User agreement

ATTENTION: the manufacturer reserves the right to change the composition, configuration, colour range of the product, the warranty period, technical specifications, etc. without prior notice.

Contents

1. General terms and scope
2. List of personal data databases
3. Purpose of processing personal data
4. Procedure for processing personal data: obtaining consent, informing about rights and actions with the personal data of the data subject
5. Location of the personal data database
6. Conditions for disclosing information on personal data to third parties
7. Protection of personal data: means of protection, the responsible person, employees who directly process and/or have access to personal data in connection with their official duties, retention period of personal data
8. Rights of the data subject
9. Procedure for handling requests of the data subject
10. State registration of the personal data database

1.General terms and scope

1.1. Definitions:

• Personal data database — a named set of ordered personal data in electronic form and/or in the form of personal data card files;
• Responsible person — a designated person who organises the work related to the protection of personal data during their processing, in accordance with the law;
• Owner of a personal data database — a natural or legal person who has been granted the right to process these data by law or with the consent of the data subject, approves the purpose of processing personal data in this database and establishes the composition of these data and the procedures for processing them, unless otherwise provided by law;
• State register of personal data databases — the single state information system for collecting, accumulating and processing information on registered personal data databases;
• Publicly available sources of personal data — directories, address books, registers, lists, catalogues and other systematised collections of open information containing personal data, placed and published with the knowledge of the data subject. Social networks and online resources where the data subject leaves their personal data are not considered publicly available sources of personal data (unless the data subject has expressly stated that the personal data are posted for free distribution and use);
• Consent of the data subject — any documented, voluntary expression of will of a natural person granting permission to process their personal data in accordance with the stated purpose of processing;
• Depersonalisation of personal data — removal of information that makes it possible to identify a person;
• Processing of personal data — any action or set of actions performed wholly or partly in an information (automated) system and/or in personal data card files, related to the collection, registration, accumulation, storage, adaptation, alteration, updating, use and dissemination (distribution, sale, transfer), depersonalisation and destruction of information about a natural person;
• Personal data — information or a set of information about a natural person who is identified or can be specifically identified;
• Processor of a personal data database — a natural or legal person granted the right to process these data by the owner of the personal data database or by law. A person instructed by the owner and/or processor of the personal data database to perform technical work on the database without access to the content of the personal data is not a processor;
• Data subject — a natural person whose personal data are processed in accordance with the law;
• Third party — any person, except the data subject, the owner or processor of the personal data database and the authorised state body for personal data protection, to whom the owner or processor of the personal data database transfers personal data in accordance with the law;
• Special categories of data — personal data on racial or ethnic origin, political, religious or philosophical beliefs, membership in political parties and trade unions, as well as data concerning health or sex life.

1.2. This Regulation is binding on the responsible person and the seller’s employees who directly process and/or have access to personal data in connection with their official duties.

2.List of personal data databases

2.1. The seller owns the following personal data databases:

• The personal data database of counterparties.

3.Purpose of processing personal data

3.1. The purpose of processing personal data in the system is to ensure civil-law relations and the provision, receipt and settlement of payments for purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine”.

4.Procedure for processing personal data: obtaining consent, informing about rights and actions with the personal data of the data subject

4.1. The consent of the data subject must be a voluntary expression of will of a natural person granting permission to process their personal data in accordance with the stated purpose of processing.

4.2. The consent of the data subject may be given in the following forms:

• a paper document with details that make it possible to identify this document and the natural person;
• an electronic document containing the mandatory details that make it possible to identify this document and the natural person. The voluntary expression of will of a natural person granting permission to process their personal data should preferably be certified by the electronic signature of the data subject;
• a mark on an electronic page of a document or in an electronic file processed in an information system based on documented software and hardware solutions.

4.3. The consent of the data subject is given when civil-law relations are formalised in accordance with the legislation in force.

4.4. The data subject is informed about the inclusion of their personal data in the personal data database, the rights defined by the Law of Ukraine “On Personal Data Protection”, the purpose of data collection and the persons to whom their personal data are transferred when civil-law relations are formalised in accordance with the legislation in force.

4.5. Processing of personal data on racial or ethnic origin, political, religious or philosophical beliefs, membership in political parties and trade unions, as well as data concerning health or sex life (special categories of data), is prohibited.

5.Location of the personal data database

5.1. The personal data databases listed in section 2 of this Regulation are located at the seller’s address.

6.Conditions for disclosing information on personal data to third parties

6.1. The procedure for third-party access to personal data is determined by the terms of the consent given by the data subject to the owner of the personal data for the processing of these data, or in accordance with the requirements of the law.

6.2. A third party is not granted access to personal data if that person refuses to undertake to ensure compliance with the requirements of the Law of Ukraine “On Personal Data Protection” or is unable to ensure it.

6.3. A party to relations related to personal data submits a request for access (hereinafter — the request) to personal data to the owner of the personal data.

6.4. The request shall state:

• the surname, first name and patronymic, place of residence (place of stay) and details of the identity document of the natural person submitting the request (for a natural person applicant);
• the name and location of the legal entity submitting the request, the position, surname, first name and patronymic of the person certifying the request; confirmation that the content of the request corresponds to the powers of the legal entity (for a legal entity applicant);
• the surname, first name and patronymic, as well as other information making it possible to identify the natural person in respect of whom the request is made;
• information on the personal data database in respect of which the request is submitted, or information on the owner or processor of this personal data database;
• the list of personal data requested;
• the purpose and/or legal grounds for the request.

6.5. The period for considering whether the request can be satisfied may not exceed ten working days from the date of its receipt. Within this period, the owner of the personal data database informs the person submitting the request that the request will be satisfied or that the relevant personal data are not subject to disclosure, stating the grounds defined in the relevant legal act. The request is satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law.

6.6. Deferral of third-party access to personal data is allowed if the necessary data cannot be provided within thirty calendar days from the date of receipt of the request. In this case, the total period for resolving the issues raised in the request may not exceed forty-five calendar days.

6.7. The third party that submitted the request is notified of the deferral in writing, with an explanation of the procedure for appealing such a decision.

6.8. The notice of deferral shall state:

• the surname, first name and patronymic of the official;
• the date the notice was sent;
• the reason for the deferral;
• the period within which the request will be satisfied.

6.9. Refusal of access to personal data is allowed if access to them is prohibited by law.

6.10. The notice of refusal shall state:

• the surname, first name and patronymic of the official refusing access;
• the date the notice was sent;
• the reason for the refusal.

6.11. A decision to defer or refuse access to personal data may be appealed in court.

7.Protection of personal data: means of protection, the responsible person, employees who directly process and/or have access to personal data in connection with their official duties, retention period of personal data

7.1. The owner of the personal data database is equipped with system, software, hardware and communication means that prevent loss, theft, unauthorised destruction, distortion, forgery and copying of information and comply with international and national standards.

7.2. The responsible person organises the work related to the protection of personal data during their processing in accordance with the law. The responsible person is appointed by order of the Owner of the personal data database.
The duties of the responsible person regarding the organisation of work related to the protection of personal data during their processing are set out in the job description.

7.3. The responsible person shall:

• know the legislation of Ukraine on personal data protection;
• develop procedures for employees’ access to personal data in accordance with their professional, official or employment duties;
• ensure that the employees of the Owner of the personal data database comply with the legislation of Ukraine on personal data protection and the internal documents governing the Owner’s activities in processing and protecting personal data in personal data databases;
• develop a procedure for internal control over compliance with the legislation of Ukraine on personal data protection and the internal documents governing the Owner’s activities in processing and protecting personal data in personal data databases, which in particular must set the frequency of such control;
• inform the Owner of the personal data database of any violations by employees of the legislation of Ukraine on personal data protection and of the internal documents governing the Owner’s activities in processing and protecting personal data in personal data databases no later than one working day after such violations are discovered;
• ensure the storage of documents confirming that the data subject has consented to the processing of their personal data and has been informed of their rights.

7.4. To perform their duties, the responsible person has the right to:

• receive the necessary documents, including orders and other administrative documents issued by the Owner of the personal data database, related to the processing of personal data;
• make copies of the documents received, including copies of files and any records stored in local computer networks and stand-alone computer systems;
• take part in discussing their duties in organising the work related to the protection of personal data during their processing;
• submit proposals for improving activities and working methods, and submit comments and options for eliminating shortcomings found in the processing of personal data;
• obtain explanations on matters of personal data processing;
• sign and endorse documents within their competence.

7.5. Employees who directly process and/or have access to personal data in connection with their official (employment) duties must comply with the legislation of Ukraine on personal data protection and the internal documents on the processing and protection of personal data in personal data databases.

7.6. Employees who have access to personal data, including those who process them, must not disclose in any way the personal data entrusted to them or that became known to them in connection with their professional, official or employment duties. This obligation remains in force after they cease activities related to personal data, except in cases established by law.

7.7. Persons who have access to personal data, including those who process them, are liable under the legislation of Ukraine if they violate the requirements of the Law of Ukraine “On Personal Data Protection”.

7.8. Personal data must not be stored longer than necessary for the purpose for which they are stored, and in any case no longer than the data retention period defined by the data subject’s consent to the processing of these data.

8.Rights of the data subject

8.1. The data subject has the right:

• to know the location of the personal data database containing their personal data, its purpose and name, and the location and/or place of residence (stay) of the owner or processor of this database, or to instruct persons authorised by them to obtain this information, except in cases established by law;
• to receive information on the conditions of access to personal data, in particular information on the third parties to whom their personal data contained in the relevant personal data database are transferred;
• to access their personal data contained in the relevant personal data database;
• to receive, no later than thirty calendar days from the date of receipt of the request, except in cases provided by law, an answer as to whether their personal data are stored in the relevant personal data database, and to receive the content of their stored personal data;
• to submit a reasoned objection to the processing of their personal data by state authorities and local self-government bodies in the exercise of their powers provided by law;
• to submit a reasoned demand for the alteration or destruction of their personal data by any owner and processor of this database if these data are processed unlawfully or are inaccurate;
• to protection of their personal data against unlawful processing and accidental loss, destruction or damage due to deliberate concealment, failure to provide or untimely provision, as well as to protection against the provision of information that is inaccurate or defames the honour, dignity and business reputation of a natural person;
• to apply to state authorities and local self-government bodies competent to protect personal data on matters of protecting their rights regarding personal data;
• to use legal remedies in the event of a violation of the legislation on personal data protection.

9.Procedure for handling requests of the data subject

9.1. The data subject has the right to receive any information about themselves from any party to relations related to personal data without stating the purpose of the request, except in cases established by law.

9.2. The data subject’s access to data about themselves is free of charge.

9.3. The data subject submits a request for access (hereinafter — the request) to personal data to the owner of the personal data database. The request shall state:

• the surname, first name and patronymic, place of residence (place of stay) and details of the identity document of the data subject;
• other information making it possible to identify the data subject;
• information on the personal data database in respect of which the request is submitted, or information on the owner or processor of this database;
• the list of personal data requested.

9.4. The period for considering whether the request can be satisfied may not exceed ten working days from the date of its receipt. Within this period, the owner of the personal data database informs the data subject that the request will be satisfied or that the relevant personal data are not subject to disclosure, stating the grounds defined in the relevant legal act.

9.5. The request is satisfied within thirty calendar days from the date of its receipt, unless otherwise provided by law.

10.State registration of the personal data database

10.1. State registration of personal data databases is carried out in accordance with Article 9 of the Law of Ukraine “On Personal Data Protection”.