Regulation on the Processing and Protection of Personal Data in Databases Owned by the Seller
Contents
- General Terms and Scope of Application
- List of Personal Data Databases
- Purpose of Processing Personal Data
- Procedure for Processing Personal Data: Obtaining Consent, Notification of Rights, and Actions with Personal Data of the Data Subject
- Location of the Personal Data Database
- Conditions for Disclosure of Personal Data to Third Parties
- Protection of Personal Data: Protection Methods, Responsible Person, Employees Who Directly Process and/or Have Access to Personal Data Due to Their Official Duties, Retention Period of Personal Data
- Rights of the Data Subject
- Procedure for Handling Requests from the Data Subject
- State Registration of the Personal Data Database
1. General Terms and Scope of Application
1.1. Definitions:
- Personal Data Database: A named set of ordered personal data in electronic form and/or in the form of personal data card indexes.
- Responsible Person: A designated individual who organizes work related to the protection of personal data during processing, in accordance with the law.
- Owner of the Personal Data Database: A natural or legal person to whom the law or the data subject has granted the right to process these data, who approves the purpose of processing personal data in this database, establishes the composition of these data, and procedures for their processing unless otherwise provided by law.
- State Register of Personal Data Databases: A unified state information system for collecting, accumulating, and processing information about registered personal data databases.
- Public Sources of Personal Data: Directories, address books, registers, lists, catalogs, and other systematized collections of open information containing personal data, placed and published with the knowledge of the data subject. Social networks and internet resources where data subjects leave their personal data (except when explicitly stated by the data subject that the personal data is placed for free distribution and use) are not considered public sources of personal data.
- Consent of the Data Subject: Any documented, voluntary expression of a natural person's will regarding the provision of permission to process their personal data in accordance with the stated purpose of processing.
- Depersonalization of Personal Data: Removal of information that allows for the identification of a person.
- Processing of Personal Data: Any action or set of actions carried out entirely or partially in an information (automated) system and/or in personal data card indexes, related to the collection, registration, accumulation, storage, adaptation, alteration, updating, use, and dissemination (distribution, sale, transfer), depersonalization, destruction of information about a natural person.
- Personal Data: Information or a set of information about a natural person who is identified or can be specifically identified.
- Manager of the Personal Data Database: A natural or legal person to whom the owner of the personal data database or the law has granted the right to process these data. A person to whom the owner and/or manager of the personal data database assigns technical work with the personal data database without access to the content of personal data is not considered a manager of the personal data database.
- Data Subject: A natural person in relation to whom the processing of their personal data is carried out according to the law.
- Third Party: Any person, except for the data subject, the owner or manager of the personal data database, and the authorized state body for personal data protection, to whom the owner or manager of the personal data database transfers personal data according to the law.
- Special Categories of Data: Personal data about racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties and trade unions, as well as data related to health or sexual life.
1.2. This Regulation is mandatory for application by the responsible person and the seller's employees who directly process and/or have access to personal data due to their official duties.
2. List of Personal Data Databases
2.1. The seller is the owner of the following personal data databases:
- Personal data database of counterparties.
3. Purpose of Processing Personal Data
3.1. The purpose of processing personal data in the system is to ensure the implementation of civil-law relations, provision, receipt, and execution of settlements for purchased goods and services in accordance with the Tax Code of Ukraine, the Law of Ukraine "On Accounting and Financial Reporting in Ukraine."
4. Procedure for Processing Personal Data: Obtaining Consent, Notification of Rights, and Actions with Personal Data of the Data Subject
4.1. The consent of the data subject must be a voluntary expression of a natural person's will regarding the provision of permission to process their personal data in accordance with the stated purpose of processing.
4.2. The consent of the data subject can be provided in the following forms:
- A document on paper with requisites that allow identifying this document and the natural person.
- An electronic document containing mandatory requisites that allow identifying this document and the natural person. The voluntary expression of a natural person regarding the provision of permission to process their personal data should preferably be certified by the electronic signature of the data subject.
- A mark on the electronic page of the document or in an electronic file processed in the information system based on documented software and technical solutions.
4.3. The consent of the data subject is provided during the execution of civil-law relations in accordance with the current legislation.
4.4. The notification of the data subject about the inclusion of their personal data in the personal data database, the rights defined by the Law of Ukraine "On Personal Data Protection," the purpose of data collection, and the persons to whom their personal data are transferred is carried out during the execution of civil-law relations in accordance with the current legislation.
4.5. The processing of personal data concerning racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties and trade unions, as well as data related to health or sexual life (special categories of data) is prohibited.
5. Location of the Personal Data Database
5.1. The personal data databases mentioned in Section 2 of this Regulation are located at the seller's address.
6. Conditions for Disclosure of Information about Personal Data to Third Parties
6.1. The procedure for access to personal data by third parties is determined by the conditions of the consent of the data subject granted to the owner of the personal data for the processing of these data or according to the requirements of the law.
6.2. Access to personal data by a third party is not granted if the mentioned person refuses to undertake obligations to ensure compliance with the requirements of the Law of Ukraine "On Personal Data Protection" or is unable to ensure them.
6.3. A subject of relations related to personal data submits a request for access (hereinafter referred to as the request) to the owner of the personal data.
6.4. The request should specify:
- Last name, first name, patronymic, place of residence (place of stay), and requisites of the document that identifies the natural person submitting the request (for a natural person-applicant).
- Name, location of the legal entity submitting the request, position, last name, first name, and patronymic of the person certifying the request; confirmation that the content of the request corresponds to the powers of the legal entity (for a legal entity-applicant).
- Last name, first name, and patronymic, as well as other information that allows identifying the natural person to whom the request relates.
- Information about the personal data database to which the request is submitted, or information about the owner or manager of this personal data database.
- List of requested personal data.
- Purpose and/or legal basis for the request.
6.5. The period for reviewing the request to determine whether it should be satisfied may not exceed ten working days from the date of its receipt. During this period, the owner of the personal data must notify the person submitting the request whether the request will be satisfied or whether the corresponding personal data will not be provided, indicating the reason specified in the relevant regulatory legal act. The request is satisfied within thirty calendar days from the date of its receipt unless otherwise provided by law.
6.6. Deferral of access to personal data by third parties is allowed if the necessary data cannot be provided within thirty calendar days from the date of receipt of the request. In this case, the total period for resolving the issues raised in the request may not exceed forty-five calendar days.
6.7. The notification of deferral is provided to the third party who submitted the request in writing with an explanation of the procedure for appealing such a decision.
6.8. The deferral notification should include:
- Last name, first name, and patronymic of the official.
- Date of sending the notification.
- Reason for deferral.
- The period within which the request will be satisfied.
6.9. Denial of access to personal data is allowed if access to them is prohibited by law.
6.10. The notification of denial should include:
- Last name, first name, and patronymic of the official denying access.
- Date of sending the notification.
- Reason for denial.
6.11. The decision on deferral or denial of access to personal data may be appealed in court.
7. Protection of Personal Data: methods of protection, responsible person, employees who directly process and/or have access to personal data in connection with the performance of their official duties, storage period of personal data.
7.1. The owner of the personal data base is equipped with system and software-technical means and communication tools that prevent losses, thefts, unauthorized destruction, distortion, forgery, and copying of information and comply with international and national standards.
7.2. The responsible person organizes the work related to the protection of personal data during their processing in accordance with the law. The responsible person is appointed by order of the owner of the personal data base. The duties of the responsible person regarding the organization of work related to the protection of personal data during their processing are specified in the job description.
7.3. The responsible person is obliged to:
- Know the legislation of Ukraine in the field of personal data protection;
- Develop access procedures for employees to personal data according to their professional, official, or employment duties;
- Ensure that employees of the owner of the personal data base comply with the requirements of the legislation of Ukraine in the field of personal data protection and internal documents regulating the activities of the owner regarding the processing and protection of personal data in databases;
- Develop a procedure for internal control of compliance with the requirements of the legislation of Ukraine in the field of personal data protection and internal documents regulating the activities of the owner regarding the processing and protection of personal data in databases, which should include norms regarding the frequency of such control;
- Inform the owner of the personal data base about violations by employees of the requirements of the legislation of Ukraine in the field of personal data protection and internal documents regulating the activities of the owner regarding the processing and protection of personal data in databases no later than one working day from the moment of detection of such violations;
- Ensure the storage of documents confirming the consent of the data subject to the processing of their personal data and informing the specified subject of their rights.
7.4. For the purpose of fulfilling their duties, the responsible person has the right to:
- Receive necessary documents, including orders and other administrative documents issued by the owner of the personal data base related to the processing of personal data;
- Make copies of received documents, including copies of files, and any records stored in local computing networks and standalone computer systems;
- Participate in discussions regarding the performance of their duties related to the organization of work concerning the protection of personal data during processing;
- Submit proposals for improving activities and refining methods of work, provide comments and options for eliminating identified deficiencies in the processing of personal data;
- Obtain explanations regarding the processing of personal data;
- Sign and approve documents within their competence.
7.5. Employees who directly process and/or have access to personal data in connection with the performance of their official (employment) duties are obliged to comply with the requirements of the legislation of Ukraine in the field of personal data protection and internal documents regarding the processing and protection of personal data in databases.
7.6. Employees with access to personal data, including those processing them, are obliged not to disclose personal data entrusted to them or which became known in connection with the performance of their professional, official, or employment duties in any way. This obligation remains in effect after they cease activities related to personal data, except in cases established by law.
7.7. Persons with access to personal data, including those processing them, who violate the requirements of the Law of Ukraine "On Personal Data Protection" are liable according to the legislation of Ukraine.
7.8. Personal data should not be stored longer than necessary for the purpose for which such data is retained, and in any case, not longer than the storage period defined by the consent of the data subject for the processing of these data.
8. Rights of the Personal Data Subject
8.1. The personal data subject has the right to:
- Know the location of the personal data base that contains their personal data, its purpose and name, the location and/or residence (stay) of the owner or manager of this base, or to instruct authorized persons to obtain this information, except in cases established by law;
- Receive information about the conditions for accessing personal data, including information about third parties to whom their personal data from the relevant personal data base are transferred;
- Access their personal data contained in the relevant personal data base;
- Receive, no later than thirty calendar days from the date of the request, a response regarding whether their personal data is stored in the relevant personal data base, as well as obtain the content of their personal data that is stored;
- Present a reasoned objection to the processing of their personal data by government authorities and local self-governing bodies in exercising their powers as provided by law;
- Submit a reasoned request for the modification or destruction of their personal data by any owner or manager of this base if these data are processed unlawfully or are inaccurate;
- Protect their personal data from unlawful processing and accidental loss, destruction, or damage due to intentional concealment, failure to provide, or untimely provision of information, as well as to protect against the dissemination of false information that defames their honor, dignity, and business reputation;
- Appeal to state authorities, local self-government bodies, which have the authority to protect personal data regarding the protection of their rights concerning personal data;
- Apply legal remedies in case of violations of the legislation on the protection of personal data.
9. Procedure for Handling Requests from Personal Data Subjects
9.1. The personal data subject has the right to receive any information about themselves from any entity involved in personal data relations without specifying the purpose of the request, except in cases established by law.
9.2. Access for the personal data subject to their data is provided free of charge.
9.3. The personal data subject submits a request for access (hereinafter referred to as the "request") to the owner of the personal data base. The request should include:
- The surname, first name, patronymic, place of residence (stay), and details of the document that certifies the identity of the personal data subject;
- Other information that allows for the identification of the personal data subject;
- Information about the personal data base regarding which the request is made, or information about the owner or manager of this base;
- A list of the personal data being requested.
-
9.4. The period for reviewing the request regarding its satisfaction cannot exceed ten working days from the date of its receipt. During this period, the owner of the personal data base must inform the personal data subject whether the request will be satisfied or if the relevant personal data cannot be provided, indicating the grounds established by the relevant regulatory act.
9.5. The request must be satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law.
10. State Registration of Personal Data Bases
10.1. The state registration of personal data bases is carried out in accordance with Article 9 of the Law of Ukraine "On Personal Data Protection."
If you have any more questions or need further assistance, feel free to ask!