1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy of OtiumSoft LLC (hereinafter referred to as the “Policy”) has been developed in compliance with the requirements of the Law of the Republic of Belarus dated May 7, 2021 No. 99-Z “On Personal Data Protection” (hereinafter referred to as the “Law”) and other legislative acts of the Republic of Belarus.
1.2. The Policy defines the activities of OtiumSoft LLC (hereinafter referred to as the “Operator”) in relation to personal data processing in the role of an operator.
1.3. The objectives of the Policy are to ensure proper protection of personal data, rights and freedoms of individuals during the processing of their personal data, as well as to harmonize the procedure for personal data processing with the requirements of the legislation of the Republic of Belarus.
1.4. The Policy explains to personal data subjects for what purposes and how their personal data is processed, and also defines the related rights of personal data subjects and the mechanism for their exercise.
1.5. Personal data processing in the course of employment, processing of cookie files on the Operator’s websites, and video surveillance are governed by separate policies.
1.6. Contact details of OtiumSoft LLC: 220034, Minsk, 3 Chapaeva St., office 239. Email: info@otium.by; website: www.otium.by; phone: +375(44) 5694712.
1.7. To ensure the possibility of free access, the Policy is published in open access on the Operator’s website www.otium.by, as well as in the “Otium E-commerce” mobile application (hereinafter referred to as the “Application”).
1.8. Terms used in the text of the Policy are used in the meanings defined in the Law and other regulatory legal acts of the Republic of Belarus.
2. PERSONAL DATA PROCESSING PROCEDURE
2.1. Personal data processing is carried out with the consent of the personal data subject, except in cases where, in accordance with the legislative acts of the Republic of Belarus, the consent of the personal data subject is not required.
2.2. The consent of the personal data subject to the processing of their personal data (with the exception of special personal data — personal data concerning racial or ethnic origin, political views, trade union membership, religious or other beliefs, health or sexual life, administrative or criminal liability, as well as biometric and genetic personal data) is not required:
2.2.1. when personal data is received by the Operator on the basis of a contract concluded (being concluded) with the personal data subject, for the purpose of performing actions established by that contract;
2.2.2. when processing personal data specified in a document addressed to the Operator and signed by the personal data subject, in accordance with the content of such document;
2.2.3. in relation to previously disseminated personal data until the moment the personal data subject submits a request to cease the processing of disseminated personal data, as well as their deletion in the absence of other grounds for personal data processing provided by the Law and other legislative acts;
2.2.4. in cases where the processing of personal data by the Operator is necessary for the fulfillment of duties (powers) provided by legislative acts.
2.3. Depending on the purpose of processing, personal data processing includes any actions or combination of actions performed with personal data, including collection, systematization, storage, modification, use, blocking, dissemination, provision (including cross-border transfer), deletion, and anonymization of personal data.
2.4. Personal data processing is carried out both using automation tools and without their use, including by mixed methods of data processing. At the same time, the Operator limits personal data processing to the achievement of specific, pre-stated processing purposes, and personal data is stored in a form that allows identification of the personal data subject no longer than required by the stated processing purposes.
2.5. The Operator processes only those personal data that are necessary to achieve the stated purposes, and does not allow their excessive processing.
2.6. When determining the storage periods for personal data, the Operator is guided by the periods defined by the following regulatory legal acts:
1) Regulation on the procedure for preliminary identification of users of an internet resource, online publication, approved by the Resolution of the Council of Ministers of the Republic of Belarus dated November 23, 2018 No. 850;
2) List of standard documents generated in the course of activities of state bodies, other organizations and individual entrepreneurs, with indication of storage periods, approved by the Resolution of the Ministry of Justice of the Republic of Belarus dated May 24, 2012 No. 140 “On the list of standard documents” (hereinafter referred to as the “List”).
If the storage period for personal data is not defined by the List, the Operator independently determines such period based on the purposes of personal data processing and the specifics of its activities, while excluding their excessive processing.
2.7. Upon expiration of the established storage periods, personal data contained in the Operator’s information systems (resources) are subject to deletion. Documents containing personal data are destroyed in the manner established by the legislation on archival affairs and records management.
2.8. The Operator processes personal data independently or with the involvement of authorized persons.
2.8.1. If the Operator entrusts the processing of personal data to an authorized person, the Operator bears responsibility before personal data subjects for actions performed with their personal data by such person.
2.8.2. The engagement by an authorized person of other (sub-authorized) persons for personal data processing is permitted only with the written consent of the Operator.
2.8.3. The list of authorized persons who process personal data on behalf of the Operator is published on the Operator’s website.
3. PROCEDURE FOR OBTAINING CONSENT OF THE PERSONAL DATA SUBJECT
3.1. The consent of the personal data subject is a free, unambiguous, informed expression of their will, by which they permit the processing of their personal data.
3.2. The consent of the personal data subject may be obtained in written, electronic, or other form.
3.2.1. In electronic form, the Operator obtains consent by the personal data subject checking the corresponding checkbox on the Website, or by clicking a button confirming such choice on the website or mobile application.
3.2.2. Other forms may include obtaining consent by any other method that allows establishing the fact of obtaining the consent of the personal data subject.
3.3. Before obtaining the consent of the personal data subject, the Operator, in written, electronic, or other form corresponding to the form of expression of such consent, is obliged to provide the personal data subject with information containing:
1) the name and location of the Operator;
2) the purposes of personal data processing;
3) the list of personal data for the processing of which consent is given;
4) the period for which consent is given;
5) information about authorized persons in cases where personal data processing will be carried out by such persons;
6) the list of actions with personal data for which consent is given, a general description of the methods of personal data processing used by the Operator;
7) other information necessary to ensure transparency of the personal data processing procedure.
4. PURPOSES, CATEGORIES, LIST OF PERSONAL DATA SUBJECTS, LEGAL GROUNDS AND PROCESSING PERIODS
4.1. For the purpose of user account registration on the Operator’s website www.otium.by and in the “Otium E-commerce” mobile application.
| Categories of subjects | Persons registering an account |
|---|---|
| List of processed data | Mobile phone number and email, network IP address and User’s device type, internal identifier (ID), User’s interaction history with the Website, surname, first name, patronymic (if any) or initials and other information related to personal data provided by the account holder — mandatory data. |
| Legal grounds | The Law |
| Storage period | 1 (one) year after termination of the User Agreement at the initiative of either party. |
4.2. For the purpose of concluding the offer agreement posted on the Operator’s website.
| Categories of subjects | Persons performing actions to accept the offer agreement, persons accepting the offer agreement, or persons who have accepted (concluded) the offer agreement |
|---|---|
| List of processed data | Mobile phone number and email, network IP address and User’s device type, internal identifier (ID), User’s interaction history with the Website, surname, first name, patronymic (if any) or initials and other information related to personal data provided by the account holder, taxpayer identification number. |
| Legal grounds | Art. 6, Art. 8 of the Law |
| Storage period | 3 (three) years after termination of the offer agreement, unless a different period is provided by law. |
4.3. For the purpose of sending notifications about the functioning of the website, services provided by the Operator, etc.
| Categories of subjects | Website users, persons performing actions to accept the offer agreement, persons accepting the offer agreement, or persons who have accepted (concluded) the offer agreement |
|---|---|
| List of processed data | Mobile phone number, email, first name, internal identifier (ID), other personal data contained in the notification. |
| Legal grounds | Art. 5, Art. 6 of the Law |
| Consent validity period | 3 (three) years |
| Storage period | 3 (three) years, unless a different period is determined by law |
4.4. For the purpose of sending advertising messages to Users of the website www.otium.by and the “Otium E-commerce” mobile application via email, SMS, Viber, Telegram, WhatsApp, and personal account functionality on the Website.
| Categories of subjects | Website users, persons performing actions to accept the offer agreement, persons accepting the offer agreement, or persons who have accepted (concluded) the offer agreement. |
|---|---|
| List of processed data | First name, email, mobile phone number, internal identifier (ID) of the User, device type. |
| Legal grounds | Art. 5 of the Law |
| Consent validity period | 3 (three) years |
| Storage period | 1. For persons who are account holders on the Website — 1 year after termination of the User Agreement at the initiative of either party. 2. For persons who are not account holders on the Website — 1 year from the moment of consent withdrawal or expiration of the consent validity period. |
4.5. For the purpose of exercising consumer rights granted by consumer protection legislation (reviewing applications, appeals, communication with consumers, etc.):
| Categories of subjects | Persons performing actions to accept the offer agreement, persons accepting the offer agreement, or persons who have accepted (concluded) the offer agreement |
|---|---|
| List of processed data | Mobile phone number, email, first name, surname, order number (service, concluded contract), information about the ordered or purchased service, other personal data contained in the order form or consumer appeal. |
| Legal grounds | Personal data processing is necessary for the fulfillment of duties (powers) provided by legislative acts (Art. 6 of the Law; Law of the Republic of Belarus dated January 9, 2002 No. 90-Z “On Consumer Protection”). |
| Storage period | 3 years after the tax authorities conduct a tax compliance audit. If the tax authorities have not conducted a compliance audit — 10 years after the expiration of the contract. |
4.6. For the purpose of processing previously disseminated personal data until the personal data subject submits a request to cease the processing of disseminated personal data.
| Categories of subjects | Individuals whose personal data has been disseminated on the Website |
|---|---|
| List of processed data | Any categories of personal data disseminated on the Website |
| Legal grounds | Art. 6 of the Law |
| Storage period | Until the personal data subject submits a request to cease the processing of previously disseminated personal data, as well as their deletion in the absence of other grounds for personal data processing provided by the Law or other legislative acts. |
4.7. For the purpose of maintaining accounting and tax records of business activities, including records of services rendered.
| Categories of subjects | Persons accepting the offer agreement, or persons who have accepted (concluded) the offer agreement |
|---|---|
| List of processed data | Personal data contained in primary accounting documents. |
| Legal grounds | Art. 6 of the Law; Law of the Republic of Belarus dated July 12, 2013 No. 57-Z “On Accounting and Reporting”). |
| Storage period | 3 years after the expiration of the contract, provided that the tax authorities have conducted a tax compliance audit. 10 years after the expiration of the contract, if the tax authorities have not conducted a tax compliance audit. |
5. RIGHTS OF PERSONAL DATA SUBJECTS
5.1. Personal data subjects have the following rights:
| No. | Subject’s right | Explanation | Operator’s action |
|---|---|---|---|
| 1 | The right to withdraw previously given consent to personal data processing. | The subject may at any time without explanation withdraw their consent if the Operator obtained the consent of the personal data subject for processing. The right to withdraw consent cannot be exercised in cases where personal data processing is carried out by the Operator on other legal grounds. | The Operator, within fifteen days after receiving the application, in accordance with its content, shall cease the processing of personal data, delete and (or) anonymize them, and notify the personal data subject thereof, except in cases where the Operator is entitled to continue processing personal data on other grounds established by the legislation of the Republic of Belarus. |
| 2 | The right to demand cessation of personal data processing and (or) their deletion. | The subject has the right to demand from the Operator the free cessation of processing of their personal data, including their deletion, in the absence of other grounds for personal data processing established by the legislation of the Republic of Belarus. | The Operator, within fifteen days after receiving the application, in accordance with its content, shall cease the processing of personal data, delete and (or) anonymize them, and notify the personal data subject thereof, except in cases where the Operator is entitled to continue processing personal data on other grounds established by the legislation of the Republic of Belarus. |
| 3 | The right to make changes to personal data. | The subject has the right to demand from the Operator to make changes to their personal data if such data is incomplete, outdated, or inaccurate. | The Operator, within fifteen days after receiving the application, shall make changes to personal data if they are incomplete, outdated, or inaccurate, and notify the personal data subject thereof. For these purposes, the personal data subject shall attach the relevant documents and (or) their duly certified copies confirming the need to make changes to personal data. Account holders have the technical ability to perform such actions independently without the Operator’s involvement in relation to personal data contained in their account profile. |
| 4 | The right to obtain information regarding the processing of personal data. | The personal data subject has the right to obtain information regarding the processing of personal data: 1) the name and location of the Operator; 2) confirmation of the fact of processing the applicant’s personal data; 3) the list of personal data processed by the Operator and the source of their receipt; 4) the legal grounds and purposes of personal data processing; 5) the period for which consent was given, provided that personal data processing is based on consent; 6) the name and location of authorized persons, if any; 7) other information provided by law. | The Operator, within five business days after receiving the application, shall provide the personal data subject with the requested information or notify them of the reasons for refusal to provide it. |
| 5 | The right to obtain information about the provision of personal data to third parties. | The personal data subject has the right to obtain from the Operator information about the provision of their personal data processed by the Operator to third parties. This right may be exercised by the personal data subject free of charge once per calendar year. | The Operator, within fifteen days from the date of receipt of the application, shall provide the personal data subject with information about which personal data and to whom were provided during the year preceding the date of the application, or notify the personal data subject of the reasons for refusal to provide it. |
| 6 | The right to appeal actions (inaction) and decisions of the Operator related to personal data processing. | The personal data subject has the right to appeal the actions/inaction and decisions of the Operator to the National Center for Personal Data Protection. | The procedure for reviewing complaints is established by the legislation on appeals of citizens and legal entities. |
5.2. To exercise their rights listed in the table under No. 1–5, the personal data subject shall send the Operator a corresponding application in one of the following ways:
5.2.1. in written form (by courier, mail, in person) to the address of the legal entity (specified in clause 1.6 of the Policy);
5.2.2. as an electronic document containing the electronic digital signature of the personal data subject, to the email address (specified in clause 1.6 of the Policy).
5.3. The right to withdraw consent, listed in the table under No. 1, may also be exercised by:
5.3.1. filling out the electronic form located on the Website.
5.3.2. sending a message (without electronic signature) to the email address (specified in clause 1.6 of the Policy) by account holders; for these purposes, Users must send an appeal to the Operator from the email validated (linked) to the account.
5.4. The right to withdraw consent cannot be exercised in cases where personal data processing is carried out by the Operator not on the basis of consent of the personal data subject, but on other legal grounds provided by law.
5.5. A response to the application is sent by the Operator in the form corresponding to the form in which the application was submitted by the personal data subject, unless otherwise specified in the application itself.
6. CROSS-BORDER TRANSFER OF PERSONAL DATA
6.1. Cross-border transfer of personal data to the territory of a foreign state may be carried out by the Operator if the territory of the foreign state ensures an adequate level of protection of the rights of personal data subjects;
6.2 If the territory of the foreign state does not ensure an adequate level of protection of the rights of personal data subjects, cross-border transfer may be carried out only on the grounds provided by the Law.
7. FINAL PROVISIONS
7.1. The Operator has the right at its own discretion to unilaterally amend and (or) supplement the terms of the Policy without prior notification to personal data subjects. The current version of the Policy is published on the website www.otium.by and in the “Otium E-commerce” mobile application.
7.2. Issues related to personal data processing not covered by the Policy are governed by the legislation of the Republic of Belarus.