Privacy and Personal Data Processing Policy of the Hotel

1. General Provisions

1.1. This document defines the policy of IE Khodoeva S.V. as an operator processing personal data (PD).

1.2. The Policy regarding the processing of personal data at IE Khodoeva S.V. (hereinafter referred to as the Policy) defines any action (operation) or set of actions (operations) for the collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data, as well as information on the implemented requirements for personal data protection.

1.3. The Policy is developed in accordance with the current legislation of the Russian Federation, and the processing of personal data is based on the following regulatory legal acts:

• Constitution of the Russian Federation;
• Labor Code of the Russian Federation;
• Civil Code of the Russian Federation;
• Federal Law of July 27, 2006 No. 152-FZ "On Personal Data";
• Federal Law "On Information, Information Technologies and Information Protection" dated July 27, 2006 No. 149-FZ;
• Decree of the Government of the Russian Federation of September 15, 2008 No. 687 "On approval of the Regulations on the specifics of personal data processing carried out without the use of automation tools";
• Decree of the Government of the Russian Federation of November 1, 2012 No. 1119 "On approval of requirements for the protection of personal data during their processing in personal data information systems";
• Order of FSTEC of Russia No. 21 dated February 18, 2013 — "On approval of the Composition and content of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems";
• Regulations on the processing of personal data in the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) approved by order dated December 15, 2022 No. 201;
• Order of FSTEC of the Russian Federation dated August 28, 2024 N 159 "On amendments to the requirements for information protection...";
• Other regulatory legal acts of the Russian Federation and regulatory documents of authorized state authorities;
• Other internal regulatory documents.

1.4. Basic concepts used in this Policy:

• Personal Data (PD) – any information relating to a directly or indirectly identified or identifiable natural person (subject of personal data);
• Personal Data Operator (Operator) – a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data;
• Personal Data Processing – any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools;
• Automated Processing of Personal Data – processing of personal data using computer technology;
• Distribution of Personal Data – actions aimed at disclosing personal data to an undefined circle of persons;
• Provision of Personal Data – actions aimed at disclosing personal data to a specific person or a specific circle of persons;
• Blocking of Personal Data – temporary termination of personal data processing (unless processing is necessary to clarify personal data);
• Destruction of Personal Data – actions as a result of which it becomes impossible to restore the content of personal data;
• Depersonalization of Personal Data – actions as a result of which it becomes impossible to determine the ownership of data to a specific subject without using additional information;
• Personal Data Information System – a set of personal data contained in databases and the technologies ensuring their processing;
• Cross-border Transfer of Personal Data – transfer of personal data to the territory of a foreign state.

1.5. IE Khodoeva S.V. processes personal data on a legal and fair basis.

1.6. IE Khodoeva S.V. does not process biometric personal data.

1.7. IE Khodoeva S.V. has the right to entrust the processing of PD to other persons in accordance with Part 3 of Art. 6 of Law No. 152-FZ.

1.8. The requirements set out in the Regulations are mandatory for all employees of IE Khodoeva S.V.

2. Purposes of Personal Data Processing

2.1. Personal data are processed by IE Khodoeva S.V. in order to comply with the law and carry out business activities.

2.1.1. Exercise of functions, powers, and duties, in particular:

• Compliance with legislation in the field of labor and taxation;
• Maintaining current accounting and tax records;
• Compliance with legislation on determining the procedure for processing and protecting personal data of employees, clients, and contractors.

2.1.2. Exercise of the rights and legitimate interests of IE Khodoeva S.V., including:

• Organization and conduct of loyalty programs, marketing, and advertising campaigns;
• Performance of obligations under civil law contracts, including through the website baikalwoodhotel.ru ;
• Promotion of services by making direct contacts (phone, email, social networks).

3. Composition of Personal Data and Terms of Their Processing

3.1. All processed personal data are confidential, strictly protected information.

3.2. The Operator processes the data of the following subjects:

• Applicants for vacant positions;
• Employees in or formerly in employment relations;
• Relatives of employees;
• Clients (guests) of IE Khodoeva S.V.;
• Representatives of potential and existing clients.

3.3. The composition of processed data may include: Full name, gender, date and place of birth, citizenship, passport data, registration and residence address, TIN (INN), Insurance Number (SNILS), information about education, work experience, family composition, military registration, salary, phone number, email address, and other information necessary to achieve processing goals.

4. Procedure for Collection, Storage, Transfer, and Other Types of Processing

4.1. Processing of personal data occurs in an automated and non-automated way.

4.2. Only employees who have passed the admission procedure (familiarization with local acts, signing a confidentiality agreement) are allowed to process the data.

4.3. Personal data are stored in paper (cabinets, safes) and electronic form (databases with restricted access).

4.4. IE Khodoeva S.V. may transfer data to employees, third parties by proxy (subject to confidentiality), and state authorities upon request in accordance with the law.

4.6. Data are subject to destruction upon reaching the goals of processing or in case of loss of the need to achieve them.

5. Rights and Obligations of the Personal Data Subject

5.1. The subject has the right to:

• Request clarification, blocking, or destruction of their data;
• Request a list of their data and the source of their receipt;
• Receive information about the processing terms;
• Withdraw consent to the processing of personal data.

Requests are sent in writing. A response is provided within 30 days.

6. Information on Implemented Protection Requirements

6.3. The Operator has taken the following measures:

• A person responsible for organizing PD processing has been appointed;
• Local acts (Policy, Regulations) have been issued;
• Legal, organizational, and technical security measures have been applied;
• Internal control and damage assessment are carried out.

7. Confidentiality on the baikalwoodhotel.ru Website

7.2. Personal data collected on the website includes: full name, phone number, email address, as well as depersonalized data (cookies).

7.5. The Yandex Metrica service uses "cookie" technology. The visitor gives consent to their collection and analysis for the formation of statistics.

7.6. IE Khodoeva S.V. receives information about the visitor's IP address, which is not used to establish identity.

8. Final Provisions

8.1. The Policy is subject to change in the event of new legislative acts.

8.3. Compliance control is carried out by the responsible person at IE Khodoeva S.V.

Approved by IE Khodoeva S.V.
Legal address: Irkutsk Region, Ust-Ordynsky settlement, Kudinskaya str., 16
Actual address: Irkutsk Region, Olkhonsky district, Khuzhir settlement, Svetlaya str., 5
OGRNIP 317385000073008, INN 850602115740