Contents

1. I. General Provisions
2. II. Basic Concepts
3. III. Principles and Rules for Processing Personal Data
4. IV. Legal Grounds for Processing Personal Data
5. V. Organization of Personal Data Processing
6. VI. Rights of the Personal Data Subject
7. VII. Final Provisions
8. Appendix

(As amended by Order of JSC Russian Railways dated October 25, 2024, No. 75)

I. General Provisions

1. This Policy, developed in accordance with the Federal Law "On Personal Data," establishes the goals, basic principles, rules, and legal grounds for processing personal data, and defines the basic measures to ensure their security.

2. This Policy has been developed to implement the requirements of Russian Federation legislation in the field of personal data at JSC Russian Railways, as well as to ensure the protection of the rights of individuals when processing their personal data.

3. The provisions of this Policy form the basis for the development and updating of administrative and organizational documents of JSC Russian Railways governing the processing of personal data of various categories of personal data subjects, as well as the procedures for implementing measures to protect the personal data being processed.

4. The provisions of this Policy are mandatory for JSC Russian Railways employees with access to personal data.

5. The list of purposes for processing personal data at JSC Russian Railways, the composition of personal data and its categories, as well as the categories of personal data subjects, is provided in the Appendix.

II. Basic Concepts

6. The following terms are used in this Policy:

1) Automated processing of personal data – processing of personal data using computer technology;

2) Personal data security – the state of protection of personal data, characterized by the ability of users, technical means, and information technologies to ensure the confidentiality, integrity, and availability of personal data when processed in information systems;

3) Biometric personal data – information characterizing the physiological and biological characteristics of the personal data subject, based on which their identity can be established and which is used by the operator to establish the identity of the personal data subject;

4) Information system – the set of information contained in databases and the information technologies and technical means that support its processing;

5) Counterparty – a Russian or foreign legal entity or individual with whom JSC Russian Railways has a contractual relationship or plans to enter into a contractual relationship, with the exception of employment relationships;

6) Confidentiality of personal data – a mandatory requirement not to disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by Russian Federation law;

7) Tangible medium – a paper or machine-readable storage medium intended for recording, transmitting, and storing personal data;

8) Non-automated processing of personal data – processing of personal data carried out with the direct participation of the employee without the use of computing equipment;

9) Personal data processing – any action (operation) or set of actions (operations) performed with or without the use of automated means with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion (including erasure), and destruction of personal data;

10) Operator – a government agency, municipal body, legal entity, or individual that, independently or jointly with other persons, organizes and/or carries out the processing of personal data, and determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data;

11) Personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject);

12) Personal data permitted for distribution by the personal data subject — personal data to which the general public has been granted access by the personal data subject by giving consent to the processing of personal data permitted for distribution by the personal data subject in the manner prescribed by the Federal Law "On Personal Data";

13) User of JSC Russian Railways services — a passenger, consignor, consignee, or other individual or legal entity using the services provided by JSC Russian Railways;

14) Provision of personal data — actions aimed at disclosing personal data to a specific individual or a specific group of individuals;

15) Dissemination of personal data — actions aimed at disclosing personal data to an indefinite number of persons;

16) Special categories of personal data — categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, and criminal record;

17) Subjects of personal data — users of services, contractors, employees of JSC Russian Railways, their close relatives, job applicants, pensioners registered with JSC Russian Railways, and their official representatives, as well as other persons whose personal data became known to JSC Russian Railways in the course of its activities, including by virtue of the provision to them of social benefits, guarantees, and compensation by JSC Russian Railways;

18) Cross-border transfer of personal data – the transfer of personal data to a foreign state, a foreign government agency, a foreign individual, or a foreign legal entity;

19) Destruction of personal data – actions that make it impossible to restore the contents of personal data in an information system or on a machine-readable medium and/or that result in the destruction of tangible media containing personal data.

III. Principles and Rules for Processing Personal Data

7. Personal data processing at JSC Russian Railways is carried out in compliance with the following principles and rules:

1) processing is carried out lawfully and fairly;

2) processing is limited to achieving specific, predetermined, and legitimate purposes;

3) personal data that meets the processing purposes is subject to processing, provided that their volume and content necessarily correspond to the stated processing purposes;

4) combining databases containing personal data processed for incompatible purposes is not permitted;

5) the accuracy and sufficiency of personal data and, where necessary, relevance in relation to the processing purposes are ensured during processing, with measures taken to delete or clarify incomplete or inaccurate data or ensuring the implementation of such measures;

6) personal data is stored in a form that allows the identification of the personal data subject, for no longer than required for the purposes of processing the personal data, unless the storage period for personal data is established by federal law or an agreement to which the personal data subject is a party, beneficiary, or guarantor;

7) Processed personal data are destroyed or anonymized upon achieving the processing purposes or when the need to achieve these purposes is no longer necessary, unless otherwise provided by Russian Federation law.

8. When processing personal data, JSC Russian Railways ensures its confidentiality and security.

IV. Legal Grounds for Processing Personal Data

9. The legal grounds for processing personal data, on the basis of which the processing of personal data by JSC Russian Railways is permitted, are:

1) consent of the personal data subject to the processing of personal data, taking into account the requirements stipulated by Russian Federation law for the relevant category of personal data;

2) achievement of the goals stipulated by an international treaty of the Russian Federation or by law, the implementation and performance of the functions, powers, and duties assigned to JSC Russian Railways by Russian Federation law and the Charter of JSC Russian Railways;

3) judicial decisions, decisions of another body or official subject to execution by JSC Russian Railways in accordance with the provisions of Russian Federation legislation on enforcement proceedings;

4) an agreement to which the personal data subject is a party, beneficiary, or guarantor, as well as an agreement concluded at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor;

5) ensuring and/or implementing the protection of the life, health, or other vital interests of the personal data subject, if obtaining the consent of the personal data subject is impossible;

6) exercising the rights and legitimate interests of JSC Russian Railways or third parties, or for the achievement of socially significant goals, provided that the rights and freedoms of the personal data subject are not violated;

7) professional journalistic activity and/or lawful media activity, or scientific, literary, or other creative activity, provided that this does not violate the rights and legitimate interests of the personal data subject;

8) processing personal data for statistical or other research purposes, subject to mandatory anonymization;

9) processing personal data for the purpose of publication or mandatory disclosure of information in accordance with the legislation of the Russian Federation.

V. Organization of Personal Data Processing

10. In order to effectively organize the processing of personal data and ensure the security of personal data at JSC Russian Railways, the CEO – Chairman of the Management Board of JSC Russian Railways appoints from among his deputies a person responsible for organizing the processing of personal data at JSC Russian Railways. This person, in accordance with established powers, ensures:

1) implementing internal control over compliance at JSC Russian Railways with the requirements of Russian Federation legislation and JSC Russian Railways regulations in the area of ​​personal data, including requirements for the protection of personal data at JSC Russian Railways;

2) communicating to JSC Russian Railways employees the provisions of Russian Federation legislation, JSC Russian Railways regulations on personal data processing, and personal data protection requirements;

3) Monitoring the processing of requests and inquiries from personal data subjects or their representatives regarding violations of personal data legislation committed by employees of JSC Russian Railways.

11. Only JSC Russian Railways executives authorized to do so by their employer, as well as JSC Russian Railways employees authorized to process personal data in accordance with the procedures established by JSC Russian Railways, are permitted to process personal data.

These managers and employees have the right to process only the personal data necessary for the performance of their job responsibilities.

12. Personal data processing at JSC Russian Railways is carried out using automated means and/or without the use of such means.

13. The processing of special categories of personal data, as well as biometric personal data at JSC Russian Railways, is carried out in accordance with the requirements of the legislation of the Russian Federation.

14. In order to implement the rights of personal data subjects, JSC Russian Railways processes their personal data:

1) applies legal, organizational, and technical measures to protect the personal data of personal data subjects from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other illegal actions;

2) explains to personal data subjects the legal consequences of refusing to provide their personal data and/or to consent to its processing, if the provision of personal data is mandatory in accordance with the legislation of the Russian Federation;

3) blocks, clarifies, and destroys unlawfully processed personal data, as well as terminates its unlawful processing;

4) notifies the personal data subject of the rectification of the violations committed or the destruction of their personal data;

5) provides, upon request of the personal data subject or their representative, information regarding the processing of their personal data, in the manner established by the legislation of the Russian Federation and the regulatory documents of JSC Russian Railways;

6) carries out internal control and/or audit of compliance of personal data processing with the legislation of the Russian Federation and the regulatory documents of JSC Russian Railways;

7) assesses the harm that may be caused to personal data subjects in the event of a violation of Russian Federation legislation on personal data, the relationship between such harm and the measures taken by JSC Russian Railways to ensure compliance with obligations stipulated by Russian Federation legislation on personal data.

15. The processing of personal data authorized for distribution by the personal data subject is carried out in compliance with the prohibitions and conditions established by Article 10.1 of the Federal Law "On Personal Data."

Consent to the processing of personal data authorized for distribution by the personal data subject is issued separately from other consents of the personal data subject.

16. The transfer of personal data to third parties is carried out with the written consent of the personal data subjects, except in cases where this is necessary to prevent a threat to the life and health of the personal data subjects, as well as in other cases established by the legislation of the Russian Federation.

17. The transfer of personal data to government authorities is permitted in the absence of the personal data subject's consent to the processing of their personal data in the manner and in cases stipulated by the legislation of the Russian Federation.

18. The cross-border transfer of personal data is carried out subject to the restrictions and prohibitions stipulated by Russian Federation legislation in the field of personal data.

Prior to the commencement of the cross-border transfer of personal data, JSC Russian Railways:

Assesses the measures taken by foreign government authorities, foreign individuals, and legal entities to whom the cross-border transfer of personal data is planned to ensure the confidentiality and security of personal data;

Notifies the authorized body for the protection of the rights of personal data subjects of its intention to carry out the cross-border transfer of personal data.

19. JSC “RZD” has the right to entrust the processing of personal data to another person with the consent of the data subject, unless otherwise provided for by the legislation of the Russian Federation, on the basis of an agreement concluded with that person.

20. When collecting personal data, including through the use of the information and telecommunications network “Internet”, JSC “RZD” ensures the recording, systematization, accumulation, storage, clarification (update, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases provided for by the legislation of the Russian Federation.

21. Ensuring the security of personal data, including during its processing in information systems, is carried out in accordance with the legislation of the Russian Federation and the requirements of the authorized body for the protection of the rights of personal data subjects, the federal executive body authorized in the field of ensuring security, and the federal executive body authorized in the field of countering technical intelligence and technical protection of information.

22. The timeframes for the processing and storage of personal data for each purpose of processing personal data in JSC “RZD”, as provided for in Appendix No. 1 to this Policy, are determined taking into account compliance with the requirements of the legislation of the Russian Federation and (or) taking into account the provisions of the contract, in which the subject of personal data is a party, beneficiary or guarantor, and (or) the consent of the subject of personal data to the processing of their personal data.

23. The procedure and methods for the destruction of personal data in JSC “RZD” are determined in accordance with the legislation of the Russian Federation and the regulatory documents of JSC “RZD”.

Personal data must be destroyed in the following cases:

1) upon achieving the processing objectives or if the need to achieve the processing objectives of personal data is lost;

2) in the event that the subject of personal data withdraws consent to the processing of their personal data, except in cases provided for by the legislation of the Russian Federation;

3) when the subject of personal data or their representative provides information confirming that the personal data:

a) is incomplete, outdated, or inaccurate (provided that it is impossible to clarify the personal data);

b) personal data was obtained illegally;

c) personal data is not necessary for the stated purpose of processing;

4) if unlawful processing of personal data is detected (in the event that it is impossible to ensure the lawfulness of the processing of personal data);

5) in the event of a request from the subject of personal data to stop the processing of personal data, except in cases provided for by the legislation of the Russian Federation.

VI. Rights of the subject of personal data

24. Subjects of personal data have the right to:

1) obtaining, upon request, complete information about their personal data processed by JSC “RZD”;

2) reviewing their personal data when contacting JSC “RZD”;

3) clarifying their personal data, blocking it, or deleting it if the personal data is incomplete, outdated, inaccurate, obtained illegally, or not necessary for the stated purpose of processing.

4) stopping the processing of their personal data;

5) providing their personal data and consenting to its processing freely, of their own will and in their own interest;

6) withdrawing consent to the processing of their personal data;

7) challenging, in accordance with the legislation of the Russian Federation, the actions (inaction) of JSC “RZD” in the processing of personal data;

8) exercising other rights provided for by the legislation of the Russian Federation.

VII. Final provisions

25. Responsibility for violating the requirements of the legislation of the Russian Federation and the regulatory documents of JSC “RZD” in the field of personal data is determined in accordance with the legislation of the Russian Federation.

26. The Policy is a publicly available document and must be published on the official website of JSC “RZD” in the information and telecommunications network “Internet” at the following address: https://www.rzd.ru.

Application

Appendix. List of purposes for processing personal data in JSC “RZD”, the composition of personal data and its categories, as well as the categories of personal data subjects