POLICY OF NON-COMMERCIAL ORGANIZATION “INTERNATIONAL FACT-CHECKING ASSOCIATION” ON PERSONAL DATA PROCESSING

1. General provisions

1.1. This Policy of the Non-profit organization “International Association for Factchecking” (hereinafter referred to as the Operator) in respect of personal data processing (hereinafter referred to as the Policy) is developed in compliance with the requirements of p. 2, para. 2 ч. 1 part 1 of Art. 18.1 of the Federal Law dated 27.07.2006 № 152-FZ “On Personal Data” (hereinafter – the Law on Personal Data) in order to ensure the protection of human and civil rights and freedoms in the processing of personal data, including the protection of the right to privacy, personal and family secrecy.

1.2. By registering on the Website, the User gives his/her explicit, informed and free consent to the processing of his/her personal data, including cross-border transfer (if necessary), in accordance with requirements of GDPR (Articles 6-7), 152-FZ and other applicable regulations. The right to withdraw consent is exercised through a request to [email].

1.3. The Policy applies to all personal data processed by the Non-profit organization “International Factchecking Association”.

1.4. The Policy applies to the relations in the field of personal data processing, arisen at the Operator both before and after the approval of the Policy.

1.5. Pursuant to the requirements of part 2 of Article 18.1 of the Law on Personal Data, the Policy is published in free access on the Operator’s website in the information and telecommunication network “Internet”.

1.6. Basic concepts used in the Policy:

Personal data – any information relating directly or indirectly to a certain or definable natural person (subject of personal data).

Personal data authorized by the subject of personal data for dissemination – personal data to which access to an unlimited number of persons is granted by the subject of personal data by giving consent to the processing of personal data authorized by the subject of personal data for dissemination in the manner prescribed by the Personal Data Law.

Personal data operator (operator) – a state authority, municipal authority, legal or natural person, independently or jointly with other persons organizing and (or) carrying out processing of personal data, as well as determining the purposes of personal data processing, composition of personal data subject to processing, actions (operations) performed with personal data.

Processing of personal data means any action (operation) or set of actions (operations) with personal data performed with or without the use of automation tools. Processing of personal data includes, but is not limited to:

• collection;

• recording;

• systematization;

• accumulation;

• storage;

• clarification (update, modification);

• extraction;

• use;

• transfer (distribution, provision, access);

• depersonalization;

• blocking;

• deletion;

• destruction.

Automated processing of personal data – processing of personal data by means of computer equipment.

Dissemination of personal data – actions aimed at disclosure of personal data to an indefinite number of persons.

Provision of personal data – actions aimed at disclosure of personal data to a certain person or a certain circle of persons.

Blocking of personal data – temporary cessation of personal data processing (except for cases when processing is necessary to clarify personal data).

Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which material carriers of personal data are destroyed.

Personal data depersonalization – actions as a result of which it becomes impossible to determine the belonging of personal data to a particular subject of personal data without using additional information.

Personal data information system – a set of personal data contained in databases and information technologies and technical means ensuring their processing.

Cross-border transfer of personal data – transfer of personal data to the territory of a foreign country to a foreign government authority, a foreign individual or a foreign legal entity.

1.7. Basic rights and obligations of the Operator.

1.7.1 The Operator has the right to:

1. To independently determine the composition and list of measures necessary and sufficient to ensure fulfillment of the obligations stipulated by the Personal Data Law and regulatory legal acts adopted in accordance therewith, unless otherwise provided by the Personal Data Law or other federal laws.

2. To entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided for by the federal law on the basis of a contract concluded with this person. The person processing personal data on behalf of the Operator shall be obliged to comply with the principles and rules of personal data processing stipulated by the Personal Data Law, observe confidentiality of personal data, take necessary measures aimed at ensuring fulfillment of obligations stipulated by the Personal Data Law.

3. In case the personal data subject revokes his/her consent to personal data processing, the Operator shall have the right to continue personal data processing without the consent of the personal data subject if there are grounds specified in the Personal Data Law.

1.6.2 The Operator shall:

1. Organize the processing of personal data in accordance with the requirements of the Personal Data Law.

2. Provide the personal data subject or his/her representative, upon their request, with information on the availability of personal data relating to the respective personal data subject, as well as provide an opportunity to familiarize with such personal data upon application of the personal data subject or his/her representative or within 30 days from the date of receipt of the personal data subject’s or his/her representative’s request.

3. To inform the authorized body for protection of the rights of personal data subjects (Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) at the request of this body of the necessary information within 10 (ten) working days from the date of receipt of such request. This term may be extended, but not more than for 5 (five) working days. For this purpose, the Operator shall send a motivated notification to Roskomnadzor indicating the reasons for extending the deadline for providing the requested information.

4. In accordance with the procedure determined by the federal executive body authorized in the field of security, ensure interaction with the state system of detection, prevention and liquidation of consequences of computer attacks on information resources of the Russian Federation, including informing it about computer incidents that resulted in unlawful transfer (provision, distribution, access) of personal data.

1.8. Basic rights of the personal data subject.

The subject of personal data has the right to:

1. full information about their personal data processed by the Operator;

2. access to their personal data, including the right to obtain a copy of any record containing their personal data, except in cases provided for by the legislation of the Russian Federation;

3. clarification of their personal data, their blocking or destruction if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing;

4. withdrawal of consent to the processing of personal data;

5. taking measures provided for by the legislation of the Russian Federation to protect his rights;

6. appealing to the authorized body for the protection of the rights of personal data subjects or in court against unlawful actions

or omissions in the processing and protection of his personal data;

7. exercising other rights provided for by the legislation of the Russian Federation.

1.9. Control over the execution of the requirements of the Policy is carried out by the authorized person responsible for the organization of personal data processing at the Operator.

1.10. Responsibility for violation of the requirements of the legislation of the Russian Federation and regulatory acts of the Organization in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2. Purposes of personal data collection

2.1. The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of personal data collection is not allowed.

2.2. Only personal data that meet the purposes of personal data processing shall be processed.

2.3 The Operator shall process personal data for the following purposes:

• maintaining personnel and accounting records;

• ensuring compliance with labor legislation of the Russian Federation;

• ensuring compliance with tax legislation of the Russian Federation;

• ensuring compliance with pension legislation of the Russian Federation;

• ensuring compliance with insurance legislation of the Russian Federation;

• ensuring compliance with legislation of the Russian Federation in the sphere of health care;

• ensuring compliance with legislation of the Russian Federation in the sphere of health care; 

• ensuring compliance with the legislation of the Russian Federation in the sphere of education;

• ensuring compliance with the legislation of the Russian Federation on combating legalization of terrorism financing;

• ensuring compliance with the legislation of the Russian Federation on combating corruption;

• ensuring compliance with the legislation of the Russian Federation on enforcement proceedings;

• participation of a person in constitutional, civil, administrative and criminal proceedings;

• preparation, conclusion and execution of a civil law contract (including agreements and assignments to process personal data received from the personal data controller (third parties);

• execution of a judicial act;

• carrying out scientific, literary or other creative activity;

• conducting research works;

• conducting statistical records;

• promotion of goods, works, services on the market;

• organization and maintenance of access and intra-object regimes at the operator’s facilities;

• selection of personnel (applicants) for vacant positions of the Operator;

• provision of familiarization, industrial and pre-graduation practice on the basis of an agreement with an educational organization;

• provision of rights and legitimate interests of the Operator within the framework of activities provided for by the Charter;

• ensuring compliance with the Constitution of the Russian Federation, legislative and other regulatory legal acts of the Russian Federation, local regulatory acts of the Operator;

• providing additional guarantees and compensations to the Operator’s employees and their family members;

• formation and maintenance of directories for information support of the Operator’s activities, including informing citizens in the information and telecommunication network “Internet”, using social networks, messengers, other means of electronic communication on socially important topics and other issues that constitute the areas of the Operator’s activities in accordance with the legislation of the Russian Federation (including informing on the topics of the Operator’s work, targeting, analytical, statistical, sociological studies and reviews, maintaining communication by any means, including phone calls to the specified landline and/or cell phone, sending SMS messages to the specified cell phone, sending e-mails to the specified e-mail address, as well as sending messages using messengers and other means of electronic communication for the purpose of informing).

2.4. Personal data of employees may be processed solely for the purpose of ensuring compliance with laws and other regulatory legal acts.

3. Legal basis for personal data processing

3.1. The legal basis for personal data processing is a set of regulatory legal acts, pursuant to which and in accordance with which the Operator processes personal data, including:

• Constitution of the Russian Federation;

• Civil Code of the Russian Federation;

• Labor Code of the Russian Federation;

• Tax Code of the Russian Federation;

• Family Code of the Russian Federation;

• Federal Law of 19.05.1995 No. 81-FZ “On State Benefits to Citizens with Children”;

• Federal Law of 24.11. 1995 No. 181-FZ “On Social Protection of Disabled Persons in the Russian Federation”;

• Federal Law of 01.04.1996 No. 27-FZ “On Individual (Personified) Accounting in the Systems of Compulsory Pension Insurance and Compulsory Social Insurance”;

• Federal Law of 26.02.1997 No. 31-FZ “On Mobilization Preparation and Mobilization in the Russian Federation”;

• Federal Law of 28.03.1998 No. 53-FZ “On Military Duty and Military Service”;

• Federal Law of 24.07.1998 No. 125-FZ “On Compulsory Social Insurance against Industrial Accidents and Occupational Diseases”;

• Federal Law of 16.07.1999 No. 165-FZ “On the Basics of Compulsory Social Insurance”;

• Federal Law of 15. 12.2001 No. 166-FZ “On State Pension Provision in the Russian Federation”;

• Federal Law of 17.12.2001 No. 173-FZ “On Labor Pensions in the Russian Federation”;

• Federal Law of 29.12.2006 No. 255-FZ “On Compulsory Social Insurance for Temporary Inability to Work and in Connection with Maternity”;

• Federal Law of 29.11. 2010 № 326-FZ “On Compulsory Medical Insurance in the Russian Federation”;

• Federal Law of 21.11.2011 № 323-FZ “On the Fundamentals of Health Protection of Citizens in the Russian Federation”;

• Federal Law of 06.12.2011 № 402-FZ “On Accounting”,

• Federal Law of 28.12.2013 № 400-FZ “On Insurance Pensions”;

• Federal Law of 15.12. 2001 № 167-FZ “On Compulsory Pension Insurance in the Russian Federation”;

• Federal Law dated 12.01.1996 № 7-FZ “On Non-Profit Organizations”;

• Resolution of the Government of the Russian Federation dated 27.11.2006 № 719 “On Approval of the Regulations on Military Registration”;

• other normative legal acts regulating relations related to the Operator’s activity.

3.2 The legal basis for personal data processing is also:

• Charter of the Organization;

• contracts concluded between the Operator and third parties, as well as personal data subjects;

• consent of personal data subjects to the processing of their personal data.

4. Scope and categories of processed personal data, categories of personal data subjects

4.1. The content and scope of processed personal data shall comply with the stated processing purposes provided for in Section 2 of the Policy. Processed personal data shall not be redundant in relation to the stated purposes of their processing.

4.2. The Operator may process personal data of the following categories of personal data subjects:

4.2.1 Employees and former employees of the Organization.

Processing of personal data of these subjects shall be carried out in order to:

• formation and maintenance of directories for information support of the Operator’s activities;

• maintenance of personnel and accounting records;

• ensuring compliance with labor, tax, pension and insurance legislation, legislation in the field of health care and education, as well as anti-corruption;

• ensuring access to the Operator’s territory;

• ensuring the rights and legitimate interests of the Operator within the framework of the activities envisaged by the Operator’s activities;

• realization of scientific, literary or other creative activity, research works, statistical accounting;

• compliance with the Constitution of the Russian Federation, other normative legal acts of the Russian Federation, local normative legal acts of the Operator;

• for other lawful purposes.

The following data shall be processed:

• surname, first name, patronymic;

• gender;

• citizenship;

• date and place of birth;

• photograph (not for identification purposes);

• details of identity document;

• address of registration at the place of residence;

• address of actual residence;

• postal address;

• contact details;

• individual taxpayer number (INN);

• insurance number of individual personal account (SNILS);

• data of documents on education, qualification, professional training, information on advanced training: name of educational institution, number and series of diploma, qualification according to the document on education, direction or specialty according to the document on education, series and number of the document on advanced training, retraining;

• marital status, data on marriage registration;

• information on family composition to the extent necessary to complete the unified form T-2;

• information on labor activity, length of service, previous jobs, income from previous jobs, including incentives, awards and (or) disciplinary penalties;

• attitude to military duty and data on military registration;

• information on disability (if any) and details of the supporting document (certificate);

• data on social benefits to which the employee is entitled in accordance with the following provisions;

• alimony withholding information;

• information on other contracts (individual, collective material liability, apprenticeship, service contracts, etc.) concluded in the course of the employment contract.

4.2.2 Employees of partner organizations and individual entrepreneurs (third parties) in order to:

• formation and maintenance of directories for information support of the Operator’s activities; ensuring the rights and legitimate interests of the Operator within the framework of the activities stipulated by the Charter;

• ensuring compliance with the legislation of the Russian Federation on enforcement proceedings,

• participation of a person in constitutional, civil, administrative, criminal proceedings, in arbitration courts;

• preparation, conclusion and execution of a civil law contract;

• to ensure compliance with the Constitution of the Russian Federation, legislative and other regulatory legal acts of the Russian Federation, local regulatory acts of the operator;

• for other lawful purposes.

The following data shall be processed:

• surname, first name, patronymic;

• place of work (organization, location address);

• position held;

• contact telephone number;

• taxpayer identification number;

• certificate of state registration of an individual entrepreneur;

• e-mail address.

4.2.3 Family members of the Operator’s employees for the purposes of:

• HR and accounting purposes; 

• ensuring compliance with labor, tax and insurance legislation of the Russian Federation;

• for other lawful purposes.

The following data shall be processed:

• surname, first name, patronymic;

• degree of kinship;

• year of birth;

• other personal data provided by employees in accordance with the requirements of labor legislation.

4.2.4 Users of the Operator’s information systems and subjects whose personal data have been transferred to the Operator by third parties within the framework of concluded contracts, for the purposes of:

• Formation and maintenance of directories for informational support of the Operator’s activities, including informing citizens in the information and telecommunication network “Internet”, using social networks, messengers, other means of electronic communication on socially important topics and other issues constituting the Operator’s activities in accordance with the legislation of the Russian Federation (including informing on the topics of the Operator’s work, targeting, analytical, statistical, sociological studies and reviews, maintaining communication by any means, including phone calls to the specified landline and/or cell phone, sending SMS messages to the specified cell phone, sending e-mails to the specified e-mail address, as well as sending messages using messengers and other means of electronic communication for the purpose of informing);

• preparation, conclusion and execution of a civil law contract (including agreements and assignments to process personal data received from the personal data controller (third parties));

• carrying out scientific, literary or other creative activities;

• conducting analytical studies and other research works, statistical accounting, promotion of goods, works, services on the market and for other legitimate purposes.

The following data shall be processed:

• surname, first name, patronymic;

• e-mail address;

• social network accounts or information about other means of communication;

• photograph (not for identification purposes);

• identification cookies (cookies), user data (information about location, type and version of the operating system of the user’s computer, type and version of the browser used by the user, type of device and its screen resolution, source, where the user came from, from what site or on what advertising, language of the operating system and browser, what pages the user opens and what buttons the user clicks on, IP address);

• information about profession;

• affiliation with volunteer organizations (as a feature).

4.2.5 Candidates for employment in the Organization for the purposes of:

• execution of labor legislation within the framework of labor and other directly related relations;

• on the territory of the Operator;

• selection of personnel (applicants) for vacant positions of the Operator.

The following data shall be processed:

• surname, first name, patronymic;

• gender;

• citizenship;

• date and place of birth;

• contact details;

• information on education, work experience, qualifications;

• other personal data provided by candidates in their CVs and cover letters.

4.2.6 Trainees (students) for the purposes of: 

• ensuring the passage of introductory, industrial and pre-graduation practice on the basis of an agreement with an educational organization, 

• training in additional professional programs – professional development programs, other training in the areas of the Organization’s activities in accordance with the requirements of the legislation; 

• implementation of access control.

The following data shall be processed:

• surname, first name, patronymic;

• contact details;

• place of work (service), position held;

• place of study (name of educational organization, faculty, course and other information required for the internship);

• citizenship;

• date and place of birth;

• photograph (not for identification purposes);

• details of identity document;

• address of registration at the place of residence;

• address of actual residence;

• postal address;

• accounts of social networks, messengers;

• data of documents on education, qualification, professional training;

• other personal data necessary for conclusion and execution of contracts.

4.3 The Operator may process biometric personal data of personal data subjects with the written consent of the subjects, unless otherwise provided for by the legislation of the Russian Federation.

4.4. For information support purposes, the Operator may create publicly available sources (including directories and address books), which may include personal data reported by the subject of personal data with his/her written consent, unless otherwise provided for by the legislation of the Russian Federation.

4.5. The Operator shall not process a special category of personal data concerning race, nationality, political views, religious or philosophical beliefs, state of health, intimate life, except as provided for by the legislation of the Russian Federation.

5. Procedure and conditions of personal data processing

5.1. Personal data shall be processed by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. Processing of personal data is carried out with the consent of personal data subjects to the processing of their personal data, as well as without it in cases provided for by the legislation of the Russian Federation.

5.3. The Operator shall collect, record, systematize, accumulate, store, clarify (update, change), extract, use, transfer (disseminate, provide, access), depersonalize, block, delete and destroy personal data.

5.4 The Operator processes personal data for each purpose of their processing in the following ways:

• non-automated processing of personal data;

• automated processing of personal data with or without transmission of received information via information and telecommunication networks;

• mixed processing of personal data.

5.4.1 The Operator’s employees whose job description includes personal data processing are allowed to process personal data.

5.5. It is not allowed to disclose to third parties and distribute personal data without the consent of the subject of personal data, unless otherwise provided for by the federal law.

Consent to the processing of personal data authorized by the subject of personal data for dissemination shall be executed separately from other consents of the subject of personal data to the processing of his/her personal data.

Requirements for the content of the consent to the processing of personal data authorized by the subject of personal data for dissemination are approved by Roskomnadzor Order No. 18 dated 24.02.2021.

5.6. The transfer of personal data to the bodies of inquiry and investigation, the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

5.7. When processing personal data, the Operator shall take necessary and sufficient legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions in relation to personal data, including:

– appointment of the person responsible for the organization of personal data processing;

– adoption of local normative acts and other documents in the field of personal data processing and protection;

– identification of personal data security threats during their processing in personal data information systems;

– application of organizational and technical measures to ensure personal data security during their processing in personal data information systems;

– familiarization the Operator’s employees directly involved in personal data processing with the provisions of the Russian Federation legislation on personal data and the Operator’s local regulatory documents on personal data protection issues;

– processing of personal data and, if necessary, organize training for these employees;

– obtaining consents of personal data subjects to the processing of their personal data, except in cases stipulated by the legislation of the Russian Federation;

– implementation of internal control over the measures taken to ensure personal data security;

– other measures provided for by the legislation of the Russian Federation in the field of personal data.

5.8 The Operator shall store personal data in a form that allows to identify the subject of personal data for no longer than required by each purpose of personal data processing, unless the period of personal data storage is established by federal law, contract.

5.8.1 Personal data in hard copy shall be stored in the Organization during the period of storage of documents for which such periods are provided by the legislation on archiving in the Russian Federation (Federal Law of 22.10.2004 No. 125-FZ “On archiving in the Russian Federation”, the List of standard management archival documents formed in the course of activities of state bodies, local governments and organizations, with indication of their storage periods, approved by the order of Rosarkhiv of 20.12.2019 No. 236)).

5.8.2 The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper.

5.9 The Operator stops processing of personal data in the following cases:

• the fact of their unlawful processing is revealed (within 3 (three) working days from the date of detection);

• the purpose of their processing has been achieved;

• the personal data subject’s consent to the processing of the said data has expired or withdrawn, when under the Personal Data Law the processing of such data is allowed only with consent.

• termination of the Operator’s activity (liquidation or reorganization).

5.10. Upon achievement of the purposes of personal data processing, as well as in case of withdrawal of the personal data subject’s consent to their processing, the Operator shall stop processing of such data if:

• otherwise is not stipulated by the contract to which the personal data subject is a party, beneficiary or guarantor;

• the Operator is not entitled to carry out processing without the consent of the personal data subject on the grounds stipulated by the Personal Data Law or other federal laws;

• otherwise is not stipulated by another agreement between the Operator and the personal data subject.

5.11. If a personal data subject appeals to the Operator with a request to stop processing personal data within a period not exceeding 10 (ten) business days from the date of receipt of the relevant request by the Operator, the processing of personal data shall be stopped, except for cases stipulated by the Personal Data Law. The said term may be extended, but not more than for 5 (five) working days. For this purpose, the Operator sends a motivated notification to the personal data subject indicating the reasons for extending the term.

5.12. When collecting personal data, including through the information and telecommunications network “Internet”, the Operator shall ensure recording, systematization, accumulation, storage, clarification (update, change), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases specified in the Law on Personal Data.

5.13. The Operator’s employees guilty of violating the requirements of the Personal Data Law and regulatory legal acts adopted in accordance with it shall bear material, disciplinary, administrative, civil or criminal liability in accordance with the procedure established by the legislation of the Russian Federation.

6. Actualization, correction, deletion, destruction of personal data, responses to the subjects’ requests for access to personal data

6.1. Confirmation of the fact of personal data processing by the Operator, legal grounds and purposes of personal data processing, as well as other information specified in part 7 of Article 14 of the Law on Personal Data shall be provided by the Operator to the personal data subject or his/her representative within 10 (ten) working days from the moment of application or receipt of the request of the personal data subject or his/her representative. This term may be extended, but not more than for 5 (five) working days. For this purpose, the Operator shall send a motivated notice to the personal data subject indicating the reasons for extending the term for providing the requested information.

The information provided shall not include personal data related to other personal data subjects, except for cases when there are legal grounds for disclosure of such personal data.

The request shall contain:

• number of the main identity document of the personal data subject or his/her representative, information about the date of issue of the said document and the issuing authority;

• information confirming the participation of the personal data subject in relations with the Operator (contract number, date of the contract, conventional word designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Operator;

• signature of the personal data subject or his/her representative.

The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator shall provide the information specified in part 7 of Article 14 of the Law on Personal Data to the personal data subject or his/her representative in the form in which the respective appeal or request was sent, unless otherwise specified in the appeal or request.

If the appeal (request) of the personal data subject does not reflect, in accordance with the requirements of the Law on personal data, all the necessary information or the subject does not have access rights to the requested information, a reasoned refusal shall be sent to him.

The right of the personal data subject to access his/her personal data may be restricted in accordance with part 8 of Article 14 of the Law on personal data, including if the access of the personal data subject to his/her personal data violates the rights and legitimate interests of third parties.

6.2. If inaccurate personal data is detected upon application of a personal data subject or his/her representative or at their request or at the request of Roskomnadzor, the Operator shall block personal data related to this personal data subject from the moment of such application or receipt of the said request for the period of verification, if the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

If the fact of inaccuracy of personal data is confirmed, the Operator shall, on the basis of information submitted by the personal data subject or his/her representative or Roskomnadzor, or other necessary documents, clarify the personal data within 7 (seven) business days from the date of submission of such information and lift the blocking of personal data.

6.3. In case of detection of unlawful processing of personal data upon application (request) of the personal data subject or his/her representative or Roskomnadzor, the Operator shall block the unlawfully processed personal data related to this personal data subject from the moment of such application or request.

6.4 When the Operator, Roskomnadzor or any other interested party reveals the fact of unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) resulting in violation of the rights of personal data subjects, the Operator:

• within 24 (twenty-four) hours notifies Roskomnadzor of the incident, the alleged reasons that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects and the measures taken to eliminate the consequences of the incident, as well as provides information on the person authorized by the Operator to interact with Roskomnadzor on issues related to the incident;

• within 72 (seventy-two) hours notify Roskomnadzor of the results of the internal investigation of the identified incident and provide information on the persons whose actions caused the incident (if any).

6.5 Procedure for destruction of personal data by the Operator.

6.5.1 Conditions and terms of personal data destruction by the Operator:

• achievement of the purpose of personal data processing or loss of necessity to achieve this purpose – within 30 (thirty) days;

• achievement of the maximum storage period for documents containing personal data – within 30 (thirty) days;

• provision by the subject of personal data (his/her representative) of confirmation that personal data were obtained illegally or are not necessary for the stated purpose of processing – within 7 (seven) business days;

• revocation by the personal data subject of his/her consent to the processing of his/her personal data, if their retention for the purpose of their processing is no longer required – within 30 (thirty) days.

6.5.2 Upon achievement of the purpose of personal data processing, as well as in case the subject of personal data withdraws consent to their processing, the personal data shall be destroyed, unless:

• otherwise is not provided for in the contract to which the personal data subject is a party, beneficiary or guarantor;

• the Operator is not entitled to carry out processing without the consent of the subject of personal data on the grounds provided for by the Personal Data Law or other federal laws;

• otherwise is not provided for by another agreement between the Operator and the subject of personal data.

6.5.3 Destruction of personal data is carried out by a commission established by the order of the General Director of the Organization.

6.5.4 The methods of personal data destruction are established in the Operator’s local normative acts.

6.5.5 If it is impossible to destroy personal data 

within the period specified in clause 6.5.4. of this Policy, the Operator shall block such personal data and ensure destruction of personal data within a period not exceeding 6 months, unless another period is established by the legislation of the Russian Federation.

6.5.6 To exercise his/her rights the subject of personal data may personally or through a legal representative apply to the Non-profit organization “International Fact-checking Association” by sending a request to the following address: 11 Timur Frunze St., 11, p. 1, Khamovniki Municipal District, Moscow 119021. 1 . The procedure for consideration of requests is carried out in accordance with the procedure established by the Law on Personal Data.