopts a new version of the Policy, taking into account the changes. Until then, the Policy is valid to the extent that does not contradict the current legislation of the Russian Federation.
7.3. For the purpose of communication with the Operator, the following contact details may be used:
tel.: 8(495) 775 73 76;
e-mail: office@a-miller.com;
postal address: 123557, Moscow, Novopresnensky Lane, building 3, room 10, floor 1.
30.07.2025
General Director
A.MILLER JSC _____________/ V.I. Gavricheva