Security Policy

User Agreement

Regulation on the Processing and Protection of Personal Data in Personal Data Databases Owned by the Seller

General Concepts and Scope of Application
List of Personal Data Databases
Purpose of Personal Data Processing
Procedure for Processing Personal Data: Obtaining Consent, Notification of Rights, and Actions with Personal Data of the Data Subject
Location of the Personal Data Database
Conditions for Disclosure of Personal Data to Third Parties
Protection of Personal Data: Protection Methods, Responsible Person, Employees Directly Processing and/or Having Access to Personal Data in Connection with Their Duties, Retention Period of Personal Data
Rights of the Personal Data Subject
Procedure for Handling Requests from the Personal Data Subject
State Registration of the Personal Data Database

1. General Concepts and Scope of Application

1.1. Definition of Terms:

personal data database – an organized set of personal data in electronic form and/or in the form of personal data files;

responsible person – a designated individual who organizes activities related to the protection of personal data during processing in accordance with the law;

owner of the personal data database – a natural or legal person who is granted the right by law or with the consent of the data subject to process these data, defines the purpose of personal data processing in this database, establishes the composition of these data and procedures for their processing, unless otherwise specified by law;

State Register of Personal Data Databases – a unified state information system for collecting, accumulating, and processing information about registered personal data databases;

public sources of personal data – directories, address books, registries, lists, catalogs, and other organized collections of publicly available information containing personal data published with the knowledge of the data subject. Social networks and internet resources where the data subject leaves personal data are not considered public sources unless the data subject explicitly states that the personal data are placed for free distribution and use;

consent of the data subject – any documented, voluntary expression of will by an individual granting permission to process their personal data according to the specified purpose of processing;

anonymization of personal data – the removal of information that allows the identification of an individual;

processing of personal data – any action or set of actions performed fully or partially in an information (automated) system and/or personal data files related to collection, registration, accumulation, storage, adaptation, modification, updating, use, and dissemination of data;

personal data – information or a set of information about an individual who is identified or can be specifically identified;

personal data controller – a natural or legal person granted the right by the owner of the personal data database or by law to process these data. A person assigned only to perform technical tasks with the database without access to its content is not considered a controller;

personal data subject – a natural person whose personal data is processed in accordance with the law;

third party – any person other than the data subject, owner or controller of the personal data database, or authorized state body for data protection, to whom personal data are transferred by the owner or controller in accordance with the law;

special categories of data – personal data concerning racial or ethnic origin, political, religious or philosophical beliefs, membership in political parties and trade unions, as well as data concerning health or sexual life.

1.2. This Regulation is mandatory for the responsible person and employees of the seller directly processing and/or having access to personal data in connection with their official duties.

2. List of Personal Data Databases

2.1. The seller owns the following personal data databases:

database of counterparties' personal data

3. Purpose of Personal Data Processing

3.1. The purpose of processing personal data in the system is to ensure the implementation of civil-law relations, provision, receipt, and execution of payments for purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine.”

4. Procedure for Processing Personal Data: Obtaining Consent, Notification of Rights, and Actions with Personal Data of the Data Subject

4.1. The consent of the data subject must be a voluntary expression of will by an individual granting permission to process their personal data according to the specified purpose of processing.

4.2. Consent may be provided in the following forms:

paper document with details identifying the document and the individual;
electronic document containing mandatory details identifying the document and the individual. It is advisable to certify the voluntary consent with the data subject’s electronic signature;
mark on an electronic page or file processed in an information system based on documented software-technical solutions.

4.3. Consent is provided when entering into civil-law relations in accordance with current legislation.

4.4. Notification of the data subject about the inclusion of their personal data in the database, their rights under the Law of Ukraine “On Protection of Personal Data,” the purpose of data collection, and the recipients of their data is provided when entering into civil-law relations in accordance with the law.

4.5. Processing of special categories of data is prohibited.

5. Location of the Personal Data Database

5.1. The databases listed in Section 2 are located at the seller's address.

6. Conditions for Disclosure of Personal Data to Third Parties

6.1. Third-party access is determined by the data subject’s consent or legal requirements.

6.2. Access is denied if the third party refuses or cannot ensure compliance with the Law of Ukraine “On Protection of Personal Data.”

6.3. The data subject submits a request to access personal data to the database owner.

6.4. The request must include:

full name, residence, and identification document details (for individuals);
company name, location, position, and full name of the person certifying the request (for legal entities);
information identifying the individual whose data are requested;
information about the database or its owner/controller;
list of requested data;
purpose and/or legal basis of the request.

6.5. The review period for the request cannot exceed ten business days. The owner must inform the requester whether the request will be fulfilled or denied with the legal basis. Requests are fulfilled within thirty calendar days unless otherwise provided by law.

6.6–6.11. [Procedures for delays, notifications, refusals, and appeal rights remain similar in translation.]

7. Protection of Personal Data

7.1–7.8. [Details regarding protection methods, responsible person’s duties, employee obligations, access control, and retention periods remain similar in translation.]

8. Rights of the Personal Data Subject

8.1. The data subject has the right to:

know the location, purpose, and owner/controller of the database;
obtain information about access conditions and third-party recipients;
access their personal data;
receive a response within 30 days about the existence and content of their personal data;
object to processing by government or local authorities;
request correction or deletion of illegal or inaccurate data;
protect personal data from unlawful processing, loss, or damage;
apply to government authorities for data protection;
seek legal remedies for violations of data protection law.