Personal Data Processing Policy of the National Energy Security Fund (NESF)

1. General Provisions

1.1. This Personal Data Processing Policy of the National Energy Security Fund (NESF) (hereinafter referred to as the Policy) defines the basic principles, purposes, legal grounds, composition and procedure for the processing of personal data, measures for their protection, and the procedure for exercising the rights of personal data subjects.

1.2. The operator of personal data is the National Energy Security Fund (NESF), a limited liability company, PSRN 1057749192270, INN 7701630081, address: 8 bldg. 1, Sadovaya-Chernogryazskaya St., Moscow, 107078, Russia (floor 3, rooms 20, 21), e-mail: projects@energystate.ru.

1.3. The Policy applies to personal data that the Operator receives in the course of its activities, including by means of the energystate.ru website, in business correspondence, when concluding and performing contracts, and in interaction with employees, candidates, contractors and their representatives.

1.4. The Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27.07.2006 "On Personal Data", Federal Law No. 149-FZ of 27.07.2006 "On Information, Information Technologies and Information Protection", the Labor Code of the Russian Federation, and other federal laws and regulatory legal acts of the Russian Federation governing the processing and protection of personal data.

1.5. When processing personal data for the purpose of sending advertising, the Operator also takes into account the requirements of Article 15 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" and Article 18 of Federal Law No. 38-FZ of 13.03.2006 "On Advertising".

1.6. The Policy is a publicly available document and is posted on the energystate.ru website. The Operator ensures unrestricted access to the Policy in the cases and in the manner provided for by the legislation of the Russian Federation.

2. Key Terms

2.1. For the purposes of this Policy, terms are used in the meanings established by Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

2.2. Personal data means any information relating directly or indirectly to an identified or identifiable individual.

2.3. Processing of personal data means any action or set of actions performed with personal data with the use of automation tools or without the use of such tools, including collection, recording, systematization, accumulation, storage, refinement (updating, modification), retrieval, use, transfer in the cases provided for by law, anonymization, blocking, deletion and destruction.

3. Principles of Personal Data Processing

3.1. The Operator processes personal data on a lawful and fair basis.

3.2. Processing is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data that is incompatible with the purposes of their collection is not allowed.

3.3. The content and scope of the personal data processed correspond to the declared processing purposes. The Operator does not allow excessive processing of personal data in relation to the declared purposes.

3.4. The Operator takes measures to ensure the accuracy, sufficiency and, where necessary, the relevance of personal data, as well as measures to delete or refine incomplete or inaccurate data.

3.5. Personal data are stored no longer than the processing purposes require, unless a different storage period is established by federal law, a contract or another lawful ground.

4. Processing Purposes, Categories of Subjects and Composition of Personal Data

4.1. Processing of enquiries, requests and messages sent to the Operator via the website, e-mail and other communication channels. Categories of subjects: website visitors, applicants and other individuals sending enquiries to the Operator. Personal data: surname, first name and patronymic, if provided by the subject; telephone number; e-mail address; information contained in the text of the enquiry and in the materials attached to it, if the subject provides such information himself or herself. Purpose of processing: receiving and reviewing the enquiry, preparing and sending a reply, maintaining feedback with the subject. Legal grounds: the consent of the personal data subject, as well as other grounds provided for by Article 6 of Federal Law No. 152-FZ of 27.07.2006, where they are applicable to a specific enquiry. Processing methods: mixed processing with the use of automation tools and without the use of such tools. Processing and storage period: until the purpose of reviewing the enquiry has been achieved and the necessary correspondence completed, after which the data are subject to destruction or further storage only if an independent statutory ground exists.

4.2. Preparation, conclusion, performance, amendment and termination of contracts, and business interaction with individuals, individual entrepreneurs, contractors and their representatives. Categories of subjects: individuals, individual entrepreneurs, representatives, employees and contact persons of contractors, customers, service providers and other persons taking part in contractual relations. Personal data: surname, first name and patronymic; position; place of work; telephone number; e-mail address; details of an identity document, banking and other details in cases where their processing is necessary for concluding and performing a contract or is provided for by law; other information directly necessary for the relevant contractual relations. Purposes of processing: establishing and maintaining business relations, preparing and concluding contracts, performing obligations, exchanging documents, making settlements, claims work and protection of the Operator's legitimate interests. Legal grounds: conclusion and performance of a contract to which the personal data subject is a party or under which he or she is a beneficiary or guarantor; performance of the obligations imposed on the Operator by the legislation of the Russian Federation; the consent of the subject in the cases where such consent is required. Processing methods: mixed processing with the use of automation tools and without the use of such tools. Processing and storage period: during the term of the relevant relations and thereafter within the periods established by the legislation of the Russian Federation for the storage of contractual, accounting, tax and other documents. Upon expiry of the applicable period, the data are destroyed or anonymized, unless another lawful ground for processing exists.

4.3. Performance of the duties of an employer and personnel record keeping. Categories of subjects: candidates for vacant positions, employees, former employees, and other persons whose personal data are processed in connection with employment relations in the cases provided for by law. Personal data: surname, first name and patronymic; date and place of birth; identity document details; residential and registration address; contact details; information on education, qualifications and employment; information necessary for personnel, military, tax and accounting records; individual personal account insurance number (SNILS); taxpayer identification number (INN); bank details; other information the processing of which is necessary for the performance of the duties of an employer and is expressly provided for by the legislation of the Russian Federation. Purposes of processing: recruitment, formalization and support of employment relations, calculation and payment of wages, personnel, accounting, tax and military record keeping, performance of the duties of an employer provided for by the legislation of the Russian Federation. Legal grounds: the Labor Code of the Russian Federation, the Tax Code of the Russian Federation, legislation on accounting, military records and mandatory social insurance, and other applicable regulatory legal acts, as well as the consent of the subject in the cases where it is required by law. Processing methods: mixed processing with the use of automation tools and without the use of such tools. Processing and storage period: during the period necessary to achieve the relevant purposes and thereafter within the retention periods for personnel, accounting, tax and archival documents established by the legislation of the Russian Federation.

4.4. Performance of the duties established by the legislation of the Russian Federation, including accounting, tax and other mandatory record keeping, preparation and submission of the established reporting, and responses to lawful requests of state bodies. Categories of subjects: employees, former employees, contractors, representatives of contractors and other persons whose information is subject to processing by force of law. Personal data: to the extent directly necessary for the performance of a specific duty of the Operator established by the legislation of the Russian Federation. Legal grounds: clauses 2, 3 and other applicable provisions of Part 1 of Article 6 of Federal Law No. 152-FZ of 27.07.2006, as well as the relevant federal laws and other regulatory legal acts. Processing methods: mixed processing with the use of automation tools and without the use of such tools. Processing and storage period: within the periods established by the applicable legislation of the Russian Federation.

4.5. Sending advertising messages and offers of goods, works and services of the Operator is allowed only with the prior consent of the personal data subject and of the recipient of the advertising in the cases where such consent is required by law. Categories of subjects: individuals who have consented to receive advertising messages. Personal data: surname and first name, if provided; telephone number; e-mail address; information on the chosen communication channel. Purpose of processing: sending advertising messages via the communication channels agreed with the subject. Legal grounds: the prior consent of the personal data subject, obtained separately from other documents and consents, as well as the prior consent of the recipient of the advertising in accordance with Federal Law No. 38-FZ of 13.03.2006 "On Advertising". Processing methods: automated or mixed processing, depending on the communication channel used. Processing and storage period: until the consent is withdrawn or the relevant processing purpose ceases, unless otherwise provided by the legislation of the Russian Federation. Upon the request of a personal data subject, the Operator immediately ceases the processing of his or her personal data for the purpose of promoting goods, works and services on the market, in accordance with Part 2 of Article 15 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

4.6. Ensuring the operation and security of the website. Categories of subjects: website visitors. Personal data and technical information: the network address of the device, information about the browser and user software, the date and time of access to the website, the address of the requested resource and other technical information automatically transmitted by the information system and necessary for ensuring the operation and security of the website. Purpose of processing: ensuring the correct operation of the website, information security, prevention and investigation of technical failures and unlawful actions. Legal grounds: the exercise of the rights and legitimate interests of the Operator, provided that the rights and freedoms of the personal data subject are not violated, and, in the cases where consent is required, the relevant consent of the personal data subject. Processing methods: automated processing. Processing and storage period: within the period necessary for ensuring the operation and security of the website, after which the technical records are deleted or anonymized, unless a longer retention period is required by law or for the protection of the rights and legitimate interests of the Operator.

5. Procedure and Conditions of Personal Data Processing

5.1. Personal data are processed by the Operator in person and by employees admitted to the processing of personal data to the extent necessary for the performance of their official duties.

5.2. The Operator may entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with such person. The instruction defines the list of personal data, the list of operations performed with them, the purposes of processing, the requirements of confidentiality and security, and other mandatory conditions provided for by Part 3 of Article 6 of Federal Law No. 152-FZ of 27.07.2006.

5.3. The transfer of personal data to third parties is allowed if a statutory ground exists, including the consent of the subject, the need to perform a contract, an obligation under law or a lawful request of a state body.

5.4. The Operator does not disclose personal data to an indefinite circle of persons and does not distribute them without a separate statutory ground. The processing of personal data authorized by the subject for distribution is carried out only in compliance with the special requirements of the legislation of the Russian Federation.

5.5. The Operator does not carry out, by means of the website, targeted collection of special categories of personal data provided for by Article 10 of Federal Law No. 152-FZ of 27.07.2006 or of biometric personal data provided for by Article 11 of the said Federal Law. The subject should not indicate such information in the free fields of forms and enquiries unless its provision has been expressly requested by the Operator on a lawful basis.

6. Processing of Personal Data When Using the Website

6.1. When information is sent via the forms of the website, the subject is given the opportunity to review this Policy and, where the processing is based on consent, to give a separate consent to the processing of personal data.

6.2. Via the forms of the website, the Operator requests only those personal data that are necessary for the stated purpose. The composition of the form fields must correspond to the content of the consent and of this Policy.

6.3. When using files stored in the user's browser, web analytics tools, advertising or other external services, the Operator, before starting the relevant processing, determines the legal grounds, the scope of the information transmitted, the recipients of the data, the place of processing and the need to inform the user or to obtain his or her consent.

6.4. When collecting personal data of citizens of the Russian Federation by means of the Internet, the Operator ensures compliance with the requirements of Part 5 of Article 18 of Federal Law No. 152-FZ of 27.07.2006 on recording, systematization, accumulation, storage, refinement and retrieval of personal data with the use of databases located on the territory of the Russian Federation, except for the cases established by law.

6.5. Before starting a cross-border transfer of personal data, the Operator complies with the requirements of Article 12 of Federal Law No. 152-FZ of 27.07.2006, including establishing the legal grounds for such transfer and notifying the authorized body in the cases and in the manner provided for by law.

7. Consent to the Processing of Personal Data

7.1. If the legislation of the Russian Federation provides for obtaining the consent of the personal data subject, the Operator obtains such consent before starting the relevant processing.

7.2. The consent must be specific, explicit, informed, conscious and unambiguous. Consent to the processing of personal data is executed separately from other information and documents confirmed or signed by the personal data subject.

7.3. The obligation to prove that the consent of the personal data subject has been obtained rests with the Operator.

7.4. The personal data subject has the right to withdraw consent. After the withdrawal is received, the Operator ceases the processing based on such consent, unless another statutory ground for continuing the processing exists.

8. Rights of the Personal Data Subject

8.1. The personal data subject has the right to receive information concerning the processing of his or her personal data, to the extent and in the manner provided for by Federal Law No. 152-FZ of 27.07.2006.

8.2. The subject has the right to demand from the Operator the refinement (updating, modification), blocking or destruction of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing, as well as to take other measures provided for by law to protect his or her rights.

8.3. The subject has the right to demand the cessation of the processing of personal data in the cases and in the manner provided for by the legislation of the Russian Federation.

8.4. To exercise these rights, the subject may send an enquiry to the e-mail address projects@energystate.ru or to the postal address of the Operator specified in clause 1.2 of this Policy. The enquiry must allow the applicant to be identified and the substance of his or her request to be determined to the extent necessary for its consideration.

8.5. The Operator provides the personal data subject or his or her representative with the information provided for by the legislation of the Russian Federation on personal data within ten working days from the date of the enquiry or of the receipt of the relevant request. This period may be extended by not more than five working days, subject to sending the personal data subject a reasoned notice stating the reasons for the extension. Other enquiries and demands are considered within the periods established by Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

9. Measures to Ensure the Security of Personal Data

9.1. The Operator takes legal, organizational and technical measures that are necessary and sufficient for the performance of the obligations established by the legislation of the Russian Federation on personal data.

9.2. The measures applied include: appointment of a person responsible for organizing the processing of personal data; adoption of internal regulations; definition of the rules of access to personal data; familiarization of the employees directly engaged in the processing of personal data with the requirements of the legislation and of the internal documents and, where necessary, their training; carrying out internal control and audit of the compliance of personal data processing with the requirements of the legislation; assessment of the harm that may be caused to personal data subjects in the event of violation of the legislation; recording of material media in the applicable cases; use of information protection tools and of other measures depending on the nature of the processing and the established threats. The harm assessment is carried out taking into account the requirements of Roskomnadzor Order No. 178 of 27.10.2022 "On Approval of the Requirements for Assessing the Harm That May Be Caused to Personal Data Subjects in the Event of Violation of the Federal Law 'On Personal Data'".

9.3. When processing personal data in information systems, the Operator takes security measures taking into account the requirements of Article 19 of Federal Law No. 152-FZ of 27.07.2006 and of Government Decree No. 1119 of 01.11.2012 "On Approval of the Requirements for the Protection of Personal Data during Their Processing in Personal Data Information Systems".

9.4. When processing personal data without the use of automation tools, the Operator takes into account the requirements of Government Decree No. 687 of 15.09.2008 "On Approval of the Regulation on the Specifics of the Processing of Personal Data Performed without the Use of Automation Tools".

10. Retention Periods, Cessation of Processing and Destruction of Personal Data

10.1. Processing and retention periods are determined by the purposes of processing, the terms of contracts and the mandatory document retention periods established by the legislation of the Russian Federation.

10.2. Upon achievement of the purpose of processing, the Operator ceases the processing and destroys the personal data within a period not exceeding thirty days from the date of achievement of the purpose, unless otherwise provided by a contract, an agreement with the subject or by law, and unless the Operator has an independent lawful ground for continuing the processing.

10.3. Upon receipt of a personal data subject's demand to cease the processing, the Operator ceases the processing of personal data or ensures its cessation within a period not exceeding ten working days from the date of receipt of the relevant demand, unless grounds provided for by law exist for continuing the processing. This period may be extended by not more than five working days, subject to sending the personal data subject a reasoned notice stating the reasons for the extension, in accordance with Part 5.1 of Article 21 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

10.4. If unlawful processing is detected, the Operator takes measures to stop it and to block, refine and destroy the personal data within the periods established by Article 21 of Federal Law No. 152-FZ of 27.07.2006.

10.5. Personal data are destroyed by methods that preclude the possibility of restoring their content. Where the processing is performed without the use of automation tools, the destruction is confirmed by a personal data destruction certificate. Where the processing is performed with the use of automation tools, the destruction is confirmed by a personal data destruction certificate and by an extract from the event registration log of the personal data information system. In the case of mixed processing, the confirmation is provided by the certificate and by the relevant log extract. The certificate and the log extract are kept for three years from the moment of destruction of the personal data. The confirmation of destruction is executed in accordance with Roskomnadzor Order No. 179 of 28.10.2022 "On Approval of the Requirements for Confirming the Destruction of Personal Data".

11. Final Provisions

11.1. The Operator revises this Policy when the legislation of the Russian Federation, the purposes and methods of personal data processing, the composition of the processed data, the information systems and services used change, as well as in other cases when the content of the Policy ceases to correspond to the actual processing procedures.

11.2. The new version of the Policy takes effect from the moment of its approval by the Operator and posting on the website, unless another effective date is established by the new version itself.

11.3. Matters not regulated by this Policy are resolved in accordance with the legislation of the Russian Federation.

11.4. Contact for enquiries on matters of personal data processing: projects@energystate.ru.

11.5. This Policy is a translation of the Russian-language original. In case of any discrepancies between this translation and the Russian version of the Policy, the Russian version shall prevail.