Personal Data Processing policy
1. General Provisions
1.1 This Personal Data Processing Policy of Ural Airlines OJSC (hereinafter referred to as the “Policy”) has been developed to implement, within Ural Airlines OJSC, Taxpayer Identification Number 6608003013, registered address: 1G Utrenniy Lane, Yekaterinburg, Sverdlovsk Region, 620025, Russian Federation (hereinafter referred to as the “Operator” or “Ural Airlines”), the provisions of the legislation of the Russian Federation that define the circumstances and specific features of personal data processing and establish requirements for personal data processing. The Policy is intended to protect the rights and freedoms of individuals and citizens (personal data subjects) when the Operator organizes and/or carries out the processing of their personal data.
The Policy is an official document defining the general principles, purposes, and procedure for personal data processing by Ural Airlines OJSC, as well as information concerning the personal data protection measures implemented.
1.2 The Policy provides the basis for organizing the processing and protection of personal data at Ural Airlines OJSC, including the development of local regulations (internal regulatory documents) governing the procedure for processing and protecting personal data at Ural Airlines OJSC, as well as organizational and administrative documents concerning personal data processing and protection, and defines:
- the principles of personal data processing followed by the Operator in the course of its activities;
- the purposes of personal data processing; the categories and list of personal data processed; the categories of personal data subjects whose personal data is processed; the methods and periods of processing, including the storage of personal data; and the procedure for its destruction;
- the legal grounds for personal data processing;
- the general procedure for considering requests from personal data subjects concerning personal data processing;
- measures to ensure the security (confidentiality, integrity, and availability) of personal data.
1.3 Employees of Ural Airlines OJSC are familiarized with the terms of the Policy, including amendments thereto, against signature.
1.4 Personal data subjects may review the terms of the Policy on the official website of Ural Airlines OJSC on the Internet, available at: https://www.uralairlines.ru/personal_data/.
1.5 Ural Airlines OJSC determines the purposes and methods of processing personal data under the Personal Data Processing Policy, controls and processes personal data in its capacity as the “personal data operator,” and acts in accordance with applicable legislation.
1.6 For website pages and/or web/mobile applications through which the Operator collects personal data, Ural Airlines OJSC may develop additional documents concerning the processing and protection of personal data collected through such website pages and/or applications, in order to provide personal data subjects with more detailed information concerning personal data processing and the measures taken to protect it, and may publish such documents on the relevant website pages and/or within the applications. Such documents may not conflict with the requirements of the legislation of the Russian Federation or the provisions of the Policy.
2. Principles of Personal Data Processing
2.1 The organization of personal data processing and protection at Ural Airlines OJSC, as well as the implementation of processes involving the processing of personal data, is carried out with due regard for the general principles of personal data processing, which form the basis for compliance with the legislation of the Russian Federation, ensuring the security (confidentiality, integrity, and availability) of the personal data of personal data subjects, and protecting the rights of personal data subjects.
2.2 The organization of personal data processing and protection at Ural Airlines OJSC, as well as the implementation of processes involving the processing of personal data, is carried out with due regard for the general principles of personal data processing, which form the basis for compliance with the legislation of the Russian Federation, ensuring the security (confidentiality, integrity, and availability) of the personal data of personal data subjects, and protecting the rights of personal data subjects.
2.3 The principles and rules governing the protection of individuals when processing their personal data, regardless of their citizenship or place of residence, must comply with fundamental rights and freedoms, particularly the right to personal data protection.
2.4 Ural Airlines considers ensuring the safety and security of its customers, including information security and all other forms of security, to be a priority.
2.5 To protect human and civil rights and freedoms, Ural Airlines undertakes to guarantee a high level of protection for the personal data of existing and potential customers, website visitors, mobile application users, and other persons whose personal data it processes.
In view of the above, Ural Airlines establishes the following principles:
- personal data shall be processed lawfully and fairly;
- personal data processing shall be limited to specific, predefined, and lawful purposes, including the prevention of personal data processing that is incompatible with the purposes for which the personal data was collected (obtained);
- all feasible and possible measures shall be taken to ensure that personal data is accurate and up to date, as well as reasonable measures to guarantee the timely deletion or correction of inaccurate data, taking into account the purposes for which it is processed;
- personal data shall be stored in a form that permits the identification of data subjects for the period necessary for the purposes for which the personal data is processed; personal data may be stored for a longer period in cases prescribed by law or an agreement with the personal data subject, including where it is processed exclusively in the public interest, for scientific or historical research, or for statistical purposes;
- databases containing personal data that is processed for mutually incompatible purposes shall not be combined;
- the content and volume of the personal data processed shall correspond to the stated purposes of personal data processing, including the prevention of processing personal data that is excessive in relation to the stated purposes of its processing;
- the accuracy and sufficiency of personal data and, where necessary, its relevance to the purposes of personal data processing shall be ensured, and the necessary measures shall be taken to destroy or correct incomplete or inaccurate personal data;
- personal data shall be processed in a manner that guarantees appropriate personal data security, including protection against unauthorized or unlawful processing and accidental loss, damage, or destruction of data, using appropriate technical and organizational measures;
- personal data shall be destroyed or its destruction ensured (where the personal data is processed by another person acting on the Operator’s instructions) once the purposes of its processing have been achieved or where the need to achieve those purposes has ceased to exist, unless otherwise prescribed by the legislation of the Russian Federation;
- an authorization system shall be maintained for Ural Airlines employees’ access to documents and databases containing personal data;
- the confidentiality of personal data shall be ensured when it is transferred to third parties.
3. Purposes of personal data processing; categories and list of personal data processed; categories of personal data subjects whose personal data is processed; methods and periods of processing, including the storage of personal data; and the procedure for its destruction
3.1 Personal data processing is limited to achieving specific, predefined, and lawful purposes. Personal data may not be processed in a manner incompatible with the purposes for which it was collected.
3.2 Depending on the specific purposes of personal data processing, such processing may include, in particular, all or some of the following actions (operations) involving personal data: collection (receipt), recording, systematization, accumulation, storage, clarification (updating, alteration), retrieval, use, transfer (dissemination, provision, access), blocking, deletion, and destruction of personal data.
3.3 For each purpose of personal data processing, Ural Airlines OJSC has defined:
- the relevant categories and list of personal data processed;
- the categories of personal data subjects whose personal data is processed by Ural Airlines OJSC;
- the methods and periods of processing, including the storage of personal data;
- the procedure for destroying personal data.
3.4 The following methods of personal data processing are provided for each purpose of personal data processing: automated processing of personal data (using computer equipment) and non-automated processing of personal data recorded on physical media. The Operator processes personal data using the specified methods in compliance with the legislation of the Russian Federation and the Operator’s internal regulations governing the processing and protection of personal data. When processing personal data by automated means, Ural Airlines OJSC takes the necessary measures to ensure the security of the personal data being processed, including compliance with the information security requirements established by legislation and the Operator’s internal regulations. Non-automated processing of personal data, including the storage of physical personal data media, is performed on premises that ensure their safekeeping and make it possible to determine the storage locations of personal data (physical media), in accordance with the procedure prescribed by the legislation of the Russian Federation and the Operator’s internal regulations.
3.5 The periods of processing, including the storage of personal data, for each purpose of personal data processing are established with due regard for compliance with the requirements, including the conditions for personal data processing, established by the legislation of the Russian Federation, and/or the provisions of a contract to which the personal data subject is a party, beneficiary, or guarantor, and/or the personal data subject’s consent to the processing of their personal data. Personal data is processed and stored no longer than required for the purposes of its processing, unless otherwise prescribed by the legislation of the Russian Federation.
3.6 Procedure for destroying personal data.
Personal data is destroyed in the following cases:
- upon achievement of the purpose or purposes, expiry of the personal data processing period, or loss of the need to achieve the purpose or purposes of personal data processing, unless otherwise prescribed by applicable legislation or other applicable regulatory legal acts of the Russian Federation;
- where unlawful processing of personal data is identified;
- where the personal data subject withdraws consent to personal data processing, unless otherwise prescribed by applicable legislation;
- where the personal data subject demands the termination of personal data processing, unless otherwise prescribed by applicable legislation.
The methods and periods for destroying personal data are determined by the internal regulations of Ural Airlines OJSC concerning the processing and protection of personal data, in accordance with the requirements of the legislation of the Russian Federation and depending on the methods of personal data processing and the physical personal data media on which personal data is recorded and stored.
Where the purposes of personal data processing have been achieved, the personal data processing periods have expired, the legal grounds for personal data processing (personal data processing conditions) have ceased to apply, or in other cases prescribed by the legislation of the Russian Federation, the Operator destroys the personal data or ensures its destruction in accordance with the procedure established by applicable legislation and the Operator’s internal regulations. Personal data is destroyed by taking actions that make it impossible to restore the content of the personal data in personal data information systems and/or that destroy the physical personal data media. Following the destruction, the Operator prepares a personal data destruction report and creates an entry in the electronic event log.
3.7 The Personal Data Processing Policy of Ural Airlines OJSC establishes the general principles, conditions, and purposes of personal data processing.
The procedure for processing the personal data of employees, dismissed employees, former employees, candidates for vacant positions, customers/beneficiaries, counterparties and their representatives, shareholders, and other persons whose personal data is processed by the Operator is/may be determined by other internal regulations of Ural Airlines OJSC concerning personal data processing.
3.8 The Operator processes personal data for the following purposes:
| Purpose No. 1: Preparation, conclusion, and performance of a civil-law contract | |
|---|---|
| 1. Categories and list of personal data processed |
Through the official website (purchase of a ticket,
gift certificate, or goods from
the online store)
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- sex;
- citizenship;
- telephone number;
- email address;
- type of identity document, as well as its number and series;
- bank details.
2. Other personal data:
- Wings card number.
Other civil-law contracts concluded by Ural Airlines OJSC.
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- passport details (series, number, issuing authority, date of issue, and registered address);
- actual residential address;
- telephone number;
- email address;
- number and series of the state pension insurance certificate;
- taxpayer identification number;
- signature;
- education details;
- information concerning certification, advanced training, and professional retraining;
- employment details;
- bank details.
2. Special categories of personal data:
- health information.
|
| 2. Categories of subjects whose personal data is processed |
- website visitors;
- customers;
- beneficiaries under contracts;
- the Operator’s counterparties and their representatives;
- the Operator’s shareholders.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the civil-law contract expires;
- until the Parties have fully performed their obligations under the contract;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without the use of automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 2: Ensuring compliance with the requirements of the transport security legislation of the Russian Federation | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- sex;
- citizenship;
- telephone number;
- email address;
- registered address;
- actual residential address;
- passport details (series, number, issuing authority, and date of issue);
- details of the identity document used outside the Russian Federation;
- information contained in the birth certificate;
- education details.
|
| 2. Categories of subjects whose personal data is processed |
- employees in an employment relationship with the Operator;
- customers.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without the use of automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 3: Maintaining personnel records and ensuring compliance with labour legislation | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- sex;
- citizenship;
- telephone number;
- email address;
- registered address;
- actual place of residence (city);
- passport details (series, number, issuing authority, and date of issue);
- information concerning replacement of the identity document and details of the previously issued identity document;
- information concerning a change of surname, first name, or patronymic;
- military registration information;
- education details (education level, form of study, name of educational institution, year of graduation, name and details of the education certificate, qualification, and specialization specified in the education certificate);
- academic degree and title and the dates on which the academic degree/title was awarded;
- information concerning advanced training and certification (number and date of issue of the training certificate);
- information concerning foreign-language proficiency and proficiency level;
- information concerning skills and professional experience;
- professional field;
- specialization;
- position and length of service;
- type and number of the pilot licence;
- information concerning certification, advanced training, and professional retraining;
- contents of the employment contract concluded with the employee;
- salary information;
- information concerning leave taken and planned;
- number and series of the state pension insurance certificate;
- information concerning social benefits;
- marital status information;
- taxpayer identification number;
- details of the compulsory health insurance policy;
- details of the civil status registration certificate;
- employment details;
- information concerning foreign-language proficiency and proficiency level;
- information concerning skills and professional experience;
- flight hours by aircraft type;
- information concerning employment and its results, including a list of duties; information concerning employers (month and year employment commenced, month and year employment ended, position held, and organization name); career advancement; disciplinary sanctions; transfers to another position/place of work; reasons for dismissal; and length of service;
- employee identification number;
- bank card number;
- results of mandatory preliminary medical examinations upon employment and periodic medical examinations;
- information contained in employees’ personnel files;
- information concerning health-related restrictions on employment activities;
- information contained in personnel orders;
- photographic image;
- signature;
- information concerning possession of a driving licence.
2. Special categories of personal data:
- health information;
- information concerning criminal convictions and/or administrative liability.
|
| 2. Categories of subjects whose personal data is processed |
- job applicants (persons who have applied to the Operator for employment);
- employees in an employment relationship with the Operator;
- former employees of the Operator, including Airline veterans;
- dismissed employees, including Airline benefit recipients;
- family members of the Operator’s employees where information concerning them is provided by the employee in accordance with legislation and/or a contract.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the employment contract is terminated;
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no longer than 75 years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without the use of automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 4: Maintaining accounting records | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- passport details (series, number, issuing authority, date of issue, and registered address);
- actual residential address;
- telephone number;
- email address;
- number and series of the state pension insurance certificate;
- information concerning social benefits;
- marital status information;
- taxpayer identification number;
- settlement account number;
- salary information;
- information concerning leave taken and planned;
- employment details, including position and length of service;
- bank details.
2. Special categories of personal data:
- information concerning ethnic origin;
- health information.
|
| 2. Categories of subjects whose personal data is processed |
- employees in an employment relationship with the Operator;
- former employees of the Operator, including Airline veterans;
- dismissed employees, including Airline benefit recipients;
- family members of the Operator’s employees where information concerning them is provided by the employee in accordance with legislation and/or a contract;
- customers;
- beneficiaries under contracts;
- the Operator’s counterparties and their representatives;
- the Operator’s shareholders;
- other individuals who have contractual or other civil-law relationships with the Operator.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without the use of automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 5: Recruitment of personnel (applicants) for the Operator’s vacant positions | |
| 1. Categories and list of personal data processed |
Through the official website (purchase of a ticket,
gift certificate, or goods from
the online store)
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- sex;
- citizenship;
- telephone number;
- email address;
- registered address;
- actual place of residence (city);
- passport details (series, number, issuing authority, and date of issue);
- information concerning replacement of the identity document and details of the previously issued identity document;
- information concerning a change of surname, first name, or patronymic;
- military registration information;
- education details (education level, form of study, name of educational institution, year of graduation, name and details of the education certificate, qualification, and specialization specified in the education certificate);
- academic degree and title and the dates on which the academic degree/title was awarded;
- information concerning advanced training and certification (number and date of issue of the training certificate);
- information concerning foreign-language proficiency and proficiency level;
- information concerning skills and professional experience;
- professional field;
- specialization;
- information concerning employment and its results, including a list of duties; information concerning employers (month and year employment commenced, month and year employment ended, position held, and organization name); career advancement; disciplinary sanctions; transfers to another position/place of work; reasons for dismissal; and length of service;
- desired position;
- desired salary and salary level at the current (previous) place of employment;
- desired type of employment and work schedule;
- willingness to travel on business and relocate;
- information concerning important criteria when choosing a place of employment;
- marital status and presence of children, including their number and ages;
- information concerning possession of a driving licence;
- information concerning health-related restrictions on employment activities;
- information concerning interview results and the decision made;
- information concerning preferences, interests, activities, and hobbies;
- photographic image;
- signature;
- taxpayer identification number (INN);
- additional information required by federal laws governing the circumstances and specific features of personal data processing;
- information concerning social benefits;
- flight hours by aircraft type;
- other information provided by the personal data subject.
2. Special categories of personal data:
- health information;
- information concerning criminal convictions and/or administrative liability.
|
| 2. Categories of subjects whose personal data is processed |
- job applicants (persons who have applied for employment)
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without the use of automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 6: Processing requests submitted by visitors to the Operator’s website through feedback forms | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- registered address;
- city of residence;
- sex;
- citizenship;
- telephone number;
- military service status;
- education details;
- English language proficiency;
- email address;
- type, number, and series of the identity document;
- bank details.
2. Other personal data:
- Wings Programme card/bonus card number;
- booking or ticket number;
- itinerary;
- booking code;
- preferred method of receiving a response;
- position applied for;
- type and number of the pilot’s licence;
- information concerning administrative liability;
- information concerning the aircraft type rating certificate;
- information concerning flight hours by aircraft type;
- information concerning the medical certificate;
- information on whether a Certificate of No Criminal Record and a Certificate of No Administrative Penalties for the Use of Narcotic Drugs or Psychotropic Substances without a Doctor’s Prescription or New Potentially Dangerous Psychoactive Substances were requested through the State Services portal;
- information contained in documents (identity document, birth certificate, registration certificate, disability certificate, large-family certificate, leave travel document, travel voucher,
document confirming full-time student status) for subsidized transportation;
- user data (location information; operating system type and version; browser type and version;
provider; source from which the user arrived; duration of the user
session; entry points (third-party websites from which the user follows a link to the website);
operating system and browser language;
- IP address;
- information from cookies.
- information about the browser (or another programme used to access the website);
- access time;
- page address;
- referrer (address of the previous page).
- other information provided during registration (authorization) on the website and while using it that corresponds to the personal data processing purposes specified in this clause of the Policy.
3. Special categories of personal data:
- information concerning criminal convictions (job applicants).
|
| 2. Categories of subjects whose personal data is processed | Website visitors |
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the personal data subject withdraws their consent;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation and the Operator’s internal regulations (including the Cookie Policy), but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 7: Participation in the Wings Loyalty Programme | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- city of residence;
- sex;
- telephone number;
- identity document details (type, series, and number).
|
| 2. Categories of subjects whose personal data is processed | Customers |
| 3. Method of personal data processing and storage | Automated (using automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the personal data subject withdraws their consent;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation and the Operator’s internal regulations, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 8: Maintaining and updating the register of shareholders and enabling shareholders to exercise their securities rights | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- registered address;
- residential address;
- sex;
- citizenship;
- telephone number;
- email address;
- passport details (series, number, issuing authority, and date of issue);
- information concerning replacement and details of the previously issued identity document;
- information concerning changes of surname, first name, or patronymic;
- bank details.
2. Other personal data:
- number and categories of shares owned, acquisition and disposal dates, and value;
- information concerning imposed restrictions (seizure or pledge);
- archive of data concerning shareholders’ participation in corporate actions, including voting at general meetings and receiving dividend payments;
- personal account.
|
| 2. Categories of subjects whose personal data is processed |
- shareholders (including former shareholders);
- nominee holders;
- trustees.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no more than 50 years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 9: Voluntary Health Insurance | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- citizenship;
- place of birth;
- registered address;
- sex;
- marital status;
- education details;
- employment history;
- military registration details;
- information concerning awards;
- information concerning social benefits;
- family composition details;
- information concerning the presence or absence of a criminal conviction and/or criminal prosecution or termination of criminal prosecution;
- previous employment details;
- profession and specialty;
- SNILS;
- taxpayer identification number (INN);
- telephone number;
- email address;
- identity document details;
- data contained in the birth certificate;
- position held.
2. Special categories of personal data:
- health information.
|
| 2. Categories of subjects whose personal data is processed |
- the Operator’s employees;
- relatives of the Operator’s employees.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the insurance agreement expires/is terminated;
- until the personal data subject withdraws their consent;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 10: Participation in constitutional, civil, administrative, and criminal proceedings and proceedings before commercial courts | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- passport details (series, number, issuing authority, date of issue, and registered address);
- actual residential address;
- telephone number;
- email address;
- number and series of the state pension insurance certificate;
- taxpayer identification number;
- bank details;
- other information obtained in connection with participation in legal proceedings or contained in documents submitted by the parties to the proceedings.
2. Special categories of personal data.
Special categories of personal data may be processed where they are provided by the parties to the legal proceedings, including:
- information concerning ethnicity;
- information concerning criminal convictions and/or administrative liability;
- health information.
|
| 2. Categories of subjects whose personal data is processed |
- individuals who are parties to legal proceedings and their representatives;
- other individuals whose personal data is processed in connection with participation in legal proceedings.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 11: Analysing website visitors’ actions and ensuring website operation using cookie services and the Yandex.Metrica analytics programme | |
| 1. Categories and list of personal data processed |
Other personal data:
- cookies (user identifiers and other data);
- user data collected through the Yandex.Metrica service (IP address; location information; operating system type and version; browser type and version; provider; source from which the user arrived; duration of the user session; entry points (third-party websites from which the user follows a link to the website); operating system and browser language; information from cookies; browser information (or information about another programme used to access the website); access time; page address; referrer (address of the previous page); device type; screen resolution; time zone; language; geographical data; URLs of pages visited; referral source; browsing depth; and user actions)
|
| 2. Categories of subjects whose personal data is processed | Website visitors |
| 3. Method of personal data processing and storage | Automated (using automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the personal data subject withdraws their consent;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation and the Operator’s internal regulations (including the Cookie Policy), but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 12: Sending advertising and informational communications to website visitors | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- telephone number;
- email address.
|
| 2. Categories of subjects whose personal data is processed | Website users |
| 3. Method of personal data processing and storage | Automated (using automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the personal data subject withdraws their consent;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 13: Arranging introductory, practical, or pre-graduation internships under an agreement with an educational institution | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- place of birth;
- sex;
- email address;
- actual residential address;
- telephone number;
- SNILS;
- taxpayer identification number (INN);
- identity document details;
- education details.
|
| 2. Categories of subjects whose personal data is processed |
- pupils;
- students;
- legal representatives of pupils and students.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without the use of automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
| Purpose No. 14: Maintaining access control at the Operator’s premises | |
| 1. Categories and list of personal data processed |
1. General personal data:
- surname, first name, and patronymic;
- date, month, and year of birth;
- position;
- employee identification number
|
| 2. Categories of subjects whose personal data is processed |
- employees in an employment relationship with the Operator;
- family members of the Operator’s employees;
- job applicants (persons who have applied to the Operator for employment);
- counterparties and their representatives;
- customers and beneficiaries under agreements;
- pupils;
- students;
- legal representatives of pupils and students;
- other visitors/guests.
|
| 3. Method of personal data processing and storage | Mixed (with and without the use of automation tools) |
| 4. Personal data processing period |
- until the purpose of personal data processing is achieved;
- until the Operator ceases its activities.
|
| 5. Personal data storage period | In accordance with applicable legislation, but for no less than five years. |
| 6. Procedure for destroying personal data once the purposes of its processing have been achieved or other lawful grounds have arisen |
Personal data processed using automation tools is destroyed by deleting it from the Operator’s database.
Personal data processed without the use of automation tools is destroyed by destroying the physical medium containing that personal data.
The destruction of personal data is documented by preparing the relevant personal data destruction report and an extract from the event log of the personal data information system (provided that the personal data was entered into the information system).
Once the report has been approved, the personal data must be permanently deleted from the Operator’s database.
|
3.9. The personal data of employees of Ural Airlines OJSC, former employees of the Operator, including Airline veterans, dismissed employees, including Airline benefit recipients, family members of employees, and job applicants is processed exclusively in compliance with the requirements of laws and other regulatory legal acts for the purposes of assisting with employment, training, and career advancement; arranging air travel for employees and former employees of Ural Airlines OJSC; sending the Operator’s employees on business trips and official travel; ensuring the personal safety of employees; monitoring the quantity and quality of work performed; and safeguarding property in accordance with the Labour Code of the Russian Federation (Article 86 of the Labour Code of the Russian Federation), as well as for the purposes of implementing social programmes; preventive healthcare; fulfilling contractual obligations to counterparties (issuing powers of attorney, copies of documents containing personal data, and other documents required to arrange interaction with banks, and interacting with counterparties in connection with the fulfilment of contractual obligations); issuing corporate payment cards; producing business cards for employees; publishing employees’ personal data on the corporate website of Ural Airlines OJSC; and for other purposes that comply with applicable legislation and the Operator’s internal regulations.
The personal data of the Operator’s passengers/customers may be processed for the purposes of performing air carriage agreements to which the personal data subject—the passenger (customer)—is a party; providing additional services during air carriage, including meals, special air carriage conditions, automatic flight check-in, SMS notifications, and other services; operating the Wings Programme; implementing the marketing programme; ensuring aviation security and flight safety, including through the collection of biometric information, such as facial recognition, during security checks before and after travel on flights or voice identification when contacting the contact centre; providing consulting services concerning the booking (reservation) of seats on an aircraft, changes to reservations, flight check-in, the booking of specialized and additional services, special transportation, and other matters relating to the conclusion and performance of an air carriage agreement; and responding to requests from state supervisory and law enforcement authorities.
The personal data of individuals who have contractual or other civil-law relationships with Ural Airlines OJSC is processed exclusively for the purposes of performing the agreements concluded with them and complying with the requirements of applicable legislation.
The personal data of persons who have provided their personal data to Ural Airlines OJSC, including individuals who have contractual or other civil-law relationships with Ural Airlines OJSC, is processed for the purposes of performing the relevant contracts and agreements between the Operator and third parties and complying with the requirements of applicable legislation.
The personal data of personal data subjects who have provided their consent to participate in statistical and marketing research is processed exclusively for marketing purposes.
4. Legal Grounds for Personal Data Processing
4.1The personal data of employees of Ural Airlines OJSC, former employees of the Operator, including Airline veterans, dismissed employees, including Airline benefit recipients, family members of employees, and job applicants is processed on the basis of the Civil Code of the Russian Federation, the Labour Code of the Russian Federation, other federal laws, and the relevant agreements between Ural Airlines OJSC and the employee, former employee, including an Airline veteran, dismissed employee, including an Airline benefit recipient, family members of employees, or job applicant, including consent to personal data processing.
4.2The personal data of passengers (customers) of Ural Airlines OJSC is processed on the basis of:
- the Air Code of the Russian Federation;
- the Civil Code of the Russian Federation;
- Federal Law No. 16-FZ dated February 9, 2007, “On Transport Security”;
- the Warsaw Convention concluded on October 12, 1929 (as amended by the Hague Protocol dated September 28, 1955);
- the Convention for the Unification of Certain Rules for International Carriage by Air (concluded in Montreal on May 28, 1999);
- the Chicago Convention concluded on December 7, 1944;
- the General Conditions of Carriage for Passengers and Baggage adopted by the International Air Transport Association (IATA);
- the passenger air carriage agreement;
- the subject’s consent to the processing of their personal data upon joining the Wings Programme and their acceptance of the Programme Rules, provided by the customer when joining the Wings Programme;
4.3the consent of a visitor to the Ural Airlines OJSC website or mobile application to the processing of personal data.
4.4The personal data of persons who have subscribed to advertising mailings and/or advertising information is processed on the basis of the consent to personal data processing that they have provided to Ural Airlines OJSC in accordance with Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data.”
4.5The personal data of persons is processed for statistical and marketing research on the basis of the personal data subjects’ consent to the processing of their personal data for statistical and marketing research.
4.6The personal data of individuals who are candidates for entering into civil-law contracts with Ural Airlines OJSC is processed on the basis of the personal data subjects’ consent to the processing of their personal data.
4.7Ural Airlines OJSC may process personal data that the personal data subject has authorized for dissemination in accordance with the procedure established by Article 10.1 of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data.”
4.8The Operator processes personal data where at least one of the following conditions applies:
- personal data is processed with the personal data subject’s consent to the processing of their personal data;
- personal data processing is necessary to achieve the purposes stipulated by an international treaty of the Russian Federation or by law or to exercise and perform the functions, powers, and duties assigned to the Operator by the legislation of the Russian Federation;
- personal data is processed in connection with the person’s participation in constitutional, civil, administrative, or criminal proceedings or proceedings before commercial courts;
- personal data processing is necessary to enforce a judicial act or an act of another authority or official that is enforceable under the legislation of the Russian Federation concerning enforcement proceedings;
- personal data processing is necessary to perform a contract to which the personal data subject is a party, beneficiary, or guarantor, or to enter into a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;
- personal data processing is necessary to protect the life, health, or other vital interests of the personal data subject where obtaining the subject’s consent is impossible;
- personal data processing is necessary to exercise the rights and legitimate interests of the Operator or third parties or to achieve socially significant objectives, provided that this does not violate the rights and freedoms of the personal data subject;
- personal data subject to publication or mandatory disclosure under federal law is processed.
4.9For informational purposes, Ural Airlines OJSC may create publicly available sources of personal data, including directories, in which personal data is included with the written consent of the personal data subject.
4.10Ural Airlines OJSC does not process special categories of personal data, which under federal legislation include, for example, information concerning health, criminal convictions, race or ethnicity, political opinions, religious or other beliefs, trade union membership, or intimate life, except in the following cases:
- the personal data subject has provided written consent to the processing of their personal data;
- personal data is processed in accordance with legislation concerning state social assistance, labour legislation, and the pension legislation of the Russian Federation;
- personal data processing is necessary to protect the life, health, or other vital interests of the personal data subject or the life, health, or other vital interests of other persons, and obtaining the personal data subject’s consent is impossible;
- personal data is processed for preventive healthcare purposes, for establishing a medical diagnosis, or for providing medical and medical-social services, provided that the personal data is processed by a healthcare professional who is required under the legislation of the Russian Federation to maintain medical confidentiality;
- personal data processing is necessary to establish or exercise the rights of the personal data subject or third parties or in connection with the administration of justice;
- personal data is processed in accordance with legislation concerning compulsory types of insurance and insurance legislation.
4.11Cross-border transfers of personal data are carried out subject to the conditions and restrictions established by Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data,” and in accordance with the internal regulations of Ural Airlines OJSC concerning the organization of personal data processing and protection. Before a cross-border transfer of personal data begins, an assessment is conducted of the measures taken by the foreign recipient to whom the personal data is to be transferred to ensure the security (confidentiality, integrity, and availability) of the personal data. The assessment procedure is established by the Operator’s internal regulations. Ural Airlines OJSC notifies Roskomnadzor of the planned cross-border transfer of personal data in accordance with the procedure prescribed by the legislation of the Russian Federation.
5. General Principles for Considering Requests from Personal Data Subjects Concerning Personal Data Processing
5.1To observe the rights and legitimate interests of personal data subjects, comply with the time limits for processing applications and/or requests, ensure the quality and completeness of measures taken in response to a lawful demand from a personal data subject, and provide the necessary information concerning their application and/or request, applications from personal data subjects are accepted and processed, and such acceptance and processing are monitored.
5.2In accordance with the legislation of the Russian Federation, a personal data subject is entitled to submit a request to Ural Airlines OJSC for information concerning the processing of their personal data or for the correction of their personal data, restriction of its processing, blocking, or destruction if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing.
5.3The request must contain the number of the primary identity document of the personal data subject or their representative, information on the date of issue of that document and the authority that issued it, information confirming the personal data subject’s relationship with the Operator (contract number, date of conclusion of the contract, code word, and/or other information), or information otherwise confirming that the Operator processes the personal data, as well as the signature of the personal data subject or their representative.
5.4A written request may be sent to Ural Airlines OJSC at: 1G Utrenniy Lane, Yekaterinburg, Sverdlovsk Region, 620025, Russian Federation.
5.5Upon receiving an application and/or request from a personal data subject and confirming its lawfulness, Ural Airlines OJSC provides the personal data subject and/or their duly authorized representative with the information specified in the request in the same form in which the relevant application or request was submitted, unless otherwise specified in the application or request, and/or takes other measures depending on the specific nature of the application and/or request. The information provided by the Operator may not contain personal data belonging to other personal data subjects, except where there are lawful grounds for disclosing such personal data.
Ural Airlines OJSC is entitled to refuse to satisfy the demands specified in the application and/or request by sending a reasoned refusal to the personal data subject or their representative if, under the legislation of the Russian Federation, the Operator has lawful grounds for refusing to fulfil or satisfy the demands received.
5.6Ural Airlines OJSC provides information and/or takes other measures in connection with applications and/or requests received from personal data subjects to the extent and within the time limits prescribed by the legislation of the Russian Federation. The time limit established by the legislation of the Russian Federation for responding to a personal data subject’s application and/or request for information concerning the processing of their personal data may be extended in accordance with the requirements governing extensions established by Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data,” provided that the personal data subject is sent a reasoned notification specifying the grounds for extending the period for providing the requested information.
5.7A personal data subject may also correct their personal data, including by making changes to the personal data in their personal account on the Ural Airlines OJSC website through the feedback form.
5.8Ural Airlines OJSC does not disclose to third parties any confidential information concerning personal data, bank details, or similar information received from customers in the course of its activities without the consent of the personal data subject, except as provided by the legislation of the Russian Federation.
5.9Personal data may be transferred to partner organizations of Ural Airlines OJSC for the purposes of issuing airline tickets, arranging additional services (air travel insurance, hotel reservations, and car rentals), and processing bank card payments, in the cases and according to the procedures prescribed by the legislation of the Russian Federation.
5.10Information containing personal data may be transferred to law enforcement agencies and other government authorities in accordance with the legislation of the Russian Federation.
6. Measures to Ensure the Security (Confidentiality, Integrity, and Availability) of Personal Data
6.1To ensure the security (confidentiality, integrity, and availability) of the personal data of personal data subjects and to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, or dissemination, as well as against other unlawful actions involving personal data, Ural Airlines OJSC takes the necessary legal, organizational, and technical measures in accordance with the applicable legislation of the Russian Federation concerning personal data.
6.2To prevent unauthorized access to personal data, the Operator applies the following organizational and technical measures:
- identifies current security threats to personal data processed in personal data information systems (PDIS) and applies appropriate organizational and technical protection measures for the established personal data security levels;
- identifies the types of personal data security threats relevant to PDIS, taking into account an assessment of the harm that may be caused to personal data subjects in the event of a violation of the requirements of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data”;
- uses information security tools appropriate to the personal data security levels and duly subjected to conformity assessment procedures to neutralize current personal data security threats;
- assesses the effectiveness of the measures taken to ensure personal data security before commissioning PDIS;
- organizes the recording of technical equipment included in PDIS, as well as machine-readable storage media, and ensures the safekeeping of personal data storage media;
- implements PDIS audit subsystems that record and log actions performed with personal data;
- ensures the recovery of personal data modified or destroyed as a result of unauthorized access;
- ensures access control and manages access to personal data, technical equipment used for personal data processing, information security tools, and tools supporting the operation of information systems;
- maintains a security regime for the premises and buildings in which PDIS are located;
- determines and, where necessary, updates the list of persons who require access, for the performance of their employment duties, to personal data processed in PDIS, and ensures that access is granted exclusively to persons who require it for the performance of their employment duties;
- appoints an official responsible for ensuring personal data security in PDIS;
- establishes a structural unit responsible for ensuring personal data security in PDIS;
- locates the Operator’s PDIS within a protected perimeter situated inside a controlled area;
- restricts access to the content of security events to a limited group of persons who require such access for the performance of their employment duties;
- monitors the measures taken to ensure personal data security and the security level of PDIS;
- uses software and/or its components authorized for use and monitors their installation and updating;
- implements measures aimed at preventing and detecting unauthorized access to personal data and taking appropriate action, including measures to prevent, detect, and eliminate the consequences of computer attacks on PDIS and to respond to computer incidents within them;
- appoints a person responsible for organizing personal data processing;
- appoints persons responsible for ensuring the security and confidentiality of personal data;
- approves the list of persons authorized to process personal data;
- provides training and familiarizes persons authorized to process personal data with the requirements of federal legislation and the Operator’s regulatory documents concerning personal data processing and protection;
- conducts internal monitoring and/or audits of the compliance of personal data processing with Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data,” the regulatory legal acts adopted pursuant thereto, personal data protection requirements, the Operator’s Personal Data Processing Policy, and the Operator’s local regulations;
- maintains a security regime for the premises in which personal data is processed.
7. Final Provisions
7.1The Policy shall enter into force and become binding on all employees of Ural Airlines OJSC from the date of its approval.
7.2The Policy may be amended at any time at the discretion of Ural Airlines OJSC.
7.3If, for any reason, one or more provisions of the Policy are declared invalid or legally unenforceable, this shall not affect the validity or applicability of the remaining provisions of the Policy.
7.4Employees of Ural Airlines OJSC shall be liable for failure to comply with the requirements governing the processing and protection of personal data, including the disclosure or unlawful use of personal data, and may also be subject to civil, administrative, and criminal liability in accordance with the applicable laws and regulations of the Russian Federation.
7.5The Personal Data Processing Policy of Ural Airlines OJSC is published on the official website on the Internet at: https://www.uralairlines.ru/personal_data/. Unrestricted access to the Policy is provided.