User agreement and personal data policy

Regulation on the processing and protection of personal data in personal data databases owned by the seller

Contents

1. General terms and scope
2. List of personal data databases
3. Purpose of personal data processing
4. Personal data processing procedure: obtaining consent, notification of rights and actions with the data subject's personal data
5. Location of the personal data database
6. Conditions for disclosing personal data to third parties
7. Personal data protection: methods of protection, the responsible person, employees who directly process and/or have access to personal data in the course of their duties, personal data retention period
8. Rights of the personal data subject
9. Procedure for handling requests from the personal data subject

1. General terms and scope

1.1. Definitions:

personal data database — a named set of organised personal data in electronic form and/or in the form of personal data filing systems;

responsible person — a designated person who organises work related to the protection of personal data during processing in accordance with the law;

owner of a personal data database — a natural or legal person who has been granted the right to process such data by law or with the consent of the personal data subject, who approves the purpose of processing personal data in that database and determines the composition of the data and the procedures for processing them, unless otherwise provided by law;

publicly available sources of personal data — directories, address books, registers, lists, catalogues and other systematic collections of open information containing personal data that have been placed and published with the knowledge of the personal data subject. Social networks and online resources where personal data subjects leave their personal data are not considered publicly available sources of personal data (except where the personal data subject has expressly stated that the personal data were placed for free dissemination and use);

consent of the personal data subject — any documented, voluntary expression of will by a natural person to permit the processing of their personal data in accordance with the stated purpose of processing;

depersonalisation of personal data — removal of information that makes it possible to identify a person;

processing of personal data — any action or set of actions performed wholly or partly in an information (automated) system and/or in personal data filing systems that relate to the collection, registration, accumulation, storage, adaptation, alteration, updating, use and dissemination (distribution, sale, transfer), depersonalisation and destruction of information about a natural person;

personal data — information or a set of information about a natural person who is identified or can be specifically identified;

manager of a personal data database — a natural or legal person who has been granted the right to process such data by the database owner or by law. A person instructed by the owner and/or manager of the personal data database to perform technical work with the database without access to the content of the personal data is not a manager of the database;

personal data subject — a natural person whose personal data are processed in accordance with the law;

third party — any person other than the personal data subject, the owner or manager of the personal data database and the authorised state body for personal data protection, to whom the owner or manager of the personal data database transfers personal data in accordance with the law;

special categories of data — personal data revealing racial or ethnic origin, political, religious or philosophical beliefs, membership of political parties and trade unions, as well as data concerning health or sex life.

1.2. This Regulation is binding on the responsible person and on the seller's employees who directly process and/or have access to personal data in the course of their duties.

2. List of personal data databases

2.1. The seller owns the following personal data databases:

• counterparty personal data database.

3. Purpose of personal data processing

3.1. The purpose of processing personal data in the system is to ensure civil-law relations, the provision and receipt of goods and services and settlements for them in accordance with the Tax Code of Ukraine and the Law of Ukraine "On Accounting and Financial Reporting in Ukraine".

4. Personal data processing procedure: obtaining consent, notification of rights and actions with the data subject's personal data

4.1. Consent of the personal data subject must be a voluntary expression of will by a natural person to permit the processing of their personal data in accordance with the stated purpose of processing.

4.2. Consent of the personal data subject may be given in the following forms:

• a paper document with details that make it possible to identify the document and the natural person;
• an electronic document that must contain mandatory details making it possible to identify the document and the natural person. It is advisable to certify the natural person's voluntary consent to the processing of their personal data with the personal data subject's electronic signature;
• a mark on an electronic page of a document or in an electronic file processed in an information system based on documented software and hardware solutions.

4.3. Consent of the personal data subject is given when civil-law relations are formalised in accordance with current legislation.

4.4. The personal data subject is notified of the inclusion of their personal data in the personal data database, of the rights set out in the Law of Ukraine "On Personal Data Protection", of the purpose of data collection and of the persons to whom their personal data are transferred when civil-law relations are formalised in accordance with current legislation.

4.5. Processing of personal data revealing racial or ethnic origin, political, religious or philosophical beliefs, membership of political parties and trade unions, as well as data concerning health or sex life (special categories of data), is prohibited.

5. Location of the personal data database

5.1. The personal data databases listed in section 2 of this Regulation are located at the seller's address.

6. Conditions for disclosing personal data to third parties

6.1. The procedure for third-party access to personal data is determined by the terms of the consent given by the personal data subject to the owner of the personal data for their processing, or in accordance with the requirements of the law.

6.2. Access to personal data is not granted to a third party if that party refuses to undertake to ensure compliance with the Law of Ukraine "On Personal Data Protection" or is unable to ensure such compliance.

6.3. A party to relations involving personal data submits a request for access (hereinafter, the request) to personal data to the owner of the personal data.

6.4. The request must state:

• the surname, first name and patronymic, place of residence (place of stay) and details of the identity document of the natural person submitting the request (for a natural person applicant);
• the name and location of the legal entity submitting the request, the position, surname, first name and patronymic of the person certifying the request, and confirmation that the content of the request falls within the powers of the legal entity (for a legal entity applicant);
• the surname, first name and patronymic, as well as other information that makes it possible to identify the natural person to whom the request relates;
• information about the personal data database to which the request relates, or information about the owner or manager of that database;
• the list of personal data requested;
• the purpose and/or legal grounds for the request.

6.5. A request must be reviewed within no more than ten working days of its receipt. Within this period, the owner of the personal data database informs the requester that the request will be granted or that the relevant personal data cannot be provided, stating the grounds set out in the relevant legal act. The request is granted within thirty calendar days of its receipt, unless otherwise provided by law.

6.6. Access to personal data by third parties may be deferred if the necessary data cannot be provided within thirty calendar days of receipt of the request. In that case, the total time for resolving the issues raised in the request may not exceed forty-five calendar days.

6.7. Notice of deferral is given to the third party who submitted the request in writing, explaining how the decision can be appealed.

6.8. The notice of deferral states:

• the surname, first name and patronymic of the official;
• the date the notice was sent;
• the reason for the deferral;
• the period within which the request will be granted.

6.9. Access to personal data may be refused if access to them is prohibited by law.

6.10. The notice of refusal states:

• the surname, first name and patronymic of the official refusing access;
• the date the notice was sent;
• the reason for the refusal.

6.11. A decision to defer or refuse access to personal data may be appealed in court.

7. Personal data protection: methods of protection, the responsible person, employees who directly process and/or have access to personal data in the course of their duties, personal data retention period

7.1. The owner of the personal data database is equipped with system, software and hardware tools and means of communication that prevent loss, theft, unauthorised destruction, distortion, forgery and copying of information and comply with international and national standards.

7.2. The responsible person organises work related to the protection of personal data during processing in accordance with the law. The responsible person is appointed by order of the owner of the personal data database.

The responsible person's duties in organising work related to the protection of personal data during processing are set out in their job description.

7.3. The responsible person must:

• know the legislation of Ukraine on personal data protection;
• develop procedures for employee access to personal data in line with their professional, official or employment duties;
• ensure that the employees of the owner of the personal data database comply with the legislation of Ukraine on personal data protection and with the internal documents governing the owner's activities in processing and protecting personal data in personal data databases;
• develop a procedure for internal control over compliance with the legislation of Ukraine on personal data protection and with the internal documents governing the owner's activities in processing and protecting personal data in personal data databases, which in particular must set out how often such control is carried out;
• notify the owner of the personal data database of any breaches by employees of the legislation of Ukraine on personal data protection and of the internal documents governing the owner's activities in processing and protecting personal data in personal data databases no later than one working day after such breaches are detected;
• ensure the storage of documents confirming that the personal data subject has consented to the processing of their personal data and has been notified of their rights.

7.4. To perform their duties, the responsible person has the right to:

• receive the necessary documents, including orders and other administrative documents issued by the owner of the personal data database relating to the processing of personal data;
• make copies of documents received, including copies of files and any records stored in local area networks and stand-alone computer systems;
• take part in discussions of their duties in organising work related to the protection of personal data during processing;
• submit proposals for improving activities and working methods, and submit comments and options for eliminating shortcomings identified in the processing of personal data;
• receive explanations on matters of personal data processing;
• sign and endorse documents within their competence.

7.5. Employees who directly process and/or have access to personal data in the course of their official (employment) duties must comply with the legislation of Ukraine on personal data protection and with internal documents on the processing and protection of personal data in personal data databases.

7.6. Employees who have access to personal data, including those who process them, must not disclose in any way personal data entrusted to them or that became known to them in the course of their professional, official or employment duties. This obligation remains in force after they cease activities involving personal data, except as provided by law.

7.7. Persons who have access to personal data, including those who process them, are liable under the legislation of Ukraine if they breach the Law of Ukraine "On Personal Data Protection".

7.8. Personal data must not be kept longer than necessary for the purpose for which they are stored, and in any case no longer than the retention period set by the personal data subject's consent to the processing of such data.

8. Rights of the personal data subject

8.1. The personal data subject has the right to:

• know the location of the personal data database containing their personal data, its purpose and name, and the location and/or place of residence (stay) of the owner or manager of that database, or authorise persons to obtain this information on their behalf, except as provided by law;
• receive information on the conditions of access to personal data, in particular information about third parties to whom their personal data contained in the relevant personal data database are transferred;
• access their personal data contained in the relevant personal data database;
• receive, no later than thirty calendar days after the request is received, except as provided by law, an answer as to whether their personal data are stored in the relevant personal data database, and receive the content of their stored personal data;
• submit a reasoned objection to the processing of their personal data by state authorities and local self-government bodies in the exercise of their powers provided by law;
• submit a reasoned demand to any owner or manager of the database to change or destroy their personal data if these data are processed unlawfully or are inaccurate;
• protection of their personal data from unlawful processing and accidental loss, destruction or damage due to deliberate concealment, failure to provide or late provision, as well as protection from the provision of information that is inaccurate or discredits the honour, dignity and business reputation of the natural person;
• apply on matters of protecting their rights regarding personal data to state authorities and local self-government bodies whose powers include personal data protection;
• use legal remedies in the event of a breach of personal data protection legislation.

9. Procedure for handling requests from the personal data subject

9.1. The personal data subject has the right to obtain any information about themselves from any party to relations involving personal data without stating the purpose of the request, except as provided by law.

9.2. The personal data subject's access to data about themselves is free of charge.

9.3. The personal data subject submits a request for access (hereinafter, the request) to personal data to the owner of the personal data database.

The request must state:

• the surname, first name and patronymic, place of residence (place of stay) and details of the identity document of the personal data subject;
• other information that makes it possible to identify the personal data subject;
• information about the personal data database to which the request relates, or information about the owner or manager of that database;
• the list of personal data requested.

9.4. A request must be reviewed within no more than ten working days of its receipt. Within this period, the owner of the personal data database informs the personal data subject that the request will be granted or that the relevant personal data cannot be provided, stating the grounds set out in the relevant legal act.

9.5. The request is granted within thirty calendar days of its receipt, unless otherwise provided by law.