APPROVED
order
of DevScience LLC 30.12.2024 No. 30
REGULATION
on the policy regarding the processing
of personal data
1.1.
This
Regulation on the policy regarding the processing of personal data (hereinafter
referred to as the Policy) of DevScience Limited
Liability Company is one of the measures taken by DevScience
LLC to protect personal data, according to the Article 17 of the Law of the
Republic of Belarus dated May 7, 2021 No. 99 Z “On the Protection of Personal
Data” (hereinafter referred to as the Law).
1.2.
The policy
applies to all personal data processed by Devscience
Limited Liability Company (hereinafter referred to as the Operator).
1.3.
The Policy
applies to relations in the field of processing personal data that arose with
the Operator both before and after the approval of the Policy.
1.4.
Postal
address of Devscience LLC: 220084, Minsk, Kuprevicha str., 1/5, office 211a; Internet address:
https://devscience.by, https://devscience.tech; e-mail: info@devscience.tech .
1.5.
According ot the requirements of paragraph 4 of Article 17 of the Law
on Personal Data, this policy is published in the public domain on the
Operator’s website on the Internet information and telecommunications network.
1.5.
Key
concepts used in the Policy:
automated processing of personal data –
processing of personal data using computer technology;
blocking of personal data – termination of
access to personal data without deleting it;
personal data information system – a set of
personal data contained in databases and information technologies and technical
means that ensure their processing;
depersonalization of personal data – an action
as a result of which it becomes impossible to determine the ownership of
personal data by a specific subject of personal data without the use of
additional information;
personal data processing – any actions
(operations) or a set of actions (operations) with personal data, performed
using automation tools or without their usage. Personal data processing
includes, but is not limited to: collection, recording, systematization,
accumulation, storage, clarification (updating, modification), extraction, use,
transfer (distribution, provision, access), depersonalization, blocking,
deletion, destruction;
personal data operator (operator) – a state
body, a legal entity of the Republic of Belarus, another organization, an
individual, including an individual entrepreneur, independently or jointly with
other specified persons organizing and (or) carrying out the processing of
personal data;
personal data – any information relating to an
identified or identifiable natural person;
provision of personal data – actions aimed at
familiarizing oneself with the personal data of a certain person or group of
persons;
dissemination of personal data – actions aimed
at disclosing personal data to an indefinite number of persons;
personal data subject – an individual whose
personal data is processed;
deletion of personal data – actions as a result
of which it becomes impossible to restore the content of personal data in the
personal data information system and (or) that results in destroying the
tangible media of personal data;
1.6.
Basic
rights and obligations of the Operator.
1.6.1. The operator has the right:
independently
determine the composition and list of measures necessary and sufficient to
ensure the fulfillment of obligations stipulated by the Law on Personal Data
and regulatory legal acts adopted in accordance with it, unless otherwise
provided by law;
entrust
the processing of personal data to another person, unless otherwise provided by
law, on the basis of an agreement concluded with this person. The person
processing personal data on behalf of the Operator is obliged to comply with
the principles and rules for processing personal data stipulated by the Law on
Personal Data;
when
the personal data subject withdraws the consent to the processing of its
personal data, the Operator has the right to continue processing personal data
without the consent of the personal data subject if there are grounds specified
in the Law on Personal Data.
1.6.2. The operator is obliged to:
organize
the processing of personal data in accordance with the requirements of the Law
on Personal Data;
respond
to requests and inquiries from personal data subjects in accordance with the
requirements of the Law on Personal Data;
report
to the authorized body for the protection of the rights of personal data
subjects about violations of personal data protection systems immediately, but
no later than three working days after the Operator became aware of such
violations;
comply
with the requirements of the authorized body for the protection of the rights
of personal data subjects to eliminate violations of the legislation on
personal data.
1.7.
Control
over compliance with the requirements of the Policy is carried out by the
person responsible for organizing the processing of personal data by the
Operator.
1.8.
Responsibility
for violation of the requirements of the legislation of the Republic of Belarus
and the regulatory acts of the Operator in the field of processing and
protection of personal data is determined in accordance with the legislation of
the Republic of Belarus.
2. Purposes of collecting personal data
2.2.
Only
personal data that meets the purposes of their processing are subject to
processing.
2.3.
The
Operator processes personal data for the following purposes:
ensuring compliance with the legislation of the
Republic of Belarus;
carrying out its activities in accordance with
the Operator’s charter;
personnel records management;
search for a candidate, information interaction
with candidates, verification of their reliability, checking of the
completeness and accuracy of the information provided by the candidates,
processing of information (CV) of the candidate for employment;
attracting and selecting candidates for work at
the Operator;
processing of personal data when organizing
internships and internships for university students;
assisting employees in finding employment,
obtaining education, ensuring the personal safety of employees, monitoring the
quantity and quality of work performed, ensuring the safety of property;
processing of personal data during work
activities (hiring, maintaining personnel records, military records, personnel
reserve, training, advanced training, instruction and knowledge testing,
monitoring the quantity and quality of work performed, checking and assessing
the performance of job responsibilities, making management and personnel
decisions, monitoring labor and performance discipline, imposing disciplinary
and financial liability, ensuring personal safety, considering and resolving
labor disputes, conflict situations and other disagreements in the context of
labor relations, ensuring the safety of property and material assets) and upon
dismissal;
organizing the registration of employees for
individual (personalized) records in the compulsory pension insurance system;
filling out and submitting required reporting
forms to executive authorities and other authorized organizations;
implementation of civil law relations;
implementation of functions,
powers and duties imposed on the Operator by the legislation of the Republic of
Belarus, including the provision of personal data to the Ministry of Labor and
Social Protection, the Social Protection Fund, as well as to other government
agencies;
accounting and tax records
management;
accrual and transfer of wages;
confirmation of the accuracy
and completeness of personal data provided by the user (if necessary);
implementation of
administrative procedures;
military registration;
posting information on the Operator’s official
website on the Internet;
establishing feedback with the visitor to the
Operator’s official website;
preparation of commercial proposals,
advertising mailings related to products (works, services), participation in
tenders;
coordination and preparation for conclusion,
conclusion, execution and termination of contracts with counterparties,
coordination and interaction with counterparties, contractual work.
2.4.
The
processing of personal data of employees may be carried out solely for the
purpose of ensuring compliance with laws and other regulatory legal acts.
2.5.
Personal
data is stored in a form that allows identification of the subject of personal
data, no longer than required by the stated purposes of processing personal
data.
3.
Legal
grounds for processing personal data
Constitution
of the Republic of Belarus;
Civil
Code of the Republic of Belarus;
Labor
Code of the Republic of Belarus;
Tax
Code of the Republic of Belarus;
Personal
Data Law;
other
regulatory legal acts governing relations related to the activities of the
Operator.
3.2.
The legal
basis for processing personal data also includes:
agreements
concluded between the Operator and personal data subjects;
consent of personal data subjects to the
processing of their personal data.
4.
Volume and
categories of personal data processed,
categories of personal data subjects
4.1.
The
content and volume of personal data processed must correspond to the stated
purposes of processing, stipulated in Section 2 of the Policy. The processed personal
data must not be excessive in relation to the stated purposes of their processing.
4.2.
The
operator may process the listed personal data of the following categories of
personal data subjects.
4.2.1.
Candidates
for employment with the Operator:
last name, first name, patronymic (if any);
gender;
citizenship;
date and place of birth;
contact details;
information about education, work experience,
qualifications;
other personal data provided by candidates in
their СVs and cover letters;
4.2.2.
Employees
and former employees of the Operator:
last name, first name, patronymic (if any);
gender;
citizenship;
date and place of birth;
image (photo);
passport details;
registration address at the place of residence;
actual address of residence;
contact details;
individual taxpayer identification number;
information about education, qualifications,
professional training and advanced training;
marital status, children, family ties;
information about work activity, including the
presence of incentives, awards and (or) disciplinary sanctions;
marriage registration data;
military registration information;
information about disability;
information about
alimony payments;
information about income from previous place of
employment;
other personal data provided by employees in
accordance with the requirements of labor legislation.
4.2.3.
Family
members of the Operator's employees:
last name, first name, patronymic (if any);
degree of kinship;
year of birth;
other personal data provided by employees in
accordance with the requirements of labor legislation.
4.2.4.
Clients
and contractors of the Operator (individuals):
last name, first name, patronymic (if any);
date and place of birth;
passport details;
registration address at place of residence;
contact details;
individual taxpayer identification number;
bank account number;
other personal data provided by clients and
counterparties (individuals) necessary for the conclusion and execution of
contracts.
4.2.5.
Representatives
(employees) of the Operator’s clients and counterparties (legal entities):
last name, first name, patronymic (if any);
passport details;
contact details;
position held;
other personal data provided by representatives
(employees) of clients and counterparties, necessary for the conclusion and
execution of contracts.
4.2.6. Citizens
who have applied (are applying) for the implementation of the administrative
procedure:
passport details;
last name, first name, patronymic (if any);
date and place of birth;
address of registration at the place of
residence, address of the place of stay;
contact details;
other personal data provided in accordance with
the legislation on the appeals of citizens and legal entities.
4.2.7 Users of the Operator's website:
data reflecting names and e-mail, other
information that is necessary, from the user (an individual);
4.3 The Operator processes biometric personal data
(e.g. photos) in accordance with the legislation of the Republic of Belarus.
4.4 The operator does not process special
categories of personal data related to race, nationality, political views,
religious or philosophical beliefs, health status, intimate life, except in
cases stipulated by the legislation of the Republic of Belarus.
5.
Procedure
and conditions for processing personal data
5.1.
The
processing of personal data is carried out by the Operator in accordance with
the legislation of the Republic of Belarus.
5.2.
The
processing of personal data is carried out with the consent of the subjects of
personal data to the processing of their personal data, as well as without such
consent in cases stipulated by the legislation of the Republic of Belarus.
5.3.
The
operator carries out only non-automated processing of personal data.
5.4.
Only
employees of the Operator whose job responsibilities include processing
personal data are allowed to process personal data.
5.5.
The
processing of personal data is carried out by:
obtaining personal data in written and oral
form directly from the subjects of personal data;
obtaining personal data from publicly available
sources;
use of other methods of processing personal
data.
5.6.
Disclosure
to third parties and distribution of personal data without the consent of the
personal data subject is not permitted, unless otherwise provided by law.
Consent to the processing of personal data is authorized by the personal data
subject for distribution, execution separately from other consents of the
personal data subject to the processing of his personal data.
5.7.
The list
of personal data for inquiry and investigation bodies, tax authorities, the
Social Security Fund and other executive authorities and organizations is
carried out in accordance with the requirements of the legislation of the
Republic of Belarus.
5.8.
The
operator takes the necessary legal, organizational and technical measures to
protect personal data from unauthorized or accidental access, destruction,
modification, blocking, distribution and other unauthorized actions, including:
identifies threats to the security of personal
data during their processing;
adopts local regulations and other documents
governing relations in the field of processing and protection of personal data;
appoints persons responsible for ensuring the
security of the Operator’s personal data;
creates the necessary conditions to work with personal data;
organizes the recording of documents containing
personal data;
stores personal data under conditions that
ensure their safety and prevent unauthorized access to them;
organizes training for the Operator’s employees
who process personal data.
5.9.
The
operator stores personal data no longer than required by the purposes of
processing personal data, unless the storage period for personal data is
established by the legislation of the Republic of Belarus or by an agreement.
5.10. The Operator stores personal data contained on
paper media, located in specially designated places with limited access under
conditions that ensure their protection from unauthorized access. The list of
document storage locations is determined by the Operator.
6.
Updating,
correcting, deleting and destroying personal data, responding to requests from
subjects for access to personal data
6.1.
Confirmation
of the fact of processing of personal data by the Operator, the legal grounds
and purposes of processing of personal data, as well as other information
specified in paragraphs 1.4 of Article 11 of the Law on Personal Data, are
provided by the Operator to the subject of personal data upon receipt of the
application of the subject of personal data.
The information provided does not include
personal data relating to other personal data subjects, except in cases when
there are legal grounds for disclosing such personal data.
The application must contain:
the last name, first name, patronymic (if any)
of the subject of personal data, the address of his place of residence (place
of stay);
date of birth of the personal data subject;
identification number of the personal data
subject, or, in the absence of such number, the number of the identity document
of the personal data subject if this information was indicated by the personal
data subject when giving his/her consent to the Operator or the processing of
personal data is carried out without the consent of the personal data subject;
statement of the essence of the requirements of
the personal data subject;
personal signature or electronic digital
signature of the subject of personal data.
The application may be submitted in writing, in
the form of an electronic document signed with an electronic digital signature
in accordance with the legislation of the Republic of Belarus.
If the application of the personal data subject
does not reflect all the necessary information in accordance with the
requirements of the Law on Personal Data or the subject does not have the right
to access the requested information, then a reasoned refusal is sent to him.
The subject of personal data may be refused
provision of information in accordance with paragraph 3 of Article 11 of the
Law on Personal Data.
6.2.
In the
event when inaccurate personal data is discovered upon the application of the
personal data subject or at his/her request or at the request of the authorized
body for the protection of the rights of the personal data subject, the
Operator must block the personal data related to this personal data subject
from the moment of receipt of the said application or request for the
verification period.
In case of confirmation of the fact of
inaccuracy of personal data, the Operator, on the basis of information provided
by the subject of personal data or the authorized body for the protection of
the rights of subjects of personal data or other necessary documents, clarifies
the personal data within 15 days from the date of provision of such information
and removes the blocking of the personal data.
6.3.
In the
event of unlawful processing of personal data, upon receipt of an application
from a personal data subject or a request from an authorized body for the
protection of the rights of personal data subjects, the Operator must block the
unlawfully processed personal data related to this personal data subject from
the moment of such an application or receipt of an application (request).
6.4.
After the
purposes of personal data processing achieved, as well as in the event of
withdrawal of consent to their processing by the subject of personal data, it should
be deleted, unless otherwise provided by another agreement between the Operator
and the subject of personal data or by law.
6.5.
Persons
whose personal data is processed by the Operator may receive clarification on
the processing of their personal data by sending a corresponding written
request to the postal address: 220084, Minsk, Kuprevicha
St., 1/5, office 211a or to the e-mail address: info@devscience.tech.
6.6.
For
assistance in exercising rights related to the processing of personal data by Devscience LLC, the subject of personal data may contact
the person responsible for implementing internal control over the processing of
personal data at Devscience LLC by sending a message
to the email address info@devscience.tech.
7.
Rights of personal data
subjects
The subject of
personal data has the right:
receive information regarding the processing of
his personal data, except for cases stipulated by law. Information is provided
to the personal data subject by the Operator in an accessible form, and it
should not contain personal data related to other personal data subjects,
except for cases where there are legal grounds for disclosing such personal
data. The list of information and the procedure for obtaining it are
established by the Law on Personal Data;
demand that the Operator clarify his personal
data if the personal data is incomplete, outdated, or inaccurate;
receive information about the provision of his
personal data to third parties, except in cases stipulated by the legislation
of the Republic of Belarus;
at any time without giving reasons, revoke your
consent to the processing of personal data;
demand that the Operator block or delete his
personal data if they were not legally obtained or are not necessary for the
stated purpose of processing, and also take measures provided by law to protect
his rights;
appeal the actions (inactions) and decisions of
the Operator that violate his rights when processing personal data, the
authorized body for the protection of the rights of personal data subjects in
the manner established by the legislation on appeals of citizens and legal
entities.
8.
Cross-border
transfer of personal data
Cross-border transfer of personal
data is prohibited if the territory of a foreign state does not ensure an
adequate level of protection of the rights of personal data subjects, except in
cases where:
the consent of the subject of personal data is
given, provided that the subject of personal data is informed of the risks
arising in connection with the lack of an adequate level of protection;
personal data were obtained on the basis of an
agreement concluded (being concluded) with the subject of personal data, for
the purpose of performing the actions established by this agreement;
personal data may be obtained by any person by
sending a request in the cases and manner provided for by law;
such transfer is necessary to protect the life,
health or other vital interests of the subject of personal data or other
persons, if obtaining the consent of the subject of personal data is
impossible;
the processing of personal data is carried out
within the framework of the implementation of international treaties of the
Republic of Belarus;
the relevant permission has been received from
the authorized body for the protection of the rights of personal data subjects.