Personal data processing policy of JV ZAO MILAVITSA
REGULATION
on the policy regarding the processing of personal data
APPROVED
order of the general director
JV ZAO "MILAVITSA"
"04" February 2025 No. 17/142
1. General Provisions
1.1. JV ZAO "MILAVITSA" (hereinafter referred to as the Organization or Operator) pays special attention to the protection of personal data during their processing and respects the observance of the rights of personal data subjects.
1.2. This Policy Statement on the Personal Data Processing Policy (hereinafter referred to as the Policy) defines the Organization's policy regarding the processing of personal data of website users, consumers, applicants, persons applying for employment, contractors, interns and other persons who are not its employees (hereinafter referred to as the Personal Data Subject), including the procedure for collecting, storing, using, transferring and protecting personal data.
The Policy does not apply to the processing of personal data in the course of work activities and in the implementation of administrative procedures (in relation to employees and former employees), during video surveillance, as well as when processing cookies on the website.
1.3. The Policy explains to personal data subjects how and for what purposes their personal data is collected, used or otherwise processed, and also reflects the rights available to personal data subjects in this regard and the mechanism for implementing them.
1.4. The approval of the Regulation on the policy regarding the processing of personal data is one of the measures taken by JV ZAO MILAVITSA to protect personal data, provided for in Article 17 of the Law of the Republic of Belarus dated May 7, 2021 N 99-Z "On the Protection of Personal Data" (hereinafter referred to as the Law).
1.5. Postal address of the Operator JV ZAO MILAVITSA:
220053, Republic of Belarus, Minsk, Novovilenskaya str., 28
Tel. +375 17 287 08 61
E-mail: office@milavitsa.by
Internet address: https://www.milavitsa.com/
1.6. The Policy is a local legal act of the Organization, mandatory for compliance and execution by employees, as well as other persons involved in the processing of personal data in accordance with this Regulation.
1.7. This Policy uses terms and their definitions in the meaning defined by the Law.
1.8. The Organization processes personal data in accordance with the requirements of the legislation of the Republic of Belarus.
1.9. The Organization processes only those personal data that are necessary to achieve the stated purposes, and does not allow their excessive processing.
1.10. The Organization processes personal data of personal data subjects for the purposes, volume, on legal grounds and within the timeframes applicable to each category of personal data subjects.
1.11. Personal data is processed with the consent of personal data subjects to the processing of their personal data, as well as without such consent in cases stipulated by the legislation of the Republic of Belarus (Articles 6, 8 of the Law).
1.12. Consents of personal data subjects to the processing of their personal data are stored by the Operator for 1 year after the expiration of the period for which the consents were given.
1.13. In compliance with the requirements of paragraph 4 of Article 17 of the Law on the Protection of Personal Data, the Policy is published in the public domain on the official website of the Organization https://www.milavitsa.com/.
1.14. Personal data is processed solely to achieve one or more legitimate purposes specified in Appendix No. 1 of this Policy. If personal data has been collected and processed to achieve a specific purpose, in order to use this data for other purposes, it is necessary to notify the personal data subject about this and, if necessary, obtain new consent for processing.
Personal data may be processed for other purposes if this is necessary in connection with ensuring compliance with the law.
1.15. In order to ensure the security of personal data, the Organization takes the necessary and sufficient legal, organizational and technical measures to protect the personal data of personal data subjects from unauthorized or accidental access to them, destruction, modification, blocking, copying, distribution, as well as from other illegal actions.
1.16. Methods of personal data processing:
- non-automatedprocessing of personal data;
- automated processing of personal data with or without the transfer of the received information via information and telecommunications networks;
- mixed processing of personal data.
Personal data shall be stored for the periods specified in Appendix No. 1 to this Policy, but no longer than required by the purposes of processing personal data.
1.17. The Organization shall cease processing personal data if the purposes of processing personal data have been achieved, the period for processing personal data has expired, consent has been revoked or a requirement to terminate the processing of personal data has been submitted, there is no basis for processing personal data, illegal processing of personal data has been identified, as well as in other cases stipulated by the legislation on the protection of personal data.
2. Purposes, categories of subjects, list of personal data processed, legal grounds and processing periods
2.1. Appendix No. 1 to this Policy contains information on what personal data the Organization processes, for what purposes, the categories of personal data subjects whose data are processed, as well as the period of time during which the Organization will store the specified personal data for each purpose.
3. Authorized persons. Cross-border transfer of personal data
3.1. The organization entrusts the processing of personal data to the following authorized persons:
- ODO "Yukola-info-Brest", 224023, Republic of Belarus, Brest, Moskovskaya str. 332/3V for the purpose of performing work and providing services for the maintenance of information systems on the 1C: Enterprise platform;
- OOO "Electronic Economy", 220116, Republic of Belarus, Minsk, Dzerzhinsky Ave. 104, office 802 for the purpose of performing work and providing services for comprehensive support and maintenance of software on the 1C: ERP, Document Management platform;
- Republican Unitary Enterprise of Telecommunications "Beltelecom", 220030, Republic of Belarus, Minsk, Engelsa, 6, as an operator for the provision of the service - creation of a video surveillance system "Video Control" with the ability to remotely access video information and provide technical support in order to ensure the safety of individuals (including employees), protect the property of the Organization from illegal encroachments;
- Maxi Bay Media LLC, 220026, Republic of Belarus, Minsk, Zhilunovicha St., 15, room 402 as a contractor for technical support of the Site with the use of which the Organization processes personal data, maintenance of the Organization's accounts in social networks;
− in some cases, may instruct other suppliers of software products with the use of which the Company processes personal data, when such software products are located on servers that do not belong to the Organization, as well as in cases where the Organization provides technical support services.
3.2. The list of personal data, the processing of which is entrusted to the authorized person, corresponds to the list specified in the table next to the corresponding purpose in Appendix No. 1 to this Policy.
The list of actions with personal data carried out by the specified authorized persons is as follows: collection, systematization, storage, modification, use, depersonalization, blocking, provision, deletion.
3.3. The Organization has the right to provide personal data to third parties for the purposes according to Appendix No. 1 to this Policy, in particular, to telecommunication operators, operators of electronic messaging services, postal organizations, insurance organizations, government agencies in the presence of grounds established by the legislation of the Republic of Belarus.
3.4. Cross-border transfer of personal data to the territory of a foreign state may be carried out by the Organization if:
- the territory of a foreign state ensures an adequate level of protection of the rights of personal data subjects - without restrictions in the presence of legal grounds provided for by the Law;
- the territory of a foreign state does not ensure an adequate level of protection of the rights of personal data subjects - in cases provided for in Article 9 of the Law, including:
when the consent of the personal data subject is given, provided that the personal data subject is informed of the risks arising from the lack of an adequate level of protection;
when posting information about their activities on the global computer network Internet;
when the processing of personal data is nnecessary to perform duties (powers) stipulated by legislative acts.
3.5. The organization may carry out cross-border transfer of personal data for the purpose of:
- posting on the Internet produced advertising materials (photo/video works) on the official pages of JV ZAO "MILAVITSA" in social networks, messengers (Instagram, TikTok, Facebook, Telegram, VKontakte, video hosting YouTube) to promote the brand;
- implementation of contractual obligations, including issues: interaction of an individual in the process of performing work/providing services, creating intellectual property within the framework of concluded contracts by sending information about the last name and first name of an individual, the name of the position held, e-mail address, contact phone number, counterparties located in the territory of other states.
3.6. Depending on the server where the data will be stored, cross-border transfer may be carried out to countries where the proper level of protection of the rights of personal data subjects is not ensured. The risks of such transfer may differ depending on the foreign country. Possible risks in cross-border transfer of personal data include: the absence of a general law on the protection of personal data, the absence of an independent supervisory body for the protection of the rights of personal data subjects, a narrow understanding of personal data, attributing to it a limited range of information about an individual.
3.7. The list of countries where the proper level of protection of the rights of personal data subjects is ensured can be found by clicking on the hyperlink:
https://cpd.by/zachita-personalnyh-dannyh/operatoru/transgranichnaya-peredacha/.
4. Rights of personal data subjects
4.1. The personal data subject has the following rights in relation to the processing of personal data by the Organization:
| № | The personal data subject has the right | Actions of the Organization |
|---|---|---|
| 4.1.1 |
To withdraw their consent, if the Organization has contacted the personal data subject to obtain consent for the processing of personal data. Note: the right to withdraw consent cannot be exercised if the processing is carried out on other legal grounds (for example, in accordance with the requirements of the law or on the basis of an agreement). |
Within 15 calendar days from the date of receipt of the request, the organization will stop processing the applicant's personal data, delete it and notify about it, except for cases when the organization has the right to continue processing the personal data if there are grounds established by the legislation of the Republic of Belarus. |
| 4.1.2 | Within 15 calendar days from the date of receipt of the request, the organization will stop processing the applicant's personal data, delete it and notify about it, except for cases when the organization has the right to continue processing the personal data if there are grounds established by the legislation of the Republic of Belarus. | Within 5 working days after receiving the application, the organization will provide the requested information or notify the subject of the personal data of the reasons for refusing to provide it. |
| 4.1.3 | Require the Organization to make changes to their personal data if the personal data is incomplete, outdated or inaccurate. For these purposes, the personal data subject shall attach the relevant documents and (or) their copies certified in the established manner, confirming the need to make changes to the personal data. | Within 15 calendar days from the date of receipt of the request, make changes to the personal data if they are incomplete, outdated or inaccurate. |
| 4.1.4 | Within 15 calendar days from the date of receipt of the request, make changes to the personal data if they are incomplete, outdated or inaccurate. | Inwithin 15 calendar days from the date of receipt of the request, provide information on what personal data and to whom were provided during the year preceding the date of filing the application, or notify the applicant of the reasons for refusing to provide it. |
| 4.1.5 | Require the Organization to stop processing their personal data free of charge, including their deletion, in the absence of grounds for processing personal data provided for by the Law and other legislative acts. | Within 15 calendar days from the date of receipt of the request, stop processing personal data, except for cases where the Organization has the right to continue processing personal data in the presence of grounds established by the legislation of the Republic of Belarus. |
| 4.1.6 | Appeal the actions (inaction) and decisions of the Organization that violate his rights when processing personal data, in the manner prescribed by law (the subject of personal data may file a complaint with the National Center for Personal Data Protection or seek protection of his rights in court) |
4.2. To exercise his rights specified in subparagraphs 4.1.1-4.1.5, the subject of personal data submits to the Organization an application in writing or in the form of an electronic document (i.e. a document signed with an electronic digital signature recognized in the Republic of Belarus), and in the case of exercising the right to revoke consent - also in the form in which such consent was received.
4.3. The application in writing must be sent to the address:
220053, Republic of Belarus, Minsk, Novovilenskaya Street, 28.
4.4. Such an application must contain:
- the last name, first name, patronymic (if any) of the personal data subject, his/her address of residence (place of stay);
- the date of birth of the personal data subject;
- a statement of the essence of the personal data subject's requirements;
- the identification number of the personal data subject, in the absence of such a number - the number of the identity document of the personal data subject, in cases where this information was indicated by the personal data subject when giving his/her consent or the personal data is processed without the consent of the personal data subject;
- the personal signature (for an application in writing) or an electronic digital signature (for an application in the form of an electronic document) of the personal data subject.
The Organization does not consider applications from personal data subjects sent by other means (telephone, fax, etc.).
4.5. To exercise their rights specified in subparagraph 4.1.6, the personal data subject has the right to contact the authorized body for the protection of the rights of personal data subjects - the National Center for Personal Data Protection of the Republic of Belarus, in the manner prescribed by the legislation on appeals of citizens and legal entities. The decision taken by the authorized body for the protection of the rights of personal data subjects may be appealed to the court in the manner prescribed by law.
4.6. Applications from personal data subjects are stored by the Operator for 1 year.
5. Procedure and conditions for processing personal data
5.1. In accordance with the legal grounds provided for in Articles 5, 6, 8 of the Law, the Organization carries out the following types of personal data processing both with and without the use of automation tools: collection, systematization, storage, modification, use, depersonalization, blocking, provision, distribution, deletion.
5.2. Only employees of the Organization whose job responsibilities include the processing of personal data are allowed to process personal data.
5.3. Personal data are processed by:
- receiving personal data in oral and written form directly from personal data subjects;
- receiving personal data from publicly available sources;
- entering personal data into the Organization's journals, registers and information systems;
- using other methods of personal data processing.
5.4. The processing of personal data is terminated:
- the purposes of processing personal data have been achieved;
- the period for processing personal data has expired;
- the subject has withdrawnom personal data consent to the processing of his (her) personal data;
- detection of unlawful processing of personal data.
5.5. The Organization stores personal data no longer than required by the purposes of processing personal data, unless the storage period of personal data is established by the legislation of the Republic of Belarus, an agreement.
6. Final Provisions
6.1. This Policy is publicly available and shall be posted on the official website of the Organization.
6.2. The Organization has the right, at its own discretion, to unilaterally change and (or) supplement the terms of this Policy without prior notice to personal data subjects by posting a new version of the Policy on the Website.
6.3. All changes and additions made to this Policy shall be approved by the General Director of the Organization.
6.4. If any points of this policy raise questions or misunderstandings, as well as for assistance in exercising rights related to the processing of personal data, you should contact the specialist responsible for the implementation of internal control over the processing of personal data by sending a message to the e-mail address: personal.data@milavitsa.by
REGULATION
on the policy regarding the processing of personal data
to the Regulation on the policy regarding
the processing of personal data
The organization processes personal data in the following cases:
Appendix No. 1
| Purpose of processing | Categories of subjects | List data | Legal grounds | Storage period |
|---|---|---|---|---|
| Sending, receiving and discussing proposals for cooperation, communicating within the framework of contracts signed/signed between the Organization and the counterparty, commercial proposals | Authorized representatives of the counterparty (potential counterparty) | Last name, first name, patronymic; contact information (phone number, email address); position; other information specified by the counterparty in the accompanying correspondence |
paragraph 15 of Art. 6 of the Law of the Republic of Belarus dated May 7, 2021. No. 99-Z "On the Protection of Personal Data" (hereinafter referred to as the Law) - when communicating with a counterparty-individual and sole proprietor or paragraph 20 of Art. 6 of the Law - when communicating with representatives of a counterparty - a legal entity (Article 49, paragraph 5 of Article 186 of the Civil Code of the Republic of Belarus) |
Correspondence on the conclusion of agreements, contracts on financial and economic activities - 3 years after the expiration of the agreement, the tax authorities' audit of compliance with tax legislation. If the tax authorities did not conduct an audit of compliance with tax legislation - 10 years after the expiration of the agreement (paragraphs 70, 71 of the Resolution of the Ministry of Justice of the Republic of Belarus dated 24.05.2012 N 140 "On the list of standard documents" hereinafter referred to as the List); if the contract has not been signed - 1 year from the date of the last message in correspondence with the counterparty |
| Conclusion and execution of civil contracts (supply of goods, works, services, contracts, etc.) | Persons authorized to sign the contract, authorized representatives of the counterparty | Last name, first name, patronymic of the counterparty - an individual, representative and (or) employee of the counterparty - a legal entity or individual entrepreneur; - details of the identity document of the person signing the contract (for counterparties - individuals and individual entrepreneurs); registration address; contact details; bank details; information on tax residency; documents confirming authority, telephone number, other information in accordance with the terms of the agreement | In the case of concluding an agreement with an individual - the processing of personal data on the basis of an agreement with the subject of personal data, for the purpose of performing the actions established by this agreement (paragraph 15 of Article 6 of the Law. In the case of concluding an agreement with a legal entity - the processing of persdata is necessary to perform duties (powers) stipulated by legislative acts (paragraph 20 of Article 6 of the Law, Article 49, paragraph 5 of Article 186 of the Civil Code of the Republic of Belarus) | 3 years after the expiration of the contract, the tax authorities conducting an audit of compliance with tax legislation. If the tax authorities have not conducted an audit of compliance with tax legislation - 10 years after the expiration of the contract |
| Review of resumes (questionnaires) of applicants for vacant positions for the purpose of concluding an employment contract |
Individuals who have submitted a resume |
Last name, first name, patronymic, year of birth, information on education and work experience, contact phone number , email address |
Consent - Art. 5 of the Law when sending a resume (questionnaire) in electronic form; paragraph 16 of Art. 6 of the Law upon sending (submission) of a resume (questionnaire) in written form or in the form of an electronic document |
In case of non-hiring – 1 year In case of hiring – 1 month |
| Consideration of appeals from citizens and legal entities | Citizens, including representatives of legal entities. Other persons whose personal data are indicated in the appeal | Surname, first name, patronymic, address of place of residence (place of stay), other information indicated in the appeal |
paragraph 20 of Art. 6 of the Law Art. 12 of the Law of the Republic of Belarus dated July 18, 2011 No. 300-Z "On Appeals of Citizens and Legal Entities" |
5 years (clause 85 of the List) |
| Implementation of administrative procedures | Applicants, third parties | In accordance with the list of administrative procedures carried out by government agencies and other organizations upon applications from citizens, approved. By Decree of the President of the Republic of Belarus dated April 26, 2010 No. 200 | paragraph 21 of Art. 6, paragraph 18 of clause 2 of Art. 8 of the Law, clause 2 of Art. 20 of the Law of the Republic of Belarus dated October 28, 2008 No. 433-Z “On the Fundamentals of Administrative Procedures”) | 5 years (paragraphs 100-101 of the List) |
| Keeping records of affiliated persons of the Organization | Individuals recognized as affiliated persons by law | Surname, first name, patronymic, address of place of registration, place of work and position held | paragraph 20 of Art. 6 of the Law | For the period of having the status of an affiliated person, lists (registration log) of affiliated persons - 10 years |
| Storage of information on shareholders and representatives of shareholders of the Organization, organization and holding of General Meetings of Shareholders, registration of relevant decisions of the General Meeting of Shareholders and keeping records of decisions, payment of dividends. Provision of information on shareholders and representatives of shareholders upon request in accordance with the law or with the consent of shareholders and representatives of shareholders | Shareholders and representatives of shareholders | Last name, first name, patronymic, address of the place of registration, details of the identity document, identification number, email address, telephone number, information on the amount of accrued dividends, bank details | paragraph 20 of Art. 6 of the Law, Art. 87, 88 of the Law of the Republic of Belarus "On Business Entities", the Charter of the company |
Shareholders' data - permanently. Shareholders' representatives' data - for the period of exercising the powers of the representativerepresentative of shareholders, after termination of the representative's powers - 55 years. Documents on the accrual and payment of dividends - 5 years. Note - 3 years after the tax authorities have conducted an audit of compliance with tax legislation. If the tax authorities have not conducted an audit of compliance with tax legislation - 10 years (clause 437 of the list) |
| Certification for admission to work of drivers | Drivers of vehicles of organizations with which the relevant agreements have been concluded | Surname, first name, patronymic | Clause 4, 5 of the Resolution of the Ministry of Health dated 03.12.2002 No. 84 "On the procedure for conducting pre-trip and other medical examinations of drivers of mechanical vehicles (except for wheeled tractors)", para. 20, Article 6 of the Law |
Pre-trip and other medical examination logs of drivers paragraph 71 – 3 years. Order of the Department of Archives and Records Management Ministry of Justice of the Republic of Belarus 01.04.2019 N 11 |
| Organization of access control in the hostels of JV ZAO "MILAVITSA" |
Visitors to hostels JV ZAO "MILAVITSA" |
Surname, first name, patronymic, identification number |
paragraph 20, Article 6 of the Law, paragraph 30 of the Regulation on hostels, approved. By the Resolution of the Council of Ministers of the Republic of Belarus dated 05.04.2013 N 269, Decree of the President of the Republic of Belarus dated October 25, 2007 N 534 "On measures to improve security activities" |
Visitor log - 1 year after the end of keeping the log |
| Registration of residents of the hostels of SP ZAO "MILAVITSA" |
Residents of hostels SP ZAO "MILAVITSA" |
Last name, first name, patronymic, telephone number |
paragraph 15 of Art. 6 of the Law, clause 6 of the Regulation on hostels, approved. By the Resolution of the Council of Ministers of the Republic of Belarus dated 05.04.2013 N 269 |
Residents' log - 1 year after the end of the log |
| Use of video surveillance system to ensure the safety of individuals, protection of property in the administrative and household building, production and other premises of SP ZAO "MILAVITSA" | Visitors to buildings and premises of SP ZAO "MILAVITSA" | Image/video image of a person |
paragraph 20 of Art. 6 of the Law, Law of the Republic of Belarus dated November 8, 2006 No. 175-Z "On Security Activities in the Republic of Belarus" |
30 days (paragraph 4 of clause 20 of the Regulation on the use of security systems and video surveillance systems, approved by the Resolution of the Council of Ministers of the Republic of Belarus dated December 11, 2012 No. 1135) |
| Use of a video surveillance system to ensure public order in the dormitories of JV ZAO "MILAVITSA" |
Residents and visitors of dormitories JV ZAO "MILAVITSA" |
Image/video image of a person |
paragraph 20 of Art. 6 Laws Decree of the President of the Republic of Belarus dated November 28, 2013 No. 527 "On the issues of creating and using a video surveillance system in the interests of ensuring public order", Law of the Republic of Belarus dated November 8, 2006 No. 175-Z "On security activities in the Republic of Belarus" p.2, p.6. Resolution of the Council of Ministers of the Republic of Belarus dated December 30, 2013 N 1164 |
30 days (paragraph 4 of paragraph 20 of the Regulation on the use of security systems and video surveillance systems, approved by Resolution of the Council of Ministers of the Republic of Belarus dated December 11, 2012 No. 1135) |
| Organization of educational and industrial practice | Students of educational institutions during industrial and educational practice | Last name, first name, patronymic; telephone number, date of birth, information about the educational institution (faculty, specialty) where the trainee is studying | paragraph 20 of Art. 6 of the Law (paragraph 4 of clause 17 of the Resolution of the Council of Ministers of the Republic of Belarus dated 03.06.2010 No. 860 "On approval of the Regulation on the practice of students, cadets, listeners") | Agreement on the organization of industrial practice - 3 years after the expiration of the agreement, the tax authorities conducting an audit of compliance with tax legislation. If the tax authorities have not conducted an audit of compliance with tax legislation - 10 years after the expiration of the contract |
| Review of a message sent by the Site user via the online form "Feedback" | The person who applied via the online form of the site |
Last name, initials, phone number, email address, country, city and other information specified in the application |
Consent of the subject of personal data | 3 years from the date of application |
| Production of advertising materials (photo/video works) for the purpose of brand promotion and their subsequent distribution on the Internet, in social networks, on official pages, printed publications, the website of JV ZAO "MILAVITSA" | Individuals whose image, video image is published | Image, video image, voice | Consent of the subject of personal data, if he is the main object of the posted information (filming) or an agreement, paragraph 15, Article 6 of the Law (in the case of concluding an agreement with an individual, model) |
3 years. When posted on the official website - 30 years z (p. 1054 of the List) |
