Our Privacy Policy

Appendix 1 to the Order
of the Perm Regional State Budgetary Institution of Culture
«Perm Regional State Club-Cinema Center «Perm Cinematheque»
dated May 12, 2026 No. 24/1-OD

POLICY
of the Perm Regional State Budgetary Institution of Culture
«Perm Regional State Club-Cinema Center «Perm Cinematheque»
regarding the Processing of Personal Data

1. General Provisions

1.1. This Policy of the Perm Regional State Budgetary Institution of Culture «Perm Regional State Club-Cinema Center «Perm Cinematheque» (hereinafter — the «Perm Cinematheque») regarding the Processing of Personal Data (hereinafter — the «Policy») has been developed in compliance with the requirements of Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ of July 27, 2006 «On Personal Data» (hereinafter — the «Personal Data Law») in order to ensure the protection of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy, personal and family secrets.

1.2. The Policy applies to all personal data processed by the Perm Cinematheque (hereinafter also referred to as the «Operator»).

1.3. The Policy covers relations in the area of personal data processing that arose with the Operator both before and after the approval of this Policy.

1.4. In compliance with the requirements of Part 2, Article 18.1 of the Personal Data Law, this Policy is published in the public domain on the information and telecommunications network Internet on the Operator’s official website.

1.5. Basic concepts used in the Policy:

personal data — any information relating directly or indirectly to an identified or identifiable natural person (personal data subject);

personal data operator (Operator) — a state body, municipal body, legal entity or individual that, independently or jointly with other persons, organizes and/or carries out the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data;

processing of personal data — any action (operation) or set of actions (operations) performed with personal data using automation means or without such means. Processing of personal data includes, inter alia:

collection;
recording;
systematization;
accumulation;
storage;
updating (renewal, modification);
retrieval;
use;
transfer (distribution, provision, access);
anonymization;
blocking;
erasure;
destruction;

automated processing of personal data — processing of personal data using computer technology;

distribution of personal data — actions aimed at disclosing personal data to an indefinite circle of persons;

provision of personal data — actions aimed at disclosing personal data to a specific person or a specific circle of persons;

blocking of personal data — temporary suspension of personal data processing (except where processing is necessary for the purposes of updating personal data);

destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the physical media containing personal data are destroyed;

anonymization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine the ownership of personal data to a specific personal data subject;

personal data information system — a set of personal data contained in databases and the information technologies and technical means ensuring their processing.

2. Principles and Purposes of Personal Data Processing

2.1. The Operator processes personal data on the basis of the following principles:

lawfulness and fairness;
limitation of personal data processing to the achievement of specific, predetermined and lawful purposes;
prevention of personal data processing incompatible with the purposes of personal data collection;
prevention of the merging of databases containing personal data processed for purposes that are incompatible with each other;
prevention of the processing of personal data that is excessive in relation to the stated purposes of their processing;
ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of personal data processing;
destruction or anonymization of personal data upon achieving the purposes of their processing or in the event of loss of the need to achieve these purposes, if it is impossible for the Operator to eliminate the violations of personal data committed, unless otherwise provided by federal law.

2.2. The Operator processes personal data for the following purposes:

carrying out its activities in accordance with the Charter of the Perm Cinematheque, including holding festivals, competitions, and other events by the Perm Cinematheque, as well as events of other organizations, implementation of project activities, implementation of activities for training moderators of social cinema halls, posting information about the Operator’s events on the Operator’s resources on the information and telecommunications network Internet, sending informational and other materials, reviewing and responding to inquiries related to the statutory activities of the Perm Cinematheque, concluding and performing contracts with counterparties;
formalizing employment relationships and other directly related relationships, including selection of candidates for employment with the Operator, maintaining personnel and accounting records, completing and submitting required reporting forms to authorized bodies, arranging for individual (personalized) registration of employees in the mandatory pension insurance and mandatory social insurance systems;
completion of internships by students of higher educational institutions.

2.3. The processing of personal data may be carried out exclusively for the purposes of ensuring compliance with laws and other regulatory legal acts.

3. Legal Grounds for Personal Data Processing

3.1. The legal grounds for the processing of personal data are the set of regulatory legal acts in compliance with and in accordance with which the Operator processes personal data, including:

The Constitution of the Russian Federation;
The Civil Code of the Russian Federation;
The Labour Code of the Russian Federation;
The Tax Code of the Russian Federation;
Federal Law No. 149-FZ of July 27, 2006 «On Information, Information Technologies and Protection of Information»;
Federal Law No. 27-FZ of April 1, 1996 «On Individual (Personalized) Registration in the Mandatory Pension Insurance System»;
other regulatory legal acts governing relations related to the statutory activities of the Perm Cinematheque.

3.2. The legal grounds for personal data processing also include:

the Charter of the Perm Cinematheque;
contracts concluded between the Operator and personal data subjects;
consent of personal data subjects to the processing of their personal data.

4. Categories of Personal Data Subjects,
Scope and Categories of Personal Data Processed

4.1. The content and scope of the personal data processed shall correspond to the stated purposes of processing set forth in Section 2 of this Policy. The personal data processed shall not be excessive in relation to the stated purposes of their processing.

4.2. The Operator may process personal data of the following categories of personal data subjects:

4.2.1. Employees and former employees of the Perm Cinematheque (persons with whom an employment contract is or was concluded), immediate family members of employees (spouses, children, parents) — for the purposes of ensuring compliance with the labour and tax legislation of the Russian Federation, maintaining personnel records, personnel and tax accounting.

The Operator processes the following personal data:

surname, first name, patronymic (including information on previous surnames, first names and patronymics);
gender;
date of birth;
place of birth;
address of registration and actual residence;
contact telephone number;
email address;
image (photograph);
identity document details;
individual taxpayer identification number (INN);
insurance number of individual personal account (SNILS);
information on education, qualifications, professional training and continuing professional development;
educational document details;
information on academic degree, academic title;
information on employment history, including information on awards, honours and/or disciplinary sanctions;
information on issued security clearance for state secrets;
information on state and other awards, distinctions;
information on citizenship;
marital status, children, family relationships;
marriage registration details and details of the relevant document;
military service obligations;
information on military registration and military registration document details;
information on criminal record (its presence or absence);
information on disability;
information on alimony deductions;
information on income from previous place of employment;
bank card details;
other personal data provided by employees in accordance with the requirements of applicable law.

4.2.2. Family members of employees (spouses, children, parents) — for the purposes of maintaining personnel records.

The Operator processes the following personal data of family members of employees:

surname, first name, patronymic;
date of birth.

4.2.3. Job applicants for positions at the Perm Cinematheque — for the purposes of considering candidates for vacant positions at the Perm Cinematheque.

The Operator processes the following personal data of job applicants:

surname, first name, patronymic;
gender;
date of birth;
information on education, qualifications, professional training and continuing professional development;
information on employment history;
email address;
contact telephone number;
other personal data provided by applicants in their CVs and cover letters.

4.2.4. Students of higher educational institutions — for the purposes of completing internships (work placements).

The Operator processes the following personal data:

surname, first name, patronymic;
name of educational institution, year of study, specialization;
email address;
contact telephone number;
other personal data provided by students in their CVs and cover letters.

4.2.5. Participants of events held within the framework of the Operator’s statutory activities — for the purposes of organizing events held by the Operator, including issuing tickets, visas, hotel reservations, payment of prizes (cash awards) to winners, and dissemination of information about the event on the Operator’s resources on the information and telecommunications network Internet.

The Operator processes the following personal data:

surname, first name, patronymic;
date of birth;
contact telephone number;
email address;
identity document details;
information on place of employment;
information on position held;
information on length of service in the position held;
information on place of study;
information on education, qualifications, professional training and continuing professional development;
image (photograph, video);
bank card details (for winners).

4.2.6. Counterparties (natural persons) of the Perm Cinematheque — for the purposes of concluding and performing civil law contracts with the Perm Cinematheque.

The Operator processes the following personal data:

surname, first name, patronymic;
address of registration and actual residence;
passport details;
individual taxpayer identification number (INN);
principal state registration number of an individual entrepreneur (OGRNIP);
insurance number of individual personal account (SNILS);
bank account details;
email address;
contact telephone number.

4.2.7. Visitors to the official website of the Perm Cinematheque — for the purposes of selling tickets and reviewing enquiries submitted through the official website of the Perm Cinematheque.

The Operator processes the following personal data:

surname, first name, patronymic;
contact telephone number;
email address.

4.2.8. Persons contacting the Perm Cinematheque on matters related to the statutory activities of the Perm Cinematheque — for the purposes of reviewing such enquiries and sending responses thereto.

The Operator processes the following personal data:

surname, first name, patronymic;
address of registration and/or actual residence;
email address;
contact telephone number;
other personal data provided by personal data subjects when contacting the Perm Cinematheque.

4.3. The Operator’s processing of biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which their identity can be established) shall be carried out in accordance with the legislation of the Russian Federation.

4.4. The processing of personal data authorized by the personal data subject for distribution shall be carried out in accordance with the legislation of the Russian Federation.

4.5. The Operator does not process special categories of personal data concerning race, nationality, political opinions, religious or philosophical beliefs, health status, or intimate life, except in cases provided for by the legislation of the Russian Federation.

5. Procedure and Conditions for Personal Data Processing

5.1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.

5.2. The processing of personal data is carried out with the consent of the personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.

5.3. The Operator processes personal data for each purpose of their processing by the following methods:

non-automated processing of personal data;
automated processing of personal data, with or without the transfer of the information obtained via information and telecommunications networks;
mixed processing of personal data.

5.4. Employees of the Operator whose job duties include the processing of personal data are permitted to process personal data.

5.5. The processing of personal data for each purpose of processing specified in Clause 2.3 of this Policy is carried out by:

obtaining personal data orally and in writing directly from the personal data subjects;
entering personal data into logs, registers and information systems of the Operator;
using other methods of personal data processing.

5.6. Disclosure of personal data to third parties and distribution of personal data without the consent of the personal data subject is not permitted, unless otherwise provided by federal law. Consent to the processing of personal data authorized by the personal data subject for distribution is formalized separately from other consents of the personal data subject to the processing of his/her personal data.

The requirements for the content of consent to the processing of personal data authorized by the personal data subject for distribution are approved by Order of Roskomnadzor No. 18 of February 24, 2021 «On Approval of Requirements for the Content of Consent to the Processing of Personal Data Authorized by the Personal Data Subject for Distribution.»

The transfer (distribution, provision, access) of personal data authorized by the personal data subject for distribution must be terminated at any time upon the request of the personal data subject. Such request shall include the surname, first name, patronymic (if any), contact information (telephone number, email address or postal address) of the personal data subject, as well as a list of personal data whose processing is subject to termination.

5.7. The transfer of personal data to bodies of inquiry and investigation, the Federal Tax Service, the Social Fund of Russia and other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.

5.8. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, distribution and other unauthorized actions, including:

identifying threats to the security of personal data during their processing;
adopting local regulatory acts and other documents regulating relations in the field of processing and protection of personal data;
appointing persons responsible for ensuring the security of personal data in the structural units and information systems of the Operator;
creating the necessary conditions for working with personal data;
organizing the registration of documents containing personal data;
organizing work with information systems in which personal data are processed;
storing personal data under conditions that ensure their safety and exclude unauthorized access to them;
organizing training for employees of the Operator who carry out the processing of personal data.

5.9. The Operator stores personal data in a form that makes it possible to identify the personal data subject no longer than is required by each purpose of personal data processing, unless the storage period for personal data is established by federal law or by a contract.

5.9.1. Personal data on paper media shall be stored at the Perm Cinematheque for the document retention periods established by the Operator in accordance with the legislation of the Russian Federation.

5.9.2. The retention period for personal data processed in personal data information systems shall correspond to the retention period for personal data on paper media.

5.10. The Operator terminates the processing of personal data in the following cases:

a fact of unlawful processing thereof has been identified. The deadline for termination of personal data processing is within 3 (three) business days from the date of identification;
the purpose of their processing has been achieved;
the consent period of the personal data subject to the processing of such data has expired or has been withdrawn, where under the Personal Data Law the processing of such data is permitted only with the consent of the subject.

5.11. Upon achieving the purposes of processing personal data, as well as in the event of the withdrawal by the personal data subject of consent to their processing, the Operator terminates the processing of such data, unless:

otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor;
the Operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
otherwise provided by another agreement between the Operator and the personal data subject.

5.12. Upon the request of the personal data subject to the Operator for the termination of personal data processing, the processing of personal data shall be terminated within a period not exceeding 10 (ten) business days from the date the Operator receives the relevant request, except in cases provided for by the Personal Data Law. This period may be extended by no more than 5 (five) business days. To do so, the Operator shall send a reasoned notice to the personal data subject indicating the reasons for extending the period.

5.13. When collecting personal data, including via the information and telecommunications network Internet, the Operator ensures the recording, systematization, accumulation, storage, updating (renewal, modification) and retrieval of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases specified in the Personal Data Law.

6. Updating, Correction, Erasure, Destruction of Personal Data,
Responses to Requests of Subjects for Access to Personal Data

6.1. Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of personal data processing, as well as other information specified in Part 7, Article 14 of the Personal Data Law, shall be provided by the Operator to the personal data subject or his/her representative within 10 (ten) business days from the date of application or receipt of the request of the personal data subject or his/her representative. This period may be extended by no more than 5 (five) business days. To do so, the Operator shall send a reasoned notice to the personal data subject indicating the reasons for extending the deadline for providing the requested information.

The information provided shall not include personal data relating to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.

6.1.1. The request shall contain:

the number of the main identity document of the personal data subject or his/her representative, information on the date of issue of the said document and the authority that issued it;
information confirming the participation of the personal data subject in relations with the Operator (contract number, date of conclusion of the contract, conventional verbal designation and/or other information), or information otherwise confirming the fact of personal data processing by the Operator;
the signature of the personal data subject or his/her representative.

6.1.2. The request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

The Operator shall provide the information specified in Part 7, Article 14 of the Personal Data Law to the personal data subject or his/her representative in the same form in which the relevant application or request was submitted, unless otherwise specified in the application or request.

6.1.3. If the application (request) of the personal data subject does not reflect, in accordance with the requirements of the Personal Data Law, all the necessary information, or if the subject does not have the right of access to the requested information, a reasoned refusal shall be sent to him/her.

6.1.4. The right of the personal data subject to access his/her personal data may be restricted in accordance with Part 8, Article 14 of the Personal Data Law, including if the access of the personal data subject to his/her personal data violates the rights and legitimate interests of third parties.

6.2. In the event of identification of inaccurate personal data upon application of the personal data subject or his/her representative, or upon their request, or upon request of Roskomnadzor, the Operator shall block the personal data relating to that personal data subject from the moment of such application or receipt of the said request for the period of verification, provided that blocking the personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

In the event of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the personal data subject or his/her representative or by Roskomnadzor, or other necessary documents, shall update the personal data within 7 (seven) business days from the date of provision of such information and shall unblock the personal data.

6.3. In the event of identification of unlawful processing of personal data upon application (request) of the personal data subject or his/her representative or of Roskomnadzor, the Operator shall block the unlawfully processed personal data relating to that personal data subject from the moment of such application or receipt of the request.

6.4. In the event that the Operator, Roskomnadzor or any other interested person identifies a fact of unlawful or accidental transfer (provision, distribution) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator shall:

within 24 (twenty-four) hours — notify Roskomnadzor of the incident that has occurred, the suspected causes that led to the violation of the rights of personal data subjects, the suspected harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provide information on the person authorized by the Operator to interact with Roskomnadzor on matters related to the incident;
within 72 (seventy-two) hours — notify Roskomnadzor of the results of the internal investigation of the identified incident and provide information on the persons whose actions caused it (if any).

6.5. Procedure for the destruction of personal data by the Operator.

6.5.1. Conditions and time limits for the destruction of personal data by the Operator:

identification of unlawful processing of personal data, including upon application of the personal data subject or his/her representative or upon request of the authorized body for the protection of the rights of personal data subjects, if it is impossible to ensure the lawfulness of personal data processing, within a period not exceeding ten business days from the date of identification of the unlawful processing of personal data;
upon the request of the personal data subject, if his/her personal data are:
incomplete, outdated, inaccurate (provided that the updating of personal data is impossible);
unlawfully obtained or are no longer necessary for the stated purpose of processing, within a period not exceeding 7 (seven) business days from the date of submission by the personal data subject or his/her representative of information confirming that such personal data are unlawfully obtained or are no longer necessary for the stated purpose of processing;
achievement of the purpose of personal data processing or loss of the need to achieve such purpose — within 30 (thirty) days;
achievement of the maximum retention periods for documents containing personal data — within 30 (thirty) days;
withdrawal by the personal data subject of consent to the processing of his/her personal data, if their retention for the purpose of their processing is no longer required — within 30 (thirty) days;
in other cases established by law.

6.5.2. Upon achieving the purposes of personal data processing, as well as in the event of withdrawal by the personal data subject of consent to their processing, the personal data shall be destroyed, unless:

otherwise provided by a contract to which the personal data subject is a party, beneficiary or guarantor;
the Operator is not entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
otherwise provided by another agreement between the Operator and the personal data subject.

6.5.3. In the event that it is impossible to destroy personal data within the period specified in Clause 6.5.1 of this Policy, such personal data shall be blocked and their destruction shall be ensured within a period not exceeding 6 (six) months (unless a different period is established by federal laws).

6.5.4. The destruction of personal data shall be carried out by the following methods:

for paper media containing personal data — cutting, hydrotreatment, incineration, passing documents through a shredder;
for electronic media — erasure of information, multiple overwriting of information, physical destruction of removable media, etc.

6.5.5. The destruction of a part of the personal data, if permitted by the physical medium, shall be carried out in a manner that precludes further processing of such personal data, while preserving the possibility of processing other data recorded on the physical medium.

6.5.6. The document confirming the destruction of personal data is the Report on the Destruction of Personal Data (hereinafter — the «Report»). The form of the Report complies with Clause 3 of the Requirements for Confirmation of Destruction of Personal Data, approved by Order of Roskomnadzor No. 179 of October 28, 2022. The Report shall be signed by the members of the Commission for the Destruction of Personal Data (hereinafter — the «Commission»), established by order of the head of the Operator.

After the Report has been signed by the members of the Commission, an entry on the destruction of the personal data media shall be made in the Register of Destruction of Personal Data Media (hereinafter — the «Register»).

6.5.7. If the processing of personal data was carried out using automation means, as well as both using automation means and without using automation means, then in addition to the Report, an extract from the event log of the personal data information system (hereinafter — the «Extract from the Log») shall be generated.

The Extract from the Log complies with Clause 5 of the Requirements for Confirmation of Destruction of Personal Data, approved by Order of Roskomnadzor No. 179 of October 28, 2022.

6.5.8. The Report and the Extract from the Log shall be retained for three years from the date of destruction of the personal data.