Consent to the processing of personal data
In order to maintain a business reputation and guarantee the compliance with the provisions of the Federal Law of the Russian Federation No. 152- FZ and (or) applicable foreign legislation in the field of personal data processing and protection in full, including the European Union Regulation No. 2016/679 (hereinafter referred to as the Legislation), JSC Severstal Management, the companies controlled by it and their subsidiaries (hereinafter collectively referred to as the Companies) consider it mandatory to comply with the objectives, principles and conditions of legal validity of personal data processing. The Companies also strive to follow the best international practices in the field of processing and protection of personal data
The policy objective
To ensure the protection of the rights and freedoms of a person (hereinafter referred to as the Subject) when processing his or her personal data in accordance with the applicable Legislation, including the protection of the rights to privacy, personal and family secrets.
Principles of personal data processing
- To comply with the Subjects’ rights when processing their personal data.
- To process personal data on a legal and fair basis to achieve the purposes of its processing.
- To prevent the processing of personal data that doesn’t meet the purposes of processing, is redundant or contained in databases, the processing purposes of which are incompatible.
- To ensure the accuracy, sufficiency and relevance of personal data during its processing in relation to the purposes of its processing.
- To store personal data for no longer than required by the purposes of processing.
- To erase or depersonalize personal data upon the achievement of the purposes of its processing or in case it is not necessary to achieve these purposes anymore.
Terms and conditions of personal data processing
- Personal data shall be processed in compliance with the principles and rules stipulated by the applicable Legislation.
- Recording, systematization, accumulation, storage, clarification and extraction of personal data of the citizens of the Russian Federation when collecting personal data shall be performed using databases ocated in the territory of the Russian Federation, unless otherwise provided by the applicable Legislation.
- A cross-border transfer of personal data shall be allowed if personal data is collected in the territory of the Russian Federation in accordance with the applicable Legislation.
- Any persons (including directors, officers, employees, agents, representatives or other intermediaries) who fulfill assignments or render services for or on the behalf of any of the Companies and who have gained access to personal data shall undertake to maintain the confidentiality and not to process it without a specific legal basis.
- Upon receipt of personal data from the European Union or in other applicable cases, personal data shall be processed with the prior receipt of the Subject’s consent to the processing of personal data or notification of the Subject about the processing of his or her personal data or on other legal grounds provided for by the applicable Legislation
Ways to meet the objectives
- To refuse to process special categories of personal data, the processing of which is prohibited according to the applicable Legislation.
- To ensure the protection of information systems in which personal data is processed against the impact of immediate security threats taking into account the assessment of harm done to the Subjects.
- To take comprehensive organizational and technical measures to ensure the security of personal data during its processing in information systems, as well as without using any automation tools.
- Systematic monitoring of the compliance of personal data processing with the requirements of the applicable Legislation.
- To carry out activities to inform and train personnel in the personal data processing and protection rules.
- To hold guilty persons liable for violation of the applicable Legislation and internal documents of the Company controling the personal data processing procedure.
