Personal Data Processing Policy
Personal Data Processing Policy in
Trading Unitary Enterprise «KAMAKO PRODCENTER»
This Policy regarding the processing of personal data (hereinafter referred to as the Policy) applies to all information that the KAMAKO PRODCENTER Trading Unitary Enterprise (KAMAKO PRODCENTER Unitary Enterprise) (registered by the Minsk City Executive Committee on 17.10.2013 in the Unified State Register of Legal Entities and Individual Entrepreneurs for No. 690367131, 220125, Minsk, ul. Gorodetskaya, 38a-29) (hereinafter referred to as the operator) can obtain information about the subject of personal data, defines the main goals and legal grounds for processing personal data, lists of subjects and personal data processed by the operator, the procedure, conditions, methods of processing personal data, the rights of personal data subjects, the duties of the operator when processing personal data.
The main objectives of the Policy are to ensure the protection of the rights and freedoms of the subject of personal data when processing his personal data, including the right to privacy, personal and family secrets.
The following terms and definitions are used in this Policy:
blocking of personal data — termination of access to personal data without their deletion;
depersonalization of personal data — actions as a result of which it becomes impossible to determine the identity of personal data to a specific personal data subject without using additional information;
personal data processing — any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, dissemination, provision, deletion of personal data;
personal data — any information related to an identified individual or an individual who can be identified;
provision of personal data — actions aimed at familiarizing with the personal data of a certain person or group of persons;
dissemination of personal data — actions aimed at familiarization with the personal data of an indefinite circle of persons;
website — https://kamako.by/, as well as subdomains of this site;
services — any services, products, programs, events, operator services;
the subject of personal data is an individual in respect of whom personal data is processed;
deletion of personal data — actions as a result of which it becomes impossible to restore personal data in information resources (systems) containing personal data, and (or) as a result of which the material carriers of personal data are destroyed;
1. General provisions.
1.1. The actions of this Policy apply to all operations performed by the operator with personal data using automation tools or without their use.
1.2. The Operator undertakes to comply with the laws and regulations concerning the protection of personal data of the personal data subject in force in the Republic of Belarus.
1.3. The Operator does not verify the accuracy of the personal data provided by the personal data subject. In this regard, the negative consequences (including any kind of liability) that may occur in connection with the provision of false personal data are in the field of responsibility of the personal data subject himself.
1.4. This Policy comes into force from the moment of its approval.
2. Purposes of personal data processing.
2.1. The operator may use the personal data of the personal data subject for the purposes of:
establishing feedback, including sending notifications, materials, requests, providing services and processing requests and requests from the personal data subject, providing information about the operator's activities;
the operator conducts promotions, surveys, interviews, and tests on the site;
information on the website;
establishing feedback by making direct contacts with the subject of personal data by means of telephone and telecommunication (e-mail);
confirmation of the accuracy and completeness of the personal data provided by the personal data subject;
providing the subject of personal data with his consent with special offers, newsletters, commercial offers and other information on behalf of the operator;
carrying out advertising activities on behalf of the operator with the consent of the personal data subject;
provision of personal data of the personal data subject to potential employers;
assignment of personal data processing to a third party;
notifying the subject of personal data by e-mail and other available means;
preparation and submission of a resume of a personal data subject for vacant positions for further employment;
making various transactions with personal data subjects, their subsequent execution, and, if necessary, modification and termination (termination);
HR management and organization of accounting of the operator's employees;
formation of statistical reports, conducting research;
implementation of economic activities;
identification of the personal data subject registered on the site for further authorization and other actions;
providing the subject of personal data with access to personalized website data;
determining the user's location;
creating an account for using parts of the site, if the personal data subject has agreed to create an account;
providing the user with effective technical support (if necessary) in case of problems related to the use of the site;
the exercise of other powers and duties assigned to the operator by law.
2.2. The Operator ensures that the content and volume of the processed personal data correspond to the stated purposes of processing and, if necessary, takes measures to eliminate their redundancy in relation to the stated purposes of processing.
3. Legal grounds for processing personal data.
Relations in the field of personal data processing are regulated by the legislation on personal data, as well as international treaties of the Republic of Belarus. The legislation on personal data is based on the Constitution of the Republic of Belarus and consists of the Law of the Republic of Belarus dated 05/07/2021 No. 99-Z "On Personal Data Protection", the Decision of the Constitutional Court of the Republic of Belarus dated 04/29/2021. No. R-1261/2021 "On Compliance with the Constitution of the Republic of Belarus with the Law of the Republic of Belarus "On Personal Data Protection", the Law of the Republic of Belarus dated 11/10/2008 No. 455-Z "On Information, Informatization and Information Protection", the Law of the Republic of Belarus dated 07/21/2008 No. 418-Z "On the Population Register", the Code of the Republic of Belarus on Administrative Offenses and other legislative acts. The legal basis for the processing of personal data is also consent to the processing of personal data.
4. The list of subjects whose personal data is processed by the operator.
The KAMAKO PRODCENTER Commercial Unitary Enterprise processes personal data of the following categories of subjects:
employees of the KAMAKO PRODCENTER Commercial Unitary Enterprise, former employees, candidates for vacant positions;
persons engaged by the operator to provide services (perform work) under civil law contracts;
representatives of contractors-legal entities and individual entrepreneurs;
contractors are individuals;
visitors, legal representatives of minors;
persons who sent an appeal to the KAMAKO PRODCENTER Trading Unitary Enterprise and left feedback about the operator, including by filling out questionnaires during advertising and other events conducted by the operator;
visitors to the website of the KAMAKO PRODCENTER Trading Unitary Enterprise;
participants of the KAMAKO PRODCENTER Trading Unitary Enterprise and affiliates of the KAMAKO PRODCENTER Trading Unitary Enterprise;
representatives of potential counterparties of the KAMAKO PRODCENTER Trading Unitary Enterprise.
5. The list of personal data processed by the operator.
5.1. The list of personal data processed by the operator is determined in accordance with the legislation of the Republic of Belarus and local regulations of the operator, taking into account the purposes of processing personal data specified in section 2 of this Policy.
5.2. The operator processes the following personal data of personal data subjects: surname, first name, patronymic, date of birth, place of birth, identity document data, photo, citizenship, place of work, position, contact information (phone number, e-mail address, registration (residence) address), information about education, place of study, occupation (specialty, area of professional knowledge), information contained in the resume, information about work, biographical information, information contained in the power of attorney, bank details (current account, BIC), electronic signature, information contained in the request, the history of requests and views on the site. other information (the list may be supplemented or shortened depending on the specific case and the purposes of processing). When visiting the operator's site, information about the use of the site is automatically collected. This information includes, among other things: the name of the domain and Internet access node, the IP address of the computer or Internet service provider, the operating system used (for example, Mac OS, Windows), the version of the web browser (for example, Mozilla Firefox, Internet Explorer, Opera), the name of the website, from which the user accessed the site, information from cookies, the type of device used, the addresses of the requested pages, and access time.
5.3. Processing of special categories of personal data is carried out in terms of biometric personal data. The processing of special categories of personal data in terms of race or nationality, political views, religious or other beliefs, health or sexual life, bringing to administrative or criminal responsibility, intimate life, is not carried out by the operator, except in cases when the personal data subject independently provided such data to the operator, or they became known to the operator in in accordance with the legislation of the Republic of Belarus.
6. The procedure and conditions for processing personal data.
6.1. The processing of personal data by the operator is carried out with the consent of the personal data subject to the processing of his personal data, unless otherwise provided by the legislation of the Republic of Belarus in the field of personal data.
6.2. The consent of the personal data subject is a free, unambiguous, informed expression of his will, through which he authorizes the processing of his personal data. Refusal to consent to the processing of personal data gives the operator the right to refuse the subject of personal data in any kind of interaction with him on any issues, including providing him with any services, hiring, providing access to the site, etc.
6.3. The Operator collects, records, systematizes, accumulates, stores, clarifies (updates, changes), extracts, uses, transfers (distributes, provides, accesses), depersonalizes, blocks, deletes and destroys personal data.
6.4. The processing of personal data is carried out both with the use of automation tools and without the use of such tools.
6.5. The Operator does not disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by law.
6.6. The Operator has the right to entrust the processing of personal data to a third party with the consent of the personal data subject, unless otherwise established by law, on the basis of an agreement concluded with this person.
6.7. Access to personal data is limited in accordance with the laws and local regulations of the operator.
6.8. The processing of personal data may be carried out:
employees of the operator holding positions included in the List of divisions and officials authorized to process personal data in the KAMAKO PRODCENTER Commercial Unitary Enterprise;
by third parties who process personal data on behalf of the operator.
6.9. The operator's employees who have received access to personal data assume obligations to ensure the confidentiality and security of the processed personal data, which are determined by the employment contract (contract), job descriptions and local regulations of the operator on personal data processing.
6.10. Processing of personal data by third parties may be carried out only on the basis of a relevant agreement with the operator in compliance with the requirements of paragraph 6.5. of this Policy.
6.11. Access of representatives of state bodies to personal data is regulated by the current legislation of the Republic of Belarus.
6.12. Personal data of the operator's employees may be provided to third parties only with the written consent of the employee, except in cases provided for by the current legislation of the Republic of Belarus.
7. Rights and obligations of personal data subjects
7.1. The subject of personal data, whose personal data is processed by the operator, has the right to receive information regarding the processing of his personal data, including information containing:
name and location of the operator;
confirmation of the fact of processing of his personal data by the operator;
his personal data and the source of their receipt;
legal grounds and purposes of personal data processing;
the period for which the consent of the personal data subject to their processing is given;
methods of processing personal data used by the operator;
the procedure for the exercise by the subject of personal data of the rights provided for by the Law of the Republic of Belarus dated 05/07/2021 No. 99-Z "On Personal data protection";
other information provided by law.
7.2. The personal data subject has the right to require the operator to make changes, clarify his personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect their rights.
7.3. The subject of personal data, whose personal data is processed by the operator, has the right to withdraw his consent to the processing of personal data.
7.4. The personal data subject has the right to appeal the actions/omissions and decisions of the operator related to the processing of personal data to the authorized body for the protection of the rights of personal data subjects in accordance with the procedure established by law. As well as the exercise of other rights provided for by law.
7.5. The subject of personal data is obliged to:
7.5.1. Provide the operator with reliable information about yourself;
7.5.2. If necessary, provide the operator with documents containing personal data to the extent necessary for the purpose of their processing;
7.5.3. Inform the operator about changes in their personal data.
7.6. A personal data subject who has provided the operator with incomplete, outdated, unreliable information about himself or herself, or information about another personal data subject without the latter's consent, is liable in accordance with the law.
8. Duties of the operator
8.1. When processing personal data, the operator is obliged to:
8.1.1. To explain to the subject of personal data his rights related to the processing of personal data;
8.1.2. To obtain the consent of the personal data subject, except in cases provided for by legislative acts;
8.1.3. To ensure the protection of personal data during their processing;
8.1.4. Take legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other unlawful actions with respect to personal data, including:
appointment by the operator of a structural unit or a person responsible for the implementation of internal control over the processing of personal data;
the publication by the operator of documents defining the operator's policy regarding the processing of personal data;
familiarization of the operator's employees and other persons directly involved in the processing of personal data with the provisions of the legislation on personal data, including the requirements for the protection of personal data, documents defining the policy of the operator (authorized person) regarding the processing of personal data, as well as training of these employees and other persons in accordance with the procedure established by law;
establishing the procedure for accessing personal data, including those processed in an information resource (system);
implementation of technical and cryptographic protection of personal data in accordance with the procedure established by the Operational Analytical Center under the President of the Republic of Belarus, in accordance with the classification of information resources (systems) containing personal data;
8.1.5. To provide the subject of personal data with information about his personal data, as well as about the provision of his personal data to third parties, except in cases provided for by legislative acts;
8.1.6. To stop processing personal data, as well as to delete or block them in the absence of grounds for processing personal data provided for by legislative acts;
8.1.7. Notify the authorized body for the protection of the rights of personal data subjects of violations of personal data protection systems immediately, but no later than three working days after the operator became aware of such violations, except in cases provided for by the authorized body for the protection of the rights of personal data subjects;
8.1.8. To modify, block or delete unreliable or illegally obtained personal data of a personal data subject at the request of the authorized body for the protection of the rights of personal data subjects, unless another procedure for making changes to personal data, blocking or deleting them is established by legislative acts;
8.1.9. Comply with other requirements of the authorized body for the protection of the rights of personal data subjects on the elimination of violations of the legislation on personal data;
8.1.10. Perform other duties provided for by legislative acts;
8.1.11. The Operator is obliged to provide unrestricted access, including through the use of the global computer network Internet, to documents defining the policy of the operator (authorized person) regarding the processing of personal data, prior to the start of such processing.
8.2. In case of receiving a request from a personal data subject, the operator is obliged to:
to provide the subject of personal data with the opportunity to get acquainted with full information about his personal data processed by the operator;
make changes to the personal data of the subject if there is information confirming that the processed personal data is incomplete, outdated, inaccurate;
to terminate the processing of personal data and delete them (to ensure the termination of the processing of personal data, as well as their deletion by an authorized person) upon his written request in cases where personal data is illegally obtained or is not necessary for the stated purpose of processing, as well as in the case of withdrawal by the subject of consent to the processing of his personal data, in the absence of the operator legal grounds for continuing the processing of personal data;
notify the subject of personal data about the results of the actions requested by the subject in the manner and within the time limits provided for by the legislation of the Republic of Belarus.
8.3. In order to respond to the requests of the personal data subject, the operator may request additional information from the personal data subject.
9. The exercise by the personal data subject of the right to revoke the consent of the personal data subject, the right to receive information regarding the processing of personal data and changes to personal data, the right to receive information about the provision of personal data to third parties and the right to demand the termination of the processing of personal data and (or) their deletion.
9.1. The subject of personal data has the right to withdraw his consent at any time without explanation by submitting an application to the operator, or in the form by which his consent was obtained.
9.2. The subject of personal data has the right to receive information regarding the processing of his personal data specified in clause 7.1. of this Policy.
9.3. The subject of personal data has the right to receive information from the operator about the provision of his personal data to third parties once a calendar year for free, unless otherwise provided by legislative acts.
9.4. The personal data subject, in order to exercise his rights to revoke the consent of the personal data subject, the right to receive information regarding the processing of personal data and changes to personal data, the right to receive information about the provision of personal data to third parties and the right to demand the termination of the processing of personal data and (or) their deletion, submits an application to the operator in writing in the form by sending a registered mail to the postal address: 220125, Minsk st. Gorodetskaya, 38a-29, or in the form of an electronic document* (* - the requirements for an electronic document are established in the Law of the Republic of Belarus No. 113-Z dated December 28, 2009 "On electronic document and electronic digital signature"). Legislative acts may provide for the mandatory personal presence of the subject of personal data and the presentation of an identity document when submitting an application to the operator in writing.
9.5. The statement of the personal data subject must contain:
the surname, proper name, patronymic (if any) of the subject of personal data, the address of his place of residence (place of stay);
date of birth of the personal data subject;
the identification number of the personal data subject, in the absence of such a number — the number of the identity document of the personal data subject, in cases where this information was indicated by the personal data subject when giving his consent to the operator or the processing of personal data is carried out without the consent of the personal data subject;
statement of the essence of the requirements of the personal data subject;
a personal signature or an electronic digital signature of the subject of personal data.
9.6. In the absence of the technical possibility of deleting personal data, the operator is obliged to take measures to prevent further processing of personal data, including blocking them, and notify the subject of personal data about this within the same period.
9.7. The Operator has the right to refuse to satisfy the personal data subject's demands to terminate the processing of his personal data and (or) delete them if there are grounds for processing personal data provided for by legislative acts, including if they are necessary for the stated purposes of their processing, with notification of the personal data subject.
9.8. Revocation of the consent of the personal data subject is not retroactive.
10. Terms of personal data processing
10.1. The terms of processing, including storage, of personal data of the operator's employees and other subjects of personal data on paper and other tangible media, as well as in personal data information systems, are determined by the operator in accordance with the legislation of the Republic of Belarus.
10.2. If the terms of processing of personal data are not established by law, their processing and storage are carried out no longer than the purposes of processing, including storage, of personal data require.
10.3. The Operator stops processing personal data if:
the purpose of processing, including storage, of personal data has been achieved;
the validity period of the subject's consent has expired or the subject has withdrawn consent to the processing of personal data and the operator has no other grounds for processing personal data provided for by the legislation of the Republic of Belarus;
illegal processing of personal data has been detected;
the operator's activity has been terminated.
11. Responsibility for violation of the legislation on personal data protection. The right to appeal against the actions (inaction) and decisions of the operator related to the processing of personal data
11.1. Persons guilty of violating the provisions of the legislation of the Republic of Belarus and local regulations of the operator in the field of personal data bear disciplinary, administrative and civil liability in accordance with the legislation of the Republic of Belarus.
11.2. Personal responsibility for compliance with the requirements of the legislation of the Republic of Belarus and local regulations of the operator in the field of personal data is assigned to persons authorized to process personal data from the operator.
11.3. Moral damage caused to the subject of personal data as a result of violation of his rights established by legislative acts is subject to compensation. Compensation for moral damage is carried out regardless of compensation for property damage and losses incurred by the subject of personal data.
11.4. The subject of personal data has the right to appeal the actions (inaction) and decisions of the operator that violate his rights when processing personal data to the authorized body for the protection of the rights of personal data subjects in accordance with the procedure established by the legislation on appeals of citizens and legal entities.
11.5. The decision adopted by the authorized body for the protection of the rights of personal data subjects may be appealed by the personal data subject to the court in accordance with the procedure established by law.
12. Final provisions
12.1. This Policy is publicly available. Unrestricted access to this Policy is provided by publishing it on the official website of the KAMAKO PRODCENTER Trading Unitary Enterprise: https://kamako.by/
12.2. Persons whose personal data is processed by the operator may receive clarifications on the processing of their personal data by sending a corresponding written request to the postal address: 38a-29 Gorodetskaya str., Minsk, 220125 or by e-mail: [email protected].
12.3. Issues related to the processing of personal data that are not fixed in this Policy are regulated by the legislation of the Republic of Belarus.
12.4. If any of the provisions of this Policy is found to be contrary to the law, the remaining provisions corresponding to it remain in force and are valid.
12.5. The Operator has the right, at its discretion and at any time, to change, supplement and (or) delete the terms of this Policy without notifying the subjects of personal data. The current version of the Policy is available at: 38a-29 Gorodetskaya str., Minsk, 220125 or on the website https://kamako.by/.