1.1. Definition of Terms:
personal data database – an organized set of personal data in electronic form and/or in the form of personal data files;
responsible person – a designated individual who organizes activities related to the protection of personal data during processing in accordance with the law;
owner of the personal data database – a natural or legal person who is granted the right by law or with the consent of the data subject to process these data, defines the purpose of personal data processing in this database, establishes the composition of these data and procedures for their processing, unless otherwise specified by law;
State Register of Personal Data Databases – a unified state information system for collecting, accumulating, and processing information about registered personal data databases;
public sources of personal data – directories, address books, registries, lists, catalogs, and other organized collections of publicly available information containing personal data published with the knowledge of the data subject. Social networks and internet resources where the data subject leaves personal data are not considered public sources unless the data subject explicitly states that the personal data are placed for free distribution and use;
consent of the data subject – any documented, voluntary expression of will by an individual granting permission to process their personal data according to the specified purpose of processing;
anonymization of personal data – the removal of information that allows the identification of an individual;
processing of personal data – any action or set of actions performed fully or partially in an information (automated) system and/or personal data files related to collection, registration, accumulation, storage, adaptation, modification, updating, use, and dissemination of data;
personal data – information or a set of information about an individual who is identified or can be specifically identified;
personal data controller – a natural or legal person granted the right by the owner of the personal data database or by law to process these data. A person assigned only to perform technical tasks with the database without access to its content is not considered a controller;
personal data subject – a natural person whose personal data is processed in accordance with the law;
third party – any person other than the data subject, owner or controller of the personal data database, or authorized state body for data protection, to whom personal data are transferred by the owner or controller in accordance with the law;
special categories of data – personal data concerning racial or ethnic origin, political, religious or philosophical beliefs, membership in political parties and trade unions, as well as data concerning health or sexual life.
1.2. This Regulation is mandatory for the responsible person and employees of the seller directly processing and/or having access to personal data in connection with their official duties.
2.1. The seller owns the following personal data databases:
3.1. The purpose of processing personal data in the system is to ensure the implementation of civil-law relations, provision, receipt, and execution of payments for purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine.”
4.1. The consent of the data subject must be a voluntary expression of will by an individual granting permission to process their personal data according to the specified purpose of processing.
4.2. Consent may be provided in the following forms:
4.3. Consent is provided when entering into civil-law relations in accordance with current legislation.
4.4. Notification of the data subject about the inclusion of their personal data in the database, their rights under the Law of Ukraine “On Protection of Personal Data,” the purpose of data collection, and the recipients of their data is provided when entering into civil-law relations in accordance with the law.
4.5. Processing of special categories of data is prohibited.
5.1. The databases listed in Section 2 are located at the seller's address.
6.1. Third-party access is determined by the data subject’s consent or legal requirements.
6.2. Access is denied if the third party refuses or cannot ensure compliance with the Law of Ukraine “On Protection of Personal Data.”
6.3. The data subject submits a request to access personal data to the database owner.
6.4. The request must include:
6.5. The review period for the request cannot exceed ten business days. The owner must inform the requester whether the request will be fulfilled or denied with the legal basis. Requests are fulfilled within thirty calendar days unless otherwise provided by law.
6.6–6.11. [Procedures for delays, notifications, refusals, and appeal rights remain similar in translation.]
7.1–7.8. [Details regarding protection methods, responsible person’s duties, employee obligations, access control, and retention periods remain similar in translation.]
8.1. The data subject has the right to:
9.1–9.5. [Procedures for submitting requests, review timelines, and response obligations remain similar in translation.]
10.1. State registration is carried out in accordance with Article 9 of the Law of Ukraine “On Protection of Personal Data.”