Personal Data Processing Policy

1. General provisions

1.1. Data controller: Joint Stock Company «Engineering center of railway transport» (ECRT), TIN (Russia) 7708357508, registered address: 121205, Moscow, Skolkovo Innovation Center, Bolshoy Boulevard 40; business address: 121205, Moscow, Skolkovo, Bolshoy Boulevard 40, Amaltea Business Center, floor 3, sector A; e-mail: info@ecrt.ru, phone: +7 (495) 909-17-99.

1.2. This Policy is prepared in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» and other applicable regulations of the Russian Federation.

1.3. The Policy applies to all personal data that the controller may receive from Website users when visiting the Website, submitting feedback forms, sending job applications, and when cookies are used.

1.4. Key terms used in this Policy:

• personal data — any information relating to an identified or identifiable individual;
• processing — any action (operation) performed with personal data;
• controller — ECRT, organising and/or carrying out personal data processing;
• user — a visitor of the Website;
• cookie — a small piece of data sent by the Website and stored on the user device.

2. Processing principles

2.1. Personal data is processed lawfully and fairly, limited to specific and legitimate purposes, and not processed in a manner incompatible with those purposes.

2.2. The controller processes only data adequate and relevant to the stated purposes and ensures accuracy and, where necessary, updates of such data.

3. Purposes of processing

3.1. Personal data is processed for the following purposes:

• ensuring Website operation and user access to its services;
• handling enquiries submitted via Website feedback forms;
• reviewing job applications and candidate responses;
• collecting anonymised visit statistics using cookies and web analytics services;
• compliance with applicable laws of the Russian Federation.

4. Categories of personal data

4.1. Depending on user actions on the Website, the following categories of personal data may be processed:

• full name;
• e-mail address;
• phone number;
• information provided in messages or CVs;
• technical data: IP address, browser and device information, cookies, visit date and time, pages viewed, referral source.

4.2. The controller does not process special categories of personal data or biometric personal data through the Website except where expressly required by Russian law.

5. Legal grounds and conditions

5.1. Processing is based on data subject consent, contractual necessity, and other grounds provided by Article 6 of Federal Law No. 152-FZ.

5.2. Consent may be expressed by submitting a Website form, sending an e-mail to the controller, or accepting cookie terms via the Website banner.

5.3. Users may withdraw consent by sending a request to info@ecrt.ru.

6. Cookies and web analytics

6.1. The Website uses cookies — small text files stored on the user device.

6.2. Strictly necessary cookies ensure proper Website operation and storage of the user cookie preference.

6.3. Analytics cookies and Yandex.Metrica (Yandex LLC, Russia) load when a user visits the Website (including before clicking “Accept” on the cookie banner). The service collects aggregated visit statistics and may include Session Replay (Webvisor) for usability analysis. See: https://yandex.ru/legal/confidential/

6.4. The Website also embeds third-party elements: a Yandex Map on the contacts page and a Dream Job rating widget in the footer. When they load, the user’s browser contacts those services; they may receive technical data (including IP address and browser details) and use their own cookies under their policies: https://yandex.ru/legal/confidential/ , https://dreamjob.ru/privacy

6.5. Users may delete cookies and change browser settings. This does not disable the Yandex Map or the Dream Job widget.

7. Disclosure to third parties

7.1. The controller may engage processors under data processing agreements subject to applicable law.

7.2. Disclosure to public authorities is made where required by Russian law.

7.3. The controller does not carry out cross-border transfer of Website users' personal data except where expressly required by Russian law.

8. Retention, storage and localization

8.1. Personal data is processed until processing purposes are fulfilled or consent is withdrawn, unless a longer period is required by law or contract.

8.2. Upon fulfilment of purposes or withdrawal of consent, personal data is destroyed or anonymised unless otherwise required by law.

8.3. Recording, storage and processing of personal data of Russian citizens uses databases located in the Russian Federation.

9. Data subject rights

9.1. Data subjects may request information about processing, rectification, blocking or deletion of data, withdrawal of consent, and exercise other rights under Federal Law No. 152-FZ.

9.2. Send requests to info@ecrt.ru with your name, contact details and the nature of the request. The controller will respond within statutory time limits.

10. Security measures

10.1. The controller implements legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, disclosure or other unlawful actions.

11. Final provisions

11.1. The controller may amend this Policy. The current version is published on the Website with the revision date.

11.2. Continued use of the Website after publication of an updated Policy constitutes acceptance of the changes unless otherwise required by Russian law.

11.3. Personal data enquiries: info@ecrt.ru, +7 (495) 909-17-99.