Regulations on the Processing and Protection of Personal Data in Personal Data Databases Owned by the Seller

 

Contents

  1. General definitions and scope
  2. List of personal data databases
  3. Purpose of personal data processing
  4. Procedure for processing personal data: obtaining consent and informing data subjects of their rights and of actions involving their personal data
  5. Location of the personal data database
  6. Conditions for disclosing personal data to third parties
  7. Protection of personal data: safeguards, the responsible person, employees who process and/or have access to personal data as part of their duties, and the retention period
  8. Rights of the data subject
  9. Procedure for handling requests from data subjects
  10. State registration of the personal data database

 

1. General Definitions and Scope

1.1. Definitions:

personal data database — a named collection of structured personal data in electronic form and/or in the form of personal data files;

responsible person — a designated person who organizes the protection of personal data during its processing in accordance with the law;

owner of a personal data database — an individual or legal entity authorized by law or by the data subject’s consent to process such data, who determines the purpose of processing, the composition of the data, and the procedures for processing it, unless otherwise provided by law;

State Register of Personal Data Databases — a unified state information system for collecting, accumulating, and processing information about registered personal data databases;

publicly available sources of personal data — directories, address books, registers, lists, catalogs, and other organized collections of publicly available information containing personal data published with the data subject’s consent. Social networks and online resources where data subjects provide their personal data are not considered publicly available sources, except where the data subject expressly states that the data has been posted for free distribution and use;

consent of the data subject — any documented, voluntary expression of an individual’s intention to authorize the processing of their personal data for a specified purpose;

depersonalization of personal data — removal of information that makes it possible to identify an individual;

processing of personal data — any action or set of actions performed wholly or partly in an information system (including an automated system) and/or in personal data files, involving the collection, registration, accumulation, storage, adaptation, alteration, updating, use, dissemination (including distribution, sale, or transfer), depersonalization, or destruction of information about an individual;

personal data — information or a set of information about an individual who is identified or can be specifically identified;

processor of a personal data database — an individual or legal entity authorized by the database owner or by law to process the data. A person assigned technical work on a personal data database without access to the contents of the personal data is not considered its processor;

data subject — an individual whose personal data is processed in accordance with the law;

third party — any person other than the data subject, the owner or processor of the personal data database, or the authorized state body responsible for personal data protection, to whom personal data is transferred by the owner or processor in accordance with the law;

special categories of data —

personal data concerning racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties or trade unions, as well as data concerning health or sexual life.

1.2. These Regulations are binding on the responsible person and the Seller’s employees who directly process and/or have access to personal data in the course of their duties.

 

2. List of Personal Data Databases

2.1. The Seller owns the following personal data database:

  • database of counterparties’ personal data.

 

3. Purpose of Personal Data Processing

3.1. The purpose of processing personal data in the system is to facilitate civil-law relationships and the provision, receipt, and payment of purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine.”

 

4. Procedure for Processing Personal Data: Obtaining Consent and Informing Data Subjects of Their Rights and of Actions Involving Their Personal Data

4.1. A data subject’s consent must be a voluntary expression of their intention to authorize the processing of their personal data for a specified purpose.

4.2. A data subject may give consent in the following forms:

  • a paper document containing details that make it possible to identify the document and the individual;
  • an electronic document containing the required details that make it possible to identify the document and the individual. It is advisable to confirm the individual’s voluntary consent to the processing of their personal data with the data subject’s electronic signature;
  • a mark on an electronic document page or in an electronic file processed in an information system using documented software and technical solutions.

4.3. The data subject gives consent when entering into a civil-law relationship in accordance with applicable law.

4.4. The data subject is informed that their personal data has been included in a personal data database, of the rights established by the Law of Ukraine “On Personal Data Protection,” of the purpose of collecting the data, and of the persons to whom the data is transferred when entering into a civil-law relationship in accordance with applicable law.

4.5. Processing personal data concerning racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties or trade unions, or data concerning health or sexual life (special categories of data) is prohibited.

 

5. Location of the Personal Data Database

5.1. The personal data database specified in Section 2 of these Regulations is located at the Seller’s address.

 

6. Conditions for Disclosing Personal Data to Third Parties

6.1. Third-party access to personal data is governed by the terms of the data subject’s consent given to the owner for processing the data, or by legal requirements.

6.2. A third party is not granted access to personal data if that party refuses to undertake to comply with the requirements of the Law of Ukraine “On Personal Data Protection” or is unable to comply with them.

6.3. A party involved in a personal data relationship submits a request for access (hereinafter referred to as a “request”) to the owner of the personal data.

6.4. The request must state:

  • the surname, given name, and patronymic, place of residence (or stay), and details of the identity document of the person submitting the request, if the applicant is an individual;
  • the name and address of the legal entity submitting the request; the position, surname, given name, and patronymic of the person signing the request; and confirmation that the request falls within the legal entity’s authority, if the applicant is a legal entity;
  • the surname, given name, and patronymic, and other information identifying the individual to whom the request relates;
  • information about the relevant personal data database or its owner or processor;
  • a list of the personal data requested;
  • the purpose and/or legal grounds for the request.

6.5. The review of a request to determine whether it can be fulfilled must take no more than ten business days from its receipt. During this period, the owner of the personal data database informs the requester whether the request will be fulfilled or the relevant personal data cannot be provided, stating the grounds established by the applicable legal act. The request is fulfilled within thirty calendar days of receipt unless otherwise provided by law.

6.6. Third-party access to personal data may be deferred if the requested data cannot be provided within thirty calendar days of receipt of the request. The total time for resolving the matters raised in the request must not exceed forty-five calendar days.

6.7. The third party that submitted the request is informed of the deferral in writing, with an explanation of how to appeal the decision.

6.8. A deferral notice must state:

  • the surname, given name, and patronymic of the official;
  • the date the notice was sent;
  • the reason for the deferral;
  • the period within which the request will be fulfilled.

6.9. Access to personal data may be refused if such access is prohibited by law.

6.10. A refusal notice must state:

  • the surname, given name, and patronymic of the official refusing access;
  • the date the notice was sent;
  • the reason for the refusal.

6.11. A decision to defer or refuse access to personal data may be appealed in court.

 

7. Protection of Personal Data: Safeguards, the Responsible Person, Employees Who Process and/or Have Access to Personal Data as Part of Their Duties, and the Retention Period

7.1. The personal data database is equipped with system, software, technical, and communication safeguards designed to prevent loss, theft, unauthorized destruction, distortion, falsification, or copying of information and to meet international and national standards.

7.2. The responsible person organizes the protection of personal data during its processing in accordance with the law. The responsible person is appointed by an order of the owner of the personal data database.

The responsible person’s duties in organizing the protection of personal data during its processing are specified in their job description.

7.3. The responsible person must:

  • know Ukrainian legislation on personal data protection;
  • develop procedures for employees’ access to personal data according to their professional or employment duties;
  • ensure that employees of the personal data database owner comply with Ukrainian personal data protection law and the owner’s internal documents governing the processing and protection of personal data;
  • develop an internal control procedure for monitoring compliance with Ukrainian personal data protection law and the owner’s internal documents governing the processing and protection of personal data, including provisions on how often such monitoring is carried out;
  • notify the personal data database owner of any employee breaches of Ukrainian personal data protection law or the owner’s internal documents no later than one business day after discovering them;
  • ensure the retention of documents confirming the data subject’s consent to the processing of their personal data and confirmation that the data subject was informed of their rights.

7.4. To perform their duties, the responsible person has the right to:

  • obtain the necessary documents, including orders and other administrative documents issued by the personal data database owner concerning personal data processing;
  • make copies of received documents, including files and any records stored on local computer networks and standalone computer systems;
  • participate in discussions concerning their duties in organizing the protection of personal data during its processing;
  • submit proposals to improve operations and working methods, provide comments, and suggest ways to address deficiencies identified in personal data processing;
  • obtain explanations concerning personal data processing;
  • sign and endorse documents within their authority.

7.5. Employees who directly process and/or have access to personal data in the course of their employment duties must comply with Ukrainian personal data protection law and internal documents governing the processing and protection of personal data.

7.6. Employees who have access to personal data, including those who process it, must not disclose in any manner personal data entrusted to them or learned in the course of their professional or employment duties. This obligation continues after they cease activities involving personal data, except as provided by law.

7.7. Persons who have access to personal data, including those who process it, are liable under Ukrainian law if they violate the requirements of the Law of Ukraine “On Personal Data Protection.”

7.8. Personal data must not be retained longer than necessary for the purpose for which it is stored, and in any event no longer than the retention period specified in the data subject’s consent to its processing.

 

8. Rights of the Data Subject

8.1. The data subject has the right to:

  • know the location and purpose of the personal data database containing their data, as well as the name and address and/or place of residence (or stay) of its owner or processor, or authorize another person to obtain this information, except as provided by law;
  • receive information about the conditions for access to their personal data, including information about third parties to whom their data in the relevant database is transferred;
  • access their personal data held in the relevant database;
  • receive, within thirty calendar days of a request unless otherwise provided by law, a response as to whether their personal data is held in the relevant database and obtain the contents of the data held;
  • submit a reasoned objection to the processing of their personal data by state authorities or local self-government bodies in the exercise of their statutory powers;
  • request that any owner or processor of the database amend or destroy their personal data if it is processed unlawfully or is inaccurate;
  • have their personal data protected against unlawful processing and accidental loss, destruction, or damage, including through intentional concealment, failure to provide the data, or late provision of the data, and against the provision of inaccurate information or information that harms their honor, dignity, or business reputation;
  • contact state authorities or local self-government bodies responsible for protecting personal data rights;
  • use legal remedies if personal data protection law is violated.

 

9. Procedure for Handling Requests from Data Subjects

9.1. A data subject has the right to obtain any information about themselves from any party involved in personal data relationships without stating the purpose of the request, except as provided by law.

9.2. A data subject’s access to their own data is free of charge.

9.3. The data subject submits a request for access (hereinafter referred to as a “request”) to the owner of the personal data database.

The request must state:

  • the surname, given name, and patronymic, place of residence (or stay), and details of the data subject’s identity document;
  • other information identifying the data subject;
  • information about the relevant personal data database or its owner or processor;
  • a list of the personal data requested.

9.4. The review of a request to determine whether it can be fulfilled must take no more than ten business days from its receipt. During this period, the owner of the personal data database informs the data subject whether the request will be fulfilled or the relevant personal data cannot be provided, stating the grounds established by the applicable legal act.

9.5. The request is fulfilled within thirty calendar days of its receipt unless otherwise provided by law.
 

10. State Registration of the Personal Data Database

10.1. State registration of personal data databases is carried out in accordance with Article 9 of the Law of Ukraine “On Personal Data Protection.”

 

Legal Information

Full legal name: Limited Liability Company “Engineering Company PNEUMOSYSTEMZ”

Address: Office 11, 52 Olesia Honchara Street, Kyiv, 01054, Ukraine
Director: Roman Yevhenovych Kyrylenko
EDRPOU code: 40583432
VAT registration number: 405834320331

Contact Information

Phone numbers: +38 (073) 77-99-432, +38 (093) 180 87 92, +38 (099) 943 49 91

Email: office.asfero@gmail.com