Privacy Policy

Regulations on the Processing and Protection of Personal Data in Personal Data Databases Owned by the Seller

General concepts and scope of application
List of personal data databases
Purpose of personal data processing
Procedure for personal data processing: obtaining consent, informing data subjects about their rights and actions involving their personal data
Location of personal data databases
Conditions for disclosing personal data to third parties
Personal data protection: protection methods, responsible person, employees who directly process and/or have access to personal data in connection with their duties, and data retention period
Rights of the personal data subject
Procedure for handling requests from personal data subjects
State registration of personal data databases

1. General Concepts and Scope of Application

1.1. Definitions:

personal data database means a named set of organized personal data in electronic form and/or in the form of personal data files;

responsible person means a designated person who organizes work related to the protection of personal data during its processing in accordance with the law;

owner of a personal data database means an individual or legal entity that, by law or with the consent of the personal data subject, has been granted the right to process such data, determines the purpose of processing personal data in this database, defines the composition of such data and procedures for its processing, unless otherwise provided by law;

State Register of Personal Data Databases means the unified state information system for collecting, accumulating and processing information about registered personal data databases;

publicly available sources of personal data include directories, address books, registers, lists, catalogs and other organized collections of open information containing personal data published with the knowledge of the personal data subject. Social networks and internet resources where a personal data subject leaves personal data are not considered publicly available sources, except where the subject expressly states that the data may be freely distributed and used;

consent of the personal data subject means any documented, voluntary expression of will by an individual regarding permission to process their personal data in accordance with the stated purpose of processing;

depersonalization of personal data means removal of information that allows a person to be identified;

processing of personal data means any action or set of actions performed fully or partially in an information system and/or in personal data files, including collection, registration, accumulation, storage, adaptation, alteration, use, dissemination, depersonalization and destruction of personal data;

personal data means information or a set of information about an individual who is identified or can be specifically identified;

manager of a personal data database means an individual or legal entity authorized by the owner of the personal data database or by law to process such data. A person entrusted by the owner and/or manager of the database with technical work on the database without access to the content of personal data is not considered a manager;

personal data subject means an individual whose personal data is processed;

third party means any person, except the personal data subject, the owner or manager of the personal data database, and the authorized state body for personal data protection, to whom the owner or manager transfers personal data in accordance with the law.

1.2. This Regulation is mandatory for the responsible person and employees of the seller who directly process and/or have access to personal data in connection with the performance of their official duties.

2. List of Personal Data Databases

2.1. The seller owns and processes the following personal data database:

database of contractors’ personal data.

3. Purpose of Personal Data Processing

3.1. Personal data is processed to ensure the implementation of civil law, business and tax relations, accounting and reporting, and other relations governed by the Tax Code of Ukraine, the Commercial Code of Ukraine and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine”.

4. Procedure for Personal Data Processing

4.1. The personal data subject must voluntarily provide the owner with consent to the processing of personal data according to the specified purpose of processing.

4.2. Consent may be provided in the following forms:

a document on paper containing details that allow the document and the individual to be identified;
an electronic document containing mandatory details that allow the document and the individual to be identified;
a mark on an electronic page of a document or electronic file processed in an information system based on documented technical solutions.

4.3. Consent is valid until the purpose for which the personal data was processed is achieved or until it is withdrawn in accordance with the law.

4.4. The personal data subject is informed about their rights, the purpose of data collection and the persons to whom personal data may be transferred within the time and in the manner required by the Law of Ukraine “On Personal Data Protection”.

4.5. Processing of personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in political parties or professional unions, as well as data concerning health or sexual life, is prohibited except in cases expressly provided by law.

5. Location of Personal Data Databases

5.1. The personal data databases specified in Section 2 of this Regulation are located at the seller’s business address.

6. Conditions for Disclosing Personal Data to Third Parties

6.1. Access to personal data by third parties is granted in accordance with the consent provided by the personal data subject or as required by law.

6.2. Access is not granted to third parties who refuse to undertake obligations to ensure compliance with the requirements of the Law of Ukraine “On Personal Data Protection” or are unable to ensure such compliance.

6.3. A request for access to personal data must be submitted to the owner of the personal data database.

6.4. The request must include:

the surname, first name and patronymic, place of residence and details of the identity document of the individual submitting the request;
the name, location and code of the legal entity submitting the request;
the surname, first name and patronymic and other information that allows identification of the individual whose personal data is requested;
information about the personal data database from which data is requested;
the list of personal data requested;
the purpose and/or legal grounds for the request.

6.5. The request is reviewed within the period established by law. During this period, the owner informs the requester whether the request will be satisfied or whether the requested personal data cannot be provided.

6.6. The personal data subject has the right to receive information about themselves from any data controller, provided that the request contains the information required for identification, except in cases established by law.

7. Personal Data Protection

7.1. The owner of the personal data database is equipped with system, software and technical means of communication that prevent loss, theft, unauthorized destruction, distortion, forgery, copying and other unauthorized access to personal data, and comply with international and national standards.

7.2. The responsible person organizes work related to the protection of personal data during processing in accordance with the law. The responsible person is appointed by order of the owner of the personal data database.

The responsible person must:

know the legislation of Ukraine in the field of personal data protection;
develop procedures for accessing personal data by employees in accordance with their professional or official duties;
ensure compliance by employees with the requirements of Ukrainian legislation and internal documents regarding personal data protection;
develop an internal control procedure for compliance with personal data protection requirements;
notify the owner of facts of violations by employees of personal data protection requirements within one business day from the date such violations are detected;
ensure storage of documents confirming that the personal data subject has given consent to the processing of personal data.

7.3. Employees who directly process or have access to personal data in connection with their duties must comply with Ukrainian legislation on personal data protection and internal documents on personal data processing and protection.

7.4. Employees who have access to personal data must not disclose personal data entrusted to them or learned in connection with the performance of their professional or official duties. This obligation remains in force after the termination of their employment or service.

7.5. Persons who have access to personal data must not allow disclosure of such data in any manner if they become aware that the data was entrusted to them or became known in connection with professional, official or employment duties.

7.6. Personal data shall not be stored longer than necessary for the purpose for which it is processed, unless otherwise provided by law.

7.7. Personal data shall be destroyed in accordance with the procedure established by law.

7.8. Personal data must be stored in a manner that prevents unauthorized access.

8. Rights of the Personal Data Subject

8.1. The personal data subject has the right to:

know the location of the personal data database containing their personal data, its purpose and name, and the location and/or place of residence of the owner or manager of the database;
receive information about the conditions of access to personal data, including information about third parties to whom their personal data is transferred;
have access to their personal data;
receive a response within the time limits established by law as to whether their personal data is being processed, and receive the content of such personal data;
submit a reasoned request to the owner of the personal data database objecting to the processing of their personal data;
submit a reasoned request to amend or destroy their personal data if such data is processed unlawfully or is inaccurate;
protect their personal data from unlawful processing and from accidental loss, destruction or damage due to intentional concealment, failure to provide or late provision, and to protect against inaccurate or defamatory information;
appeal to state authorities and officials authorized to protect personal data rights;
apply legal remedies in case of violation of personal data protection legislation.

9. Procedure for Handling Requests from Personal Data Subjects

9.1. The personal data subject may receive information about themselves from any entity related to personal data processing without specifying the purpose of the request, except in cases established by law.

9.2. Access to personal data is provided free of charge.

9.3. The personal data subject submits a request for access to personal data to the owner of the personal data database.

The request must include:

the surname, first name and patronymic, place of residence and details of the identity document of the personal data subject;
other information that allows the personal data subject to be identified;
information about the personal data database in relation to which the request is submitted;
the list of personal data requested.

9.4. The response period may not exceed the time limits established by law. The owner of the personal data database provides a response stating whether the personal data is processed and provides the requested data or a reasoned refusal.

9.5. The request is satisfied within the time limits established by law, unless otherwise provided by law.

10. State Registration of Personal Data Databases

10.1. State registration of personal data databases is carried out in accordance with Article 9 of the Law of Ukraine “On Personal Data Protection”.