Privacy Policy

1. General Provisions.

 

1.1. This Policy on the processing of personal data (hereinafter referred to as the Policy) defines the activities of TUP "BelPAM" registered at the address: Republic of Belarus, 225710, Pinsk, pr-d Kalinovskogo, 2, postal address: Republic of Belarus, 225710, Pinsk, pr-d Kalinovskogo, 2 (hereinafter referred to as the Company or the Operator) in relation to the processing of personal data.

 

1.2. This Policy has been developed in compliance with the requirements of the Law of the Republic of Belarus dated 07.05.2021 No. 99-3 "On the Protection of Personal Data" (hereinafter referred to as the Law).

 

1.3. Concepts contained in Art. 1 of the Law, are used in this Policy with the same meaning: biometric personal data - information characterizing the physiological and biological characteristics of a person, which is used for his unique identification (fingerprints, palms, iris, facial characteristics and its image, etc.);

• blocking of personal data - termination of access to personal data without deleting them;
• depersonalization of personal data - actions as a result of which it becomes impossible to determine the ownership of personal data by a specific subject of personal data without the use of additional information;
• processing of personal data - any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion of personal data;
• publicly available personal data - personal data disseminated by the subject of personal data himself or with his consent or disseminated in accordance with the requirements of legislative acts;
• operator - a transport unitary enterprise that independently or jointly with other persons organizes and (or) carries out the processing of personal data;
• personal data - any information related to an identified individual or an individual who can be identified;
• provision of personal data - actions aimed at familiarizing a specific individual or group of individuals with personal data;
• dissemination of personal data - actions aimed at familiarizing an indefinite group of individuals with personal data;
• special personal data - personal data related to racial or national affiliation, political views, membership in trade unions, religious or other beliefs, health or sex life, administrative or criminal liability, as well as biometric and genetic personal data;
• subject - an individual in respect of whom personal data are processed;
• cross-border transfer of personal data - transfer of personal data to the territory of a foreign state;
• deletion of personal data - actions as a result of which it becomes impossible to restore personal data in information resources (systems) containing personal data, and (or) as a result of which the tangible carriers of personal data are destroyed;
• authorized person - a state body, a legal entity of the Republic of Belarus, another organization, an individual who, in accordance with a legislative act, a decision of a state body that is an operator, or on the basis of an agreement with the Company, process personal data on behalf of the Transport Unitary Company or in its interests;
• an individual who can be identified - an individual who can be directly or indirectly determined, in particular through their last name, first name, patronymic, date of birth, identification number, or through one or more features characteristic of their physical, psychological, mental, economic, cultural or social identity.

 

1.4. The following terms are used in this Policy:

 

Services are any services, products, programs, events, services of the Company (including, but not limited to, Bitrix, iSpring, etc.).

 

Websites – belpam.com and other websites owned by the Company, subdomains of these websites, as well as other services with which the company works.

 

1.5. This Policy applies to all operations performed by the Operator with personal data using automation tools or without them.

 

1.6. This Policy comes into force from the moment of its approval.

 

2. Categories of personal data subjects and the volume of personal data processed.

 

2.1. The Operator processes personal data that may be received from the following subjects of personal data:

• Company members and affiliates of the Company;
• Company employees, former employees, candidates for vacant positions;
• Company counterparties and clients who are individuals; representatives and/or employees of the Company counterparties and clients who are legal entities or individual entrepreneurs; visitors to the Company's Websites and Services;
• persons who have provided the Company with personal data by subscribing to the mailing list, sending reviews, requests, by filling out questionnaires during advertising and other events held by the Company;
• persons who have provided the Company with personal data in other ways.

 

2.2. The Operator processes the following personal data of the personal data subject:

• last name, first name, patronymic; gender;
• date of birth;
• e-mail address;
• phone number;
• place of residence;
• occupation (specialty, area of ​​professional knowledge);
• place of work;
• history of requests and views on the Company's Websites and Services;
• data contained in an identity document;
• data contained in a military registration document;
• data contained in an education document;
• data contained in a work record book;
• data contained in an autobiography and references from previous places of work;
• data obtained to create a personal file;
• data contained in an insurance certificate and other documents confirming circumstances related to work, the presentation of which is required by law;
• other information (the specified list may be shortened or expanded depending on the specific case and the purposes of processing).

 

2.3. To analyze the operation of the Sites and Services, the Operator processes the following data:

• IP address;
• browser information;
• cookie data;
• addresses of requested pages;
• access time.

 

2.4. The Operator shall ensure that the content and volume of the processed personal data correspond to the stated purposes of processing and, if necessary, shall take measures to eliminate their redundancy in relation to the stated purposes of processing.

 

2.5. The Operator shall process biometric personal data only with the consent of the personal data subject or without consent in other cases stipulated by the legislation of the Republic of Belarus.

 

2.6. The Operator shall not process special personal data related to race, nationality, political views, membership in trade unions, religious and other beliefs, health, sexual life, administrative or criminal liability, except for cases when the personal data subject has independently provided such data to the Operator, or they have become known to the Operator in accordance with the legislation of the Republic of Belarus.

 

2.7. The Operator, if necessary to achieve the purposes of processing, has the right to transfer personal data to third parties in compliance with the requirements of the legislation of the Republic of Belarus.

 

3. Purposes of collecting personal data.

 

3.1. The Operator processes personal data for the following purposes:

• communication with personal data subjects; execution of various transactions with personal data subjects, their subsequent execution, and, if necessary, modification and termination (termination);
• provision of the Company's Services to personal data subjects;
• provision of information to personal data subjects about the Company's activities, about the development of new Sites and Services by the Company;
• sending notifications, commercial offers, advertising and informational messages to personal data subjects;
• conducting promotions, surveys, interviews, testing by the Company on the Company's Sites and Services;
• assessment and analysis of the Company's Services, control and improvement of the Company's Services quality;
• informing about the operation of the Company's Sites;
• registration and maintenance of accounts on the Company's Sites and Services;
• processing of requests and inquiries received from personal data subjects;
• attracting candidates for vacant positions in the Company;
• conducting personnel work and organizing the accounting of the Company's employees;
• formation of statistical reports, conducting research;
• implementation of economic activities;
• implementation of other powers and duties imposed on the Operator by the legislation of the Republic of Belarus.

 

4. Basic rights and obligations of the operator and subject of personal data.

 

4.1. The Operator has the right to:

• receive reliable information and/or documents containing personal data from the personal data subject;
• request information from the personal data subject about the relevance and reliability of the personal data provided;
• refuse the personal data subject's requests to terminate the processing of his/her personal data and/or delete them if there are grounds for processing stipulated by the legislation of the Republic of Belarus, including if they are necessary for the stated purposes of their processing.

 

4.2. The Operator is obliged to:

• explain to the Subject his/her rights related to the processing of personal data;
• obtain the consent of the Subject, except for cases stipulated by legislative acts;
• process personal data in the manner established by the legislation of the Republic of Belarus;
• ensure the protection of personal data in the process of their processing;
• take measures to ensure the reliability of the personal data processed by him/her, make changes to personal data that are incomplete, outdated or inaccurate;
• consider applications from personal data subjects on issues of personal data processing and give reasoned responses to them;
• provide the personal data subject with information about his personal data, about their provision to third parties;
• make changes to personal data that are incomplete, outdated or inaccurate, except for cases when another procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not imply subsequent changes to such data;
• change, block or delete inaccurate or illegally obtained personal data of the Subject at the request of the authorized body for the protection of the rights of personal data subjects, unless another procedure for making changes to personal data, their blocking or deletion is established by legislative acts;
• stop processing personal data, as well as delete or block them in the absence of grounds for their processing, as well as at the request of the personal data subject;
• fulfill other obligations stipulated by the legislation of the Republic of Belarus.

 

4.3. The personal data subject has the right:

• to receive information regarding the processing of his/her personal data by the Operator;
• to make changes to his/her personal data if the personal data is incomplete, outdated or inaccurate;
• to revoke his/her consent to the processing of personal data;
• to receive information about the provision of his/her personal data to third parties;
• to terminate the processing of his/her personal data, including their deletion, if there are no grounds for their processing;
• to appeal the actions/inactions and decisions of the Operator related to the processing of his/her personal data to the authorized body for the protection of the rights of personal data subjects in the manner prescribed by law;
• to exercise other rights stipulated by the legislation of the Republic of Belarus.

 

4.4. The personal data subject is obliged to:

• provide the Operator with only reliable information about himself/herself;
• if necessary, provide the Operator with documents containing personal data in the amount necessary for the purpose of their processing;
• to inform the Operator of changes to his/her personal data.

 

4.5. A person who has provided the Operator with incomplete, outdated, or inaccurate information about himself or herself, or information about another subject of personal data without the latter’s consent, shall be liable in accordance with the legislation of the Republic of Belarus.

 

5. Consent of the personal data subject. Procedure and conditions for processing personal data.

 

5.1. The basis for processing personal data is the consent of the personal data subject, except for cases established by the legislation of the Republic of Belarus, when the processing of personal data is carried out without obtaining such consent.

 

5.2. The consent of the personal data subject is a free, unambiguous, informed expression of his will, by which he allows the processing of his personal data.

 

The consent of the Subject can be obtained in writing, in the form of an electronic document or in another electronic form.

 

In another electronic form, the consent of the Subject can be obtained by:

 

• indication (selection) by the personal data subject of certain information (code) after receiving a SMS message, a message to the e-mail address;
• putting the appropriate mark on the Internet resource by the personal data subject;
• other methods that make it possible to establish the fact of obtaining the consent of the personal data subject.

 

5.3. Before receiving the consent of the personal data subject, the Company is obliged to provide the personal data subject with information in writing or electronic form corresponding to the form of expression of such consent, containing:

• name and location of the Company;
• purposes of personal data processing;
• list of personal data for the processing of which the consent of the personal data subject is given;
• term for which the consent of the Subject is given;
• information on authorized persons if the personal data will be processed by such persons;
• list of actions with personal data for which the consent of the Subject is given, general description of the methods of personal data processing used by the Company;
• other information necessary to ensure transparency of the personal data processing process.

 

Before receiving the consent of the Subject, the Transport Unitary Enterprise shall explain to the Subject in simple and clear language his rights related to the processing of personal data, the mechanism for exercising such rights, as well as the consequences of the consent of the Subject or refusal to give such consent. This information must be provided to the Subject in written or electronic form, corresponding to the form of expression of his consent, separately from other information provided to him.

 

5.4. When giving consent to the Company, the Subject shall indicate his/her last name, first name, patronymic (if any), date of birth, identification number, and in the absence of such number, the number of the document proving his/her identity, except for the case provided for in part two of this paragraph.

 

If the purposes of processing personal data do not require processing the information specified in part one of this paragraph, this information shall not be processed by the Transport Unitary Enterprise upon receipt of the Subject's consent.

 

5.5. The burden of proof of receipt of the Subject's consent rests with the Operator. Refusal to give consent to the processing of personal data entitles the Operator to deny the subject of personal data access to the Company's Websites and Services.

 

5.6. The processing of personal data by the Operator includes the following actions with personal data: collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion, and other actions in accordance with the legislation of the Republic of Belarus.

 

5.7. Methods of personal data processing by the Operator:

• non-automated processing of personal data;
• automated processing of personal data with or without the transfer
• of received information via information and telecommunications networks;
• mixed processing of personal data.

 

5.8. Personal data shall be stored in a form that allows the identification of the subject of personal data, for a period no longer than required by the purposes of personal data processing, except for cases when the storage period of personal data is established by the legislation of the Republic of Belarus, an agreement concluded (being concluded) with the subject of personal data, for the purpose of performing the actions established by this agreement.

 

5.9. The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, the expiration of the personal data processing period, the revocation of the consent of the subject of personal data to the processing of his personal data, as well as the detection of illegal processing of personal data.

 

5.10. When processing personal data, the Operator takes the necessary legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other illegal actions in relation to personal data.

 

5.11 The Transport Unitary Enterprise processes special personal data exclusively for the purposes specified in paragraph 3.1. of this Policy. The Transport Unitary Enterprise may also process biometric personal data for the purposes specified in paragraph 3.1. of this Policy.

 

5.12. The processing of special, including biometric, personal data is permitted only if a set of measures is taken to prevent risks that may arise during the processing of such personal data for the rights and freedoms of personal data subjects.

 

5.13. The Company does not carry out cross-border transfer of personal data if the territory of a foreign state does not ensure an adequate level of protection of the rights of personal data subjects, except for cases established by law.

 

6. Mechanism for implementing the rights of the subject of personal data.

 

6.1. The personal data subject has the right to revoke their consent to the processing of personal data by submitting a written application to the Operator sent by registered mail or in the form of an electronic document. The application must contain:

• last name, first name, patronymic name of the personal data subject;
• address of place of residence (place of stay);
• date of birth;
• identification number (if specified when giving consent or personal data is processed without the consent of the personal data subject);
• statement of the essence of the requirement;
• personal signature or electronic digital signature.

The Operator, within 15 days after receiving the application, stops processing personal data (if there are no grounds for processing, in accordance with the law), deletes them, and if there is no technical possibility of deletion, takes measures to prevent further processing of personal data, including blocking them, and notifies the personal data subject about this within the same period.

 

6.2. The personal data subject has the right to obtain information from the Operator regarding the processing of their personal data by submitting an application to the Operator in the manner prescribed by paragraph 6.1 of these Rules. Within 5 working days after receiving the application, the Operator provides the personal data subject with the relevant information or notifies them of the reasons for refusing to provide such information.

 

6.3. The personal data subject has the right to demand that the Operator make changes to their personal data if they are incomplete, outdated or inaccurate by submitting an application to the Operator in the manner prescribed by paragraph 6.1 of these Rules, with attached documents (copies certified in the established manner) confirming the need to make such changes. Within 15 days after receiving the application, the Operator makes changes to the personal data and notifies the personal data subject about this or notifies them of the reasons for refusing to make changes.

 

6.4. The personal data subject has the right to receive information from the Operator about the provision of their personal data to third parties once per calendar year free of charge, by submitting an application to the Operator in the manner prescribed by clause 6.1 of these Rules. Within 15 days after receiving the application, the Operator provides the personal data subject with information about which personal data of this subject and to whom were provided during the year preceding the date of filing the application, or notifies him of the reasons for refusing to provide such information.

 

6.5. The personal data subject has the right to demand that the Operator stop processing their personal data, including their deletion, in the absence of grounds for processing, by submitting an application to the Operator in the manner prescribed by clause 6.1 of these Rules. Within 15 days after receiving the application, the Operator stops processing the personal data (if there are no grounds for processing, in accordance with the law), deletes them, and if there is no technical possibility of deletion, takes measures to prevent further processing of the personal data, including blocking them, and notifies the personal data subject about this within the same period.

 

7. Measures to ensure the protection of personal data.

 

7.1. The Company is obliged to take legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other illegal actions in relation to personal data.

 

7.2. The following measures are taken to protect the personal data of the Company:

• appointment of structural divisions or persons responsible for the implementation of internal control over the processing of personal data;
• maintenance of processing registers;
• development and communication to all interested parties of this Policy and other documents of the Transport Unitary Enterprise regarding the processing of personal data;
• familiarization of employees of the Transport Unitary Enterprise and other persons directly involved in the processing of personal data with the provisions of the legislation on personal data, including the requirements for the protection of personal data, this Policy and other documents of the Transport Unitary Enterprise regarding the processing of personal data, as well as training of the said employees and other persons in the manner prescribed by law;
• establishing the procedure for access to personal data, including those processed in the information resource (system);
• implementation of technical and cryptographic protection of personal data in the manner established by the Operational and Analytical Center under the President of the Republic of Belarus, in accordance with the classification of information resources (systems) containing personal data.

 

7.3. The transport unitary enterprise is obliged to ensure unlimited access, including using the global computer network Internet, to documents defining the policy of the transport unitary enterprise with respect to the processing of personal data, prior to the commencement of such processing.

 

7.4. The classification of information resources (systems) containing personal data, in order to determine the requirements for technical and cryptographic protection of personal data imposed on them, is established by the authorized body for the protection of the rights of personal data subjects.

 

8. Final provisions.

 

8.1. Issues related to the processing of personal data that are not set out in this Policy are governed by the legislation of the Republic of Belarus.

 

8.2. If any provision of the Policy is recognized as contradicting the legislation, the remaining provisions that comply with the legislation shall remain in force and are valid, and any invalid provision will be considered deleted/modified to the extent necessary to ensure its compliance with the legislation.

 

The Operator has the right, at its own discretion, to change and (or) supplement the terms of this Policy without prior and (or) subsequent notification of personal data subjects. The current version of the Policy is always available at: https://belpam.com.

 

8.4. The personal data subject can receive any clarifications on issues of interest related to the processing of his personal data by contacting the Site Administration via e-mail info@belpam.com.