POLICY OF LIMITED LIABILITY COMPANY "RUDMYANSKOE KHOSYAISTVO" REGARDING THE PROCESSING OF PERSONAL DATA
Privacy Policy
1. General Provisions 1.1. This Policy (hereinafter referred to as the Policy) defines the general principles and procedure for processing personal data and measures to ensure their security in Rudmyanskoe Khozyaistvo LLC, UNP 691083092, address: Republic of Belarus, 222666, Minsk Region, Stolbtsy, Gagarin Street, 119, Apt. 01 (hereinafter referred to as the Company).
1.2. This Policy applies to all personal data that the Company processes as an operator, as well as as an authorized person in cases where the Company is entrusted with the processing of personal data by third parties (operators) in the manner and in compliance with the requirements of the law.
1.3. The purpose of the Policy is to ensure the protection of the rights and freedoms of a person and citizen when processing his personal data, including the protection of the rights to privacy, personal and family secrets, strict compliance with the requirements of the legislation of the Republic of Belarus and international treaties of the Republic of Belarus in the field of personal data protection.
1.4. The policy has been developed in accordance with the provisions of the legislation of the Republic of Belarus governing the processing and protection of personal data, including taking into account the provisions of the Law of the Republic of Belarus dated 07.05.2021 No. 99-Z "On the Protection of Personal Data", other regulatory legal acts determining the procedure for working with personal data and requirements for ensuring their security.
1.5. Ensuring unlimited access to the current version of the Policy in accordance with the requirements of the legislation is implemented by publishing it on the Internet at the address: www.rudhoz.by/privacy-policy.
1.6. The provisions of this Policy serve as the basis for the development of local acts regulating issues of processing, protection, and ensuring the confidentiality of personal data in the Company.
1.7. The requirements of this Policy are also mandatory for all employees of the Company who have received access to personal data in the established manner and who directly process personal data.
1.8. When making changes to legislative acts, as well as in the event of the adoption of other regulatory legal acts on issues regulated by this Policy, until the relevant changes are made to this Policy to bring it into compliance with the requirements of the legislation, it is necessary to be guided by the relevant provisions of regulatory legal acts.
2. Terms and definitions
2.1. This Policy uses the terms and definitions necessary for the purposes of this Policy, including those provided by the legislation of the Republic of Belarus governing the processing and protection of personal data:
2.1.1. processing of personal data means any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion;
2.1.2. operator - state body, legal entity of the Republic of Belarus, other organization, individual person, including an individual entrepreneur (hereafter, unless otherwise determined - individual), alone or jointly with other specified persons organizing and (or) processing of personal data;
2.1.3. Personal data means any information relating to an identified individual or individual that can be identified;
2.1.4. The processing of personal data by the Company is carried out in accordance with the need to protect the rights and freedoms of data subjects, based on the following principles and requirements:
2.1.5. Dissemination of personal data - actions aimed at obtaining the personal data of an uncertain circle of persons;
2.1.6. The subject of personal data is an individual in respect of whom personal data are processed;
2.1.7. Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state;
2.1.8. authorized person - state body, legal entity of the Republic of Belarus, other organization, natural person who in accordance with the act ...
2.1.9. identifiable natural person - a natural person who can be directly or indirectly identified, in particular by means of a surname, first name, patronymic, date of birth, identification number or by means of one or more features characteristic of his physical, psychological, mental, economic, cultural or social identity.
3. Principles and purposes of personal data processing
3.1. The processing of personal data by the Company is carried out taking into account the need to ensure the protection of the rights and freedoms of personal data subjects, including on the basis of the following principles and requirements:
3.1.1. the processing of personal data must be proportionate to the stated purposes of their processing and ensure at all stages of such processing a fair balance of interests of all interested parties;
3.1.2. the processing of personal data is carried out with the consent of the subject of personal data, except in cases provided for by legislative acts;
3.1.3. the processing of personal data is limited to achieving specific, previously declared legitimate purposes. Processing of personal data that is incompatible with the originally declared purposes of their processing is not permitted, unless otherwise established by legislative acts;
3.1.4. the content and volume of the personal data being processed must correspond to the stated purposes of their processing. The personal data being processed must not be excessive in relation to the stated purposes of their processing;
3.1.5. the processing of personal data is transparent. The subject of personal data is provided with relevant information concerning the processing of his personal data in the manner and under the conditions established by law;
3.1.6. storage of personal data in a form that allows identification of the subject of personal data is ensured for no longer than required by the stated purposes of their processing;
3.1.7.The Company takes measures to ensure the accuracy of the personal data processed and, if necessary, to update them.
3.2. The processing of personal data by the Company is or may be carried out for the following purposes:
3.2.1. implementation of functions, powers and duties imposed by law on the Company, including duties of a tax agent and duties to provide reports and necessary information to government authorities, the Social Security Fund of the Ministry of Labor and Social Protection of the Republic of Belarus, tax authorities, as well as other government bodies;
3.2.2. regulation of labor and other directly related relations, including personnel management and office work, organization of records, registration of employees for individual (personalized) records in the compulsory insurance system, training, career advancement, ensuring personal safety, monitoring the quantity and quality of work performed, ensuring the safety of property and material assets, calculating and paying wages, benefits, other remuneration and payments, calculating and transferring taxes and insurance premiums, maintaining military records;
3.2.3.recruitment, selection, verification of candidates (applicants), including their qualifications and work experience;
3.2.4. preparation, conclusion (modification/termination) and execution of any types of agreements with personal data subjects;
3.2.5. fulfillment by the Company of its obligations to the subject of personal data arising from contractual or other relationships;3.2.6. organization and support of business trips;
3.2.7. issuance of powers of attorney and other authorizing documents;
3.2.8. processing of requests, messages and inquiries received from the personal data subject, providing feedback, communicating with personal data subjects and customer support, including providing technical, user and other support on issues related to the functioning of the services, applications, and Internet resources of the Company;а;
3.2.9. execution of judicial acts, acts of state bodies and other organizations, as well as officials, subject to execution in accordance with the legislation on enforcement proceedings; 3.2.10. formation of reference and analytical materials for internal information support of the Company's activities;
3.2.11. providing personal data subjects with information about the Company’s activities, advertising, promotion of the Company’s products (works/services), including sending the personal data subject notifications, commercial offers, informational and advertising mailings related to the Company’s products (works, services);
3.2.12. assessment and analysis of the products (works/services) provided by the Company, control and improvement of the quality of the products (works/services) of the Company;
3.2.13. ensuring access to the services, applications and Internet resources of the Company, identification of users;
3.2.14. tracking statistics on the use of the Company’s services, applications and Internet resources, determining user preferences, displaying targeted advertising, and analyzing the collected data;
3.2.15. holding events and ensuring the participation of personal data subjects in them;
3.2.16. preparation of corporate documents in accordance with legislation;
3.2.17. ensuring access control;
3.2.18. ensuring the protection of life, health, property or other vital interests of personal data subjects, as well as the achievement of socially significant goals in accordance with the law;
3.2.19. implementation of economic activities, rights and legitimate interests of the Company within the framework of the implementation of types of activities provided for by the Charter and other local acts of the Company;3.2.20. other legitimate purposes, including those arising from the requirements of legislation.
3.3. In the event of a need to change the originally stated purposes of processing personal data, the Company is obliged to obtain the consent of the subject of personal data to process his personal data in accordance with the changed purposes of their processing in the absence of other grounds for such processing provided for by legislative acts.
4. Categories of personal data subjects whose personal data are processed by the company
4.1. The Company processes or may process personal data of the following categories of personal data subjects:
4.1.1. candidates for vacant positions (applicants), employees of the Company, former employees, as well as their close relatives (in-laws)
4.1.2. individuals with whom the Company has concluded (plans to conclude) civil law contracts (clients and contractors of the Company);
4.1.3. representatives/employees of the Company’s clients and contractors (individuals/legal entities);
4.1.4. individuals who are members of (applicants for election to) the management bodies of the Company, their close relatives (in-laws);4.1.5. members of the Company and their affiliated and interdependent persons (individuals);
4.1.6. visitors (users) of websites, applications and Internet resources administered by the Company;
4.1.7. individuals who have provided the Company with personal data when sending reviews, by subscribing to the mailing list, or by filling out questionnaires during advertising and other events held by the Company;4.1.8. individuals applying to the Company and (or) providing their personal data, including for the purpose of fulfilling requests, instructions and appeals of the said individuals addressed to the Company, as well as fulfilling duties (powers) stipulated by legislative acts of the Republic of Belarus;
4.1.9. other individuals who have expressed consent to the processing of their personal data by the Company, as well as individuals whose personal data processing is necessary for the Company to achieve the goals stipulated by law.
4.2. The list of personal data processed by the Company in relation to the relevant subjects of personal data is determined taking into account the relevant purposes of processing personal data, including taking into account the requirements of the legislation.
4.3. In the event of the need to process special personal data, the Company undertakes to ensure compliance with the procedure for processing such personal data established by law, including taking a set of measures aimed at preventing risks that may arise during the processing of such personal data for the rights and freedoms of personal data subjects.5.2. The processing of personal data is carried out with the consent of the subjects of personal data to the processing of their personal data or without such consent in cases stipulated by the legislation of the Republic of Belarus.
5.3. The Company may process personal data using automation tools, without using such tools, and in a mixed manner.
5.4. Personal data may be stored:
5.4.1. on paper;
5.4.2. in electronic documents;
5.4.3. in computer files;
5.4.4. in information systems (resources) that provide automatic processing and storage of information.
5.5. Access to personal data processed by the Company may be provided to employees of the Company to the extent necessary to perform their official (service) duties, in compliance with the procedure established by legislation and local acts of the Company.5.6. The Company has the right, subject to the requirements of the law, to entrust the processing of personal data on its behalf or in its interests to an authorized person on the basis of an agreement concluded with this person. The said agreement must define:
5.6.1. purposes of processing personal data;
5.6.2. a list of actions that will be performed with personal data by an authorized person;5.6.3. obligations to maintain the confidentiality of personal data;
5.6.4. measures to ensure the protection of personal data in accordance with Article 17 of the Law of the Republic of Belarus dated 07.05.2021 No. 99-Z "On the Protection of Personal Data".
5.7. If the Company entrusts the processing of personal data to an authorized person, the Company shall be responsible to the subject of personal data for the actions of the said person. The authorized person shall be responsible to the Company.
5.8. Unless otherwise established by law, the condition for termination of the processing of personal data may be the achievement of the purposes of processing personal data (loss of the need to achieve these purposes), the expiration of the period for processing personal data, the withdrawal of the consent of the subject of personal data to processing, as well as the absence of grounds for processing personal data established by legislative acts.
5.9. In the event of a need for cross-border transfer of personal data, the Company is obliged to ensure that the foreign state to whose territory it is intended to transfer personal data ensures reliable protection of the rights of personal data subjects.In relation to foreign states, on the territory of which the adequate level of protection of the rights of personal data subjects is not ensured, the cross-border transfer of personal data can be carried out only in compliance with the requirements in cases provided for in Article 9 of the Law of the Republic of Belarus dated 07.05.2021 No. 99-Z "On the Protection of Personal Data".
6. Duties of society
6.1. The Company, acting as an operator, undertakes to:
6.1.1. explain to the subject of personal data his rights related to the processing of personal data;6.1.2. obtain the consent of the subject of personal data, except in cases provided for by this Law and other legislative acts;
6.1.3. обеспечивать защиту персональных данных в процессе их обработки;
6.1.4. provide the subject of personal data with information about his personal data, as well as about the provision of his personal data to third parties, except in cases stipulated by this Law and other legislative acts;
6.1.5. make changes to personal data that are incomplete, outdated or inaccurate, except in cases where a different procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not imply subsequent changes to such data;
6.1.6. stop processing personal data, as well as delete or block them (ensure that the processing of personal data is stopped, as well as their deletion or blocking by an authorized person) in the absence of grounds for their processing provided for by this Law and other legislative acts;
6.1.7. notify the authorized body for the protection of the rights of personal data subjects of violations of personal data protection systems immediately, but no later than 3 working days after the operator became aware of such violations, except for cases provided for by the authorized body for the protection of the rights of personal data subjects;
6.1.8. to change, block or delete inaccurate or illegally obtained personal data of a personal data subject at the request of the authorized body for the protection of the rights of personal data subjects, unless another procedure for making changes to personal data, blocking or deleting them is established by legislative acts;
6.1.9. comply with other requirements of the authorized body for the protection of the rights of personal data subjects to eliminate violations of the legislation on personal data;
6.1.10. perform other duties provided for by legislative acts.
7. Measures to ensure the protection of personal data
7.1. The Company takes the necessary legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other illegal actions in relation to personal data, including mandatory measures to ensure the protection of personal data provided for by law.
7.2. The specific composition and list of measures necessary and sufficient to fulfill the obligations to ensure the protection of personal data is determined by the Company, taking into account the specifics of the processing carried out and the requirements of the legislation.
8. Rights of the personal data subject
8.1. The subject of personal data has the rights granted to him by law, including:
8.1.1. the right to revoke the consent of the subject of personal data at any time without giving reasons;8.1.2. the right to receive information regarding the processing of personal data. The list of relevant information that is provided or may be provided to the subject of personal data is determined in accordance with the legislation;
8.1.3. the right to change personal data if the personal data is incomplete, outdated or inaccurate;
8.1.4. the right to receive information on the provision of personal data to third parties once per calendar year free of charge, unless otherwise provided by legislative acts;8.1.6. the right to appeal the actions (inactions) and decisions of the Company related to the processing of personal data to the National Center for Personal Data Protection of the Republic of Belarus (the authorized body for the protection of the rights of personal data subjects) in the manner established by the legislation on appeals from citizens and legal entities.
8.2. Each of the rights of the personal data subject has its own mechanism and conditions for implementation established by law.
8.3. In order to exercise their rights, the subject of personal data shall apply to the Company with an application in accordance with the procedure established by law (in this case, the withdrawal of consent is also permitted in the form by which the relevant consent was obtained), and the Company undertakes to consider the application in the established manner and within the established timeframe and take appropriate measures to ensure the implementation of the rights of personal data subjects in accordance with the law.
8.4. The application of the personal data subject, in accordance with the requirements of the legislation, must contain:8.4.2. date of birth of the personal data subject;
8.4.3. identification number of the personal data subject, or, in the absence of such, the number of the document certifying his identity, in cases where this information was indicated by the personal data subject when giving his consent to the Company or the processing of personal data is carried out without his consent;
8.4.4. statement of the essence of the requirements of the personal data subject;
8.4.5. personal or electronic digital signature of the subject of personal data.
8.5. The response to the application is sent to the subject of personal data in a form corresponding to the application submission form, unless otherwise specified in the application itself.
8.6. Legislative acts may provide for the mandatory personal presence of the subject of personal data and the presentation of an identity document when submitting an application to the Company in writing.9. Responsibility
9.1. for violation of the legislation and local acts of the Company when processing personal data, the relevant employees and other persons who are at fault for such a violation, depending on the nature and extent of the violation, may be subject to disciplinary, administrative or criminal liability.10. final provisions
10.1. This Policy comes into force on 11/15/2021.
10.2. The Company has the right to change and/or supplement the terms of this Policy at its own discretion. Changes and additions made to the Policy will come into force from the date of their approval, unless otherwise determined by the Company.
10.3. Issues related to the processing of personal data that are not specified in this Policy are regulated by legislation and local acts of the Company.
10.4. All suggestions or questions regarding this Privacy Policy should be sent to the Company's email address: rudhozrudzmianskoje@gmail.com