How to create terms of use and business privacy policy. Personal data processing policy constructor Scope and categories of processed personal data, categories of personal data subjects

Privacy policy - how to do it right?

July 2017 still made site owners pretty nervous. This is due to the amendments to Article 13.11 of the Code of Administrative Offenses of the Russian Federation that came into force on July 1, 2017 (see Federal Law No. 13-FZ of February 7, 2017 “On Amending the Code Russian Federation on Administrative Offenses"), toughening administrative liability for violation of the procedure for processing personal data.

The amount of fines for entrepreneurs varies from 5 thousand rubles. up to 75 thousand rubles. The last figure refers to organizations that have allowed the processing of personal data, for example, without the written consent of the subject of personal data.

Before sounding the alarm and thinking about what to do and rushing to turn off forms on the site for feedback, it is necessary to diagnose your own site for the presence or absence of documents regulating relations with users, including on the issue of processing the data they leave, as well as evaluate their content in terms of transparency, completeness, consistency and sufficiency.

If you do not know how to do this correctly, and what a privacy policy should include, we suggest paying attention to the following key points.

1. Why do we need a Privacy Policy?

We think that the answer is obvious here. The document regulating the processing of personal data of users and posted on the site is nothing more than the rules of the game that the site owner establishes in relations with users. The purpose of fixing and posting such rules is to reduce the risks from the legislation on personal data, if necessary, to repel consumer extremism.

2. How better to call it - an offer, an agreement on the processing of personal data or a privacy policy?

From a legal point of view, the name of the document regulating the processing of personal data of users does not matter. The rest is a matter of taste for each site owner. For our part, we can highlight the name "privacy policy" because of its capacity, widespread use and understandability for the user.

3. What is the best way to place it - in the form of a separate document or make it part of the offer / user agreement?

There are also no mandatory rules and a universal template. You can reflect the necessary provisions in a separate document or make it part of, for example, a user agreement.

As a rule, the user agreement contains many features of the use of the site, which affects the volume of the document. Including data processing provisions in the user agreement will obviously overload the document and complicate its perception by the user.

When placing two separate documents on the site (for example, a privacy policy and a user agreement), we recommend that you check them for consistency with each other, as well as for links to each other.

4. Do I need to post a separate form of consent to the processing of personal data in addition to the Privacy Policy?

Here the answer is simple. If the Privacy Policy obviously implies consent to the processing of what data and for what purpose the user gives, then a separate consent form will be superfluous.

5. How to make the rules work?

The privacy policy is the same offer (agreement), only on issues related to the processing of personal data of users. In order for the user to be considered the owner of the site who has accepted the terms of processing his data, he must accept the proposed rules (accept, agree).

Such an acceptance may be:

b) putting marks in the fields,

c) performing a sequence of actions,

d) use of site functionality.

“The User agrees to the provisions of this Privacy Policy by clicking the “Accept the Privacy Policy” or “Continue” button, by putting the appropriate mark in the field during Registration, including at any stage of such registration and (or) at any time when using the site.

6. What should be included in the Privacy Policy (hereinafter referred to as the Policy)?

There is no universal template for the Privacy Policy. In any case, when drawing up the Privacy Policy, it is worth considering the specifics of the site, its purpose, functionality, the circle of users, the amount of data they leave.

An analysis of the current legislation in the field of personal data processing, as well as our own experience, allowed us to formulate the following recommendations for website owners on the content of the Privacy Policy:

a) include on request section with terms and definitions- is optional. For the convenience of the user and the unification of documents on the site, you can include an appropriate section with concepts and definitions that are common to both the Privacy Policy and the User Agreement (for example, "Privacy Policy", "user", "site", "site owner" , " Personal Area" and etc.).

The absence of such a section in the Privacy Policy is not associated with risks for the site owner.

b) highlight the general provisions, where we describe:

• subject of regulation of the Policy ( for example, "regulates the procedure for processing users' personal data, including for the purpose of ensuring the security of processing users' personal data, ensuring their rights and interests in the processing of personal data").
• user acceptance forms with the terms of the Policy and data processing ( an example is given in paragraph 5 of this article).
• place of resolution of disputes arising from the Policy, subject to ( for example, all possible disputes regarding this Privacy Policy and relations between the user and the Site Administration will be resolved according to the rules of Russian law in court at the location of the Site Administration,unless otherwise expressly provided by the legislation of the Russian Federation ).

The reservation is necessary to comply with applicable law, and the indication of the place of dispute resolution at the location of the site owner is intended to have a rather preventive effect on the user.

• the procedure for changing and updating the Policy ( for example, “The site administration reserves the right to change and (or) supplement this Privacy Policy without any special notice. The new version of the Privacy Policy comes into force from the moment it is posted on the website page, unless otherwise provided by the new version of the Privacy Policy. The current version of the Privacy Policy is always located on the website page at... ").

It is worth pointing out that the silence of the user is regarded as acceptance of the changes and (or) additions to the Privacy Policy.

• lack of access to data that the user leaves on third-party sites. This may be due to the user paying for services and providing their payment information.

In this case, you should clearly state, for example, the following:“the user acknowledges and confirms that any data (including details bank cards), directly or indirectly related to the payment for services and services, are posted by the User on the pages of sites owned by third parties that are not related to the Site Administration; The site administration does not have access to such information, does not carry out any actions in relation to such data, including their collection, systematization, accumulation, storage, clarification (updating, changing), use, distribution (including transfer), depersonalization, blocking , destruction, cross-border transfer".

c) fix the provision of consent to the processing of personal data. This is simply a "must have" of any privacy policy. Be sure to indicate that by giving consent, the user acts of his own will and in his own interest. Consent is given by the user from the moment of registration on the site and (or) other actions related to the use of the services or features of the site.

d) indicate the purpose of giving consent. Several options are possible here:

• for the purposes of concluding an agreement with the Site Administration, other agreements expressly provided for by the Policy, other agreements posted on the pages of the site, and their further execution,
• participation in ongoing promotions, decision-making or other actions that give rise to legal consequences in relation to the user or other persons,
• to accept, process requests;
• informing about the status of the request, services, for example, through electronic and SMS notifications;
• improving the quality of the site;
• conducting statistical and other research based on depersonalized data.

The key is the first option indicating the provision of data in order to conclude agreements with the Site Administration and their execution. This option, in the event of problems with Roskomnadzor, will explain the lack of consent to the processing of personal data "on paper", as well as the failure of the site owner to send a notification to Roskomnadzor.

e) describe the composition of personal data. Remember that not all user data is personal. Personal data includes such a set of data that allows you to identify the user, for example, full name and address of residence.

You can specify that consent applies to the surname, name, patronymic, address, telephone number and any other information related to the identity of the user, available or known at any particular time Site administration.

e) indicate the period for which consent is granted. It can be described like this: the consent is given by the user until the expiration of the storage period for the relevant information or documents containing the above information, determined in accordance with the legislation of the Russian Federation, after which it can be withdrawn by the user by sending the appropriate written notice to the Administration at least 3 months prior to the withdrawal of consent.

g) fix the scope of possible processing actions. Here we proceed from the fact that the more possible actions with data are described, the better. It can be described as follows : Consent is given to perform any actions in relation to personal data that are necessary or desirable to achieve the above goals, including, without limitation: collection, systematization, accumulation, storage, clarification (updating, changing), use, distribution (including transfer), depersonalization, blocking, destruction, cross-border transfer of personal data, as well as the implementation of any other actions with the user's personal data, subject to the current legislation of the Russian Federation.

h) indicate the methods of data processing.You can specify the following: storage, recording on electronic media and their storage, listing. Separately, it should be noted that the specified list of processing methods is not exhaustive.

i) include the right to disclosure to third parties. It is worth fixing the right of the Site Administration to transfer data to third parties in order to achieve the goals specified in the Policy, as well as the user's consent to this.

j) determine the procedure for sending legally significant messages. To regulate the flow of incoming requests from users regarding data processing, it is worth complicating the procedure for interacting with the Site Administration. This can be done by determining the written form for such appeals, as well as the method of their submission - sending to the postal address indicated on the site and / or by courier. Additionally, it is worth pointing out that otherwise, appeals and notifications of the user may remain without consideration.

1. General Provisions

This personal data processing policy has been drawn up in accordance with the requirements of the Federal Law of July 27, 2006. No. 152-FZ "On Personal Data" and determines the procedure for processing personal data and measures to ensure the security of personal data of Mikhailov Ivan Sergeevich (hereinafter referred to as the Operator).

1. The operator sets as its most important goal and condition for the implementation of its activities the observance of the rights and freedoms of a person and a citizen in the processing of his personal data, including the protection of the rights to privacy, personal and family secrets.
2. This Operator's policy regarding the processing of personal data (hereinafter referred to as the Policy) applies to all information that the Operator can receive about visitors to the https://mysite.ru website.

2. Basic concepts used in the Policy

1. Automated processing of personal data - processing of personal data using computer science;
2. Blocking of personal data - temporary suspension of the processing of personal data (unless the processing is necessary to clarify personal data);
3. Website - a set of graphic and informational materials, as well as computer programs and databases that ensure their availability on the Internet at the network address https://mysite.ru;
4. Information system of personal data - a set of personal data contained in databases and providing their processing information technologies and technical means;
5. Depersonalization of personal data - actions, as a result of which it is impossible to determine without using additional information belonging of personal data to a specific User or other subject of personal data;
6. Processing of personal data - any action (operation) or a set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;
7. Operator - government agency, a municipal authority, a legal or natural person, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
8. Personal data - any information relating directly or indirectly to a specific or identifiable User of the website https://mysite.ru;
9. User - any visitor to the website https://mysite.ru;
10. Providing personal data - actions aimed at disclosing personal data to a certain person or a certain circle of persons;
11. Dissemination of personal data - any actions aimed at disclosing personal data to an indefinite circle of persons (transfer of personal data) or familiarizing with personal data of an unlimited number of persons, including the disclosure of personal data in the media, placement in information and telecommunication networks or providing access to personal data in any other way;
12. Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign natural or foreign legal entity;
13. Destruction of personal data - any actions as a result of which personal data is destroyed irrevocably with the impossibility further recovery the content of personal data in information system personal data and (or) as a result of which material carriers of personal data are destroyed.

3. The Operator may process the following personal data of the User

1. Full Name;
2. Phone number;
3. Address Email;
4. The site also collects and processes anonymous data about visitors (including cookies) using Internet statistics services (Yandex Metrika and Google Analytics and others).
5. The above data is further merged in the text of the Policy general concept Personal data.

4. Purposes of personal data processing

1. The purpose of processing the User's personal data is the conclusion, execution and termination of civil law contracts; providing the User with access to the services, information and/or materials contained on the website https://mysite.ru; clarification of order details.
2. The Operator also has the right to send notifications to the User about new products and services, special offers and various events. The user can always refuse to receive information messages by sending an email to the Operator [email protected] marked "Opt out of notifications about new products and services and special offers."
3. Impersonal data of Users collected using Internet statistics services are used to collect information about the actions of Users on the site, improve the quality of the site and its content.

5. Legal grounds for the processing of personal data

1. The Operator processes the User's personal data only if they are filled in and / or sent by the User independently through special forms located on the site https://mysite.ru. By filling out the relevant forms and / or sending their personal data to the Operator, the User expresses his consent to this Policy.
2. The Operator processes anonymized data about the User if it is allowed in the User's browser settings (saving cookies and using JavaScript technology is enabled).

6. The procedure for collecting, storing, transferring and other types of processing of personal data

The security of personal data processed by the Operator is ensured through the implementation of legal, organizational and technical measures necessary to fully comply with the requirements of the current legislation in the field of personal data protection.

1. The Operator ensures the safety of personal data and takes all possible measures to exclude access to personal data of unauthorized persons.
2. The User's personal data will never, under any circumstances, be transferred to third parties, except in cases related to the implementation of applicable law.
3. In case of detection of inaccuracies in personal data, the User can update them independently by sending a notification to the Operator to the Operator’s e-mail address [email protected] marked "Updating personal data".
4. The term for processing personal data is unlimited. The user may at any time withdraw his consent to the processing of personal data by sending a notification to the Operator by e-mail at email address Operator [email protected] marked "Withdrawal of consent to the processing of personal data".

7. Cross-border transfer of personal data

1. Before the start of the cross-border transfer of personal data, the operator is obliged to make sure that the foreign state to whose territory the transfer of personal data is supposed to be carried out provides reliable protection of the rights of subjects of personal data.
2. Cross-border transfer of personal data on the territory of foreign countries that do not meet the above requirements can only be carried out if there is consent in writing the subject of personal data for the cross-border transfer of his personal data and / or the execution of an agreement to which the subject of personal data is a party.

8. Final provisions

1. The user can get any clarifications on issues of interest regarding the processing of his personal data by contacting the Operator via e-mail [email protected].
2. AT this document any changes in the personal data processing policy by the Operator will be reflected. The policy is valid indefinitely until it is replaced by a new version.
3. Current version The freely available policy is located on the Internet at https://mysite.ru/policy/.

This Privacy Policy (hereinafter referred to as the Policy) is an annex to the User Agreement and determines the procedure for processing and protecting personal information about Users, which Mann, Ivanov and Ferber Limited Liability Company (hereinafter referred to as the Administration), may receive while using the Administration Service (hereinafter referred to as the Services).

Before using the Service, users should read the terms of this Privacy Policy.

1. General Provisions

1.1. Using the Service in any form means the User's unconditional consent to the terms of this Privacy Policy and the conditions for processing his personal information specified therein. In case of disagreement with the terms of the Privacy Policy, the User must refrain from using the Service.

1.2. The Privacy Policy (including any of its parts) may be changed by the Administration without any special notice and without payment of any compensation in connection with this. The new version of the Privacy Policy comes into force from the moment it is posted on the Administration website.

1.3. By accepting the terms of this Policy, the User expresses his consent to the processing by the Administration of data about the User for the purposes provided for in this Policy, as well as to the transfer of data about the User to third parties in the cases listed in this Policy.

The specified consent can be revoked by the User only if he notifies the Administration in writing at least 180 days before the expected date of termination of the use of data by the Administration.

Using the Service using a web browser that accepts data from cookies means the User's consent to the fact that the Administration can collect and process data from cookies for the purposes provided for in this Policy, as well as to transfer data from cookies to third parties in the cases listed in this Policy.

Disabling and / or blocking by the User of the web browser option to accept data from cookies means a prohibition on the collection and processing by the Administration of data from cookies in accordance with the terms of this Privacy Policy.

1.4. By general rule The Administration does not verify the accuracy of the personal information provided by Users. At the same time, in the cases provided for by the User Agreement, the User is obliged to provide confirmation of the accuracy of the personal information provided by him about himself.

2. The composition of information about Users that the Administration receives and processes

2.1. This Policy applies to the following types of personal information:

2.1.1. Personal information posted by Users, incl. about yourself when filling out the form for sending a message, other personal information, access to which the User provides the Administration through websites or services of third parties, or personal information posted by Users in the process of using the Service. The personal information obtained in this way may include, in particular, the last name, first name, telephone number, e-mail address of the User, address for delivery of the order. Other information is provided by the User at his discretion.

It is prohibited for the User to provide personal data of third parties without permission from third parties for such distribution, or if such personal data of third parties were not obtained by the User from publicly available sources of information.

2.1.2. This Policy also applies to candidates for existing vacancies of the Administration, along with other Users. Candidates for vacancies, by sending a resume to the Administration using the Service, or by e-mail, for the purpose of passing an interview and further employment, thus express their consent to the processing of the following personal data: last name, first name, patronymic, date of birth, citizenship, city of residence, contacts ( telephone, e-mail address), place of work and dates of work, as well as other data indicated by candidates for vacancies in the resume.

2.1.3. The Seller guarantees the Buyer the confidentiality of the following personal information about the Buyer:

- information about the user's card (last 4 digits);

- information about purchases and orders.

The specified information is transferred by the Seller to third parties solely for the purpose of making payment for the order payment system; other cases of transfer of the specified information to third parties are not allowed.

2.1.4. Data automatically transmitted to the Service in the process of their use with the help of the User installed on the device software, incl. IP address, individual device network number (MAC address, device ID), email serial number(IMEI, MEID), cookie data, browser information, operating system, access time, search queries User.

2.1.5. Data additionally provided by the Users at the request of the Administration in order to fulfill the obligations of the Administration to the Users regarding the use of the Service.

2.1.6. Other information about Users, the collection and / or processing of which is established by the user agreement of the Administration.

3. Purposes of collecting and processing information about Users

3.1. The Administration collects and processes only that information about Users, incl. their personal data, which is necessary to fulfill the obligations of the Administration to provide the Service, answer the question asked by the User when sending a message using the Service, as well as fulfill the obligations stipulated by the user agreement.

3.2. The Administration may use the personal information of Users for the following purposes:

3.2.1. identification of the party within the framework of agreements between the User and the Administration.

3.2.2.providing services to Users using the Service and to fulfill their obligations to them, incl. clarification of payment data, processing of orders and requests and further improvement of the Service, development of new services and services.

3.2.3. informing Users about the appearance of new materials on the Site, sending requests regarding the use of the Service, feedback from the User.

3.2.4. performing marketing tasks, conducting statistical and other research based on anonymized data,

3.2.5. informing the User through electronic mailings. By providing his data, the User agrees to receive promotional and informational messages and service messages (mailing).

3.3. The purposes of processing personal data of candidates for vacancies are:

— Ensuring compliance with the requirements of the legislation of the Russian Federation.
– Solving employment issues, registration and regulation of labor relations.
— Reflection of information in personnel documents.
— Other purposes of PD processing may be approved by the order of the Operator.

3.4. Mobile applications may collect anonymous data about the user's location in order to provide a more correct work with the choice of payment method. Mobile applications may collect anonymous usage statistics.

3.5. The User hereby expresses his consent to the transfer of personal information about him to the partners of the Administration, third parties for the purposes provided for in clause 3.2 of this Privacy Policy.

3.6. If it is necessary to use personal information about the User for purposes not provided for by this Policy, the Administration requests the User's consent to such actions.

4. Processing information about Users

4.1. Personal information about Users is stored in accordance with applicable law.

4.2. Personal information about Users is not transferred to third parties, except for the following cases:

4.2.1. The user has agreed to such actions.

4.2.2. The transfer is necessary in order to ensure the functioning of the Service and / or its individual functionality.

4.2.3. The transfer is subject to applicable law.

4.2.4. In order to ensure the possibility of protecting the rights and legitimate interests of the Administration and / or third parties in cases where the User violates the terms of the user agreement.

4.2.5. If the Administration takes part in a merger, acquisition or any other form of sale of some or all of its assets. At the same time, all obligations to comply with the terms of this Policy are transferred to the purchaser of the Administration's assets.

4.3. The User is hereby notified and agrees that the Administration may receive personal data of third parties that are provided by the User when using the Service and use them to implement certain functions of the Service, provided that the User guarantees the consent of third parties, data about which are provided by the User when using the Service, for processing by the Administration, for the purposes provided for in this Policy, as well as for the transfer of such data in the cases listed in this Policy.

4.4. In addition, the User is hereby notified and agrees that the Administration may receive statistical anonymized (without reference to the User) data on the User's actions when using the Service.

4.5. Users have the right, upon request, to receive information from the Administration regarding the processing of their personal data.

5. Measures to protect information about Users

5.1. The Administration takes all necessary and sufficient organizational and technical measures to protect personal information about Users from unauthorized or accidental access to them, destruction, modification, blocking, distribution of personal information, as well as from other illegal actions with it. These measures include, in particular, internal review of data collection, storage and processing processes and security measures, including measures to ensure the physical security of data to prevent unauthorized access to personal information.

5.2. When processing personal data of Users, the Administration is guided by federal law"On Personal Data" dated July 27, 2006 No. 152-FZ.

6. Final provisions

6.1. This Policy, the relationship between the User and the Administration arising in connection with the application of this Policy, as well as issues not regulated by this Policy, are governed by the current legislation of the Russian Federation.

Margarita Ledovskikh

I am glad to welcome you on our site. My name is Margarita Ledovskikh, I am a media lawyer. I have been working in the field for 19 years information law, of which I have been managing the Law in the Network project for 6 years.

Site search

We provide services for registering sites as mass media

Preparatory stage First, it takes time to prepare. I am writing about this because sometimes these points are not taken into account. Founders- individuals at a minimum, you need to visit a bank and a notary to make notarized copies of documents. You will say that you can pay through an online bank without leaving your home, and this is the purest truth, but even in this case, you need to go to […]

Prepare documents for your website

When the customer, after you have provided him with a service, signed the act, you have documentary evidence of the fulfillment of obligations in your hands. And if suddenly the customer starts to refuse that he accepted the result of the work, you can remove all questions with this document. But in the case of remote services, such as online education or Skype consultations, acts are not signed. At […]

Part 3

Compliance with legal requirements for privacy policy

Do you need a privacy policy? You collect personal information about customers, whether it be website operations or a page in in social networks? Then you must draw up and abide by a privacy policy. In other words, these will be your terms of collection, use, transfer and protection of third party data. The Consumer Protection Bureau describes the importance of privacy and policies on their website. The US Small Business Administration also recognizes the importance of privacy and confidentiality, as stated on the organization's website.

Review the types of clauses in the privacy policy. The privacy policy contains a number of different provisions. It includes, but is not limited to, these provisions:

Make sure you don't make promises that you can't deliver. Very often people make a serious mistake using a phrase like "We do not provide your personal information to third parties." Alas, sales transactions and Internet transactions as such do not leave the possibility of avoiding the exchange of this information. For example, an intermediary bank that processes payments credit card client, must have at least some information about the client. Such statements can cost you dearly, so it is important that the privacy policy is reviewed by a professional lawyer.