Personal data processing and protection policy in
SMP RACING
autonomous non-profit organization for the development of motorsport

1. General provisions
   1. This Policy of the autonomous non-profit organization for the development of motorsport SMP RACING regarding processing of personal data (hereinafter referred to as the “Policy”) has been developed in compliance with the requirements of paragraph 2 of Part 1 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter referred to as the Law on Personal Data) in order to ensure the protection of human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy, personal and family secrets.
   2. The Policy applies to all personal data processed by the autonomous non-profit organization for the development of motorsport SMP RACING (hereinafter referred to as the Operator, SMP RACING).
   3. The Policy applies to the relations concerning personal data processing that arose with the Operator both before and after the approval of this Policy.
   4. In compliance with the requirements of Part 2 of Article 18.1 of the Law on Personal Data, this Policy is published in free access on the Internet information and telecommunications network on the Operator's website.
   5. The following terms, definitions and abbreviations shall be used in this Personal data processing policy (hereinafter referred to as the “Policy”): br>

      personal data

      - any information related directly or indirectly to an identified or identifiable individual (personal data subject);

      
      

      personal data processor (operator)

      - a state body, a municipal body, a legal entity or an individual, independently or jointly with other persons organizing and (or) processing personal data, as well as determining the purposes of processing personal data, the state and nature of personal data to be processed, as well as actions (operations) performed with personal data;

      
      

      personal data processing

      - Any action (operation) or set of actions (operations) conducted with personal data with or without the use of automation facilities. Personal data processing includes:

      • collection;
      • recording;
      • systematization;
      • accumulation;
      • storage;
      • validation (updating, modification);
      • extraction;
      • use;
      • transfer (distribution, provision, access);
      • depersonalization;
      • blocking;
      • deletion;
      • destruction;

      automated personal data processing

      - processing of personal data by means of computer technology;

      
      

      personal data distribution

      - actions aimed at disclosure of personal data to indefinite persons;

      
      

      personal data provision

      - actions aimed at disclosing personal data to a certain person or a number of certain persons;

      
      

      personal data blocking

      - temporary termination of personal data processing (except in cases where processing is necessary to clarify personal data);

      
      

      personal data destruction

      - actions that make impossible to restore the content of personal data in the personal data information system and (or) that result in the material carriers of personal data being destroyed;

      
      

      personal data depersonalization

      - actions as a result of which it becomes impossible to determine the identity of personal data to a specific personal data subject without using additional information;

      
      

      personal data information system

      - a set of personal data contained in databases and information technologies and technical means that ensure their processing;

      
      

      cross-border transfer of personal data

      - transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.

   6. Main rights and obligations of the Operator.
      1. The operator has the right to:
         1. independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations provided for by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws;
         2. to entrust the processing of personal data to another person with the consent of the subject of personal data, unless otherwise provided by federal law, based on a contract concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided for by the Law on Personal Data;
         3. if the subject of personal data withdraws consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal Data.
      2. The Operator shall:
         1. organize the processing of personal data in accordance with the requirements of the Law on Personal Data;
         2. respond to requests and requests from personal data subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
         3. report to the authorized body for the protection of the rights of personal data subjects (Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)) and provide the necessary information upon its request within 30 days from the date of such a request being received.
   7. Main rights of the personal data subject. Personal data subject has the right:
      1. receive information concerning the processing of his personal data, except in cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form, and it should not contain personal data related to other personal data subjects, except in cases where there are legitimate grounds for disclosure of such personal data. The list of information and the procedure for obtaining it is stipulated by the Law on Personal Data;
      2. require the operator to clarify his personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing, as well as take measures provided by law to protect their rights;
      3. to put forward the condition of prior consent when processing personal data in connection with promotion of goods, works and services on the market;
      4. appeal to Roskomnadzor or in court against illegal actions or inaction of the Operator when processing his/her personal data.
   8. Control over the fulfillment of the requirements of this Policy is carried out by an authorized person appointed by the Operator to organize personal data processing.
   9. Responsibility for violation of the requirements of the legislation of the Russian Federation and regulations of SMP RACING connected with processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.
2. Purposes of personal data collection
   1. The processing of personal data is limited to the achievement of specific, predetermined and legitimate goals. Processing of personal data incompatible with the purposes of personal data collection is not allowed.
   2. Only personal data that meet the purposes of their processing are subject to processing.
   3. The processing of personal data by the Operator is carried out for the following purposes:
      • ensuring compliance with the Constitution of the Russian Federation, federal laws and other regulatory legal acts of the Russian Federation;
      • registration and participation in competitions held by SMP RACING, including simracing competitions.
   4. The processing of personal data may be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts.
3. Legal grounds for processing personal data
   1. The legal basis for the processing of personal data is a set of regulatory legal acts, pursuant to which and in accordance with which the Operator processes personal data, including:
      • The Constitution of the Russian Federation;
      • Civil Code of the Russian Federation;
      • The operator processes the subject's personal data only if they are filled in and/or sent by the subject independently through special forms at https://smpesports.ru/. By filling out the appropriate forms and/or sending their personal data to the Operator, the subject expresses his consent to this Policy;
      • other by-laws and federal laws of the Russian Federation defining the cases and features of data processing, as well as the Charter and local acts of the Operator.
   2. The processing of personal data may be carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts.
      • consent of personal data subjects to the processing of their personal data.
4. Scope and categories of personal data processed,
   categories of personal data subjects
   1. The content and volume of the processed personal data must correspond to the stated processing purposes provided for in section 2 of this Policy. The processed personal data should not be redundant in relation to the stated purposes of their processing.
   2. The Operator may process the following personal data of subjects:
      • last name, first name, patronymic;
      • steamID
      • First name in Russian
      • First name in English
      • Last name in Russian
      • FLast name in English
      • Telephone number
      • Email
      • Date of birth
      • Country
      • City
      • Photo
      • Passport scan page 2-3 and registration page
   3. The operator does not process biometric personal data (information that characterizes the physiological and biological characteristics of a person, on the basis of which he/she can be identified).
   4. The Operator does not process special categories of personal data concerning race, nationality, political views, religious or philosophical beliefs, health status, intimate life, except in cases provided for by the legislation of the Russian Federation.
5. Procedure and conditions of personal data processing
   1. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation.
   2. The processing of personal data is carried out with the consent of personal data subjects to the processing of their personal data, as well as without it in cases provided for by the legislation of the Russian Federation.
   3. The operator performs both manual and automated processing of personal data.
   4. The Operator's employees, whose job responsibilities include the processing of personal data, are allowed to process personal data.
   5. The processing of personal data is carried out by means of:
      • receiving personal data in electronic format after filling out special forms located on the websites of the tournament organizers
   6. Disclosure to third parties and dissemination of personal data without the consent of the subject of personal data is not allowed, unless otherwise provided by federal law. Consent to the processing of personal data authorized by the subject of personal data for distribution is issued separately from other consents of the subject of personal data to the processing of his personal data.
   7. The transfer of personal data to the bodies of inquiry and investigation and to other authorized executive authorities and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
   8. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, distribution and other unauthorized actions, including:
      • identifies threats to the security of personal data during processing;
      • adopts local regulations and other documents regulating relations in connection with personal data processing and protection;
      • appoints persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;
      • creates the necessary conditions for working with personal data;
      • organizes accounting of documents containing personal data;
      • organizes work with information systems in which personal data is processed;
      • хранит personal data in conditions under which their safety is ensured and unauthorized access to them is excluded;
      • organizes training of the Operator's employees who process personal data.
   9. The operator stores personal data in a form that allows determining the subject of personal data, no longer than the purposes of personal data processing require, unless the period of personal data storage is established by federal law or legal contract.
   10. When collecting personal data, including through the Internet information and telecommunications network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for the cases specified in the Law on Personal Data.
6. Updating, correcting, deleting and destroying
   personal data, responses to the requests of subjects
   to access personal data
   1. Confirmation of the fact of personal data processing by the Operator, the legal grounds and purposes of personal data processing, as well as other information specified in Part 7 of Article 14 of the Law on Personal Data, are provided by the Operator to the personal data subject or his representative when contacting or receiving a request from the personal data subject or his representative.
      The information provided does not include personal data relating to other personal data subjects, except in cases where there are legitimate grounds for the disclosure of such personal data.
      The request must contain:
      • the number of the main identity document of the personal data subject or his representative, information about the date of issue of the specified document and the issuing authority;
      • information confirming the participation of the subject of personal data in relations with the Operator (contract number, date of conclusion of the contract, conditional verbal designation and (or) other information), or information otherwise confirming the fact of processing of personal data by the Operator;
      • signature of the personal data subject or his/her representative.
      The request can be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
      If the personal data subject's request does not reflect all the necessary information in accordance with the requirements of the Law on Personal Data, or the subject does not have access rights to the requested information, then a reasoned refusal is sent to him.
      The right of the subject of personal data to access his personal data may be restricted in accordance with Part 8 of art. 14 of the Law on Personal Data, including if the access of the personal data subject to his personal data violates the rights and legitimate interests of third parties.
   2. If inaccurate personal data is detected when the personal data subject or his/her representative is contacted, or at their request or at the request of Roskomnadzor, the Operator blocks personal data related to this personal data subject from the moment of such request or receipt of the specified request for the verification period, if the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.
      In case of confirmation of the fact of inaccuracy of personal data, the Operator, based on the information provided by the subject of personal data or his representative or Roskomnadzor, or other necessary documents, clarifies personal data within seven working days from the date of submission of such information and removes the blocking of personal data.
   3. In case of detection of unlawful processing of personal data when contacting (requesting) a personal data subject or his representative or Roskomnadzor, the Operator blocks the unlawfully processed personal data relating to this personal data subject from the moment of such request or receipt of the request.
   4. Upon achievement of the purposes of personal data processing, as well as in case of withdrawal of consent to their processing by the subject of personal data, personal data are subject to destruction in case:
      • otherwise is not provided for by the contract, the party to which, the beneficiary or the guarantor of which is the subject of personal data;
      • the operator is not entitled to process without the consent of the subject of personal data on the grounds provided for by the Law on Personal Data or other federal laws;
      • otherwise is not provided for by another agreement between the Operator and the subject of personal data.