1. General provisions

1.1. This Confidentiality and Personal Data Processing Policy (hereinafter the Policy) establishes the basic principles, purposes, conditions and procedures for processing personal data, and requirements for maintaining the confidentiality of information received by the Private Institution Interecoms Quality Systems Certification Centre (hereinafter the Operator or the Centre) in the course of its activities.

1.2. The Policy has been developed in accordance with the requirements of:

• the Constitution of the Russian Federation;
• Federal Law No. 152-FZ of 27 July 2006 on Personal Data;
• Federal Law No. 149-FZ of 27 July 2006 on Information, Information Technologies and Information Protection;
• Federal Law No. 63-FZ of 6 April 2011 on Electronic Signatures, where applicable;
• Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012;
• Resolution of the Government of the Russian Federation No. 687 of 15 September 2008;
• GOST R ISO/IEC 17021-1-2025 concerning the confidentiality of information obtained during management system certification;
• other applicable Russian regulatory legal acts and the Centre's internal documents.

1.3. The Centre is a personal data operator; independently or jointly with other persons, it organises and/or carries out processing, determines its purposes, the personal data involved and the operations performed on them.

1.4. The main purpose of this Policy is to safeguard human and civil rights and freedoms during personal data processing, including the rights to privacy and personal and family confidentiality, and prevent unlawful disclosure of confidential information.

1.5. The Policy applies to the Centre's employees, contracted experts and auditors, commission and committee members, contractors and other persons obtaining access to information in performing their duties.

1.6. The Policy is a publicly available document published on the official website https://www.qs.ru. https://www.qs.ru.

2. Information about the Operator

2.1. Full name:

Private Institution Interecoms Quality Systems Certification Centre.

Abbreviated name: PI Interecoms QSCC.

2.2. Registered address:

Room 22, Premises VIII, 28 Petrovsko-Razumovsky Proyezd, Savyolovsky Municipal District, intracity territory of Moscow, 127287, Russian Federation.

2.3. Postal address:

28 Petrovsko-Razumovsky Proyezd, Moscow, 127287, Russian Federation.

2.4. Contact details:

• Official website: https://www.qs.ru https://www.qs.ru
• Email: account@qs.ru
• Telephone: +7 (495) 970-79-65.

2.5. The person responsible for organising personal data processing is appointed by an order of the Centre's Director.

3. Scope of the Policy

3.1. This Policy applies to personal data and confidential information received by the Centre in carrying out the following activities:

a) management system certification, including:

• quality management systems;
• environmental management systems;
• occupational health and safety management systems;
• information security management systems;
• quality management systems of organisations operating in the medical devices sector;
• integrated management systems;

b) management system audits;

c) professional and public accreditation of educational programmes;

d) assessment of organisations' experience and business reputation, including determination of their business reputation index;

e) handling applications, enquiries, complaints and appeals;

f) concluding and performing contracts;

g) maintaining registers, accounting data and records of completed work;

h) supporting the Centre's operations, including personnel, contractual and administrative support;

i) ensuring operation of the Centre's official website.

3.2. The Policy applies to personal data obtained directly from data subjects, organisations' authorised representatives, documents submitted for assessment, and other sources where lawful grounds exist.

3.3. Personal data are processed by automated and non-automated means.

4. Basic principles of personal data processing

4.1. Personal data are processed lawfully and fairly.

4.2. Processing is limited to achieving specific, predetermined and lawful purposes.

4.3. Processing incompatible with the purposes for which personal data were collected is prohibited.

4.4. The content and volume of data processed must correspond to the stated purposes. Processing excessive personal data is prohibited.

4.5. Processing ensures personal data are accurate, sufficient and, where necessary, up to date.

4.6. Databases containing personal data processed for mutually incompatible purposes must not be combined.

4.7. Personal data are retained in a form permitting identification of the subject for no longer than required for the processing purposes, unless Russian legislation or a contract establishes a different period.

4.8. Once processing purposes have been achieved, personal data are destroyed or anonymised unless otherwise provided by Russian legislation.

5. Categories of data subjects and personal data processed

5.1. Depending on its activities, the Centre may process personal data concerning:

• current and former employees of the Centre;
• applicants for vacant positions;
• auditors, experts, technical specialists and other contracted persons;
• representatives of applicant organisations and clients;
• representatives of certified organisations;
• representatives of educational organisations;
• employees and experts involved in professional and public accreditation procedures;
• representatives of organisations undergoing experience and business reputation assessment;
• persons providing information and supporting documents during assessment procedures;
• commission and committee members;
• representatives of counterparties;
• persons submitting complaints, appeals and enquiries;
• users of the official website.

5.2. Depending on the processing purposes, the following personal data may be used:

5.2.1. General identification and contact details:

• surname, first name and patronymic;
• position;
• organisation and organisational unit name;
• business and contact telephone numbers;
• email address;
• correspondence address;
• information on the organisation representative's authority;
• signature, including an electronic signature where provided for by law.

5.2.2. Employee and job applicant data:

• date of birth;
• identity document details where processing is necessary;
• education details;
• qualifications and specialisation;
• employment history, length of service and professional experience;
• continuing professional development and vocational training information;
• personnel records;
• information necessary to comply with labour, tax and other applicable legislation.

5.2.3. Auditor, expert and specialist data:

• education and qualification details;
• professional competencies;
• training records;
• work experience;
• participation in audits and assessments;
• competence evaluation results;
• information confirming impartiality and compliance with confidentiality requirements;
• information on appointment to perform specific work.

5.2.4. Data processed during management system certification:

• full names and positions of client representatives;
• information on managers and process owners;
• contact details;
• personnel competence information necessary for auditing;
• information on employees' involvement in management system processes;
• information in applications, audit programmes and plans, reports, formal records and other certification records.

5.2.5. Data processed during professional and public accreditation of educational programmes:

• full names of the educational organisation's management and responsible representatives;
• positions and contact details;
• information on teaching and academic staff;
• education, qualifications, academic degrees and titles;
• professional experience and length of service;
• information on staff involvement in delivering the programmes assessed;
• data in submitted self-evaluation materials and documents demonstrating programme quality.

Students' and graduates' personal data are processed only as necessary for assessment and where an appropriate legal basis exists. Anonymised or aggregated information is used wherever possible.

5.2.6. Data processed during experience and business reputation assessment:

• full names of managers and authorised representatives;
• positions and contact details;
• managers' and specialists' professional experience;
• qualification details;
• length-of-service data;
• involvement in completed projects and contracts;
• information in documents substantiating experience and business reputation;
• other information required by the assessment methodology, where lawful grounds for processing exist.

5.3. When an enquiry is submitted through the website, the user's name, contact details and enquiry content may be processed.

5.4. The Centre does not intentionally collect special categories of personal data or biometric data through public website forms.

5.5. Where special categories of personal data must be processed for personnel administration, the Centre ensures compliance with the specific requirements of Russian legislation.

5.6. The Centre takes measures to exclude unnecessary personal data from client materials for the purposes of the relevant assessment procedure.

6. Purposes and legal grounds for personal data processing

6.1. Personal data are processed for:

• handling enquiries and applications;
• concluding and performing contracts;
• organising and conducting management system certification;
• performing audits;
• conducting professional and public accreditation of educational programmes;
• conducting experience and business reputation assessment;
• producing and retaining assessment results;
• maintaining registers and mandatory records;
• handling complaints and appeals;
• evaluating and confirming personnel competence;
• complying with labour and other legislation;
• ensuring information security and website operation.

6.2. Legal grounds for processing are:

a) the data subject's consent;

b) the need to perform a contract to which the subject is a party, beneficiary or guarantor, or conclude a contract at their initiative;

c) the need to fulfil obligations imposed on the Operator by Russian legislation;

d) exercise of the rights and legitimate interests of the Operator or third parties, provided the subject's rights and freedoms are not infringed;

e) other grounds under Article 6 of Federal Law No. 152-FZ.

6.3. For consent-based processing, the Operator ensures consent is obtained in a form compliant with Russian legislation. Consent is executed separately from other information and documents acknowledged or signed by the subject.

6.4. Processing for dissemination requires statutory grounds and compliance with the specific requirements of Article 10.1 of Federal Law No. 152-FZ.

6.5. Processing for advertising mailings requires the subject's necessary prior consent.

7. Procedures and conditions for personal data processing

7.1. The Operator collects, records, systematises, accumulates, stores, updates, retrieves, uses, transfers (provides or grants access to), anonymises, blocks, deletes and destroys personal data.

7.2. Processing uses personal data information systems, electronic documents and paper records.

7.3. Access is granted only to employees and other authorised persons as necessary to perform their duties.

7.4. Persons granted access must comply with established confidentiality requirements.

7.5. Other parties process data on the Operator's behalf under a contract or other statutory basis defining their data protection obligations.

7.6. When collecting Russian citizens' personal data, the Operator complies with Article 18 of Federal Law No. 152-FZ concerning use of databases located in the Russian Federation.

8. Maintaining information confidentiality

8.1. The Centre maintains confidentiality of all information obtained or created during management system certification, professional and public accreditation, audits and experience and business reputation assessment, unless otherwise provided by Russian legislation or the relevant procedure's conditions.

8.2. Confidential information includes:

• clients' documents and records;
• audit and assessment results;
• commercial and technical information;
• production and management process information;
• information on information systems and their security;
• personal data of clients' employees and representatives;
• materials containing personnel competence information;
• professional and public accreditation materials;
• source materials for experience and business reputation assessment;
• information obtained from complaints, appeals and enquiries.

8.3. Assessment information must not be disclosed to third parties without an appropriate legal basis.

8.4. In management system certification, the Centre informs clients in advance of information it intends to make public.

8.5. Information neither publicly available nor independently disclosed by the client is confidential.

8.6. Where disclosure is required by law or permitted by an appropriate contractual basis, the interested party is notified unless the law prohibits notification.

8.7. Client information obtained from other sources, including complainants, is also confidential.

8.8. Employees, auditors, experts, commission and committee members and contracted specialists undertake confidentiality obligations.

8.9. Confidentiality obligations continue after contracts, employment or assessment involvement end, to the extent provided by law and concluded agreements.

9. Transfer of personal data and confidential information

9.1. The Centre does not sell personal data or provide them to third parties for independent commercial use.

9.2. Transfer is permitted on statutory grounds, particularly:

• with the subject's consent;
• in performing contractual obligations;
• to authorised state bodies in statutory cases;
• to fulfil mandatory requirements applicable to the activities;
• to persons acting on the Operator's behalf, subject to personal data legislation.

9.3. Assessment results and certification, accreditation or business reputation assessment status are transferred to the extent established by relevant rules, contractual terms and Russian legislation.

9.4. Individuals' personal data may be published in public registers only on a lawful basis.

9.5. The Operator does not transfer personal data across borders.

9.6. If a cross-border transfer becomes necessary, it may begin only after fulfilling Russian legal requirements, including Article 12 procedures under Federal Law No. 152-FZ.

10. Use of cookies and technical information

10.1. При посещении официального сайта https://www.qs.ru могут использоваться файлы cookie и иные технические данные, необходимые для корректного функционирования сайта, обеспечения его безопасности и удобства использования.

10.2. Cookies are small pieces of information that may be stored on a user's device when visiting a website.

10.3. Users may manage cookies through browser settings, including restricting or disabling storage.

10.4. Restricting cookies may affect certain website functions.

10.5. Any personal data processing involving cookies complies with Russian legislation.

10.6. Use of technical data does not authorise processing for purposes unrelated to stated website purposes without an appropriate legal basis.

11. Rights of data subjects

11.1. A data subject may:

• obtain details of processing their personal data;
• obtain information on processing grounds, purposes and methods;
• request rectification;
• request blocking or destruction on statutory grounds;
• withdraw previously given consent;
• request cessation of processing;
• challenge unlawful acts or omissions before Roskomnadzor or a court;
• exercise other rights under Russian legislation.

11.2. Subjects may exercise their rights by contacting the Operator using the details in Section 2.

11.3. Requests must contain information necessary to identify the applicant and comply with Article 14 of Federal Law No. 152-FZ.

11.4. The Operator handles enquiries and requests within statutory Russian time limits.

11.5. Withdrawal of consent does not preclude further processing on other lawful grounds under Federal Law No. 152-FZ.

12. Operator's obligations

12.1. The Operator undertakes to:

• process personal data lawfully;
• ensure data confidentiality and security;
• provide subjects with statutory information;
• take measures for rectification, blocking and destruction;
• handle subjects' enquiries;
• appoint a person responsible for organising processing;
• internally monitor legal compliance;
• familiarise employees with processing and protection requirements;
• notify Roskomnadzor in statutory cases;
• take other measures under Federal Law No. 152-FZ.

13. Personal data security measures

13.1. The Operator takes necessary legal, organisational and technical measures against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.

13.2. These measures include:

• appointing responsible persons;
• defining and controlling access rights;
• establishing document handling procedures;
• using necessary information security tools;
• safeguarding paper and electronic media;
• backing up information;
• recording and controlling information system access;
• incident detection and prevention;
• familiarising employees with confidentiality requirements;
• internally monitoring established requirements.

13.3. For incidents involving unlawful or accidental transfer, provision, dissemination or access, the Operator complies with Article 21 of Federal Law No. 152-FZ, including notification of the authorised body in statutory cases and timeframes.

14. Retention periods and cessation of processing

14.1. Processing and retention periods depend on processing purposes, legal requirements, contracts and the Centre's records retention schedule.

14.2. Personal data in certification, professional and public accreditation, and experience and business reputation assessment documents are retained for the periods required by the applicable procedures and record retention requirements.

14.3. Current and former employees' data are retained under labour and archival legislation.

14.4. Grounds for ceasing processing are:

• achievement of its purposes;
• expiry of the established processing period;
• withdrawal of consent without other lawful grounds for continuation;
• receipt of a justified request to cease processing;
• detection of unlawful processing;
• other statutory circumstances.

14.5. On cessation, data must be destroyed or anonymised under Russian statutory procedures and timeframes.

14.6. Destruction is documented with the necessary supporting records under applicable regulatory requirements.

15. Monitoring Policy compliance

15.1. The Centre's management is responsible for organising compliance with this Policy.

15.2. The person appointed by the Director's order monitors compliance with personal data legislation.

15.3. Employees and contracted specialists must comply with this Policy and relevant internal documents.

15.4. Identified violations must be reviewed and necessary corrective measures taken.

16. Final provisions

16.1. This Policy takes effect upon approval by the Director of the Private Institution Interecoms Quality Systems Certification Centre.

16.2. The Policy is reviewed when Russian legislation, operating conditions, applicable regulatory requirements or personal data processing processes change.

16.3. The current version is freely available at https://www.qs.ru. https://www.qs.ru.

16.4. On introduction of this Policy, the previous Management Policy on Personal Data Processing, approved by Order No. 3 of 15 October 2025, shall be replaced under the established procedure.

16.5. Employees and others processing personal data must be familiarised with the provisions relevant to their activities.