Regulation on the processing and protection of personal data in personal data bases owned by the seller
1.1. Definition of terms:
personal data base — a referred to as a set of ordered personal data in electronic form and/or in the form of personal data files;
responsible person - a specific person who organizes work related to the protection of personal data during their processing, in accordance with the law;
the owner of the personal data base - an individual or legal entity who has been granted the right to process this data by law or with the consent of the personal data subject, approves the purpose of processing personal data in this database, establishes the composition of this data and the procedures for their processing, unless otherwise specified by law;
state register of personal data bases - a unified state information system for collecting, accumulating and processing information on registered personal data bases;
publicly available sources of personal data - directories, address books, registers, lists, catalogs, and other systematized collections of open information containing personal data posted and published with the knowledge of the personal data subject. Social networks and Internet resources where the personal data subject leaves their personal data are not considered publicly available sources of personal data (except when the personal data subject expressly states that personal data is posted for the purpose of their free distribution and use);
consent of the personal data subject - any documented, voluntary expression of the will of an individual to grant permission to process his personal data in accordance with the stated purpose of their processing;
anonymization of personal data — extracting information that makes it possible to identify an individual;
personal data processing — any action or set of actions performed in whole or in part in an information (automated) system and/or in personal data files related to the collection, registration, accumulation, storage, adaptation, change, update, use and distribution (distribution, sale, transfer), anonymization, destruction of information about an individual;
personal data - information or a set of information about an individual who has been identified or can be specifically identified;
personal database manager - an individual or legal entity who has been granted the right to process this data by the owner of the personal database or by law. A person who is instructed by the owner and/or manager of the personal data base to carry out technical work with the personal data base without access to the content of personal data is not the manager of the personal data;
personal data subject - an individual in respect of whom his personal data is processed in accordance with the law;
intervener - any person, except for the subject of personal data, the owner or manager of the personal data base and the authorized state body for the protection of personal data, to whom the owner or manager of the personal data base transfers personal data in accordance with the law;
special data categories — personal data on racial or ethnic origin, political, religious or ideological beliefs, membership in political parties and trade unions, as well as data related to health or sexual life.
1.2. This Regulation is mandatory for use by the responsible person and the seller's employees who directly process and/or have access to personal data in connection with the performance of their official duties.
2.1. The seller is the owner of the following personal data bases:
- a database of personal data of counterparties.
3.1. The purpose of processing personal data in the system is to ensure the implementation of civil law relations, to provide, receive and make payments for purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine”.
4.1 The consent of the personal data subject must be a voluntary expression of the will of an individual to grant permission to process their personal data in accordance with the stated purpose of their processing.
4.2. The consent of the personal data subject may be provided in the following forms:
a paper document with details that allow the identification of this document and the individual;
an electronic document that must contain mandatory details to identify this document and an individual. It is advisable to certify the voluntary will of an individual to grant permission to process his personal data with an electronic signature of the personal data subject;
a mark on the electronic page of a document or in an electronic file that is processed in the information system based on documented software and hardware solutions.
4.3. The consent of the personal data subject is provided when registering civil law relations in accordance with current legislation.
4.4. The notification of the personal data subject about the inclusion of his personal data in the personal data database, the rights defined by the Law of Ukraine “On the Protection of Personal Data”, the purpose of data collection and the persons to whom his personal data is transferred are carried out when registering civil law relations in accordance with current legislation.
4.5. The processing of personal data on racial or ethnic origin, political, religious or ideological beliefs, membership in political parties and trade unions, as well as data related to health or sex life (special categories of data) is prohibited.
5.1. The personal data bases specified in section 2 of this Regulation are located at the seller's address.
6.1. The procedure for accessing personal data by third parties is determined by the terms of the consent of the personal data subject provided to the personal data owner to process this data, or in accordance with legal requirements.
6.2. Access to personal data is not provided to a third party if this person refuses to assume obligations to ensure compliance with the requirements of the Law of Ukraine “On the Protection of Personal Data” or cannot provide them.
6.3. The subject of a relationship related to personal data submits a request for access (hereinafter referred to as the request) to personal data to the owner of personal data.
6.4. The request shall specify:
6.5. The period for studying the request for its satisfaction may not exceed ten working days from the date of its receipt. During this period, the owner of the personal data base informs the person submitting the request that the request will be satisfied or the relevant personal data cannot be provided, specifying the grounds specified in the relevant regulatory act. The request is satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law.
6.6. Access to third party personal data may be delayed if the required data cannot be provided within thirty calendar days from the date of receipt of the request. At the same time, the total period for resolving the issues raised in the request cannot exceed forty-five calendar days.
6.7. The notice of the delay is brought to the attention of the third party who filed the request in writing, explaining the procedure for appealing such a decision.
6.8. The postponement report states:
6.9. Access to personal data may be denied if access to it is prohibited by law.
6.10 The refusal notice shall specify:
6.11 The decision to postpone or deny access to personal data may be appealed to the court.
7.1. The owner of the personal data base is equipped with system, software and communication tools that prevent loss, theft, unauthorized destruction, distortion, forgery, copying of information and meet the requirements of international and national standards.
7.2. The responsible person organizes work related to the protection of personal data during their processing in accordance with the law. The responsible person is determined by order of the Personal Data Base Owner.
The duties of the responsible person to organize work related to the protection of personal data during their processing are specified in the job description.
7.3. The responsible person is obliged to:
7.4. In order to perform his duties, the responsible person has the right to:
7.5. Employees who directly process and/or have access to personal data in connection with the performance of their official (labor) duties are required to comply with the requirements of Ukrainian legislation in the field of personal data protection and internal documents, and on the processing and protection of personal data in personal data bases.
7.6. Employees who have access to personal data, including those who process it, are obliged to prevent the disclosure by any means of personal data that have been entrusted to them or that have become known in connection with the performance of their professional or official or work duties. This obligation is effective after they stop their activities related to personal data, except as provided by law.
7.7 Persons who have access to personal data, including those who process it, in case of violation of the requirements of the Law of Ukraine “On the Protection of Personal Data” are liable under Ukrainian legislation.
7.8. Personal data should not be kept longer than is necessary for the purpose for which such data is stored, but in any case not longer than the data storage period determined by the consent of the data subject to the processing of this data.
8.1. The personal data subject has the right to:
9.1. The data subject has the right to obtain any information about himself from any personal data subject without specifying the purpose of the request, except as provided by law.
9.2. Personal data subject access to personal data is free of charge.
9.3. The personal data subject submits a request for access (hereinafter referred to as the request) to personal data to the owner of the personal data base.
The request shall specify:
9.4. The period for studying the request for its satisfaction may not exceed ten working days from the date of its receipt. During this period, the owner of the personal data base informs the personal data subject that the request will be satisfied or the relevant personal data cannot be provided, specifying the grounds specified in the relevant regulatory act.
9.5. The request is satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law.
10.1. State registration of personal data bases is carried out in accordance with Article 9 of the Law of Ukraine “On the Protection of Personal Data”.
