Политика конфиденциальности

POLICY regarding the processing of personal data
in AgroPishcheProm LLC No. 01 dated 11/15/2021
Approved by the Head of the Company on 11/15/2021

CHAPTER 1
GENERAL PROVISIONS

1.1. The personal data processing policy of AgroPishcheProm LLC (hereinafter referred to as the Policy) defines the basic principles, goals, conditions and methods of personal data processing, lists of subjects and personal data processed by AgroPishcheProm LLC, functions of AgroPishcheProm LLC in processing personal data, rights of personal data subjects, as well as requirements for the protection of personal data implemented by AgroPishcheProm LLC.

1.2. The Policy has been developed taking into account the requirements of the Constitution of the Republic of Belarus, legislative and other regulatory legal acts of the Republic of Belarus in the field of personal data.

1.3. The provisions of the Policy serve as the basis for the development of local legal acts regulating the processing of personal data of employees of AgroPishcheProm LLC and other subjects of personal data in AgroPishcheProm LLC.

CHAPTER 2
LEGISLATIVE AND OTHER REGULATORY LEGAL ACTS OF THE REPUBLIC OF BELARUS, IN ACCORDANCE WITH WHICH THE POLICY OF PROCESSING PERSONAL DATA IN AGROPISHCHEPROM LLC IS DETERMINED

2.1. The personal data processing policy at AgroPishcheProm LLC is determined in accordance with the following regulatory legal acts:

• The Constitution of the Republic of Belarus;
• The Labor Code of the Republic of Belarus;
• The Law of the Republic of Belarus of 07.05.2021 N 99-Z "On the Protection of Personal Data" (hereinafter referred to as the Law on the Protection of Personal Data);
• The Law of the Republic of Belarus of 21.07.2008 N 418-Z "On the Population Register";
• The Law of the Republic of Belarus of 10.11.2008 N 455-Z "On Information, Informatization and Information Protection";
• other regulatory legal acts of the Republic of Belarus and regulatory documents of authorized state authorities.

2.2. In order to implement the provisions of the Policy, AgroPishcheProm LLC develops relevant local legal acts and other documents, including:

• Regulation on the processing and protection of personal data in AgroPishcheProm LLC (Appendix 1 to this Policy);
• Regulation on the procedure for ensuring confidentiality when processing information containing personal data (Appendix 2 to this Policy);
• other local legal acts and documents regulating the processing of personal data in AgroPishcheProm LLC.

CHAPTER 3
MAIN TERMS AND DEFINITIONS USED IN LOCAL LEGAL ACTS OF AGROPISHCHEPROM LLC REGULATING PERSONAL DATA PROCESSING ISSUES

3.1. Biometric personal data — information characterizing the physiological and biological characteristics of a person, which is used for his unique identification (fingerprints, palms, iris, facial characteristics and its image, etc.).

3.2. Blocking personal data — termination of access to personal data without deleting them.

3.3. Genetic personal data — information related to the inherited or acquired genetic characteristics of a person, which contains unique data on his physiology or health and can be revealed, in particular, during the examination of his biological sample.

3.4. Depersonalization of personal data — actions as a result of which it becomes impossible to determine the ownership of personal data to a specific subject of personal data without the use of additional information.

3.5. Processing of personal data — any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion of personal data.

3.6. Publicly available personal data — personal data disseminated by the subject of personal data or with his consent or disseminated in accordance with the requirements of legislative acts.

3.7. Personal data — any information related to an identified individual or an individual who can be identified.

3.8. Provision of personal data — actions aimed at familiarization with the personal data of a certain person or group of persons.

3.9. Dissemination of personal data — actions aimed at familiarizing an indefinite number of persons with personal data.

3.10. Special personal data — personal data related to racial or national origin, political views, membership in trade unions, religious or other beliefs, health or sex life, administrative or criminal liability, as well as biometric and genetic personal data.

3.11. Subject of personal data — an individual in relation to whom personal data is processed.

3.12. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state.

3.13. Deletion of personal data — actions that make it impossible to restore personal data in information resources (systems) containing personal data, and (or) that result in the destruction of tangible media of personal data.

3.14. An identifiable individual — an individual who can be directly or indirectly determined, in particular, by his or her last name, first name, patronymic, date of birth, identification number, or by one or more features characteristic of his or her physical, psychological, mental, economic, cultural, or social identity.

3.15. Information — data (messages, data) about persons, objects, facts, events, phenomena, and processes, regardless of the form of their presentation.

3.16. Automated processing of personal data — processing of personal data using computer technology.

CHAPTER 4
PRINCIPLES AND PURPOSES OF PERSONAL DATA PROCESSING

4.1. AgroPishcheProm LLC, being the operator of personal data, processes personal data of AgroPishcheProm LLC employees and other personal data subjects who are not in employment relations with AgroPishcheProm LLC.

4.2. Personal data processing in AgroPishcheProm LLC is carried out taking into account the need to ensure the protection of the rights and freedoms of AgroPishcheProm LLC employees and other personal data subjects, including the protection of the right to privacy, personal and family secrets, based on the following principles:

• personal data is processed in a lawful and fair manner;
• personal data is processed in proportion to the stated purposes of their processing and ensures a fair balance of interests of all interested parties at all stages of such processing;
• personal data is processed with the consent of the subject of personal data, except for cases stipulated by legislative acts;
• personal data is processed limited to achieving specific, previously stated legitimate purposes. Processing of personal data that is incompatible with the originally stated purposes of their processing is not permitted;
• the content and volume of personal data being processed correspond to the stated purposes of their processing. The personal data being processed are not excessive in relation to the stated purposes of their processing;
• personal data is processed transparently. The subject of personal data may be provided with relevant information regarding the processing of his personal data;
• the operator takes measures to ensure the accuracy of the personal data processed by him, and updates them if necessary;
• personal data are stored in a form that allows identifying the subject of personal data, no longer than required by the stated purposes of processing the personal data.

4.3. Personal data are processed in AgroPishcheProm LLC for the purposes of:

• ensuring compliance with the Constitution of the Republic of Belarus, legislative and other regulatory legal acts of the Republic of Belarus, local legal acts of AgroPishcheProm LLC;
• implementing the functions, powers and duties imposed by the legislation of the Republic of Belarus on AgroPishcheProm LLC, including providing personal data to government agencies, the Social Security Fund of the Ministry of Labor and Social Protection of the Republic of Belarus, as well as other government agencies;
• regulating labor relations with employees of AgroPishcheProm LLC (assistance in employment, training and career advancement, ensuring personal safety, monitoring the quantity and quality of work performed, ensuring the safety of property);
• protecting the life, health or other vital interests of personal data subjects;
• preparing, concluding, executing and terminating contracts with counterparties;
• ensuring access control and internal facility regimes at the facilities of AgroPishcheProm LLC;
• providing employees of AgroPishcheProm LLC with additional social guarantees;
• forming reference materials for internal information support of the activities of AgroPishcheProm LLC;
• enforcement of judicial acts, acts of other bodies or officials subject to execution in accordance with the legislation of the Republic of Belarus on enforcement proceedings;
• exercise of the rights and legitimate interests of AgroPishcheProm LLC within the framework of the implementation of types of activities stipulated by the Charter and other local legal acts of AgroPishcheProm LLC, or achieving socially significant goals;
• for other legal purposes.

CHAPTER 5
LIST OF SUBJECTS WHOSE PERSONAL DATA IS PROCESSED AT AGROPISHCHEPROM LLC

5.1. AgroPishcheProm LLC processes personal data of the following categories of subjects:

• employees of structural divisions of AgroPishcheProm LLC;
• employees of counterparties of AgroPishcheProm LLC;
• students (pupils) sent for practical training and industrial training at AgroPishcheProm LLC;
• job candidates at AgroPishcheProm LLC;
• other subjects of personal data (to ensure the implementation of the processing purposes specified in Chapter 4 of the Policy).

CHAPTER 6
LIST OF PERSONAL DATA PROCESSED BYLLC "AGROPISHCHEPROM"

6.1. The list of personal data processed by AgroPishcheProm LLC is determined in accordance with the legislation of the Republic of Belarus and local legal acts of AgroPishcheProm LLC, taking into account the purposes of processing personal data specified in Chapter 4 of the Policy.

CHAPTER 7
FUNCTIONS OF AGROPISHCHEPROM LLC WHEN PROCESSING PERSONAL DATA

7.1. When processing personal data, AgroPishcheProm LLC:

• takes measures necessary and sufficient to ensure compliance with the requirements of the legislation of the Republic of Belarus and local legal acts of AgroPishcheProm LLC in the field of personal data;
• takes legal, organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data;
• appoints a structural unit or a person responsible for implementing internal control over the processing of personal data;
• issues local legal acts defining the policy and issues of processing and protecting personal data in AgroPishcheProm LLC;
• familiarizes employees of AgroPishcheProm LLC directly involved in the processing of personal data with provisions of the legislation of the Republic of Belarus and local legal acts of AgroPishcheProm LLC in the field of personal data, including requirements for the protection of personal data, and training of the said employees;
• publishes or otherwise provides unlimited access to this Policy;
• informs, in the prescribed manner, the subjects of personal data or their representatives of information on the availability of personal data related to the relevant subjects, provides an opportunity to familiarize themselves with this personal data upon request and (or) receipt of requests from the said subjects of personal data or their representatives, unless otherwise established by the legislation of the Republic of Belarus;
• stops processing and destroys personal data in cases stipulated by the legislation of the Republic of Belarus in the field of personal data;
  performs other actions stipulated by the legislation of the Republic of Belarus in the field of personal data.

CHAPTER 8
TERMS OF PERSONAL DATA PROCESSING AT AGROPISHCHEPROM LLC

8.1. Personal data processing at AgroPischeProm LLC is carried out with the consent of the personal data subject to the processing of his personal data, unless otherwise provided by the legislation of the Republic of Belarus in the field of personal data.

8.2. AgroPischeProm LLC does not disclose to third parties or distribute personal data without the consent of the personal data subject, unless otherwise provided by the legislation of the Republic of Belarus.

8.3. AgroPischeProm LLC has the right to entrust the processing of personal data on behalf of AgroPischeProm LLC or in its interests to an authorized person on the basis of an agreement concluded with this person. The agreement must contain:

• the purposes of personal data processing;
• the list of actions that will be performed with personal data by the authorized person;
• obligations to maintain the confidentiality of personal data;
• measures to ensure the protection of personal data in accordance with Art. 17 of the Law on the Protection of Personal Data.

The authorized person is not required to obtain the consent of the personal data subject. If the consent of the personal data subject is required to process personal data on behalf of AgroPishcheProm LLC, such consent is obtained by AgroPishcheProm LLC.

8.4. For the purposes of internal information support, AgroPishcheProm LLC may create internal reference materials, which, with the written consent of the personal data subject, unless otherwise provided by the legislation of the Republic of Belarus, may include his last name, first name, patronymic, place of work, position, year and place of birth, address, subscriber number, e-mail address, and other personal data reported by the personal data subject.

8.5. Access to personal data processed by AgroPishcheProm LLC is permitted only to employees of AgroPishcheProm LLC holding positions included in the list of positions of structural divisions of AgroPishcheProm LLC, when replacing which personal data is processed.

CHAPTER 9
LIST OF ACTIONS WITH PERSONAL DATA AND METHODS OF THEIR PROCESSING

9.1. AgroPishcheProm LLC processes personal data (any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion of personal data).

9.2. Processing of personal data in AgroPishcheProm LLC is carried out in the following ways:

• using automation tools;
• without using automation tools, if this provides for searching for personal data and (or) access to them according to certain criteria (card indexes, lists, databases, journals, etc.).

CHAPTER 10
RIGHTS OF PERSONAL DATA SUBJECTS

10.1. Subjects of personal data have the right to:

• revoke the consent of the subject of personal data;
• receive information concerning the processing of personal data and change personal data;
• require termination of the processing of personal data and (or) their deletion;
• appeal the actions (inaction) and decisions of the operator related to the processing of personal data.

CHAPTER 11
MEASURES TAKEN BY AGROPISHCHEPROM LLC TO ENSURE FULFILLMENT OF THE OPERATOR'S RESPONSIBILITIES WHEN PROCESSING PERSONAL DATA

11.1. The measures necessary and sufficient to ensure that AgroPishcheProm LLC fulfills its obligations as an operator, as stipulated by the legislation of the Republic of Belarus in the field of personal data, include:

• providing personal data subjects with the necessary information before obtaining their consent to the processing of personal data;
• explaining to personal data subjects their rights related to the processing of personal data;
• obtaining written consent from personal data subjects to the processing of their personal data by the subject placing the appropriate mark on the notification of the provision of information, except for cases stipulated by the legislation of the Republic of Belarus;
• appointing a structural unit or a person responsible for the implementation of internal control over the processing of personal data in AgroPishcheProm LLC;
• issuing documents defining the policy of AgroPishcheProm LLC regarding the processing of personal data;
• familiarizing employees directly involved in the processing of personal data in the LLC "AgroPishcheProm", with the provisions of the legislation on personal data;
• establishing the procedure for access to personal data, including those processed in the information resource (system);
• implementing technical and cryptographic protection of personal data in AgroPishcheProm LLC in the manner established by the Operational and Analytical Center under the President of the Republic of Belarus, in accordance with the classification of information resources (systems) containing personal data;
• ensuring unlimited access, including using the global computer network Internet, to documents defining the policy of AgroPishcheProm LLC regarding the processing of personal data, prior to the start of such processing;
• termination of the processing of personal data in the absence of grounds for their processing;
• immediate notification of the authorized body for the protection of the rights of personal data subjects about violations of personal data protection systems;
• implementing changes, blocking, deleting inaccurate or illegally obtained by means of personal data;
• limiting the processing of personal data to the achievement of specific, pre-declared legitimate purposes;
• storing personal data in a form that allows identification of personal data subjects, no longer than required by the declared purposes of processing personal data.

11.2. Measures to ensure the security of personal data when processing them in personal data information systems are established in accordance with local legal acts of AgroPishcheProm LLC, regulating issues of ensuring the security of personal data when processing them in personal data information systems of AgroPishcheProm LLC.

CHAPTER 12
CONTROL OVER COMPLIANCE WITH THE LEGISLATION OF THE REPUBLIC OF BELARUS AND LOCAL LEGAL ACTS OF AGROPISHCHEPROM LLC IN THE FIELD OF PERSONAL DATA, INCLUDING REQUIREMENTS TO THE PROTECTION OF PERSONAL DATA

12.1. Control over compliance by structural divisions of AgroPishcheProm LLC with the legislation of the Republic of Belarus and local legal acts of AgroPishcheProm LLC in the field of personal data, including requirements for the protection of personal data, is carried out in order to verify the compliance of personal data processing in structural divisions of AgroPishcheProm LLC with the legislation of the Republic of Belarus and local legal acts of AgroPishcheProm LLC in the field of personal data, including requirements for the protection of personal data, as well as measures taken aimed at preventing and identifying violations of the legislation of the Republic of Belarus in the field of personal data, identifying possible leakage channels and unauthorized access to personal data, and eliminating the consequences of such violations.

12.2. Internal control over compliance by structural divisions of AgroPishcheProm LLC with the legislation of the Republic of Belarus and local legal acts of AgroPishcheProm LLC in the field of personal data, including requirements for the protection of personal data, is carried out by the person responsible for organizing the processing of personal data in AgroPishcheProm LLC.

12.3. Personal responsibility for compliance with the requirements of the legislation of the Republic of Belarus and local regulatory acts of AgroPishcheProm LLC in the field of personal data in the structural division of AgroPishcheProm LLC, as well as for ensuring the confidentiality and security of personal data in the said divisions of AgroPishcheProm LLC is assigned to their managers.