Regulation on the processing and protection of personal data in personal data bases owned by the seller


Content

    1. General concepts and scope
    2. List of personal data bases
    3. Purpose of processing personal data
    4. The procedure for processing personal data: obtaining consent, reporting rights and actions with personal data of the subject of personal data
    5. Location of the personal data base
    6. Terms of disclosure of information about personal data to third parties
    7. Protection of personal data: methods of protection, the responsible person, employees who directly process and / or have access to personal data in connection with the performance of their official duties, the period of storage of personal data
    8. Rights of the subject of personal data
    9. The procedure for dealing with requests of the subject of personal data
    10. State registration of personal data base


1. General concepts and scope

1.1. Definition of terms:

personal data base - a named collection of ordered personal data in electronic form and / or in the form of personal data files;

Responsible person - a certain person who organizes work related to the protection of personal data when they are processed in accordance with the law;

The owner of the personal data base - a natural or legal person who has been granted the right to process this data by law or with the consent of the subject of personal data; approves the purpose of personal data processing in this database;

The state register of personal data bases is a unified state information system for collecting, accumulating and processing information about registered personal data bases;

Publicly accessible sources of personal data - reference books, address books, registers, lists, catalogs, other systematized collections of public information containing personal data posted and published with the consent of the subject of personal data. Social networks and Internet resources in which the subject of personal data leaves their personal data are not considered to be publicly accessible sources of personal data (except when the subject of personal data explicitly states that personal data are placed for the purpose of their free distribution and use);

Consent of the subject of personal data - any documented, voluntary will of an individual to grant permission for the processing of his personal data in accordance with the stated purpose of their processing;

De-identification of personal data - the removal of information that allows you to identify the person;

Personal data processing - any action or a set of actions performed in whole or in part in the information (automated) system and / or in personal data files, related to the collection, registration, accumulation, storage, adaptation, modification, updating, use and distribution (distribution, implementation, transfer), impersonation, destruction of information about an individual;

Personal data - information or a set of information about an individual that is identified or can be specifically identified;

The manager of the personal data base is a natural or legal person to whom the owner of the personal data base or the law has the right to process this data. Is not the manager of the personal data base a person who is charged with the owner and / or manager of the personal data base to carry out technical work with the personal data base without access to the content of personal data;

The subject of personal data is a natural person in respect of whom the processing of his personal data is carried out in accordance with the law;

Third party - any person, with the exception of the subject of personal data, the owner or manager of the personal data base and the authorized state body for the protection of personal data, which the owner or manager of the personal data base transmits personal data in accordance with the law;

Specific data categories are personal data on racial or ethnic origin, political, religious or ideological convictions, membership in political parties and trade unions, as well as data related to health or sexuality.

1.2. This Regulation is mandatory for use by the responsible person and the seller’s employees who directly process and / or have access to personal data in connection with the performance of their official duties.
 
2. List of personal data bases

2.1. The seller is the owner of such personal data bases:

 - database of personal data of counterparties.


3. Purpose of processing personal data

3.1. The purpose of processing personal data in the system is to ensure the implementation of civil law relations, the provision, receipt and settlement of purchased goods and services in accordance with the Tax Code of Ukraine, the Law of Ukraine “On Accounting and Financial Reporting in Ukraine”.

4. The procedure for processing personal data: obtaining consent, reporting rights and actions with personal data of the subject of personal data

4.1. The consent of the subject of personal data must be the voluntary will of the individual to grant permission for the processing of his personal data in accordance with the stated purpose of their processing.

4.2. The consent of the subject of personal data can be provided in the following forms:

   - the document on paper with details, allows you to identify this document and an individual;
   - an electronic document that must contain mandatory details to identify this document and an individual. The voluntary will of an individual to grant permission for the processing of his personal data is advisable to certify with the electronic signature of the subject of personal data;
   - mark on the electronic page of the document or in an electronic file processed in the information system based on documented software and technical solutions.

4.3. The consent of the subject of personal data is granted when formalizing civil law relations in accordance with the current legislation.

4.4. Notification of the subject of personal data about the inclusion of his personal data in the personal data base, the rights defined by the Law of Ukraine "On the protection of personal data", the purpose of collecting data and the persons to whom his personal data is transferred is carried out at registration of civil law relations in accordance with current legislation.

4.5. The processing of personal data on racial or ethnic origin, political, religious or ideological convictions, membership in political parties and trade unions, as well as data relating to health or sexuality (special data categories) is prohibited.


5. Location of the personal data base

5.1. The personal data bases specified in section 2 of these Regulations are located at the seller’s address.


6. Terms of disclosure of information about personal data to third parties

6.1. The procedure for access to personal data of third parties is determined by the terms of consent of the subject of personal data provided to the owner of personal data to process this data, or in accordance with the requirements of the law.

6.2. Access to personal data is not provided to a third party if the said person refuses to assume obligations to ensure compliance with the requirements of the Law of Ukraine “On Personal Data Protection” or cannot provide them.

6.3. The subject of the relationship related to personal data, submits a request for access (hereinafter - the request) to the personal data of the owner of personal data.

6.4. The request shall include:

   - surname, name and patronymic, place of residence (location) and details of the document certifying the individual submitting the request (for the individual - the applicant);
   - name, location of the legal entity submitting the request, position, surname, name and patronymic of the person certifying the request; confirmation that the content of the request conforms to the authority of the legal entity (for the legal entity - the applicant);
   - surname, name and patronymic, as well as other information that allows you to identify the individual in respect of which the request is made;
   - information about the database of personal data in respect of which the request is submitted, information about the owner or manager of this database of personal data;
   - a list of personal data requested;
   - purpose and / or legal basis for the request.

6.5. The term for studying a request for its satisfaction may not exceed ten working days from the date of its receipt. During this period, the owner of the personal data database brings to the notice of the person submitting the request, the request will be sufficient or the relevant personal data will not be provided, indicating the basis defined in the relevant legal act. The request is satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law.

6.6. The postponement of access to personal data of third parties is allowed if the necessary data cannot be provided within thirty calendar days from the date the request is received. At the same time, the total time for resolving issues raised in the request may not exceed forty-five calendar days.


6.7. The postponement is communicated to the third party who submitted the request, in writing, explaining the procedure for appealing such a decision.

6.8. The postponement report shall include:

   - surname, name and patronymic of the official;
   - date of sending the message;
   - the reason for the delay;
   - the period during which the request is satisfied.

6.9. Denial of access to personal data is allowed if access to them is prohibited by law.

6.10. The refusal message includes:

   - surname, name, patronymic of the official who denies access;
   - date of sending the message;
   - rejection reason.

6.11. The decision to postpone or refuse with access to personal data may be appealed in court.
 
7. Protection of personal data: methods of protection, the responsible person, employees who directly process and / or have access to personal data in connection with the performance of their official duties, the period of storage of personal data

7.1. The owner of the personal data base is equipped with system and software and hardware and communication tools that prevent loss, theft, unauthorized destruction, distortion, forgery, copying information and meet the requirements of international and national standards.

7.2. The responsible person organizes the work related to the protection of personal data when they are processed in accordance with the law. The responsible person is determined by the order of the owner of the personal data base.

The responsibilities of the responsible person in organizing work related to the protection of personal data during their processing are indicated in the job description.

7.3. The responsible person must:

   - know the legislation of Ukraine in the field of personal data protection;
   - develop procedures for access to personal data of employees in accordance with their professional or service or employment duties;
   - ensure that the employees of the owner of the personal data base comply with the requirements of the Ukrainian legislation in the field of personal data protection and internal documents governing the activities of the owner of the personal data base for processing and protecting personal data in the personal data bases;
   - to develop a procedure (procedure) for internal control over compliance with the requirements of the legislation of Ukraine in the field of personal data protection and internal documents governing the activities of the owner of personal data bases for processing and protecting personal data in personal data databases, which, in particular, should contain rules on the frequency of implementation such control;
   - inform the owner of the personal data base of facts of violations by employees of the requirements of Ukrainian legislation in the field of personal data protection and internal documents regulating the activities of the owner of the personal data base for processing and protecting personal data in personal data databases no later than one working day after such violations have been detected ;
   - to ensure the storage of documents confirming the provision by the subject of personal data of consent to the processing of his personal data and the message of the specified subject about his rights.

7.4. In order to fulfill their duties, the responsible person has the right to:

   - receive the necessary documents, including orders and other administrative documents issued by the Owner of the personal data base, related to the processing of personal data;
   - make copies of received documents, including copies of files, of any records stored in local computer networks and autonomous computer systems;
   - participate in the discussion of the duties of the organization of work related to the protection of personal data during their processing;
   - to submit proposals for the improvement of activities and improvement of working methods, to submit comments and options for eliminating the identified deficiencies in the process of processing personal data;
   - receive explanations on the implementation of the processing of personal data;
   - sign and endorse documents within its competence.

7.5. Employees who directly process and / or have access to personal data in connection with the fulfillment of their official (labor) duties must comply with the requirements of Ukrainian legislation in the field of personal data protection and internal documents, and personal data processing and protection in personal data bases.

7.6. Employees who have access to personal data, including processing it, are obliged not to allow disclosure to any method of personal data that they have been entrusted to or who have become known in connection with the performance of professional or official or labor duties "connections. This obligation is valid after the termination of their activities related to personal data, except as required by law.

7.7. The entities that have access to personal data, including processing it if they violate the requirements of the Law of Ukraine "On the protection of personal data" are liable under the laws of Ukraine.

7.8. Personal data should not be stored longer than is necessary for the purpose for which such data is stored, but in any case no more than the storage period of the data, the specific consent of the subject of personal data to the processing of this data.
 
8. Rights of the subject of personal data

8.1. The subject of personal data has the right to:

   - be aware of the whereabouts of the personal data base containing its personal data, its purpose and name, location and / or place of residence (stay) of the owner or manager of this database or give the appropriate order to receive this information to persons authorized by it, except as required by law;
   - receive information about the conditions for granting access to personal data, including information about third parties to whom his personal data is transmitted, contained in the relevant personal data database;
   - access to their personal data contained in the relevant database of personal data;
   - receive, no later than thirty calendar days from the date of receipt of the request, except as required by law, an answer stating that his personal data is stored in the relevant personal data database, as well as receiving the contents of his personal data that is stored;
   - to submit a reasoned demand with objection to the processing of their personal data by state authorities, local authorities in the exercise of the powers provided by law;
   - to present a reasoned request to change or destroy their personal data by any owner and manager of this database, if this data is processed illegally or is unreliable;
   - to protect their personal data from unlawful processing and accidental loss, destruction, damage due to deliberate concealment, failure to provide or untimely granting, as well as protection from providing information that is inaccurate or discrediting the honor, dignity and business reputation of an individual;
   - to apply for the protection of their personal data rights to the state authorities, local governments, the powers of which include the implementation of personal data protection;
   - apply legal remedies in case of violation of personal data protection legislation.


9. The procedure for dealing with requests of the subject of personal data

9.1. The subject of personal data is entitled to receive any information about himself from any subject of the relationship related to personal data, without specifying the purpose of the request, except as required by law.

9.2. Access by the subject of personal data to personal data is free of charge.

9.3. The personal data subject submits a request for access (hereinafter - the request) to the personal data to the owner of the personal data base.

The request shall include:

   - surname, name and patronymic, place of residence (location) and details of the document certifying the identity of the subject of personal data;
   - other information to identify the identity of the subject of personal data;
   - information about the database of personal data in respect of which the request is being submitted, information about the owner or manager of this database;
   - a list of personal data requested.

9.4. The term for studying a request for its satisfaction may not exceed ten working days from the date of its receipt. During this period, the owner of the personal data database brings the subject of personal data to the notice, the request will be sufficient or the relevant personal data will not be provided, indicating the basis defined in the relevant legal act.

9.5. The request is satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law.

 

10. State registration of personal data base

10.1. State registration of personal data bases is carried out in accordance with Article 9 of the Law of Ukraine “On Personal Data Protection”.