Log in
About the Corporation
Infrastructure
History of the regionEconomy of the regionDevelopment strategyTeam of the regionMunicipalities
Regulations for «One-stop shop» principle for investor supportDirect LineSupport measuresDevelopment InstitutesInvestment platformsImplemented investment projectsF.A.Q.ПОС Бизнес
NewsEventsVideosSuccess stories
Investment legislation
Investment map
Investment Standard
Direct Line
MainPrivacy Policy

Privacy Policy

  1. General.
    1. This Policy for Processing and Protection of Personal Data on the Investment Portal (website https://krdonbass.ru/) (hereinafter referred to as the Policy) has been developed in accordance with the norms of the current legislation, including the Federal Law No. 152 dated July 27, 2006 "On Personal Data" (hereinafter referred to as the Federal Law), the Resolution of the Government of the Russian Federation No. 1119 dated November 1, 2012 "On approval of requirements for the protection of personal data during their processing in personal data information systems" and other regulatory legal acts in the field of personal data.
    2. The Policy defines the basic principles, goals and methods of personal data processing, the functions of the State unitary company "Donbass Development Corporation" (hereinafter referred to as the Corporation) in processing personal data, the rights of personal data subjects, the implemented requirements for the protection of personal data, as well as the establishment of responsibility of persons who have access to personal data for non-compliance with the requirements of the norms governing the processing and protection of personal data.
    3. Personal data (in some cases hereinafter referred to as PD) are confidential, strictly protected information and are subject to all requirements established by the internal documents of the Corporation for the protection of confidential information.
    4. The Policy is an internal public document of the Corporation.
    5. All concepts and terms used in the Policy, which are defined in the Federal Law, are used in the meaning derived from the legislative definition of the corresponding concept.
  2. Principles and purposes of personal data processing.
    1. Personal data processing in the Corporation must be carried out on a legal and fair basis.
    2. The processing of personal data should be limited to achieving specific, predetermined and legitimate purposes. Processing of personal data incompatible with the purposes of collecting personal data is not allowed.
    3. It is not allowed to combine databases containing personal data that are processed for incompatible purposes.
    4. Only personal data that meet the purposes of their processing are subject to processing.
    5. The content and volume of personal data processed must comply with the stated purposes of processing. The personal data processed shall not be excessive in relation to the stated purposes of their processing.
    6. When processing personal data, the accuracy of personal data, their sufficiency, and, if necessary, relevance to the purposes of processing personal data must be ensured. The operator must take the necessary measures or ensure that they are taken to delete or clarify incomplete or inaccurate data.
    7. The storage of personal data shall be carried out in a form that allows determining the subject of personal data, for no longer than the purposes of personal data processing require, unless the storage period for personal data is established by the Federal Law or by a contract to which the subject of personal data, the beneficiary or the guarantor is a party. The processed personal data shall be subject to destruction or depersonalization upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by the Federal Law.
    8. The Corporation processes personal data for the following purposes:
      1. Implementation of activities provided for by the Corporation’s Charter and the current legislation of the Russian Federation.
      2. Processing of applications, proposals, statements, requests, etc., sent by users through the website of the Investment Portal of the Donetsk People’s Republic https://krdonbass.ru/ (hereinafter referred to as the Investment Portal), including but not limited to:- identification of persons who submit applications, appeals, requests, etc. through the Investment Portal, including through the investor’s personal account of the Donetsk People’s Republic;- identification of persons who have applied to the Corporation and plan to cooperate with the Corporation, including on a contractual basis, as well as for the assessment of their business reputation;- conclusion, execution, amendment and termination of civil law contracts with individuals, legal entities and individual entrepreneurs;- communication with the subject of personal data, including sending decisions, conclusions, notifications, requests and information related to the services provided through the Investment Portal, including support of investment projects in the territory of the Donetsk People’s Republic;- communication with the subject of personal data via electronic and telephone communication, sending responses, notifications, letters, requests and other information;- acceptance and review of documents justifying the compliance of an object or an investment project with the criteria established by the Law of the Donetsk People’s Republic "On Investment Policy and State Support for Investment Activities in the Donetsk People’s Republic" for the provision of land plots and property objects for lease without conducting auctions in accordance with the order of the Head of the Donetsk People’s Republic;- acceptance and consideration of an application for amendments to agreements providing for the placement of the facility or the implementation of the project, and documents justifying the need for such amendments;- maintaining a consolidated register of applications of legal entities containing information on the lease, without bidding, of a land plot or property object in accordance with the order of the Head of the Donetsk People’s Republic for the placement of an object or the implementation of an investment project, as well as containing information on amendments to the parameters of an object or investment project, with subsequent posting of such data on the website https://krdonbass.ru/ and/or duplication and distribution on paper media;- preparation of summary conclusions on the compliance of an object or an investment project with the criteria established by the Law of the Donetsk People’s Republic "On Investment Policy and State Support for Investment Activities in the Donetsk People’s Republic", as well as summary conclusions on the effectiveness of the placement of an object or the implementation of an investment project, and the expediency of making changes to the parameters of an object or an investment project;- monitoring the placement of a facility for social, cultural and communal purposes, the implementation of a large-scale investment project and the fulfillment of obligations under an agreement on the placement of facilities for social, cultural and communal purposes, with subsequent posting of such data on the website https://krdonbass.ru/ and/or duplication and distribution on paper media;- preparation for consideration and consideration by the Investment Committee of the Donetsk People’s Republic for making a decision on the compliance (non-compliance) of the object (project) with the criteria established by Article 13 of the Law of the Donetsk People’s Republic "On Investment Policy and State Support for Investment Activities in the Donetsk People’s Republic", consideration of the expediency of providing a land plot as a real estate object that constitutes a part of the earth’s surface and has characteristics that allow it to be identified as an individually defined thing, as well as of property objects;- formation and maintenance of the register of investment sites of the Donetsk People’s Republic, with subsequent posting of such data on the website https://krdonbass.ru/ and/or duplication and distribution on paper media;- formation and maintenance of the register of investment proposals of the Donetsk People’s Republic, with subsequent posting of such data on the website https://krdonbass.ru/ and/or duplication and distribution on paper media;- formation and maintenance of the register of investment projects of the Donetsk People’s Republic, with subsequent posting of such data on the website https://krdonbass.ru/ and/or duplication and distribution on paper media;- processing of the received data by the competent employees of the Corporation and distribution of the received data, namely the subsequent posting of such data on the Site and/or duplication and distribution on paper media;- transfer of personal and other received data to the competent regional and municipal authorities in the territory of the Donetsk People’s Republic;- improving the quality of the Investment Portal, its usability, and developing new types of services.
      3. For other purposes that do not contradict the legislation of the Russian Federation, in particular the Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data".
  3. Legal grounds for the processing of personal data.
    1. The legal basis for the processing of personal data is a set of legal acts, pursuant to and in accordance with which the Corporation processes personal data, namely:- Federal Law No. 149 dated July 27, 2006 "On Information, Information Technologies and Information Protection";- Decree of the President of the Russian Federation No. 188 dated March 6, 1997 "On approval of the list of confidential information";- Resolution of the Government of the Russian Federation No. 1119 dated November 1, 2012 "On approval of requirements for the protection of personal data during their processing in personal data information systems";- Law of the Donetsk People’s Republic dated May 17, 2023 No. 444-IINS "On Investment Policy and State Support for Investment Activities in the Donetsk People’s Republic";- Directive of the Acting Head of the Donetsk People’s Republic dated June 5, 2023 No. 165 "On the creation of the Investment Committee of the Donetsk People’s Republic";- Resolution of the Government of the Donetsk People’s Republic dated June 22, 2023 No. 45-6 "On some issues of providing legal entities with land plots owned by the Donetsk People’s Republic and municipalities for lease without bidding";- Resolution of the Government of the Donetsk People’s Republic dated March 7, 2024 No. 23-1 "On approval of the Procedure for leasing property and calculating the cost of leasing property owned by the state of the Donetsk People’s Republic under property lease agreements for the purpose of implementing agreements on the placement of facilities for social, cultural and communal purposes, and on the implementation of a large-scale investment project";- Resolution of the Government of the Donetsk People’s Republic dated May 23, 2024 No. 53-3 "On the formation and maintenance of the registers of investment sites of the Donetsk People’s Republic, investment proposals of the Donetsk People’s Republic, investment projects of the Donetsk People’s Republic";- The Charter of the Corporation;- contracts concluded between the Corporation and the subject of personal data;- federal laws and the regulatory legal acts adopted on their basis that regulate relations related to the Corporation’s activities;- consent to the processing of personal data.
  4. Categories and content of personal data processed by the Corporation.
    1. Personal data of the personal data subjects belongs to the category of confidential information.
    2. The list of personal data that are processed by the Corporation and subject to protection is formed in accordance with the Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data".
    3. Information constituting personal data in the Corporation is any information relating to a directly or indirectly identified or identifiable individual (subject of personal data), including but not limited to:- personal details (surname, first name, patronymic, date and place of birth, including biography, information about changes to personal details, place of registration and actual place of residence);- passport data, including the place of residence (registration) of the subject of personal data;- taxpayer identification number data;- information on specialty, qualification, profession, position, availability of special knowledge, advanced training;- information on the place of work;- information on tax status (resident/non-resident);- information about the circumstances giving grounds for the provision of guarantees, benefits and compensations provided by law;- information about real estate objects owned/used by the subject of personal data;- contact details (phone numbers, e-mail addresses);- other information transmitted with the consent of the subject of personal data through the website of the Investment Portal of the Donetsk People’s Republic, owned by the Corporation.
    4. Depending on the subject of personal data, the Corporation processes personal data of the following categories of personal data subjects:- personal data of persons received by the Corporation through the Investment Portal (website https://krdonbass.ru/), including personal data of persons who have applied to the Corporation in order to receive services provided by the Corporation within the framework of statutory activities to support investment projects.
  5. Procedure for the processing of personal data.
    1. PD processing is carried out after obtaining the consent of the PD subject directly from the PD subject or from the legal representatives of the PD subject vested with the relevant authority.
    2. The PD subject decides to provide his/her PD and gives consent to their processing freely, of his/her own will and in his/her own interest. Consent to PD processing must be specific, informed and conscious.
    3. Consent to PD processing is executed in writing.
    4. The written consent of the PD subject to the processing of his/her personal data must include, in particular:1) surname, first name, patronymic (if any), address of registration and actual place of residence of the PD subject, number of the main identity document, information on the date of issue of the specified document and the issuing authority;2) surname, first name, patronymic (if any), address of registration and actual place of residence of the representative of the subject of personal data, number of the main identity document, information on the date of issue of the specified document and the issuing authority, details of the power of attorney or other document confirming the authority of this representative (when consent is obtained from the representative of the subject of personal data);3) full name and location of the Corporation;4) the purpose of PD processing;5) the list of PD to whose processing the PD subject gives consent;6) the name or surname, first name, patronymic (if any) and address of registration and actual place of residence of the person processing personal data on behalf of the Corporation, if processing is entrusted to such person;7) the list of actions with PD to which consent is given, a general description of the methods used by the Corporation to process PD;8) the period during which the consent of the PD subject is valid, as well as the method of its revocation, unless otherwise established by federal law;9) the signature of the PD subject;10) the date of signing the consent of the PD subject.
    5. The Corporation obtains PD directly from the PD subject or from his/her legal representatives vested with the relevant authority.
    6. Employees of the Corporation are obliged to explain to PD subjects the legal consequences of a refusal to provide their PD.
    7. The Corporation prohibits the processing of special categories of personal data concerning race, nationality, political views, religious or philosophical beliefs, health status, intimate life, biometric personal data, without the written consent of the personal data subject to the processing of special categories of personal data.
    8. Personal data may not be used for the purpose of causing property or moral damage to the PD subject, or hindering the exercise of his/her rights and freedoms.
    9. The processing of personal data for the purposes provided for in this Policy is carried out using automation tools.
    10. The Corporation has the right to entrust the processing of PD to another person with the consent of the PD subject, unless otherwise provided by the Federal Law, on the basis of an agreement concluded with this person, or through the adoption of a relevant act by a state or municipal authority. A person processing personal data on behalf of the Corporation is obliged to comply with the principles and rules of personal data processing provided for by the Federal Law. The Corporation’s instructions must specify the list of actions (operations) with personal data to be performed by the person processing personal data, and the purposes of processing; such person must be obliged to maintain the confidentiality of personal data and ensure the security of personal data during their processing, and the requirements for the protection of the personal data being processed must be specified in accordance with Article 19 of the Federal Law.
    11. If the Corporation entrusts the processing of personal data to another person, the Corporation bears responsibility to the subject of personal data for the actions of the said person. A person processing personal data on behalf of the Corporation bears responsibility to the Corporation.
    12. The Corporation does not process biometric personal data and does not carry out cross-border transfer of personal data.
  6. Period of processing and storage of personal data.
    1. The period of processing and storage of PD is determined in accordance with the Federal Law.
    2. Processing of PD begins from the moment the personal data is received into the personal data information system and terminates:- in the event that unlawful actions with PD are identified, within a period not exceeding three business days from the date of such identification, the Corporation eliminates the violations committed. If it is impossible to eliminate the violations committed, the Corporation, within a period not exceeding three business days from the date the unlawfulness of the actions with PD was identified, destroys the PD. The Corporation notifies the PD subject or his/her legal representative of the elimination of the violations committed or of the destruction of the personal data, and if the request was sent by the authorized body for the protection of the rights of PD subjects, the Corporation also notifies the said body;- in the event that the purpose of PD processing is achieved or the need to achieve these purposes is lost, unless otherwise provided by the current legislation, the Corporation immediately terminates the processing of PD and destroys the relevant PD within a period not exceeding three business days from the date the purpose of PD processing is achieved, and notifies the PD subject or his/her legal representative thereof, and if the request was sent by the authorized body for the protection of the rights of PD subjects, the Corporation also notifies the said body;- in the event that the PD subject revokes his/her consent to the processing of his/her PD, the Corporation terminates the processing of personal data and, if the retention of PD is not required for the purposes of PD processing, destroys the PD within a period not exceeding three business days from the date of receipt of the said revocation. The Corporation notifies the PD subject of the destruction of the PD;- in the event of termination of the Corporation’s activity as a legal entity.
    3. Information on PD subjects processed by the Corporation is stored on a server owned by the Corporation.
    4. PD is stored in a manner that precludes its loss or unlawful use.
    5. PD is stored in a form that allows the PD subject to be identified, for no longer than the purposes of PD processing require, unless the storage period for PD is established by the Federal Law or by a contract to which the PD subject is a party. The processed PD is subject to destruction or depersonalization upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by the Federal Law.
    6. In the event of reorganization or liquidation of the Corporation, the accounting and preservation of documents and the procedure for their transfer to state storage is carried out in accordance with the rules provided for by the legislation of the Russian Federation.
    7. Storage of data in electronic form:
      1. Storage of PD in electronic form is carried out on servers and/or other infrastructure that meets the requirements of the Federal Law.
      2. The Corporation appoints a person responsible for organizing the processing of PD in electronic form (hereinafter referred to as the information system administration).
      3. The information system administration takes the necessary organizational and technical measures to protect the personal data of the PD subject in electronic form from unlawful or accidental access, destruction, modification, blocking, copying, distribution, as well as from other unlawful actions of third parties.
  7. Transfer of personal data.
    1. The Corporation does not provide or disclose information containing personal data of PD subjects to third parties without their written consent, except in cases where this is necessary to prevent a threat to life and health, as well as in cases established by the current legislation.
    2. Personal data of the PD subject may be transferred without his/her consent:- to judicial authorities in connection with the administration of justice;- to state security authorities;- to prosecutor’s office authorities;- to police authorities;- to investigative authorities;- to other authorities and organizations in cases established by the current legislation.
  8. Procedure for the destruction of personal data.
    1. The persons responsible for the destruction of PD are authorized persons appointed by order of the Chairman of the Management Board of the Corporation. For each structural unit of the Corporation (participating in the processing of personal data), its own responsible person is appointed for the destruction of PD within that structural unit.
    2. Upon the occurrence of any event necessitating the destruction of PD, the persons responsible for organizing the destruction of PD are obliged to:- establish the list, type, name, details and other information of the media on which the PD subject to destruction is located;- determine the technology (method) for the destruction of PD;- determine the technical (material, software and other) means by which the destruction of PD will be carried out;- send a memo to the Chairman of the Management Board with information on which PD, by what method and within what timeframe are subject to destruction;- within the business day following the day the memo is endorsed by the Chairman of the Management Board of the Corporation, take measures to destroy the PD;- draw up the relevant Certificate of Destruction of PD (and/or material carriers of PD) and submit this Certificate for signature to the Chairman of the Management Board of the Corporation;- in cases provided for by this Policy, notify the PD subject and/or the authorized body of the destruction of PD.
  9. Rights of the subject of personal data.
    1. The subject of personal data has the right to receive information relating to the processing of his/her personal data, including information containing:1) confirmation of the fact of processing of personal data by the Corporation;2) legal grounds and purposes of personal data processing;3) purposes and methods of personal data processing used by the Corporation;4) the name and location of the operator (the Corporation), information on persons (other than employees of the Corporation) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Corporation or on the basis of the current legislation;5) the personal data being processed relating to the relevant subject of personal data, and the source of their receipt, unless another procedure for providing such data is provided for by the Federal Law;6) the terms of processing of personal data, including the terms of their storage;7) the procedure for the exercise by the subject of personal data of the rights provided for by the current legislation;8) information on the cross-border transfer of data carried out or intended;9) the name or surname, first name, patronymic (if any) and address of registration and actual place of residence of the person or the location of the operator processing personal data on behalf of the Corporation;10) other information provided for by the current legislation.
    2. The right of the subject of personal data to access his/her personal data may be limited in accordance with the current legislation, including if:1) the processing of personal data, including personal data obtained as a result of operational-investigative, counter-intelligence and intelligence activities, is carried out for the purposes of national defense, state security and the maintenance of law and order;2) the processing of personal data is carried out by authorities that have detained the subject of personal data on suspicion of committing a crime, or have brought charges against the subject of personal data in a criminal case, or have applied a preventive measure to the subject of personal data before charges are brought, except in cases provided for by the criminal procedure legislation of the Russian Federation where the suspect or the accused is permitted to familiarize himself/herself with such personal data;3) the processing of personal data is carried out in accordance with the legislation on combating the legalization (laundering) of proceeds from crime and the financing of terrorism;4) access of the subject of personal data to his/her personal data violates the rights and legitimate interests of third parties;5) the processing of personal data is carried out in cases provided for by the legislation of the Russian Federation on transport security, for the purposes of ensuring the safe functioning of the transport complex, and protecting the interests of the individual, the Corporation and the state in the field of the transport complex from acts of unlawful interference.
    3. The information specified in clause 9.1. of this Policy must be provided to the subject of personal data by the Corporation in an accessible form, and must not contain personal data relating to other subjects of personal data, except in cases where there are legal grounds for the disclosure of such personal data.
    4. The information specified in clause 9.1. of this Policy is provided to the subject of personal data or his/her representative by the Corporation upon application, or upon receipt of a request from the subject of personal data or his/her representative. The request must contain the number of the main identity document of the subject of personal data or his/her representative, information on the date of issue of the said document and the authority that issued it, information confirming the participation of the subject of personal data in relations with the Corporation (contract number, date of conclusion of the contract, conditional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Corporation, and the signature of the subject of personal data or his/her representative.
    5. If the information specified in clause 9.1. of this Policy, as well as the personal data being processed, was provided for review to the subject of personal data at his/her request, the subject of personal data has the right to personally apply to the Corporation again, or to send a repeated request to the Corporation, in order to obtain the information specified in clause 9.1. of this Policy and to familiarize himself/herself with such personal data, no earlier than thirty days after the initial application or the sending of the initial request, unless a shorter period is established by laws, regulatory legal acts adopted in accordance with them, or an agreement to which the subject of personal data is a party, or a beneficiary or guarantor.
    6. The subject of personal data has the right to apply to the Corporation again, or to send a repeated request to the Corporation, in order to obtain the information specified in clause 9.1. of this Policy, as well as to familiarize himself/herself with the personal data being processed, before the expiration of the period specified in clause 9.5. of this Policy, in the event that such information and (or) the personal data being processed was not provided to him/her for review in full based on the results of consideration of the initial application. A repeated request, along with the information specified in clause 9.4. of this Policy, must contain a justification for sending the repeated request.
    7. The Corporation has the right to refuse the subject of personal data the fulfillment of a repeated request that does not comply with the conditions of this Policy. Such refusal must be reasoned. The burden of providing evidence of the validity of the refusal to fulfill a repeated request lies with the Corporation.
    8. The subject of personal data has the right to receive the information specified in clause 9.1 of this Policy. The subject of personal data has the right to demand that the Corporation clarify his/her personal data, block it or destroy it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained or is not necessary for the stated purpose of processing, as well as to take the measures provided for by the Federal Law to protect his/her rights.
    9. Consent to the processing of personal data may be revoked by submitting a corresponding written application to the Corporation no later than 30 (thirty) calendar days before the revocation of consent takes effect. An application for the revocation of consent is submitted personally by the PD subject or his/her legal representative, with the provision of identity documents and a power of attorney executed in accordance with the procedure established by law. If the application is granted, the Corporation terminates the processing of PD. In the event of revocation of consent to the processing of PD, the Corporation has the right to continue processing PD without the consent of the subject of personal data if there are grounds specified in clauses 2–11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of the Federal Law.
    10. Applications (requests, statements) of PD subjects are recorded in the log of PD applications. Responses to applications (requests, statements) of PD subjects are stored for 1 (one) year from the date they are sent (delivered) to the PD subject. The log is kept in electronic form.
  10. Obligations of the Corporation when working with personal data.
    1. When collecting personal data, the Corporation is obliged, upon the request of the subject of personal data, to provide him/her with the information provided for by this Policy.
    2. If the provision of personal data is mandatory in accordance with the Federal Law, the Corporation is obliged to explain to the subject of personal data the legal consequences of a refusal to provide his/her personal data.
    3. If personal data was not obtained from the subject of personal data, the Corporation, except in the cases provided for by Part 4 of Article 18 of the Federal Law and clause 10.4 of this Policy, is obliged, prior to commencing the processing of such personal data, to provide the subject of personal data with the following information:1) the name or surname, first name, patronymic and address of the Corporation or its representative;2) the purpose of personal data processing and its legal basis;3) the intended users of the personal data;4) the established rights of the subject of personal data;5) the source of the receipt of the personal data.
    4. The Corporation is exempt from the obligation to provide the subject of personal data with the information provided for in clause 10.3 of this Policy in the following cases:1) the subject of personal data has previously been notified by the Corporation of the processing of his/her personal data by the relevant operator;2) the personal data was obtained by the Corporation on the basis of the Federal Law or in connection with the performance of an agreement to which the subject of personal data is a party, or a beneficiary or guarantor;3) the personal data was made publicly available by the subject of personal data or was obtained from a publicly available source;4) the Corporation processes personal data for statistical or other research purposes, for the professional activity of a journalist or for scientific, literary or other creative activity, provided that the rights and legitimate interests of the subject of personal data are not violated;5) the provision of the information specified in clause 10.3. of this Policy to the subject of personal data violates the rights and legitimate interests of third parties.
    5. When collecting personal data, including via the "Internet" information and telecommunications network, the Corporation is obliged to ensure the recording, systematization, accumulation, storage, clarification (updating, modification) and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for the cases specified in clauses 2, 3, 4 and 8 of Part 1 of Article 6 of the Federal Law.
    6. The Corporation is obliged to inform the subject of personal data or his/her representative of the availability of personal data relating to the relevant subject of personal data, and to provide the opportunity to familiarize himself/herself with such personal data upon the application of the subject of personal data or his/her representative, or within thirty days from the date of receipt of the request of the subject of personal data or his/her representative.
    7. In the event of a refusal to provide information on the availability of personal data on the relevant subject of personal data, or personal data, to the subject of personal data or his/her representative upon their application or upon receipt of a request from the subject of personal data or his/her representative, the Corporation is obliged to give a reasoned response in writing, containing a reference to the provision of the norms of the Federal Law "On Personal Data" or another federal law that serves as the basis for such refusal, within a period not exceeding thirty days from the date of application of the subject of personal data or his/her representative, or from the date of receipt of the request of the subject of personal data or his/her representative.
    8. The Corporation is obliged to provide, free of charge, the subject of personal data or his/her representative with the opportunity to familiarize himself/herself with the personal data relating to that subject of personal data. Within a period not exceeding seven business days from the date the subject of personal data or his/her representative submits information confirming that the personal data is incomplete, inaccurate or outdated, the operator is obliged to make the necessary amendments to it. Within a period not exceeding seven business days from the date the subject of personal data or his/her representative submits information confirming that such personal data was unlawfully obtained or is not necessary for the stated purpose of processing, the operator is obliged to destroy such personal data. The operator is obliged to notify the subject of personal data or his/her representative of the amendments made and the measures taken, and to take reasonable measures to notify third parties to whom the personal data of this subject was transferred.
    9. In the event that unlawful processing of personal data is identified upon the application of the subject of personal data or his/her representative, or upon the request of the subject of personal data or his/her representative or of the authorized body for the protection of the rights of subjects of personal data, the Corporation is obliged to block the unlawfully processed personal data relating to that subject of personal data, or to ensure its blocking (if the processing of personal data is carried out by another person acting on behalf of the Corporation) from the moment of such application or receipt of the said request, for the period of verification. In the event that inaccurate personal data is identified upon the application of the subject of personal data or his/her representative, or upon their request or the request of the authorized body for the protection of the rights of subjects of personal data, the Corporation is obliged to block the personal data relating to that subject.

Personal data

Notifications

My appeals

Favorites