"APPROVE"
B.P.
Individual entrepreneur
Zykovich Vyacheslav Sergeevich
06/01/2023
POLICY
on personal data processing
This Policy on personal data processing (hereinafter referred to as the "Policy") is prepared in accordance with the requirements of the Law of the Republic of Belarus dated May 7, 2021, No. 99-3 "On Personal Data Protection" (hereinafter referred to as the "Law") and establishes the procedure for processing personal data by individual entrepreneur Vyacheslav Sergeevich Zykovich (hereinafter referred to as the "Operator") and the measures taken by the Operator to ensure the protection and security of personal data.
The Policy is an internal document of the Operator. The Operator has the right to unilaterally make changes to the Policy as necessary, followed by posting the new Policy on the Operator's website and at the location of the Operator's vehicle pickup point: Minsk, Pobediteley Avenue, 31, 3rd floor, office 324. Individuals independently receive information about Policy changes on the Operator's website and at the location of the vehicle pickup point.
The provisions of the Policy serve as the basis for the development of local regulatory acts regulating the processing of personal data by individual entrepreneur Vyacheslav Sergeevich Zykovich.
SECTION 1
GENERAL PROVISIONS
1.1. The Policy applies to all processes of processing personal data obtained by the Operator about the data subjects.
1.2. By providing personal data to the Operator through the Operator's internet resources and messengers: Skype, Telegram, Viber, WhatsApp, WeChat, the data subject confirms their consent to the processing of the relevant information on the terms outlined in this Policy.
1.3. The current version of the Policy is available to the public on the global computer network Internet at the following address: https://skv-rent.by/.
1.4. The following main terms and their definitions are used in this Policy:
- Blocking of personal data - restricting access to personal data without their deletion;
- Operator's internet resources - the website https://skv-rent.by/;
- Operator's messengers: Skype, Telegram, Viber, WhatsApp, whose numbers are listed on the Operator's internet resources;
- Processing of personal data - any action or set of actions performed with personal data, including collection, systematization, storage, alteration, use, depersonalization, blocking, distribution, provision, deletion of personal data;
- Personal data - any information related to an identified individual or an individual who can be identified;
- Provision of personal data - actions aimed at familiarizing specific individuals or a group of individuals with personal data;
- Distribution of personal data - actions aimed at familiarizing an indefinite group of individuals with personal data;
- Deletion of personal data - actions that make it impossible to restore personal data on an internet resource containing personal data and/or actions resulting in the destruction of material carriers of personal data;
Other terms and their definitions used in this Policy are used in the meanings defined by the legislation.
SECTION 2
PROCEDURE AND CONDITIONS FOR PROCESSING PERSONAL DATA
2.1. The basis for processing personal data is the consent of the data subject, except for cases provided by the legislation of the Republic of Belarus, when processing personal data is carried out without obtaining such consent.
2.2. Consent of the data subject for processing personal data is a voluntary, unambiguous, informed expression of their will, through which they allow the processing of their personal data.
The data subject gives consent for the processing of personal data in electronic form (by placing the corresponding mark on the Operator's internet resources).
The data subject gives consent for the processing of personal data in electronic form (through conclusive actions, i.e., actions of the data subject that indicate their intention to enter into specific legal relations, but not in oral or written form of expression, but through behavior from which it is possible to conclude such intent, in particular by providing necessary data to the Operator through the Operator's messengers: Skype, Telegram, Viber, WhatsApp, the numbers of which are listed on the Operator's internet resources).
2.3. Refusal to give consent for the processing of personal data gives the Operator the right to deny the data subject access to special sections of the Operator's internet resources, refuse to rent a vehicle, as well as deny the provision of vehicle rental services.
2.4. Processing of personal data by the Operator includes the following actions with personal data: collection, systematization, storage, alteration, use, depersonalization, blocking, distribution, provision, deletion, and other actions in accordance with the legislation of the Republic of Belarus.
2.5. Storage of personal data is carried out in a form that allows the data subject to be identified, for a period of one (1) year from the date of concluding a vehicle rental agreement (lease) without a crew, except for cases when the period of storage of personal data is established by the legislation of the Republic of Belarus, by an agreement concluded (being concluded) with the data subject, for the purpose of performing actions stipulated by this agreement.
2.6. The termination of personal data processing can be a result of achieving the purposes of processing personal data, expiration of the processing period, withdrawal of consent by the data subject for the processing of their personal data, detection of unlawful processing of personal data, as well as the termination of the Operator's activities.
2.7. When processing personal data, the Operator takes necessary legal, organizational, and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, alteration, blocking, copying, distribution, provision, deletion of personal data, as well as from other unauthorized actions in relation to personal data.
2.8. Processing of personal data is limited to achieving specific, pre-declared lawful purposes. Processing of personal data that is incompatible with the originally stated purposes of their processing is not allowed.
2.9. The content and scope of processed personal data must correspond to the declared purposes of their processing. Processed personal data should not be excessive in relation to the stated purposes of their processing.
2.10. Personal data must be destroyed or depersonalized upon achieving the purposes of processing or in case the need for achieving these purposes is no longer relevant, unless otherwise provided by legislation.
SECTION 3
PURPOSES OF PERSONAL DATA PROCESSING
3.1. The purposes of personal data processing by the Operator are:
- Determining the presence or absence of a valid driver's license to operate a vehicle of the corresponding category in accordance with the legislation of the Republic of Belarus;
- Determining the presence or absence of legal grounds for refusing to enter into contracts with data subjects and their subsequent fulfillment, including rental agreements, vehicle rental agreements without a crew, lease agreements with subsequent purchase;
- Recording at the vehicle pickup point through the Operator's internet resources and messengers;
- Renting (leasing) a vehicle without a crew through the Operator's internet resources and messengers;
- Reserving a vehicle without a crew for subsequent rental (leasing) through the Operator's internet resources and messengers;
- Identifying the User who has reserved a vehicle without a crew for subsequent rental (leasing) through the Operator's internet resources and messengers;
- Identifying the User who has reserved a vehicle without a crew through the Operator's internet resources and messengers for subsequent rental (leasing) when directly visiting the pickup point;
- Providing technical support on issues related to the functionality of the Operator's internet resources;
- Processing messages and inquiries received from data subjects;
- Analyzing the operation of the Operator's internet resources, improving their functional and search capabilities.
SECTION 4
CATEGORIES OF PERSONAL DATA SUBJECTS AND LIST OF PERSONAL DATA PROCESSED BY THE OPERATOR
4.1. The Operator can process personal data of the following data subjects:
- Potential individual contractors,
- Employees and/or representatives of potential corporate contractors;
- Visitors of the Operator's internet resources;
- Users of the Operator's messengers.
4.2. The personal data processed by the Operator include:
4.2.1. Personal data of employees and/or other representatives of corporate contractors:
Last name, first name, patronymic; passport information or information from another identity document (series, number, date of issue, issuing authority, etc.); registration information (including address, date of registration), contact details (including work, home, and/or mobile phone numbers, email, messengers: Skype, Telegram, Viber, WhatsApp, WeChat); position; driver's license information (series, number, date of issue, validity period, category, issuing authority, etc.);
4.2.2. Personal data of potential individual contractors:
Last name, first name, patronymic; citizenship; passport information or information from another identity document (series, number, date of issue, issuing authority, etc.); registration information (including address, date of registration); driver's license information (series, number, date of issue, validity period, category, issuing authority, etc.); bank account details; taxpayer identification number; contact details (including home and/or mobile phone numbers, email, messengers: Skype, Telegram, Viber, WhatsApp, WeChat);
4.2.3. Personal data of other subjects, including visitors of the Operator's internet resources:
Last name, first name, patronymic; contact details (including home and/or mobile phone numbers, email, messengers: Skype, Telegram, Viber, WhatsApp, WeChat); passport information or information from another identity document (series, number, date of issue, issuing authority, etc.); registration information (including address, date of registration); driver's license information (series, number, date of issue, validity period, category, issuing authority, etc.).
4.3. The Operator may process the following technical information:
- IP address;
- Access time;
- Browser information;
- Data from cookies;
- Requested page address;
- History of requests and views on the Operator's internet resources.
4.4. The Operator does not process special categories of personal data.
SECTION 5
MAIN RIGHTS AND OBLIGATIONS OF THE OPERATOR
5.1. The Operator has the right to:
- Receive accurate information and/or documents containing personal data from the data subject;
- Request from the data subject information about the relevance and accuracy of the provided personal data;
- Continue processing personal data without the consent of the data subject if there are grounds specified in the Law, in case the data subject withdraws their consent for personal data processing;
- Transfer personal data to third parties if necessary, for achieving the purposes of personal data processing, while complying with legal requirements;
- Independently determine the measures necessary and sufficient to ensure the fulfillment of obligations prescribed by the Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law.
5.2. The Operator is obligated to:
- Appoint a person responsible for organizing the processing of personal data at the Operator;
- Explain to the data subject their rights related to personal data processing;
- Obtain consent from the data subject for the processing of personal data, except in cases provided by the Law and other legislative acts;
- Ensure the protection of personal data during their processing; provide the data subject with information about their personal data and their provision to third parties, except as provided by the Law and other legislative acts;
- Make changes to incomplete, outdated, or inaccurate personal data, except in cases where a different procedure for making changes to personal data is established by legislative acts, or if the purposes of personal data processing do not imply subsequent changes to such data;
- Cease processing personal data and perform their deletion or blocking when there are no legal grounds for personal data processing, as provided by the Law and other legislative acts;
- Notify the authorized body for the protection of the rights of data subjects about violations of personal data protection systems immediately, but no later than three (3) working days after the Operator becomes aware of such violations, except as provided by the authorized body for the protection of the rights of data subjects;
- Implement changes, blocking, or deletion of inaccurate or unlawfully obtained personal data of the data subject upon the request of the authorized body for the protection of the rights of data subjects, unless a different procedure for making changes, blocking, or deletion of such data is established by legislative acts;
- Fulfill other requirements of the authorized body for the protection of the rights of data subjects regarding the elimination of violations of legislation on personal data;
- Provide unrestricted access to this Policy;
- Fulfill other obligations provided by the Law and other legislative acts.
SECTION 5A
USE OF THIRD-PARTY CONTRACTORS
5A.1. The Operator uses third-party contractors (third parties) to carry out economic activities, including the provision of vehicles that are not available to the Operator at the time of request.
During relations with third-party contractors, the Operator provides them with a limited amount of personal data or grants limited access to personal data, strictly in the amount necessary for providing a vehicle for rent. The Operator makes reasonable efforts to ensure that each third-party contractor maintains the confidentiality of the relevant personal data and does not use them for any purposes other than providing a vehicle for rent.
The Operator undertakes and obliges third parties who have access to personal data not to disclose or distribute personal data to third parties without the consent of the data subject unless otherwise provided by the legislation.
SECTION 6
MAIN RIGHTS AND OBLIGATIONS OF THE DATA SUBJECT
6.1. The data subject has the right to:
- Receive information regarding the processing of their personal data;
- Obtain information from the Operator about the provision of their personal data to third parties under the conditions defined by the Law;
- Withdraw consent for the processing of personal data;
- Challenge unlawful actions or inaction of the Operator in processing their personal data before the authorized body for the protection of the rights of data subjects or through legal proceedings;
- Demand from the Operator: changes to their personal data if the personal data is incomplete or outdated;
- Terminate the processing of their personal data, including their deletion, for free if there are no legal grounds for personal data processing, as provided by the Law and other legislative acts;
- Obtain clarifications on questions related to the processing of their personal data by contacting the Operator via email: info@skv-rent.by.
- Exercise other rights provided by the legislation of the Republic of Belarus.
6.2. The data subject is obligated to:
- Provide the Operator with accurate data about themselves;
- Inform the Operator about the clarification (update, change) of their personal data. Persons who provide the Operator with false information about themselves or information about another data subject without their consent are liable under the legislation of the Republic of Belarus.
SECTION 7
WITHDRAWAL OF CONSENT FOR PERSONAL DATA PROCESSING
7.1. The data subject has the right to revoke their consent for the processing of personal data without providing reasons by submitting a statement to the Operator.
7.2. The statement is submitted to the Operator in writing by sending it to the following address: Republic of Belarus, Minsk, Pobediteley Avenue, 31, 3rd floor, office 324, by registered mail with a return receipt, or in the form of an electronic document, by sending it to the email address: info@skv-rent.by. A statement submitted through any other means or using addresses other than those specified in this policy will not be considered by the Operator.
7.3. The statement must contain:
- Surname, first name, patronymic (if applicable) of the data subject, their address of residence (stay);
- Date of birth of the data subject;
- Identification number of the data subject, if available;
- Document number verifying the identity of the data subject;
- Explanation of the subject's data subject's demands;
- Personal signature or electronic digital signature of the data subject.
7.4. Within fifteen (15) days after receiving the data subject's statement, the Operator, in accordance with its content, ceases the processing of personal data, performs their deletion, and informs the data subject about this within the same period.
7.5. The withdrawal of consent for personal data processing provides the Operator with the right to deny the data subject access to special sections of the Operator's internet resources, refuse to reserve unmanned vehicles for subsequent rental via the internet resource, as well as refuse to provide unmanned vehicles for rent.
7.6. The withdrawal of the data subject's consent does not have retroactive effect, meaning that the processing of personal data before its termination in accordance with the statement submitted by the data subject is not considered unlawful.
SECTION 8
RECEIVING INFORMATION REGARDING PERSONAL DATA PROCESSING AND CHANGING PERSONAL DATA
8.1. The data subject has the right to receive information from the Operator regarding the processing of their personal data by submitting a statement to the Operator.
8.2. The data subject is not required to justify their interest in the requested information.
8.3. The statement is submitted in the manner provided in Section 7 of this Policy. Within five (5) working days after receiving the data subject's statement, the Operator provides the data subject with the relevant information or notifies them of the reasons for refusing to provide such information.
8.4. The information or refusal to provide it is sent to the data subject using the same method as the statement was submitted.
8.5. The data subject has the right to demand changes to their personal data from the Operator if the data is incomplete, outdated, or inaccurate by submitting a statement to the Operator.
8.6. The statement is submitted in the manner provided in Section 7 of this Policy, with the attachment of documents (certified copies in the prescribed manner) confirming the need for such changes. Within fifteen (15) days after receiving the statement, the Operator makes changes to the personal data and informs the data subject about this or notifies them of the reasons for refusing to make changes.
8.7. The notification is sent to the data subject using the same method as the statement was submitted.
SECTION 9
RECEIVING INFORMATION ABOUT PROVIDING PERSONAL DATA TO THIRD PARTIES
9.1. The data subject has the right to receive information from the Operator about the provision of their personal data to third parties once a year free of charge by submitting a statement to the Operator.
9.2. The statement is submitted in the manner provided in Section 7 of this Policy.
9.3. Within fifteen (15) days from the moment of receiving the data subject's statement, the Operator provides them with information about what personal data of the subject and to whom it was provided during the year preceding the date of the statement or informs the data subject about the reasons for refusing to provide this information.
9.4. The information or refusal to provide it is sent to the data subject using the same method as the statement was submitted.
SECTION 10
TERMINATION OF PERSONAL DATA PROCESSING AND/OR THEIR DELETION AT THE DATA SUBJECT'S REQUEST
10.1. The data subject has the right to demand the Operator to cease the processing of their personal data, including their deletion, free of charge in the absence of legal grounds for personal data processing.
10.2. To exercise this right, the data subject submits a statement to the Operator in the manner provided in Section 7 of this Policy.
10.3. Within fifteen (15) days from the moment of receiving the data subject's statement, the Operator ceases the processing of personal data (if there are no grounds for processing according to the legislation), performs their deletion, and in case technical deletion is not possible, takes measures to prevent further processing of personal data, including their blocking, and informs the data subject about this within the same period.
10.4. The Operator has the right to refuse the data subject's demands for terminating the processing of their personal data and/or their deletion if there are grounds provided by the legislation on personal data.
10.5. The notification is sent to the data subject using the same method as the statement was submitted.
SECTION 11
CROSS-BORDER TRANSFER OF PERSONAL DATA
11.1. The Operator does not transfer personal data to the territories of foreign states.
SECTION 12
INTERNAL CONTROL
12.1. For the purpose of verifying the compliance of personal data processing by the Operator with the legislation of the Republic of Belarus and the Operator's local regulations in the field of personal data, as well as the measures taken to prevent and detect violations of the legislation of the Republic of Belarus in the field of personal data, to identify possible leakage channels and unauthorized access to personal data, and to mitigate the consequences of such violations, the Operator carries out internal control, which is conducted by the person responsible for the organization of personal data processing – individual entrepreneur Vyacheslav Sergeevich Zykovich.
SECTION 13
CONCLUDING PROVISIONS
13.1. The Operator and other persons who have gained access to personal data are obliged not to disclose personal data to third parties and not to disseminate personal data without the consent of the data subject, unless otherwise provided by the Law.
The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of the legislation in the field of personal data protection.
13.2. This Policy comes into effect from the day of its approval.
13.3. The Operator has the right to unilaterally change this Policy without prior coordination and subsequent notification of the data subject.
13.4. Matters related to the processing of personal data not covered by this Policy are governed by the legislation.
