Regulations on the Procedure for Storing and Disseminating Information
Constituting Commercial Secrets and Other Confidential Information
of National Aerospace University
«Kharkiv Aviation Institute»
Approved:
By the Academic Council
of National Aerospace University
«Kharkiv Aviation Institute»
Minutes No. 1 dated August 28, 2024
Enacted by Order No. 338 dated August 29, 2024
QMS KhAI-LD-R/001:2024
Effective Date: September 01, 2024
Revision No. 1
1. General Provisions
1.1. Regulations on the Procedure for Storing and Disseminating Information Constituting Commercial Secrets and Other Confidential Information (hereinafter – Regulations) of National Aerospace University «Kharkiv Aviation Institute» (hereinafter – University) define the procedure for categorizing information as commercial secrets and confidential information and its list, the procedure for storing and protecting commercial secrets and confidential information in educational, scientific, managerial, industrial, economic, and other activities of the University, as well as the procedure for protecting commercial secrets / confidential information entrusted to the University by another organization.
1.2. The Regulations are developed on the basis of Art. 32, 36, 162 of the Economic Code of Ukraine, Art. 505-508 of the Civil Code of Ukraine, Laws of Ukraine «On Information», «On Access to Public Information», «On Protection Against Unfair Competition», «On Personal Data Protection», Resolution of the Cabinet of Ministers of Ukraine dated 09.08.1993 No. 611 «On the List of Information That Does Not Constitute Commercial Secrets», as well as the University Charter.
1.3. The effect of these Regulations is aimed at preventing possible economic damage both to the University and its employees, higher education applicants, and counterparties, and applies to any persons to whom commercial secrets or confidential information of the University became known through their official or other activities.
1.4. According to the access procedure, information is divided into open information and restricted access information, in particular, confidential information, secret information (including state, commercial, banking, professional secrets).
1.5. In these Regulations, a commercial secret means information of scientific, scientific-technical, technological, organizational, financial-economic, and other nature that is secret in the sense that it, as a whole or in a specific form and configuration of its components, is unknown and not easily accessible to persons who usually deal with the type of information to which it belongs, the disclosure (transfer, leakage) of which may harm the interests of the University, is associated with actual or potential commercial value, has been subject to measures reasonable under the circumstances to keep it secret, and does not constitute state secrets.
1.6. In these Regulations, confidential information means restricted access information in the possession, use, or disposal of the University, which is disseminated in the manner determined by the University exclusively with its consent, in particular, commercial secrets, information for internal use. Confidential information also includes information about an individual (personal data), which may be disseminated at the request (consent) of the relevant person in the manner determined by them in accordance with conditions provided by them, as well as in other cases defined by law*.
* Data protection principles cannot be applied to anonymous information, in particular information that does not relate to an identified or identifiable natural person, or personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.
1.7. The owner of information containing commercial secrets created by a University employee within labor relations, or created within performance of duties under a civil law contract by an individual – contractor in favor of the University, is the University, unless otherwise directly established by law or contract.
1.8. The University is the owner of economic intellectual property rights to commercial secrets, which include:
- the right to use commercial secrets;
- the exclusive right to authorize the use of commercial secrets;
- the exclusive right to prevent unlawful disclosure, collection, or use of commercial secrets;
- other economic intellectual property rights established by legislation.
1.9. University employees who created information recognized as commercial secrets retain personal moral rights of intellectual property and may have, in accordance with the established procedure, the right to remuneration upon realization and use of commercial secrets.
1.10. The University, as the owner of information containing commercial secrets, has the right to guaranteed statutory protection of its commercial secrets against unlawful misappropriation, use, and disclosure to other organizations and persons (right to protection against unfair competition). Protection of commercial secrets is carried out by organizational and legal means, namely:
- the University, as the owner of information containing commercial secrets, independently creates its information security system and ensures its sufficiently effective functioning by implementing organizational-administrative and technical measures, in particular, through limiting the circle of persons having access to this information, applying software, technical, and other security means to ensure confidentiality and integrity of protected information, and settling confidentiality issues during contractual and legal work with partners of the University;
- the state guarantees prevention of unfair competition through judicial prosecution of an organization or person that unlawfully misappropriated, used, or disclosed information that is a commercial secret of its owner. In this case, the organization or person violating state guarantees regarding fair competition is obliged to compensate the information owner for its value, as well as return or compensate all revenues acquired based on this information from the time they became aware of the unlawfulness of information misappropriation.
1.11. Preservation of commercial secrets and confidential information is the duty of employees and heads of structural units possessing it.
1.12. In accordance with para. 2 Art. 142 of the Labor Code of Ukraine, these Regulations are an integral part of the rules of conduct at the University. Requirements and rules set forth in these Regulations are mandatory for execution by all University employees. Access of other persons to restricted access information is permitted in the manner determined by these Regulations, based on such persons providing written non-disclosure undertakings, or in cases where such person possesses powers to obtain access to information under the norms of applicable legislation of Ukraine.
2. Determination of the List of Information Constituting Commercial Secrets and Other Confidential Information
2.1. The list of information constituting commercial secrets and other confidential information of the University is determined by current legislation of Ukraine, taking into account the interests of the University and obligations to fulfill legislative requirements regarding restriction of access to certain information.
2.2. The list of information constituting commercial secrets and other confidential information of the University is established by these Regulations. Amendments and additions to this list are approved in the same manner as the Regulations are approved. Information containing commercial secrets and other confidential information of the University pursuant to paragraphs 2.3 and 2.4 of these Regulations acquires the status of restricted access information from the date of entry into force of these Regulations.
2.3. Information constituting commercial secrets of the University includes:
2.3.1. Information on University management:
- information on the use of original University management methods;
- information on the preparation of specific decisions of management bodies and leadership of the University on organizational, scientific, educational, economic, production, technical, and other issues, in particular, internal memos, draft decisions, and other documents related to the decision-making process and preceding their adoption, broadcasts of meetings held remotely, statistical, analytical, working materials prepared for decision-making, etc.;
- information on the facts of holding meetings, their content, objectives, and results of meetings and sessions of management and self-government bodies of the University;
- information on plans to expand or scale down educational activities, open new or liquidate structural units of the University;
- information on planned targets for attracting higher education applicants for study;
- plans for procurement, sale of educational services, results of research work, and the planned volume of investments.
2.3.2. Information on financial activities of the University:
- market research of educational, scientific, and innovative services;
- information on property and finances of the University (with the exception of information on the allocation of budget funds, possession, use, or disposal of state property according to the provisions of the Law of Ukraine «On Access to Public Information»):
- information on pricing, expenses, and other economic indicators;
- property status of the University;
- information on the balance sheet of the University;
- information on the status of bank accounts of the University;
- information on debt obligations of the University.
2.3.3. Information on contractual activities of the University and its partners:
- information on concluded agreements/deals/memorandums/contracts, as well as those planned to be concluded, with the exception of public procurement contracts in which the University is a customer of goods/services, works;
- information on domestic and foreign counterparties: customers, contractors, suppliers, higher education applicants, consumers, buyers, sponsors, intermediaries, and other partners of the University, as well as its competitors, if this information is not specified in open sources (directories, catalogs, registers, databases, etc.), in particular, information on customers of scientific research, topics of ordered research, areas of educational and scientific cooperation of the University;
- information on methods of acquiring and selling necessary products to meet the needs of the University, the size of the trade markup;
- data on issues of international cooperation of the University.
2.3.4. Information on scientific and scientific-technical activities:
- data in any form on intellectual property objects that have potential commercial value (documentation of scientific and technical developments, optimal parameters of new designs and technological processes, original software, information on composition, structure, and main characteristics of new materials, know-how, etc.);
- information on the cost price of scientific research, volumes of scientific, scientific-technical research, areas of this research;
- current and perspective research plans, plans for implementing research results into production;
- information on scientific, technical, and production equipment of the University, with the exception of information published in accordance with established procedures;
- methods for obtaining research results, process flow charts, working research logs;
- experimental or calculated results, independent acquisition of which by other interested organizations or persons involves significant financial, material, or time costs;
- information on the system for monitoring the progress of research and development work and compliance of the obtained result with the order;
- information on decisions and prospects of the University regarding obtaining legal protection and commercialization of intellectual property objects created at the University;
- description of technological processes, information on features of technologies being used and developed, as well as on specifics of their use;
- prototype samples of products;
- terms of reference, technical specifications, regulations, reports on the performance of scientific work;
- results of scientific and scientific-technical activities of employees and visiting researchers of the University, working logs of employees and other working documents, including in electronic form, containing information that does not constitute a state secret, but the disclosure of which may cause economic damage and harm the protection of intellectual property rights;
- information on inventions, utility models, and other intellectual property objects until the full completion of work on their patenting (registration of intellectual property rights) in Ukraine and abroad.
2.3.5. Information on educational activities:
- information from the distance learning system at the University «Mentor»;
- syllabus and study programs, methodological, educational, scientific materials;
- original teaching technologies and methodologies, computer programs and databases, computerized textbooks and reference books, automated training courses, materials and conclusions of student academic work (course and diploma projects, research training papers) of practical orientation;
- other information related to scientific, research, development, educational, financial, managerial, and other activities of the University that does not constitute a state secret and disclosure of which may result in damage to the University, cause material losses, and harm its business reputation.
2.3.6. Corporate chats in networks such as Telegram, Viber, etc., created to improve activities and inform employees of structural units, members of governing bodies, working groups, educational, scientific, and other collectives of the University, are not official pages of the University on social networks; therefore, any information in the specified chats containing details listed in paragraphs 2.3.1 – 2.3.5 is considered a commercial secret.
2.3.7. The list of information belonging to commercial secrets provided in paragraphs 2.3.1 – 2.3.5 of the Regulations is not exhaustive. The University, within its autonomy, independently establishes the commercial value of information belonging to it and determines such list, as well as establishes the regime of access to information constituting commercial secrets (commercial secrecy regime), and the system (method) of protecting said information from unauthorized use and dissemination.
2.4. Confidential information of the University includes:
- data contained in the University's databases, corporate resources, etc., as well as information on databases (number of users, total volume of disk space occupied by the database, software modules, etc.);
- logins, passwords to administrative, technological, and personal accounts, in particular, access passwords to corporate Wi-Fi access points, internal network, corporate website, corporate pages on social networks, e-mail, University databases;
- materials of video surveillance, alarm, and security systems, in particular, logs of arming/disarming facilities, working time tracking logs, registration of arrival at work and departure from work, etc.;
- information regarding the architecture, state of software and hardware, technical, organizational, and software protection systems (password protection, antivirus protection, etc.) of the University's internal network against external and internal interference;
- conclusions of internal investigations (checks), internal audit reports, inventory reports, certificates on the results of checks of structural units of the University, except for cases provided by law;
- information defined as confidential in accordance with concluded contracts, agreements between the University and partners, counterparties, etc.;
- information on codes and keys of licensed software;
- information not published in accordance with established procedures and related to managerial activity of the University management, in particular, the rectorate, faculty dean's offices, Academic Council of the University / faculty academic councils, Scientific and Technical Council of the University, Supervisory Board of the University, self-government bodies of the University and faculties, officials and structural units of the University;
- organizational and administrative documents: orders, instructions, regulations, rules, guidelines, etc., except for cases when these acts are published (brought to notice) for an unlimited circle of third parties according to the act itself or the distribution list for the act, or except for cases provided by law;
- content of curricula and syllabi developed on the initiative of the University, educational and methodological developments in disciplines;
- results of special statistical and sociological studies;
- information on the market environment for training specialists with full or partial payment for tuition;
- documentation related to the process of studying and obtaining higher education by University students;
- personal data of academic, pedagogical, and other employees of the University, as well as higher education applicants, in particular, information on the place of residence of employees and applicants of the University, as well as other personal data contained in personal data databases owned by the University;
- information regarding equipping the University premises with security alarms and their installation locations, as well as any specifics of the access control system;
- information regarding holding any public events at the University, locations of equipment, engineering networks, etc., information about which may cause danger under conditions of armed aggression against Ukraine;
- information related to security measures and systems at the University.
2.5. The following cannot constitute a commercial secret of the University:
- information specified in paragraph 2.3 of these Regulations, if it is in accordance with established procedure:
- posted on the official website of the University, or on official social media pages of the University, or
- disseminated in another manner, in particular, in articles, textbooks, monographs;
- information from public registers and databases;
- foundational documents, documents permitting engaging in educational, scientific, research, and other activities according to the statutory tasks of the University;
- information across all established forms of state reporting;
- data necessary to verify the calculation and payment of taxes and other mandatory payments;
- information on the number and composition of employees, their salary as a whole and by professions and positions, as well as the availability of vacancies;
- documents on payment of taxes and mandatory payments;
- information on environmental pollution, failure to comply with safe working conditions, sale of products harmful to health, as well as other violations of the legislation of Ukraine and the amount of damage caused thereby;
- documents on solvency;
- information on the participation of University officials in cooperatives, enterprises, unions, associations of enterprises, and other organizations engaged in entrepreneurial activity;
- information on contracts in which the University is a buyer/customer, information on the status of execution of these contracts, amount of payments under contracts;
- information specified in paragraphs 5-7 of Art. 6, paragraph 2 of Art. 13 of the Law of Ukraine «On Access to Public Information»;
- information subject to public disclosure in accordance with current legislation of Ukraine.
2.6. For the purpose of applying in work the list of information constituting commercial secrets and other confidential information of the University, heads of all structural units are obliged to prepare a list of information used in the activity of their unit that constitutes commercial secrets and other confidential information of the University in accordance with Section 2 of these Regulations, as well as prepare a list of positions of unit officials who must have access to this information.
2.7. A sample form according to which units must create lists of information constituting commercial secrets and other confidential information, and persons authorized to access this information, is provided in Appendix No. 3 to these Regulations. Said lists, signed by the head of the structural unit, are submitted to the rector through the person authorized for access to public information.
2.8. Annually by December 1, heads of structural units must submit to the rector proposals for introducing amendments to said lists or their confirmation in the previous revision.
3. Procedure for the Protection of Commercial Secrets and Confidential Information of the University
3.1. Any person who, by the nature of their activity, has access to information constituting commercial secrets and confidential information of the University is obliged to familiarize themselves with these Regulations under personal signature and sign a non-disclosure undertaking regarding information constituting commercial secrets and confidential information of the University in the form established in Appendix No. 1 to these Regulations.
The fact of familiarization with the Regulations and the non-disclosure undertaking may be reflected in the employment contract (agreement) of the employee, another agreement between them and the University, or in the form of a separate document in the form established in Appendix No. 1 to these Regulations. Non-disclosure undertakings, if signed as a separate document, are stored in the personal files of employees.
3.2. Information constituting commercial secrets and confidential information of the University may be provided by University officials to state executive authorities, controlling, and law enforcement agencies in accordance with the procedure provided for by current legislation, upon their properly formatted request, only after documented permission from the Rector of the University, that is, their consent to transfer the information to other physical or legal entities.
3.3. Access of University employees to information constituting commercial secrets and confidential information is lawful in the following cases:
3.3.1. The employee is appointed by the rector's order to the corresponding position and, according to their functional duties, must have access to documents and information constituting commercial secrets and confidential information.
3.3.2. The employee has read and mastered the requirements of these Regulations, in particular, has become acquainted with the content of the articles of the legislation of Ukraine regarding the establishment of administrative and criminal liability for disclosing information constituting commercial secrets and confidential information of the University (Appendix No. 2 to these Regulations).
3.4. Access of persons who are not employees of the University to information constituting commercial secrets and confidential information is lawful only under the following conditions:
3.4.1. Such person has written authorization that, in accordance with current legislation in Ukraine, allows them to become acquainted with information constituting commercial secrets and confidential information of the University in a specific case.
3.4.2. Such person has received written consent from the Rector of the University or another official acting on behalf of the Rector to become acquainted with information constituting commercial secrets and confidential information.
3.4.3. The issuance of documents, details, and transfer of information containing commercial secrets and confidential information of the University to potential partners is carried out only after signing a non-disclosure agreement or after signing a relevant contract containing a non-disclosure clause/section.
3.5. Other cases of access to (familiarization with) information constituting commercial secrets and confidential information of the University are unauthorized.
3.6. Upon detecting unauthorized access by any person to information constituting commercial secrets and confidential information of the University, every employee is obliged to immediately bring this fact to the attention of their immediate supervisor and/or the person authorized for access to public information and/or the rector.
3.7. The issuance of documents, details, and transfer of information containing commercial secrets and which are confidential to third parties (legal entities or individuals) is carried out in accordance with the procedure set forth in Section 4 of these Regulations.
3.8. The Rector of the University has the right to deny any person access to information constituting commercial secrets and confidential information of the University if they have reasonable suspicions regarding the probability of unlawful use of information constituting commercial secrets and confidential information of the University. Such refusal may be appealed in the manner established by the legislation of Ukraine.
3.9. The leadership of the University is obliged to ensure the technical capability to perform the actions specified above, in particular, conducting briefings for employees on compliance with the confidentiality regime regarding information constituting commercial secrets of the University.
4. Procedure for Issuing Documents, Information to Employees, as well as Transferring Information Containing Commercial Secrets and Confidential Information of the University to Counterparties, Clients, and State Bodies
4.1. In case of receiving a request (written, oral, or via email) for information constituting commercial secrets and confidential information from counterparties, clients, and state bodies, an employee is obliged to:
a) ascertain from the counterparty, client, or representative of a state body the necessity of receiving such information (what such request is related to; the volume of information that must be contained in the response);
b) report such request to the authorized person of the University for access to public information, or to their supervisor empowered to make a decision on providing such information, or to the rector;
c) obtain consent to provide information from the authorized person for access to public information, or the supervisor empowered to make a decision on providing such information, or the rector;
d) agree with the authorized person for access to public information or the supervisor empowered to make a decision on providing information on the content and volume of information to be provided;
e) provide only the information to which the employee has access in connection with the performance of their functional duties;
f) in the absence of the opportunity to obtain consent from the authorized person for access to public information, or the supervisor empowered to make a decision on providing information, or the rector, the employee is obliged to:
- notify the above-mentioned officials of the receipt of the request in the shortest possible time;
- record the contact details of the person making the request and obtain from them a justification of the necessity of obtaining such information and its scope.
4.2. To coordinate activities on issues of protecting information constituting commercial secrets and confidential information, processing requests for providing information, monitoring compliance with the regime of non-disclosure of restricted access information, and compiling relevant documents at the University, the duties of the person authorized for access to public information are assigned to the relevant official by the rector's order. The list of tasks, rights, and duties of the person authorized for access to public information is set out in the instructions (additions to the job description of the employee tasked with performing the duties of the person authorized for access to public information).
4.3. When processing and storing commercial secrets and confidential information, University employees are obliged to:
- throughout legal relations with the University and after their termination, as long as such information retains value for the University, not disclose, transfer to third parties, or publicly reveal in any form without documented permission from the rector information constituting commercial secrets and confidential information of the University that will be entrusted to or become known during the performance of official (labor or civil-law) duties;
- not use commercial secrets and confidential information received from the University for selfish motives or other personal reasons in activities that may cause damage to the University;
- strictly comply with all requirements of internal regulatory documents of the University regarding information security protection;
- immediately report to their immediate supervisor and the person authorized for access to public information in case of attempts by unauthorized persons to obtain any information regarding the activities of the University or its employees that constitutes commercial secrets and confidential information;
- immediately report to their immediate supervisor and the person authorized for access to public information about the loss or shortage of information carriers constituting commercial secrets and confidential information, IDs, passes, keys to premises, safes, seals, and other facts that may lead to disclosure, as well as the causes and conditions of potential information leaks of the University;
- upon dismissal (termination of legal relations with the University), return to their immediate supervisor all information carriers containing commercial secrets (electronic information, paper media, manuscripts, drafts, printed materials, audio, photo, and video materials, etc.) received from the University and held by the person during work (activity) at the University.
4.4. Obligations related to the protection of commercial secrets and confidential information do not restrict the employee's intellectual property rights. The implementation of the employee's intellectual property rights is carried out in accordance with the requirements of current legislation of Ukraine.
4.5. Responsibility for organizing work with information constituting commercial secrets and confidential information of the University, as well as organizing compliance with the requirements of these Regulations by employees of structural units of the University, is assigned to their heads.
4.6. The development of rules and information protection measures in the University's information systems, as well as the implementation and monitoring of their performance, is carried out by the person authorized for access to public information and the Chancellery and Archive Department of the University.
5. Procedure for Processing Information Constituting Commercial Secrets and Confidential Information, Access to Such Information
5.1. When working with documents (materials) containing commercial secrets and confidential information, employees must comply with instructions and regulations governing record-keeping, document flow, contractual activities, claim and lawsuit work, etc.
5.2. Processing (creation, storage) of files containing commercial secrets and confidential information may be carried out on corporate work devices (laptops) of employees within the internal network of the University. Processing such files on third-party (personal) computers and laptops is prohibited.
5.3. In exceptional cases, processing (creation, storage, printing, copying, etc.) of files and paper media containing commercial secrets and confidential information may be carried out outside the University (during remote work, attending exhibitions, conducting negotiations, being on a business trip, etc.) provided that the employee working with this information takes measures to ensure its preservation and non-disclosure. Upon returning to the University, the employee who processed the file and/or worked with the paper carrier of information with commercial secrets and confidential information is obliged to upload the information to the internal network of the Enterprise and delete it on the primary medium, and store the document in a way that excludes disclosure of information.
5.4. Storage of files containing commercial secrets and confidential information is allowed on internal drives of work devices of University employees (subject to proper protection) and network resources of the University (subject to proper protection). Access to such files should be held by employees who created them and worked with them, and their immediate supervisors. Posting such files in electronic folders accessible to employees who do not work with this type of information according to their functional duties is prohibited.
5.5. Copying information containing commercial secrets and confidential information to electronic or paper media may be carried out with the permission of the head of the structural unit of the University where the employee copying them works. Copying such files outside the University (computers, laptops, smartphones, tablets, other information carriers) may be carried out with the permission of the Rector of the University.
5.6. Electronic and paper media containing commercial secrets and confidential information must be stored on University premises.
5.7. Forwarding files containing commercial secrets or confidential information by email may only be carried out between corporate email subscribers (khai.edu). Sending such files to external addressees may be carried out on the condition that the content of the commercial secret and confidential information directly concerns the recipient of the information; in all other cases, with the consent of the Rector of the University, their deputies, or heads of structural units.
5.8. If the addressee's email is registered in domains «ru», «su», or other domains of the Russian segment of the Internet, sending electronic messages containing commercial secrets and confidential information to it is strictly prohibited.
5.9. Information constituting commercial secrets and confidential information must not be used for publication in mass media, public editions, in particular on the Internet; exhibited at open exhibitions, demonstrated in public places, announced in public speeches, or disclosed in any other way without a corresponding written decision of the Rector of the University, except for cases when disclosure is required under current legislation of Ukraine (in particular, providing explanations in court, during investigative actions, etc.).
6. Liability for Disclosure of Information Constituting Commercial Secrets and Confidential Information
6.1. In case of disclosure of information constituting commercial secrets of the University, employees of the University may be held disciplinarily liable, in particular, subject to dismissal in compliance with the procedure provided for by the Labor Code of Ukraine.
6.2. Any person guilty of disclosing information constituting commercial secrets of the University may be brought to criminal, administrative, or civil liability under the terms and conditions provided for by the current legislation of Ukraine.
6.3. An employee of the University bears criminal liability in accordance with the current criminal legislation of Ukraine in case of committing intentional acts of illegal storage of information constituting commercial secrets (or confidential information of a commercial nature) for the purpose of their disclosure or other use.
6.4. An employee of the University bears criminal liability in accordance with the current criminal legislation of Ukraine in case of intentional disclosure of a commercial secret without the consent of its owner.
6.5. In the event that damages were caused by the employee's actions in collecting and disclosing commercial secrets of the University, such employee is obliged to fully compensate for all damages associated with their illegal actions.
6.6. The fact of disclosure of a commercial secret or confidential information is established by an internal investigation, the conduct of which is governed by the Regulations «On the Procedure for Conducting Internal Service Investigations at National Aerospace University named after M. Ye. Zhukovsky «Kharkiv Aviation Institute».
7. Final Provisions
7.1. The Regulations are adopted by the Academic Council of the University and enacted by order of the Rector of the University.
7.2. Amendments and/or additions to these Regulations are made in accordance with the procedure established for their adoption.
7.3. In case of amendments to higher education legislation regulating relations defined in these Regulations, the norms of Ukrainian legislation shall apply until corresponding amendments are made to these Regulations.
Appendix No. 1
UNDERTAKING
ON NON-DISCLOSURE OF COMMERCIAL SECRETS AND CONFIDENTIAL INFORMATION
I, f___________________________________________________________ /position, Full Name/, am familiarized with and understand the text of the «Regulations on the Procedure for Storing and Disseminating Information Constituting Commercial Secrets and Other Confidential Information» of National Aerospace University named after M. Ye. Zhukovsky «Kharkiv Aviation Institute» (hereinafter – University), and I am warned about my duties regarding the protection of this information, non-allowance of its disclosure and transfer to other organizations or persons, its use outside the University, as well as liability for violation of the listed duties.
For the period of my employment or other relations with the University and for 5 (five) years after their termination, I undertake:
1) NOT TO DISCLOSE information constituting commercial secrets and other confidential information of the University that will be entrusted to me or become known during the performance of official duties for the position or become known during the performance of other duties or in any other way, and which are specified in the above-mentioned Regulations.
2) NOT TO TRANSFER to third parties and NOT TO DISCLOSE PUBLICLY information constituting commercial secrets and other confidential information of the University without the written consent of the Rector or a person authorized by them.
3) TO STRICTLY COMPLY WITH THE REQUIREMENTS of the administrative documents of the University and the above-mentioned Regulations on information protection issues.
4) In case of attempts by unauthorized persons to obtain from me information constituting commercial secrets and other confidential information of the University, TO AVOID such disclosure and URGENTLY NOTIFY the authorized person of the University on access to public information, and/or my immediate supervisor, and/or the Rector about this fact.
5) NOT TO USE information constituting commercial secrets and other confidential information of the University to engage in any activity that may cause damage to the University.
6) In case of my dismissal from the University (regardless of the reasons for such dismissal), within 3 days from the date of the decision on dismissal, TO HAND OVER to the immediate supervisor all media of confidential information and commercial secrets of the University (magnetic and paper information media, including manuscripts, drafts, drawings, etc., film and photo materials, models, products, etc.) that were at my disposal in connection with the performance of official duties or for other reasons, about which a transfer-acceptance act is drawn up.
7) TO URGENTLY NOTIFY my immediate supervisor about the loss of media of confidential information and commercial secrets, certificates, passes, keys to the premises of the University (including safes, cabinets), seals and stamps of the University, about the presence of other circumstances that may lead to the disclosure of commercial secrets, as well as about the causes and conditions of such facts.
On all issues unclear to me regarding the above circumstances and duties, I have received the necessary clarifications from the official of the University who provided me with the above-mentioned Regulations for familiarization and the text of this Undertaking for signing.
I am also aware that violation of the conditions regarding non-disclosure of information constituting commercial secrets and other confidential information of the University may entail bringing me to criminal, disciplinary, civil, or other liability.
f___________________ 202__ f__________________________________________ /position, Full Name, signature/
Appendix No. 2
Economic Code of Ukraine
Article 36. Unlawful Collection, Disclosure, and Use of Information Constituting Commercial Secrets
1. Information related to production, technology, management, financial, and other activities of an economic entity that does not constitute a state secret, the disclosure of which may damage the interests of the economic entity, may be recognized as its commercial secret. The composition and scope of information constituting commercial secrets, as well as the method of its protection, are determined by the economic entity in accordance with the law.
2. Unlawful collection of information constituting commercial secrets is considered to be the acquisition of specified information by illegal means, if this caused or could cause damage to the economic entity.
3. Disclosure of commercial secrets is the familiarization of another person without the consent of a person authorized to do so, with information that, according to the law, constitutes a commercial secret, by a person to whom this information was entrusted in the established manner or became known in connection with the performance of official duties, if this caused or could cause damage to the economic entity.
4. Inducement to disclose commercial secrets is prompting a person to whom information constituting a commercial secret under the law was entrusted in the established manner or became known in connection with official duties, to disclose this information, if this caused or could cause damage to the economic entity.
5. Unlawful use of commercial secrets is the implementation into production or consideration during planning or conducting business activity without the permission of an authorized person of unlawfully obtained information constituting a commercial secret according to the law.
6. For the unlawful collection, disclosure, or use of information constituting commercial secrets, guilty persons bear liability established by law.
Code of Ukraine on Administrative Offenses
Article 1643. Unfair Competition
***
Receipt, use, disclosure of commercial secrets, as well as other confidential information for the purpose of causing damage to the business reputation or property of another entrepreneur - shall entail the imposition of a fine from nine to eighteen non-taxable minimum incomes of citizens.
Criminal Code of Ukraine
Article 231. Illegal Collection for Purpose of Use or Use of Information Constituting Commercial or Banking Secrets
Intentional actions aimed at obtaining information constituting commercial or banking secrets for the purpose of disclosure or other use of this information, as well as illegal use of such information, if it caused substantial damage to an economic entity, -
shall be punishable by a fine from three thousand to eight thousand non-taxable minimum incomes of citizens.
Note. Public, including through the mass media, journalists, public associations, trade unions, reporting by a person of information about the commission of a criminal or other offense carried out in compliance with the requirements of the law, does not constitute actions provided for by this article and does not entail criminal liability.
Article 232. Disclosure of Commercial, Banking Secrets or Professional Secrets on Capital Markets and Organized Commodity Markets
Intentional disclosure of commercial, banking secrets or professional secrets on capital markets and organized commodity markets without the consent of its owner by a person to whom this secret is known in connection with professional or official activities, if it was committed out of mercenary or other personal motives and caused substantial damage to an economic entity, -
shall be punishable by a fine from one thousand to three thousand non-taxable minimum incomes of citizens or probation supervision for a term of up to three years, with deprivation of the right to hold certain positions or engage in certain activities for a term of up to three years.
Appendix No. 3
f____________________________ / name of the structural unit of the University
| Name of restricted access information used in the work of the unit (according to paras. 2.3, 2.4 of the Regulations) | Position of the employee who, according to their job duties, has access to restricted access information | Access level (to all information, to part of the information) |
| Commercial Secret Information on University management: - information on the use of original methods of University management; - information on the preparation of specific decisions of governing bodies and leadership of the University on organizational, scientific, educational, economic, operational, production, technical, and other issues, in particular, internal memos, draft decisions, and other documents related to the decision-making process that precede their adoption, broadcasts of meetings conducted remotely, statistical, analytical, working materials prepared for decision-making, etc.; - information on the facts of holding meetings, their content, objectives, and results of meetings and sessions of governing and self-governing bodies of the University; - information on plans to expand or curtail educational activities, open new or liquidate structural units of the University; - information on target indicators for attracting higher education students for studies; - procurement plans, sales of educational services, results of scientific research works, and planned volume of investments. Information on financial activities of the University: - market research of educational, scientific, and innovative services market; - information on the property and finances of the University (with the exception of information on the disposal of budget funds, ownership, use, or disposal of state property pursuant to the provisions of the Law of Ukraine «On Access to Public Information»): - information on pricing, expenses, and other economic indicators; - property status of the University; - information on the balance sheet of the University; - information on the status of bank accounts of the University; - information on debt obligations of the University. Information on contractual activities of the University and its partners: - information on concluded agreements/contracts/memorandums, as well as those planned to be concluded, with the exception of public procurement contracts in which the University is a customer of goods/services, works; - information on domestic and foreign counterparties: customers, contractors, suppliers, higher education students, consumers, buyers, sponsors, intermediaries, and other partners of the University, as well as its competitors, if this information is not stated in open sources (directories, catalogs, registers, databases, etc.), in particular, information on scientific research customers, topics of ordered research, directions of educational and scientific cooperation of the University; - information on methods of purchasing and selling necessary products to meet the needs of the University, trade markup sizes; - data on international cooperation of the University. Information on scientific, scientific-technical activities: - data in any form on intellectual property objects that have potential commercial value (documentation of scientific and technical developments, optimal parameters of new designs and technological processes, original software, information on composition, structure, and main characteristics of new materials, know-how, etc.); - information on the cost price of scientific research, volumes of scientific, scientific-technical research, spheres of this research; - current and long-term research plans, plans for implementing research results into production; - information on scientific-technical and production equipment of the University; - methods of obtaining scientific research results, process flow charts, working research logs; - experimental or calculation results, independent acquisition of which by other interested organizations or persons involves significant financial, material, or time expenditures; - information on the monitoring system for the progress of research and development works and compliance of the obtained result with the order; - information on decisions and prospects of the University regarding obtaining legal protection and commercialization of intellectual property objects created at the University; - description of technological processes, information on features of used and developed technologies, as well as the specifics of their use; - prototype samples of products; - terms of reference, technical specifications, regulations, reports on performance of scientific works; - results of scientific and scientific-technical activities of employees and visiting researchers of the University, working logs of employees and other working documents, including in electronic form, containing information that does not constitute a state secret, but disclosure of which may cause economic damage and harm the protection of intellectual property rights; - information on inventions, utility models, and other intellectual property objects until full completion of works on their patenting (registration of intellectual property rights) in Ukraine and abroad. Information on educational activities: - information from the distance learning system at the University «Mentor»; - working and study programs, methodological, educational, scientific materials; - original technologies and teaching methods, computer programs and databases, computerized textbooks and reference books, automated training courses, materials and conclusions of student educational works (term papers and graduation projects, educational research works) of practical orientation; - other information related to scientific, research, development, educational, financial, managerial, and other activities of the University that does not constitute a state secret and disclosure of which may lead to damage to the University, cause material losses, and harm its business reputation. |
|
|
| Confidential Information - data contained in the databases of the University, corporate resources, etc., as well as information on databases (number of users, total volume of disk space occupied by the database, software product modules, etc.); - logins, passwords for administrative, technological, and personal accounts, in particular, access passwords to corporate WiFi points, internal network, corporate website, corporate social network pages, email, University databases; - materials from video surveillance, alarm, and security systems, in particular, logs of arming/disarming objects, logs of tracking working hours, registration of arrival at work and departure from work, etc.; - information regarding architecture, status of software and hardware, technical, organizational, and software protection systems (password protection, antivirus protection, etc.) of the University's internal network against external and internal interference; - conclusions of internal investigations (checks), internal audit and inventory reports, certificates on results of checks of structural units of the University, except for cases provided for by legislation; - information defined as confidential in accordance with concluded agreements, contracts between the University and partners, counterparties, etc.; - information on codes and keys of licensed software; - unpromulgated information related to managerial activities of the University leadership, in particular, the rector's office, dean's offices of faculties, academic council of the University / academic councils of faculties, scientific and technical council of the University, supervisory board of the University, self-governing bodies of the University and faculties, officials, and structural units of the University; - organizational and administrative documents: orders, instructions, regulations, rules, guidelines, etc., except for cases when these acts are published (brought to attention) for an unlimited circle of third parties according to the act itself or the distribution list to the act, or except for cases provided for by legislation; - content of curricula and course programs developed on the initiative of the University, teaching materials for disciplines; - results of special statistical and sociological research; - information on market conditions for training specialists with full or partial payment for tuition; - documentation related to the process of studying and obtaining higher education by University students; - personal data of scientific-pedagogical, pedagogical, and other employees of the University, as well as students, in particular, information on place of residence of employees and students of the University, as well as other personal data contained in personal data bases owned by the University; - information regarding equipping University premises with intruder alarms and locations of their installation, as well as any specifics of access control procedures; - information regarding conducting any mass events at the University, locations of equipment, utility networks, etc., information about which may cause danger under conditions of armed aggression against Ukraine; - information related to safety measures and safety systems at the University. |
|
|
f__________________________________ / date, position, Full Name of the head of the unit, signature