Personal Data Processing Policy
1. Basic Terms and Definitions
Automated processing of personal data – processing of personal data using computer technology.
Blocking of personal data – temporary suspension of personal data processing (except where processing is necessary to clarify personal data).
Personal data information system – a set of personal data contained in databases and information technologies and technical means ensuring their processing.
Depersonalization of personal data – actions as a result of which it becomes impossible, without the use of additional information, to determine the personal data belonging to a specific personal data subject.
Processing of personal data – any action (operation) or set of actions (operations) performed with personal data using automation tools or without the use of such tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
Personal data operator (operator) – a state authority, municipal authority, legal entity or individual, independently or jointly with other persons organizing and/or carrying out personal data processing, as well as determining the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
Personal data – any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
Distribution of personal data – actions aimed at disclosing personal data to an indefinite group of persons.
Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which physical media containing personal data are destroyed.
2. General Provisions
2.1. This Policy regarding the processing of personal data at the Scientific and Production Enterprise Neuronix Limited Liability Company (hereinafter referred to as the Operator) is an official document (hereinafter referred to as the Policy), which defines the general principles, purposes and procedure for processing personal data (hereinafter referred to as PD), as well as information on the implemented PD protection measures.
The organization is included in the register of personal data operators, registration number 72-25-051801, on the basis of Order No. 207 dated 17.10.2025.
2.2. This Policy applies to all employees of the Operator, as well as to representatives of third-party organizations interacting with the Operator on the basis of relevant agreements, regulatory and organizational-administrative documents, as well as to counterparties and participants in the Operator’s programs, projects and events, and visitors to the Operator’s information channels.
2.3. This Policy enters into force from the moment of its approval and remains in force indefinitely.
3. Purposes of Personal Data Processing, Categories of Personal Data Processed, List of Personal Data Processing Actions
Personal data collected and stored by the Operator are considered confidential information. Personal data are protected against loss, alteration or unauthorized access in accordance with the legislation of the Russian Federation in the field of personal data. For this purpose, we apply technical means and organizational measures in accordance with Articles 18, 18.1, 19 of Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data”.
4. Legal Grounds for PD Processing
4.1. The Operator processes PD in accordance with the following regulatory and legal acts and local regulations:
Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data”;
federal laws and regulatory legal acts adopted on their basis governing relations related to the Operator’s activities;
constituent documents of the Operator;
local regulations of the Operator governing PD processing;
this Policy;
consents to PD processing (in writing, as well as in another form permitted by Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” and other regulatory legal acts).
5. Categories of PD Subjects
5.1. The Operator processes the following subjects and categories of PD:
1) applicants, employees and former employees of the Operator – for the purposes of complying with labor legislation within the framework of labor and other relations directly related thereto;
2) counterparties, representatives of counterparties, participants in the Operator’s projects and events – for the purposes of carrying out activities in accordance with the Operator’s charter and types of activities;
3) visitors to the Operator’s website – for conducting information activities.
4) beneficiaries under contracts – for the purposes of carrying out activities in accordance with the Operator’s charter and types of activities;
5) other subjects within the framework of the Operator’s activities.
5.2. The list of personal data processed for each purpose is provided in Section 3 of the Policy.
5.3. The Operator does not carry out cross-border transfer of PD.
6. Procedure and Conditions for PD Processing
6.1. PD processing is carried out on a lawful and fair basis in accordance with the provisions of Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data”.
6.2. PD processing is limited to achieving specific, predetermined and lawful purposes. Processing of PD incompatible with the purposes of PD collection is not permitted.
6.3. Combining databases containing PD, the processing of which is carried out for mutually incompatible purposes, is not permitted.
6.4. Only PD that correspond to the purposes of their processing are subject to processing.
6.5. The content and volume of PD processed correspond to the stated purposes of processing and are not excessive in relation to the stated purposes of their processing.
6.6. When processing PD, the accuracy of PD, their sufficiency, and, where necessary, their relevance in relation to the purposes of PD processing are ensured. Necessary measures are taken to delete or clarify incomplete or inaccurate data.
6.7. PD are stored in a form that makes it possible to identify the PD subject for no longer than required by the purposes of PD processing, unless the PD storage period is established by federal law or an agreement to which the PD subject is a party, beneficiary or guarantor. Processed PD, upon achieving the purposes of processing or in the event that the need to achieve these purposes is lost, unless otherwise provided by federal law, are subject to destruction or depersonalization.
7. Conditions and Time Limits for Termination of Personal Data Processing
7.1. The Operator terminates PD processing in the following cases:
achievement of the purposes of PD processing or the maximum storage periods – within 30 days;
loss of the need to achieve the purposes of PD processing – within 30 days;
provision by the PD subject or their legal representative of information confirming that the PD were obtained unlawfully or are not necessary for the stated purpose of processing – within 7 days;
impossibility of ensuring the lawfulness of PD processing – within 10 days;
withdrawal by the PD subject of consent to PD processing, if retention of PD is no longer required for the purposes of PD processing – within 7 days;
expiration of limitation periods for legal relations within which PD processing is or was carried out;
liquidation of the Operator in the manner prescribed by law.
8. Measures to Ensure PD Security
8.1. The security of PD processed by the Operator is ensured by implementing legal, organizational, technical and software measures necessary and sufficient to ensure compliance with the requirements of legislation in the field of PD protection.
8.2. The Operator responsibly approaches the issue of protecting the collected PD and implements requirements for their protection by adopting a set of measures necessary and sufficient to ensure fulfillment of the obligations provided for by the current legislation of the Russian Federation on personal data.
8.3. The Operator takes the necessary organizational and technical measures to ensure the security of PD against accidental or unauthorized access, destruction, alteration, blocking of access and other unauthorized actions.
8.4. The Operator takes the following organizational and technical measures:
appointment of an official responsible for organizing PD processing and ensuring PD security;
limiting and regulating the composition of the Operator’s employees who have access to PD;
familiarizing the Operator’s employees with the requirements of federal legislation and local regulations on PD processing and protection;
ensuring accounting for and storage of physical media containing PD and their handling in a manner that excludes theft, substitution, unauthorized copying and destruction;
where necessary, identifying PD security threats during their processing in personal data information systems (hereinafter referred to as PD information systems), and forming threat models on their basis;
developing, on the basis of the threat model, a PD protection system for the appropriate level of PD security during their processing;
checking the readiness and effectiveness of the use of information security tools;
implementing an authorization system for user access to information resources and software and hardware tools for information processing and protection;
password protection of user access to technical means containing personal data;
carrying out antivirus control, preventing the introduction of malicious programs (computer viruses) into the corporate network;
where necessary, applying intrusion detection tools in the corporate network for intrusions that violate or create prerequisites for violation of the established requirements for ensuring PD security;
training the Operator’s employees in the field of legal regulation of PD processing;
keeping records of the information security tools used and the operational and technical documentation for them;
maintaining technical means of security and control over premises containing personal data databases;
controlling access to premises containing documentation with PD;
updating the Operator’s local regulations governing PD processing and bringing them into compliance with changes in legislation.
9. Rights of Personal Data Subjects
9.1. A PD subject has the right to receive information concerning the processing of their PD, including information containing:
confirmation of the fact of PD processing by the Operator;
legal grounds and purposes of PD processing;
purposes and methods of PD processing used by the Operator;
name and location of the Operator, information about persons (except for the Operator’s employees) who have access to PD or to whom PD may be disclosed on the basis of an agreement with the Operator or on the basis of federal law;
processed PD relating to the relevant PD subject, and the source of their receipt, unless another procedure for providing such data is established by federal law;
time limits for PD processing, including their storage periods;
procedure for exercising by the PD subject the rights provided for by the Federal Law “On Personal Data”;
name or surname, first name, patronymic and address of the person processing PD on behalf of the Operator, if processing is entrusted or will be entrusted to such person;
other information provided for by Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” or other federal laws.
9.2. A PD subject has the right to require the Operator to clarify their PD, block or destroy them if the PD are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing, as well as to take measures provided by law to protect their rights.
9.3. If a PD subject believes that the Operator processes their PD in violation of the requirements of the Federal Law “On Personal Data” or otherwise violates their rights and freedoms, the PD subject has the right to appeal the actions or inaction of the Operator to the higher authority for the protection of the rights of PD subjects (Federal Service for Supervision of Communications, Information Technology and Mass Media – Roskomnadzor) or in court.
9.4. A PD subject has the right to protection of their rights and legitimate interests, including compensation for losses and/or compensation for moral harm in court.
9.5. A PD subject has other rights provided for by Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” or other federal laws.
10. Provision of Personal Data to Third Parties
10.1. The Operator may provide personal data of personal data subjects to the following third parties:
11. Final Provisions
11.1. Control over compliance with the requirements of this Policy is carried out by the person responsible for organizing PD processing.
11.2. Other rights and obligations of the Operator are determined by the Federal Law “On Personal Data” and other regulatory legal acts in the field of PD protection.
11.3. Officials guilty of violating the rules governing the processing and protection of PD bear material, disciplinary, administrative, civil-law or criminal liability in the manner established by federal laws.
11.4. A personal data subject may obtain any explanations on questions of interest concerning the processing of their personal data by contacting the Operator with the corresponding request at the Operator’s email address: info@нейроникс-нпп.рф.
11.5. Withdrawal of consents of personal data subjects is carried out in the manner established in the text (form) of the relevant consents. In any case, consent may be withdrawn by sending a written or electronic statement in free form to the Operator’s email address: info@нейроникс-