Privacy policy

PERSONAL DATA PROCESSING POLICY

1. General Provisions

1.1. This Personal Data Processing Policy (hereinafter referred to as the Policy) has been prepared in compliance with the requirements of the Law of the Republic of Belarus dated May 7, 2021, No. 99-3 "On the Protection of Personal Data" (hereinafter referred to as the Law) and defines the personal data processing procedures of "Z Z Corporation" LLC (hereinafter referred to as the Company or the Operator) and the measures taken by the Operator to ensure the protection and security of personal data.

1.2. This Policy applies to all personal data processing processes that the Company receives regarding the personal data subject.

1.3. The purpose of this Policy is to ensure the appropriate protection of personal data from unauthorized access and disclosure, and to respect the rights and freedoms of individuals when processing their personal data, including ensuring the protection of their privacy, personal secrets, and family confidentiality.

1.4. The Policy is publicly available and is posted on the Operator's website: https://zvonkomadewithlove.by/.

1.5. The terms and definitions used in this Policy have the meanings defined in the current legislation of the Republic of Belarus.

1.6. Name and location of the Operator: Limited Liability Company "Z Z Corporation", legal and postal address: 19 Gaspadarchaya Street, Grodno, 230005, Republic of Belarus.

1.7. The Operator has the right to entrust the processing of personal data on behalf of the Operator or in its interests to an authorized person.

The authorized person is not required to obtain the consent of the personal data subject.

2. Basic principles of personal data processing

2.1. Personal data processing includes the following actions with the provided personal data: collection, systematization, storage, modification, use, anonymization, blocking, distribution, provision, and deletion, both with and without the use of automated tools.

2.2. Personal data processing is carried out based on the following principles:

·           is carried out with the consent of the personal data subject, except in cases established by law;

·           is limited to the achievement of specific, pre-defined legitimate purposes. Processing of personal data that is incompatible with the originally stated purposes of processing is prohibited;

·           the content and volume of personal data processed must correspond to the stated purposes of processing. The personal data processed must not be excessive in relation to the stated purposes of processing;

·           when processing personal data, its accuracy, sufficiency, and, where necessary, relevance in relation to the stated purposes of processing are ensured;

·           must be transparent. For these purposes, the personal data subject, in cases stipulated by the Law, is provided with relevant information regarding the processing of their personal data;

Personal data is stored in a form that allows for the identification of the personal data subject for no longer than required for the purposes of processing the personal data.

2.3. "Z Z Corporation" LLC establishes the categories of personal data subjects whose personal data is processed, the list of personal data processed, the purposes for processing personal data, the legal grounds for processing personal data, and the retention period in accordance with the Appendix to this Policy.

2.4. Personal data is subject to destruction or anonymization upon the achievement of the processing purposes or when the need to achieve these purposes is no longer necessary, unless otherwise provided by law.

2.5. The personal data subject agrees that, in order to achieve the established goals, the Operator has the right to transfer personal data to third parties, in particular, delivery services, courier services, carriers, postal organizations, mobile operators, insurance companies, banks and their representatives, service centers, companies providing information technology (IT) support for the Operator's information resources (systems), sending informational, advertising, and other messages, and other third parties engaged by the Operator. Third parties are provided only with the personal data necessary for the provision of the relevant services. Third parties are obligated to maintain the confidentiality of personal data. Third parties are prohibited from using personal data for any other purposes.

2.6. The Operator shall entrust the processing of personal data to an authorized person only on the basis of a contract/agreement concluded between the Operator and the authorized person in accordance with the legislation of the Republic of Belarus.

If the Operator entrusts the processing of personal data to an authorized person, the Operator shall be liable to the personal data subject for the actions of such person. Any person processing personal data on behalf of the Operator shall be liable to the Operator.

2.7. The Operator has the right to carry out cross-border transfers of personal data, provided that, prior to such transfer, it has ensured that the foreign state to which the personal data is to be transferred ensures reliable protection of the rights of personal data subjects.

Cross-border transfers of personal data to the territory of foreign states that do not meet the above requirement may only be carried out in cases stipulated by law.

2.8. Personal data may be transferred to government officials only on the grounds and in the manner established by the legislation of the Republic of Belarus.

2.9. In the event of loss or disclosure of personal data, the Operator will inform the personal data subject of such loss or disclosure.

3. Methods for Obtaining Consent from a Personal Data Subject to Processing Personal Data

3.1. By submitting personal data to the Operator, including through the Operator's online resources, the personal data subject confirms their consent to the processing of the relevant information under the terms and for the purposes set forth in this Policy and the Appendix, and also confirms that they have read this Policy and agree to its terms.

3.2. Refusal to provide consent or revocation of previously provided consent constitutes disagreement with this Policy. In such a case, the personal data subject's participation in all activities conducted by the Operator, as well as third parties engaged by the Operator, that involve the use of personal data becomes impossible (is cancelled); bonuses on the balance of the "ZVONKO Madewithlove" client card belonging to the personal data subject and linked to their personal account are also cancelled. Cancellation is irrevocable and irrevocable.

Refusal to consent to the processing of personal data or termination of the processing of personal data may also result in the inability to provide services to the personal data subject and the Operator's ability to fulfill its obligations.

3.3. The consent of the personal data subject is a free, unambiguous, and informed expression of their will, by which they authorize the processing of their personal data.

3.4. The consent of the personal data subject may be obtained in writing, as an electronic document, or in another electronic form.

3.5. In another electronic form, the consent of the personal data subject may be obtained by:

·           the personal data subject providing (selecting, entering) certain information (code) after receiving an SMS message or email;

·           the personal data subject placing the appropriate mark on an online resource (website, mobile application);

Other methods that allow for the verification of the personal data subject's consent, such as by creating an account (registering a Personal Account) on the website https://zvonkomadewithlove.by/ or in the ZVONKO Madewithlove mobile app.

3.6. The Operator reserves the right, in cases established by law, to process personal data without the consent of the personal data subject.

4. Basic Rights and Obligations of the Personal Data Subject

4.1. The personal data subject has the right to:

4.1.1. Revoke the consent of the personal data subject.

The personal data subject has the right to revoke their consent at any time without explanation by submitting an application to the Operator in accordance with the procedure established in Section 4.3. of this Policy, or in the form by which their consent was obtained.

The Operator is obligated, within fifteen days of receiving the personal data subject's application and in accordance with its content, to cease processing the personal data, delete it, and notify the personal data subject thereof, unless there are other grounds for such actions with the personal data stipulated by law. If it is technically impossible to delete the personal data, the Operator is obligated to take measures to prevent further processing of the personal data, including blocking it, and notify the personal data subject thereof within the same period.

The revocation of the personal data subject's consent is not retroactive; i.e., the processing of personal data prior to its termination in accordance with paragraph 3 of this Section is not illegal.

4.1.2. To receive information regarding the processing of personal data and to amend personal data.

The data subject has the right to receive information regarding the processing of their personal data, including:

Name and location of the Operator;

Confirmation of the processing of personal data by the Operator (authorized person);

The data subject's personal data and the source thereof;

The legal grounds and purposes for processing personal data;

The period for which their consent is given;

Name and location of the authorized person, who is a government agency, a legal entity of the Republic of Belarus, or another organization, if the processing of personal data is entrusted to such person;

Other information required by law.

To obtain the information specified in this clause, the data subject must submit a corresponding application to the Operator. In this case, the data subject does not need to justify their interest in the requested information.

The Operator is obligated to provide the personal data subject with the information specified in this clause in an accessible form or notify them of the reasons for refusing to provide it within five business days of receiving the personal data subject's application, unless otherwise specified by law. Such information is provided to the personal data subject free of charge, except in cases stipulated by law.

A personal data subject has the right to request that the Operator amend their personal data if such personal data is incomplete, outdated, or inaccurate. For this purpose, the personal data subject shall submit an application to the Operator accompanied by relevant documents and/or their duly certified copies confirming the need to amend the personal data. The Operator is obligated to make the appropriate amendments to the personal data within fifteen days of receiving the personal data subject's application and notify the personal data subject accordingly, or notify the personal data subject of the reasons for refusing to make such amendments, unless another procedure for amending personal data is established by law.

4.1.3. To receive information regarding the provision of personal data to third parties.

The personal data subject has the right to receive information from the Operator regarding the provision of their personal data to third parties once per calendar year free of charge, unless otherwise provided by law.

To obtain the information specified in the first paragraph of this clause, the personal data subject must submit a corresponding application to the Operator.

The Operator is obligated, within fifteen days of receiving the personal data subject's application, to provide information regarding which personal data of the personal data subject was provided and to whom during the year preceding the date of submission, or to notify the personal data subject of the reasons for refusing to provide such information.

4.1.4. Request the cessation of processing of personal data and/or its deletion.

A personal data subject has the right to request the Operator to cease processing their personal data free of charge, including deletion, if there are no grounds for processing the personal data stipulated by law. To exercise this right, the personal data subject must submit an application to the Operator.

In the case specified in this clause, the Operator is obligated to cease processing of the personal data within fifteen days of receiving the personal data subject's application, as well as to delete it (ensure that the processing of the personal data ceases, and that an authorized person deletes it), and notify the personal data subject accordingly.

If deletion of the personal data is technically impossible, the Operator is obligated to take measures to prevent further processing of the personal data, including blocking it, and notify the personal data subject accordingly within the same period.

The Operator has the right to refuse a personal data subject's request to cease processing their personal data and/or delete it if there are grounds for processing the personal data stipulated by law, including if it is necessary for the stated purposes of processing, with notice to the personal data subject within fifteen days.

4.1.5. To appeal the Operator's actions (inactions) and decisions related to the processing of personal data.

A personal data subject has the right to appeal the Operator's actions (inactions) and decisions that violate their rights in the processing of personal data to the authorized body for the protection of the rights of personal data subjects in the manner established by law regarding appeals from individuals and legal entities.

A decision made by the authorized body for the protection of the rights of personal data subjects may be appealed by the personal data subject to a court in the manner established by law.

4.1.6. To exercise other rights provided for by the legislation of the Republic of Belarus.

4.2. The personal data subject is obligated to:

4.2.1. Provide the Operator with accurate information about their personal data;

4.2.2. Notify the Operator of any clarifications (updates, changes) to their personal data. Persons who provide the Operator with inaccurate information about themselves or another personal data subject without their consent are liable in accordance with the legislation of the Republic of Belarus.

Procedure for Submitting an Application to the Operator by a Personal Data Subject

To exercise the rights provided for in paragraphs 4.1.1-4.1.4 of this Policy, the personal data subject must submit an application to the Operator in writing or as an electronic document. Legislative acts may require the personal presence of the personal data subject and the presentation of an identity document when submitting a written application to the Operator.

The personal data subject's application must contain:

·           the last name, first name, patronymic (if any) of the personal data subject, and their residential address (place of stay);

·           the identification number of the personal data subject, or, if such number is not available, the number of the personal data subject's identity document, if this information was provided by the personal data subject when giving their consent to the operator or if the personal data is processed without the personal data subject's consent;

·           a statement of the essence of the personal data subject's requests;

·           the personal signature or electronic digital signature of the personal data subject.

A response to the application will be sent to the personal data subject in the form corresponding to the application form, unless otherwise specified in the application itself.

5. Measures to Ensure the Protection of Personal Data

5.1. The Operator is obligated to take legal, organizational, and technical measures to ensure the protection of personal data from unauthorized or accidental access, modification, blocking, copying, distribution, provision, deletion, and other illegal actions in relation to personal data.

5.2. The Operator (authorized person) determines the composition and list of measures necessary and sufficient to fulfill its obligations to ensure the protection of personal data, taking into account the requirements of legislation.

5.3. Mandatory measures to ensure the protection of personal data are:

5.3.1. The Operator's appointment of a structural unit or individual responsible for implementing internal control over the processing of personal data;

5.3.2. The Operator's issuance of documents defining the Operator's policy regarding the processing of personal data;

5.3.3. Familiarizing the Operator's employees and other persons directly involved in the processing of personal data with the provisions of personal data legislation, including personal data protection requirements and documents defining the Operator's policy regarding the processing of personal data, as well as training these employees and other persons in accordance with the procedure established by law;

5.3.4. Establishing procedures for accessing personal data, including data processed in the information resource (system);

5.3.5. Implementing technical and cryptographic protection of personal data in accordance with the procedure established by the Operational and Analytical Center under the President of the Republic of Belarus, in accordance with the classification of information resources (systems) containing personal data.

6. Final Provisions

6.1. The current legislation of the Republic of Belarus shall apply to this Policy and the relationship between the personal data subject and the Operator.

6.2. This Policy shall take effect upon its posting on the Operator's website, unless otherwise provided in a new version of the Policy.

6.3. The Operator reserves the right to unilaterally amend this Policy without prior approval or subsequent notification of the personal data subject.

6.4. Issues related to the processing of personal data not covered by this Policy are governed by the legislation of the Republic of Belarus.

List of personal data processed by "Z Z Corporation" LLC, the purposes of processing, categories of personal data subjects whose data is processed, legal grounds for processing, and retention periods for personal data