User Agreement (English Version)

Contents

  1. General Terms and Scope of Application

  2. List of Personal Data Databases

  3. Purpose of Processing Personal Data

  4. Procedure for Processing Personal Data: Obtaining Consent, Notification of Rights, and Actions with the Personal Data of the Data Subject

  5. Location of the Personal Data Database

  6. Conditions for Disclosing Personal Data to Third Parties

  7. Personal Data Protection: Protection Methods, Responsible Person, Employees Directly Involved in Processing and/or Having Access to Personal Data, Retention Period

  8. Rights of the Data Subject

  9. Procedure for Handling Requests of the Data Subject

  10. State Registration of the Personal Data Database

1. General Terms and Scope of Application

1.1. Definitions:

Personal Data Database — a named collection of structured personal data in electronic form and/or in the form of card files.

Responsible Person — a designated person who organizes activities related to the protection of personal data during its processing in accordance with the law.

Owner of the Personal Data Database — a natural or legal person who, by law or with the consent of the data subject, is granted the right to process this data, establishes the purpose of processing personal data in this database, determines its content and processing procedures, unless otherwise defined by law.

State Register of Personal Data Databases — a unified state information system for collecting, storing, and processing information about registered personal data databases.

Public Sources of Personal Data — directories, address books, registers, lists, catalogs, and other systematic collections of open information containing personal data, placed and published with the consent of the data subject.

Consent of the Data Subject — any documented, voluntary expression of will by an individual granting permission for the processing of their personal data in accordance with the stated purpose.

Depersonalization of Personal Data — removal of information that allows the identification of a person.

Processing of Personal Data — any operation or set of operations carried out, in whole or in part, in an information (automated) system and/or in card files of personal data: collection, registration, accumulation, storage, adaptation, modification, renewal, use, distribution (dissemination, transfer), depersonalization, destruction.

Personal Data — information or a set of information about an individual who is identified or can be identified.

Data Controller — a natural or legal person who, by the owner of the database or by law, is authorized to process this data.

Data Subject — an individual whose personal data is being processed.

Third Party — any person except the data subject, the owner or the controller of the database, and the authorized state authority on data protection, to whom the personal data is transferred according to the law.

Special Categories of Data — personal data relating to racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties and trade unions, as well as data concerning health or sexual life.

1.2. This Regulation is mandatory for the responsible person and employees of the seller who directly process and/or have access to personal data in connection with their official duties.

2. List of Personal Data Databases

2.1. The seller is the owner of the following personal data databases:

  • the personal data database of contractors.

3. Purpose of Processing Personal Data

3.1. The purpose of processing personal data in the system is to ensure the implementation of civil-law relations, the provision, receipt, and execution of payments for purchased goods and services in accordance with the Tax Code of Ukraine and the Law of Ukraine “On Accounting and Financial Reporting in Ukraine.”

4. Procedure for Processing Personal Data

4.1. Consent of the data subject must be a voluntary expression of will of the individual granting permission for the processing of their personal data in accordance with the stated purpose of processing.

4.2. The consent of the data subject may be provided in the following forms:

  • a document on paper with the necessary details to identify the document and the individual;

  • an electronic document with mandatory requisites to identify the document and the individual, preferably verified by the electronic signature of the data subject;

  • a mark on the web page of the document or in an electronic file processed in an information system based on documented technical solutions.

4.3. Consent of the data subject is provided when entering into civil-law relations in accordance with applicable law.

4.4. The data subject is notified about the inclusion of their personal data in the database, the rights defined by the Law of Ukraine “On Personal Data Protection,” the purpose of data collection, and the persons to whom their personal data is transferred, at the time of establishing civil-law relations.

4.5. Processing of personal data relating to racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties and trade unions, as well as data concerning health or sexual life (special categories of data) is prohibited.

5. Location of the Personal Data Database

5.1. The personal data databases listed in section 2 of this Regulation are located at the address of the seller.

6. Conditions for Disclosing Personal Data to Third Parties

6.1. The procedure for access to personal data by third parties is determined by the terms of consent given by the data subject or as required by law.

6.2. Access to personal data is not granted to a third party if it refuses to comply with the Law of Ukraine “On Personal Data Protection” or is unable to ensure compliance.

6.3. A data subject or related party submits a request for access to the owner of the personal data database.

6.4. The request must include:

  • full name, place of residence (location), and identification document details of the applicant (for individuals);

  • name, location of the legal entity, position, full name of the representative certifying the request, and confirmation that the request complies with the legal entity's authority (for legal entities);

  • full name and other information identifying the data subject whose personal data is requested;

  • information about the personal data database or its owner/controller;

  • the list of requested personal data;

  • purpose and/or legal grounds for the request.

6.5. The time for reviewing the request may not exceed 10 business days from the date of its receipt. Within this time, the owner informs the applicant whether the request will be satisfied or refused, specifying the reasons. The request is fulfilled within 30 calendar days from receipt unless otherwise provided by law.

6.6. Delay in access is allowed if the requested data cannot be provided within 30 days but must not exceed 45 calendar days.

6.7. The applicant is informed in writing of any delay, with an explanation of the appeal process.

6.8. A refusal must state the name of the responsible official, date, and reason for refusal.

6.9. Decisions on refusal or delay of access may be appealed in court.

7. Personal Data Protection

7.1. The owner of the personal data database has technical and organizational measures to prevent loss, theft, unauthorized destruction, alteration, forgery, copying, or unauthorized access, meeting international and national standards.

7.2. A responsible person is appointed to organize the protection of personal data during processing.

7.3. The responsible person must:

  • know the Ukrainian legislation in the field of personal data protection;

  • establish access procedures for employees in accordance with their duties;

  • ensure that employees comply with personal data protection laws and internal regulations;

  • report violations within one working day from discovery;

  • ensure the storage of documents confirming the consent of data subjects.

7.4. The responsible person has the right to:

  • obtain documents, orders, and instructions related to data processing;

  • copy relevant files or records;

  • participate in discussions on data protection;

  • propose improvements and remedies;

  • request explanations on data processing.

7.5. Employees with access to personal data must comply with the law and internal regulations.

7.6. They must not disclose personal data entrusted to them, even after their employment ends, unless required by law.

7.7. Individuals who violate the Law of Ukraine “On Personal Data Protection” bear responsibility as defined by law.

7.8. Personal data must not be stored longer than necessary for the stated purpose.

8. Rights of the Data Subject

The data subject has the right to:

  • know the location, purpose, and owner of the database containing their personal data;

  • receive information on the conditions of access, including third parties to whom their data is transferred;

  • access their personal data;

  • receive a response within 30 days of a request confirming whether their data is stored and receive its content;

  • object to unlawful processing;

  • request correction or deletion of inaccurate or illegally processed data;

  • protect their data from unauthorized processing and accidental loss;

  • contact government or local authorities regarding personal data rights;

  • use legal remedies in case of violations.

9. Procedure for Handling Requests of the Data Subject

9.1. The data subject has the right to obtain any information about themselves from any personal data-related entity without stating a purpose, unless restricted by law.

9.2. Access to their own data is free of charge.

9.3. The request must include:

  • full name, residence, and ID details;

  • other information identifying the data subject;

  • information about the database or its owner;

  • list of requested data.

9.4. Requests are reviewed within 10 business days, and responses are provided within 30 calendar days.

10. State Registration of the Personal Data Database

10.1. The state registration of personal data databases is carried out in accordance with Article 9 of the Law of Ukraine “On Personal Data Protection.”