Personal Data Processing Policy

This personal data processing policy was developed in accordance with para.2 Article 18.1 of the Federal Law dated 27.07.2006 No.152-FZ “On Personal Data” and is applied for all personal data processed by the processor – JSC “Power machines”.

1. Information about data processor:

Name: Joint-Stock Company “Power machines – ZTL, LMZ, Electrosila Plant, Energomachexport” (JSC “Power machines”).

Registered office: 3A Vatutina Str., St. Petersburg, 195009, Russia

2. Legal basis for personal data processing:

Personal data processing is performed in the amount and within the terms specified in regulatory legal acts of the Russian Federation:

• Labor Code of the Russian Federation;
• Tax Code of the Russian Federation;
• Federal Law dated  26.12.1995 No. 208-FZ “On Joint-Stock Companies”;
• Federal Law dated  01.04.1996 No. 27-FZ “On Individual (Personified) Record-Keeping in the Statutory Pension Insurance System”;
• Federal Law dated 29.11.2010 No. 326-FZ “On Compulsory Medical Insurance in the Russian Federation”;
• “Fundamentals of the legislation of the Russian Federation on Notaries” No. 4462-1 dated 11.02.1993;
• Federal Law dated 18.07.2006 No. 109-FZ “On Migration Registration of Foreign Citizens and Stateless Persons in the Russian Federation”.

As well as by consent to process personal data.

3. Purposes for personal data processing.

3.1. Personal data processing is performed to achieve the following purposes:

• Performance of obligations of an employer in accordance with the legislation of the Russian Federation, including assistance in employment, training and career development, maintenance of HR records keeping, assurance of personal security for an employee, control of quantity and quality of the work performed, safekeeping of property,   maintenance of medical and social insurance, occupational safety, organization of  employee posting;
• Fulfillment of civil law contracts where the personal data subject is a party to or beneficiary under such contracts;
• Compliance with the internal security policy and pass control;
• Archival storage of documents in compliance with the legislation of the Russian Federation, as well as issue of archival letters of verification upon demand of the personal data subject or its legal representative;
• Preparation and sending of replies to requests received by JSC “Power machines” using the corporate website or by other means, as well as preparation of reports for these requests.

3.2. JSC “Power machines” has the right to define other purposes for personal data processing within the legislation of the Russian Federation.

4. Categories of the data processed, their sources and terms of processing.

4.1. JSC “Power machines” processes the following categories of personal data:

• Personal data of employees of JSC “Power machines”. Source: personal data subjects;
• Personal data of applicants for filling in the vacancies at divisions of  JSC “Power machines”. Sources: personal data subjects, recruiting agencies, publicly available sources;
• Personal data of visitors. Sources: personal data subjects;
• Personal data of the persons applying to JSC “Power machines” using the corporate website or other means. Sources: personal data subjects.

4.2. JSC “Power machines” does not process personal data related to ethnicity, nationality, political opinions, religious and philosophical beliefs and intimate life.

4.3. JSC “Power machines” processes personal data related to health only to the extent permitted by the legislation of the Russian Federation.

4.4. Terms of personal data processing are determined:

• In compliance with legal acts of the Russian Federation – in respect of personal data processed in compliance with the requirements of the legislation of the Russian Federation;
• By consent to process personal data – in respect of personal data processed in compliance with the consent to process personal data.

JSC “Power machines”, as a personal data processor, determines a three-year processing term for personal data to reply to requests obtained via the corporate website or by other means.

5. General principles of personal data processing.

5.1. When processing personal data JSC “Power machines” complies with the principles established by Article 5 of the Federal Law dated 27.07.2006 No. 152-FZ “On Personal Data”.

5.2. JSC “Power machines” carries out cross-border transfer of personal data in accordance with the procedure established by the legislation of the Russian Federation.

5.3. JSC “Power machines” created publicly available sources of personal data (address directory of the corporate mailing system, telephone directory). Personal data are included in such sources on the basis of a written consent of personal data subjects.

5.4. Processing of personal data shall be ceased, and personal data shall be destroyed in the following cases:

• Upon achievement of the processing purposes or in the event of lack of necessity to achieve the same, unless otherwise provided for by the legislation of the Russian Federation;
• Upon withdrawal of the employee’s consent to personal data processing, except where the obligation of further processing of personal data is provided for by the legislation of the Russian Federation;
• Upon detection of wrongful acts in respect of personal data and impossibility to eliminate the violations committed within the terms prescribed by the legislation of the Russian Federation.

6. Information about third parties involved in personal data processing.

6.1. JSC “Power machines” protects the confidentiality of personal data and neither transfers personal data, nor provides access to them to third parties without consent of personal data subjects, unless otherwise provided for by the legislation of the Russian Federation.

6.2. JSC “Power machines” transfers personal data (provides access to them) to public authorities of the Russian Federation in accordance with their competence and to the extent provided for by the legislation of the Russian Federation.

6.3. JSC “Power machines” transfers personal data to other third parties subject to an agreement or instruction to processing which establish the following:

• Purpose of personal data processing;
• List of personal data acts (operations) to be performed by a contractor;
• Contractor’s obligation to protect the confidentiality of personal data and ensure safety of personal data when they are processed;
• Requirements to safety of processed personal data in accordance with Article 19 of the Federal Law dated 27.07.2006 No. 152-FZ “On Personal Data”;
• And, to the extent permitted by applicable law, subject to execution of written consent to transfer personal data.

7. Assurance of personal data security.

7.1. JSC “Power machines” takes all necessary organizational and technical measures to guarantee confidentiality of personal data when they are processed by the Company divisions:

• Provision of legal protection of personal data by means of execution of contractual relations which involve obligations to keep confidentiality of personal data by authorized employees of JSC “Power machines”;
• Safekeeping of documents containing personal data and stored in the production and office premises, including use of access control systems in such premises and installation of burglar and fire alarm systems;
• Use of antivirus protection, security features preventing unauthorized access to personal data, mechanisms controlling personal data integrity and other hardware and software in   personal data information systems;
• Constant control of acts carried out by users of personal data information systems, where applicable – implementation of measures on elimination of revealed non-conformances to the requirements of regulatory documents established by regulatory institutions;
• Periodic audit of conformance of measures taken for assurance of personal data security by authorized bodies.

7.2. JSC “Power machines” determines at its own discretion the content and list of measures which are necessary and sufficient to ensure fulfillment of obligations vested in it, unless otherwise provided for by legal instruments of the Russian Federation.

8. Rights of personal data subjects.

8.1. Personal data subject has the right:

• To receive the information related to processing of its personal data;
• To unrestricted free access to its personal data, including the right to receive copies of any record containing personal data;
• To demand from JSC “Power machines” to update its personal data, block or destroy personal data if they are incomplete, outdated, inaccurate, illegally obtained or unnecessary for the stated purpose of processing, as well as to take statutory measures for protection of its rights.

8.2. The rights of personal data subject, specified in clause 8.1. hereof, may be restricted to the extent provided for by the legislation of the Russian Federation.

8.3. In order to exercise all the above rights the personal data subject has the right to submit the relevant request to JSC “Power machines”.

9. Contact information.

Contact information for personal data subjects, contractors and other third parties:

Corporate website of JSC “Power machines” www.power-m.ru

HR Department +7 (812) 336-26-19

Information Security Department +7 (812) 336-24-72