RUEN

Privacy Policy

APPROVED

Minutes of the General Meeting of Participants of Tech and Business Solutions LLC

No. 17 dated 10/01/2024

 

Revision 1.00 dated 10/02/2024

  1. General Provisions.

1.1. This Policy on the processing of personal data (hereinafter referred to as the Policy) defines the activities of the management company of the holding "1AK-GROUP" - Limited Liability Company "Tech and Business Solutions", registered at the address: Republic of Belarus, 225710, Brest region, Pinsk, Kalinovsky proezd, 2, off. 7 postal address: Republic of Belarus, 225710, Brest region, Pinsk, Kalinovsky proezd, 2, off. 7. (hereinafter referred to as the Company or the Operator) in relation to the processing of personal data.

1.2. This Policy has been developed in compliance with the requirements of the Law of the Republic of Belarus dated 07.05.2021 No. 99-3 "On the Protection of Personal Data" (hereinafter referred to as the Law).

1.3. The concepts contained in Art. 1 of the Law are used in this Policy with the same meaning:

  • biometric personal data - information characterizing the physiological and biological characteristics of a person, which is used for his unique identification (fingerprints, palms, iris, facial characteristics and its image, etc.);
  • blocking of personal data - termination of access to personal data without deleting them;
  • depersonalization of personal data - actions as a result of which it becomes impossible to determine the ownership of personal data by a specific subject of personal data without the use of additional information;
  • processing of personal data - any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion of personal data;
  • publicly available personal data - personal data distributed by the subject of personal data himself or with his consent or distributed in accordance with the requirements of legislative acts;
  • operator - a Company that independently or jointly with other persons organizes and (or) carries out the processing of personal data;
  • personal data - any information related to an identified individual or an individual who can be identified;
  • provision of personal data - actions aimed at familiarizing a specific individual or group of individuals with personal data;
  • dissemination of personal data - actions aimed at familiarizing an indefinite group of individuals with personal data;
  • special personal data - personal data related to racial or national affiliation, political views, membership in trade unions, religious or other beliefs, health or sex life, administrative or criminal liability, as well as biometric and genetic personal data;
  • subject - an individual in respect of whom personal data are processed;
  • cross-border transfer of personal data - transfer of personal data to the territory of a foreign state;
  • deletion of personal data - actions as a result of which it becomes impossible to restore personal data in information resources (systems) containing personal data, and (or) as a result of which tangible carriers of personal data are destroyed;
  • authorized person - a government agency, a legal entity of the Republic of Belarus, another organization, an individual who, in accordance with a legislative act, a decision of a government agency that is an operator, or on the basis of an agreement with the Company, process personal data on behalf of the Company or in its interests;
  • an individual who can be identified - an individual who can be directly or indirectly determined, in particular through their last name, first name, patronymic, date of birth, identification number, or through one or more characteristics characteristic of their physical, psychological, mental, economic, cultural or social identity.

1.4. The following terms are used in this Policy:

Services are any services, products, programs, events, services of the Company (including, but not limited to, Bitrix, iSpring, etc.).

Websites – 1ak-group.com and other websites owned by the Company, subdomains of these websites, as well as other services with which the company works.

1.5. This Policy applies to all operations performed by the Operator with personal data using automation tools or without them.

1.6. This Policy comes into force from the moment of its approval.

  1. Categories of personal data subjects and the volume of personal data processed.

2.1. The operator processes personal data that may be obtained from the following personal data subjects:

  • Company members and affiliates of the Company;
  • Company employees, former employees, candidates for vacant positions;
  • Company counterparties and clients who are individuals; representatives and/or employees of the Company counterparties and clients who are legal entities or individual entrepreneurs; visitors to the Company’s Websites and Services;
  • persons who have provided the Company with personal data by subscribing to the mailing list, sending reviews, requests, by filling out questionnaires during advertising and other events held by the Company;
  • persons who have provided personal data to the Company in other ways.

2.2. The operator processes the following personal data of the personal data subject:

  • last name, first name, patronymic; gender;
  • date of birth;
  • email address;
  • phone number;
  • place of residence;
  • occupation (specialty, area of ​​professional knowledge);
  • place of work;
  • history of requests and views on the Company's Websites and Services;
  • data contained in an identity document;
  • data contained in a military registration document;
  • data contained in an education document;
  • data contained in a work record book;
  • data contained in an autobiography and references from previous places of work;
  • data obtained to create a personal file;
  • data contained in an insurance certificate and other documents confirming circumstances related to work, the presentation of which is required by law;
  • other information (the specified list may be shortened or expanded depending on the specific case and the purposes of processing).

2.3. To analyze the operation of the Sites and Services, the Operator processes the following data:

  • IP address;
  • browser information;
  • cookie data;
  • addresses of requested pages;
  • access time.

2.4. The operator ensures that the content and volume of personal data processed correspond to the stated purposes of processing and, if necessary, takes measures to eliminate their redundancy in relation to the stated purposes of processing.

2.5. The operator processes biometric personal data only subject to the consent of the subject of personal data or without consent in other cases stipulated by the legislation of the Republic of Belarus.

2.6. The Operator does not process special personal data related to race, nationality, political views, membership in trade unions, religious and other beliefs, health, sexual life, administrative or criminal liability, except for cases when the subject of personal data independently provided such data to the Operator, or they became known to the Operator in accordance with the legislation of the Republic of Belarus.

2.7. The operator, if necessary, to achieve the purposes of processing, has the right to transfer personal data to third parties in compliance with the requirements of the legislation of the Republic of Belarus.

  1. Purposes of collecting personal data.

3.1. The operator processes personal data for the following purposes:

  • communication with personal data subjects; execution of various transactions with personal data subjects, their subsequent execution, and, if necessary, modification and termination (termination);
  • provision of the Company's Services to personal data subjects;
  • provision of personal data subjects with information about the Company's activities, about the development of new Sites and Services by the Company;
  • sending notifications, commercial offers, advertising and informational messages to personal data subjects;
  • holding by the Company of promotions, surveys, interviews, tests on the Company's Sites and Services;
  • evaluation and analysis of the Company's Services, control and improvement of the Company's Services quality;
  • informing about the operation of the Company's Sites;
  • registration and maintenance of accounts on the Company's Sites and Services;
  • processing of requests and inquiries received from personal data subjects;
  • attracting candidates for vacant positions in the Company;
  • conducting personnel work and organizing the accounting of the Company's employees;
  • formation of statistical reports, conducting research;
  • implementation of business activities;
  • exercise of other powers and duties imposed on the Operator by the legislation of the Republic of Belarus.
  1. Basic rights and obligations of the operator and subject of personal data.

4.1. The operator has the right:

  • receive reliable information and/or documents containing personal data from the subject of personal data;
  • request information from the subject of personal data on the relevance and reliability of the personal data provided;
  • refuse the subject of personal data in satisfying the requirements to stop the processing of his personal data and/or their deletion if there are grounds for processing stipulated by the legislation of the Republic of Belarus, including if they are necessary for the stated purposes of their processing.

4.2. The operator is obliged to:

  • explain to the Subject his rights related to the processing of personal data;
  • obtain the consent of the Subject, except for cases stipulated by legislative acts;
  • process personal data in the manner established by the legislation of the Republic of Belarus;
  • ensure the protection of personal data in the process of their processing;
  • take measures to ensure the accuracy of the personal data processed by him, make changes to personal data that are incomplete, outdated or inaccurate;
  • consider applications from personal data subjects on issues of personal data processing and give reasoned responses to them;
  • provide the subject of personal data with information about his personal data, on their provision to third parties;
  • make changes to personal data that are incomplete, outdated or inaccurate, except for cases when another procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not imply subsequent changes to such data;
  • change, block or delete inaccurate or illegally obtained personal data of the Subject at the request of the authorized body for the protection of the rights of personal data subjects, unless another procedure for making changes to personal data, blocking or deleting them is established by legislative acts;
  • stop processing personal data, as well as delete or block them in the absence of grounds for processing them, as well as at the request of the personal data subject;
  • fulfill other obligations stipulated by the legislation of the Republic of Belarus.

4.3. The subject of personal data has the right:

  • to receive information regarding the processing of his personal data by the Operator;
  • to make changes to his personal data if the personal data is incomplete, outdated or inaccurate;
  • to revoke his consent to the processing of personal data;
  • to receive information about the provision of his personal data to third parties;
  • to stop the processing of his personal data, including their deletion, if there are no grounds for their processing;
  • to appeal the actions/inactions and decisions of the Operator related to the processing of his personal data, to the authorized body for the protection of the rights of personal data subjects in the manner prescribed by law;
  • to exercise other rights provided for by the legislation of the Republic of Belarus.

4.4. The subject of personal data is obliged to:

  • provide the Operator with only reliable information about themselves;
  • if necessary, provide the Operator with documents containing personal data in the amount necessary for the purpose of their processing;
  • inform the Operator about changes in their personal data.
  1. Consent of the personal data subject. Procedure and conditions for processing personal data.

5.1. The basis for the processing of personal data is the consent of the subject of personal data, except for cases established by the legislation of the Republic of Belarus, when the processing of personal data is carried out without obtaining such consent.

5.2. The consent of the subject of personal data is a free, unambiguous, informed expression of his will, by which he permits the processing of his personal data.

The Subject's consent may be obtained in writing, in the form of an electronic document or in another electronic form.

In other electronic form, the consent of the Subject may be obtained through:

  • indication (selection) by the subject of personal data of certain information (code) after receiving a SMS message, a message to an e-mail address;
  • placing a corresponding mark on the Internet resource by the subject of personal data;
  • other methods that make it possible to establish the fact of receiving the consent of the subject of personal data.

5.3. Before receiving the consent of the personal data subject, the Company is obliged to provide the personal data subject with information in written or electronic form corresponding to the form of expression of such consent, containing:

  • name and location of the Company;
  • purposes of personal data processing;
  • list of personal data for the processing of which the consent of the personal data subject is given;
  • period for which the consent of the Subject is given;
  • information on authorized persons if the processing of personal data will be carried out by such persons;
  • list of actions with personal data for which the consent of the Subject is given, a general description of the methods of personal data processing used by the Company;
  • other information necessary to ensure transparency of the personal data processing process.

Before receiving the Subject's consent, the Company is obliged to explain to the Subject in simple and clear language his rights related to the processing of personal data, the mechanism for implementing such rights, as well as the consequences of the Subject's consent or refusal to give such consent. This information must be provided by the Company to the Subject in written or electronic form corresponding to the form of expression of his consent, separately from other information provided to him.

5.4. When giving consent to the Company, the Subject shall indicate his/her last name, first name, patronymic (if any), date of birth, identification number, and, in the absence of such number, the number of the document certifying his/her identity, except for the case provided for in part two of this clause.

If the purposes of processing personal data do not require the processing of the information specified in the first part of this paragraph, this information shall not be processed by the Company upon receipt of the consent of the Subject.

5.5. The burden of proof of obtaining the Subject's consent rests with the Operator. Refusal to give consent to the processing of personal data entitles the Operator to refuse the subject of personal data access to the Company's Websites and Services.

5.6. The processing of personal data by the Operator includes the following actions with personal data: collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion, and other actions in accordance with the legislation of the Republic of Belarus.

5.7. Methods of processing personal data by the Operator:

  • non-automated processing of personal data;
  • automated processing of personal data with or without the transfer
  • of received information via information and telecommunications networks;
  • mixed processing of personal data.

5.8. Personal data shall be stored in a form that allows the identification of the subject of personal data, for a period no longer than required by the purposes of processing the personal data, except in cases where the storage period of personal data is established by the legislation of the Republic of Belarus, an agreement concluded (being concluded) with the subject of personal data, for the purpose of performing the actions established by this agreement.

5.9. The condition for termination of the processing of personal data may be the achievement of the purposes of processing personal data, the expiration of the period for processing personal data, the revocation of the consent of the subject of personal data to the processing of his personal data, as well as the identification of unlawful processing of personal data.

5.10. When processing personal data, the Operator takes the necessary legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other illegal actions in relation to personal data.

5.11 The Company processes special personal data exclusively for the purposes specified in paragraph 3.1. of this Policy. The Company may also process biometric personal data for the purposes specified in paragraph 3.1. of this Policy.

5.12. The processing of special, including biometric, personal data is permitted only if a set of measures is taken to prevent risks that may arise during the processing of such personal data for the rights and freedoms of personal data subjects.

5.13. The Company does not carry out cross-border transfer of personal data if the territory of a foreign state does not ensure an adequate level of protection of the rights of personal data subjects, except in cases established by law.

  1. Mechanism for implementing the rights of the subject of personal data.

6.1. The personal data subject has the right to revoke his/her consent to the processing of personal data by submitting to the Operator an application in writing, sent by registered mail, or in the form of an electronic document. The application must contain:

  • last name, first name, patronymic of the subject of personal data;
  • address of place of residence (place of stay);
  • date of birth;
  • identification number (if indicated when giving consent or personal data is processed without the consent of the subject of personal data);
  • statement of the essence of the requirement;
  • personal signature or electronic digital signature.

The operator, within 15 days after receiving the application, stops processing personal data (if there are no grounds for processing, according to the law), deletes them, and if there is no technical possibility of deleting them, takes measures to prevent further processing of personal data, including blocking them, and notifies the subject of personal data about this within the same period.

6.2. The personal data subject has the right to receive information from the Operator concerning the processing of his/her personal data by submitting an application to the Operator in the manner prescribed by clause 6.1 of these Rules. The Operator, within 5 working days after receiving the application, provides the personal data subject with the relevant information or notifies him/her of the reasons for refusing to provide such information.

6.3. The personal data subject has the right to demand that the Operator make changes to his/her personal data if they are incomplete, outdated or inaccurate by submitting an application to the Operator in the manner prescribed by clause 6.1 of these rules, with attached documents (copies certified in the established manner) confirming the need to make such changes. The Operator, within 15 days after receiving the application, makes changes to the personal data and notifies the personal data subject thereof or notifies of the reasons for refusing to make changes.

6.4. The personal data subject has the right to receive information from the Operator about the provision of his/her personal data to third parties once per calendar year free of charge, by submitting an application to the Operator in the manner prescribed by clause 6.1 of these Rules. The Operator, within 15 days after receiving the application, provides the personal data subject with information about which personal data of this subject and to whom were provided during the year preceding the date of filing the application, or notifies him/her of the reasons for refusing to provide such information.

6.5. The personal data subject has the right to demand that the Operator stop processing his/her personal data, including deleting them, if there are no grounds for processing, by submitting an application to the Operator in the manner prescribed by clause 6.1 of these Rules. Within 15 days after receiving the application, the Operator stops processing the personal data (if there are no grounds for processing, in accordance with the law), deletes them, and if there is no technical possibility of deleting them, takes measures to prevent further processing of the personal data, including blocking them, and notifies the personal data subject about this within the same period.

  1. Measures to ensure the protection of personal data

7.1. The Company is obliged to take legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other illegal actions in relation to personal data.

7.2. To protect personal data, the Company takes the following measures:

  • appointment of structural divisions or persons responsible for the implementation of internal control over the processing of personal data;
  • maintenance of processing registers;
  • development and dissemination to all interested parties of this Policy and other documents of the Company regarding the processing of personal data;
  • familiarization of the Company's employees and other persons directly involved in the processing of personal data with the provisions of the legislation on personal data, including the requirements for the protection of personal data, this Policy and other documents of the Company regarding the processing of personal data, as well as training of the said employees and other persons in the manner prescribed by law;
  • establishment of the procedure for access to personal data, including that processed in the information resource (system);
  • implementation of technical and cryptographic protection of personal data in the manner established by the Operational and Analytical Center under the President of the Republic of Belarus, in accordance with the classification of information resources (systems) containing personal data.

7.3. The Company is obliged to provide unlimited access, including through the use of the global computer network Internet, to documents defining the Company’s policy regarding the processing of personal data, prior to the commencement of such processing.

7.4. The classification of information resources (systems) containing personal data, for the purpose of determining the requirements for technical and cryptographic protection of personal data, shall be established by the authorized body for the protection of the rights of personal data subjects.

  1. Final provisions.

8.1. Issues related to the processing of personal data that are not set out in this Policy are governed by the legislation of the Republic of Belarus.

8.2. If any provision of the Policy is recognized as contradicting the legislation, the remaining provisions that comply with the legislation shall remain in force and are valid, and any invalid provision will be considered deleted/modified to the extent necessary to ensure its compliance with the legislation.

8.3. The Operator has the right, at its own discretion, to change and (or) supplement the terms of this Policy without prior and (or) subsequent notification of personal data subjects. The current version of the Policy is always available at: 1ak-group.com/politika-konfidenczialnosti.html

8.4. The personal data subject can receive any clarifications on issues of interest related to the processing of his personal data by contacting the Site Administration via e-mail info@1ak-group.com.