Privacy Policy

1. General Provisions

This Privacy Policy governs the collection, storage, processing, and transfer of personal data of employees and authorised users of the ElbrusTech corporate intranet portal (the "Portal"), operated by ООО ElbrusTech (elbrustech.ru).

By accessing the Portal, you confirm that you have read, understood, and agree to the terms set forth in this Policy, in accordance with Federal Law No. 152-FZ "On Personal Data" of the Russian Federation.

2. Data Collected

The Portal collects only the minimum data necessary to provide its functionality:

• Identity data: full name, corporate email address, employee ID.
• Authentication data: encrypted password hash (never stored in plain text), session tokens.
• Access logs: IP address, browser type, timestamp of login/logout events.
• Usage data: pages accessed, documents viewed, actions performed within the Portal.
• HR data: department, job title, manager — sourced from the HR system.

3. Purpose of Processing

Collected data is used exclusively for the following purposes:

• Authentication and access control to corporate resources.
• Ensuring information security and audit requirements (access logs).
• Providing portal features: document management, directory, IT support.
• Compliance with labour law and internal corporate regulations.
• Incident investigation and technical support.

Data is not used for marketing, profiling, or any commercial purposes.

4. Data Storage and Security

All personal data is stored on servers located within the territory of the Russian Federation, in compliance with Article 18 of Federal Law No. 152-FZ.

Technical and organisational security measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access control — access is granted on a need-to-know basis.
• Passwords stored exclusively as cryptographic hashes (bcrypt/argon2).
• Regular security audits and penetration testing.
• Automatic session termination after inactivity.

5. Data Retention

• Active employees: data retained for the duration of employment plus 5 years.
• Access logs: retained for 1 year for security and audit purposes.
• Former employees: data anonymised or deleted upon expiry of the retention period.
• Password reset tokens: automatically invalidated after 30 minutes.

6. Third-Party Sharing

Personal data is not transferred to third parties, except where required by applicable Russian law, a court order, or explicit written consent of the data subject. Internal transfers between ООО ElbrusTech systems are governed by internal data-sharing agreements.

7. Your Rights

As a data subject under Federal Law No. 152-FZ, you have the right to:

• Request confirmation of whether your personal data is being processed.
• Access a copy of your personal data held by the company.
• Request correction of inaccurate or incomplete data.
• Request deletion of data, subject to legal and contractual obligations.
• Object to processing in cases provided by law.

To exercise your rights, submit a written request to: dpo@elbrustech.ru (Data Protection Officer).

8. Cookies and Session Data

The Portal uses session cookies solely for authentication purposes. These cookies are HttpOnly, Secure, and SameSite=Strict, and expire when the browser is closed or the session timeout is reached. No tracking or third-party analytics cookies are used.

9. Changes to This Policy

ООО ElbrusTech reserves the right to update this Privacy Policy. Changes are communicated to employees via the Portal's announcement system. Continued use of the Portal constitutes acceptance of the updated Policy.

10. Contact

For questions regarding this Policy or the processing of your personal data, contact:

• Data Protection Officer: dpo@elbrustech.ru
• Legal address: ООО ElbrusTech, г. Москва, Россия
• Website: elbrustech.ru