1. General Provisions
1.1 This Policy on personal data processing (hereinafter referred to as the Policy) defines the activity of 4RM Systems LLC, registered at the address: Republic of Belarus, Vitebsk, 50/7, P. Brovki str., postal code: 210039 (hereinafter referred to as the Company or the Operator), with regard to personal data processing.
1.2 This Policy is developed in compliance with the requirements of the Law of the Republic of Belarus No. 99-3 of 07.05.2021 "On Personal Data Protection" (hereinafter - the Law).
1.3 The notions contained in Article 1 of the Law are used in this Policy with the same meaning:
1.4 The following terms are used in this Policy:
Services - any services, products, programs, events, activities, services of the Company (including but not limited to Bitrix, iSpring, etc.).
Sites - https://4rm.org/ and other sites owned by the Company, subdomains of these sites, as well as other services with which the Company operates.
1.5 This Policy applies to all operations performed by the Operator with personal data with or without the use of automation tools.
1.6 This Policy comes into effect from the moment of its approval.
2. Categories of personal data subjects and scope of processed personal data.
2.1 The Operator processes personal data that may be received from the following subjects of personal data:
2.2 The Operator processes the following personal data of the subject of personal data:
2.3 To analyze the operation of the Sites and Services, the Operator processes such data as:
2.4 The Operator ensures that the content and scope of processed personal data corresponds to the stated processing purposes and, if necessary, takes measures to eliminate their redundancy in relation to the stated processing purposes.
2.5 The Operator processes personal data, including biometric data only with the consent of the personal data subject or without consent in other cases provided for by the legislation of the Republic of Belarus.
2.6 The Operator shall not process special personal data concerning race, nationality, political views, membership in trade unions, religious and other beliefs, health, sex life, administrative or criminal liability, except for cases when the personal data subject has independently provided such data to the Operator or they became known to the Operator in accordance with the legislation of the Republic of Belarus.
2.7 The Operator, if necessary to achieve the purposes of processing, has the right to transfer personal data to third parties in compliance with the requirements of the legislation of the Republic of Belarus.
3. Purposes of personal data collection.
3.1 The Operator processes personal data for the following purposes:
4. Basic rights and obligations of the operator and the subject of personal data.
4.1 The Operator has the right to:
4.2 The Operator shall:
4.3 The subject of personal data has the right:
4.4 The subject of personal data is obliged to:
4.5 The person who provided the Operator with incomplete, outdated, unreliable information about himself/herself or information about another subject of personal data without the consent of the latter shall be liable in accordance with the legislation of the Republic of Belarus.
5. Consent of the subject of personal data.
Procedure and conditions of personal data processing.
5.1 The basis for personal data processing is the consent of the personal data subject, except for cases established by the legislation of the Republic of Belarus, when personal data processing is carried out without obtaining such consent.
5.2 The consent of the subject of personal data is a free, unambiguous, informed expression of his/her will, by which he/she authorizes the processing of his/her personal data.
The Subject's consent may be obtained in writing, in the form of an electronic document or in another electronic form.
In other electronic form, the Subject's consent may be obtained by:
5.3 Prior to obtaining the consent of the personal data subject, the Company shall provide the personal data subject with information in writing or electronically, corresponding to the form of expression of such consent, containing:
Prior to obtaining the Subject's consent, the Company shall explain to the Subject in simple and clear language his/her rights related to the processing of personal data, the mechanism for exercising such rights, as well as the consequences of the Subject's consent or refusal to give such consent. This information shall be provided by the Subject's Company in written or electronic form, corresponding to the form of expression of his/her consent, separately from other information provided to him/her.
5.4 When giving his/her consent to the Company, the Subject shall indicate his/her surname, first name, patronymic (if any), date of birth, identification number and, in the absence of such number, the number of his/her identity document, except in the case provided for in part two of this paragraph.
If the purposes of personal data processing do not require processing of the information specified in part one of this clause, this information shall not be processed by the Company upon receipt of the Subject's consent.
5.5 The obligation to prove that the Subject's consent has been obtained shall be imposed on the Operator. Refusal to give consent to the processing of personal data shall entitle the Operator to deny the Subject of personal data access to the Company's Sites and Services.
5.6 Processing of personal data by the Operator includes the following actions with personal data: collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion, other actions in accordance with the legislation of the Republic of Belarus.
5.7 Methods of personal data processing by the Operator:
5.8 Storage of personal data is carried out in a form that allows to identify the subject of personal data, for a period not longer than required by the purposes of personal data processing, except in cases when the period of storage of personal data is established by the legislation of the Republic of Belarus, the contract concluded (to be concluded) with the subject of personal data, in order to perform the actions established by this contract.
5.9. The condition for termination of personal data processing may be the achievement of the objectives of personal data processing, expiration of the term of personal data processing, withdrawal of the personal data subject's consent to the processing of his/her personal data, as well as detection of unlawful processing of personal data.
5.10 When processing personal data, the Operator shall take the necessary legal, organizational and technical measures to ensure protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other unlawful actions in relation to personal data.
5.11 The Company shall process special personal data solely for the purposes specified in clause 3.1 of this Policy. The Company may also process biometric personal data for the purposes specified in p. 3.1 of this Policy.
5.12. Processing of special, including biometric personal data is allowed only if a set of measures is taken to prevent risks that may arise during the processing of such personal data for the rights and freedoms of personal data subjects.
5.13. The Company shall not carry out trans-border transfer of personal data if the territory of a foreign state does not provide an adequate level of protection of the rights of personal data subjects, except for cases established by law.
6. Mechanism for exercising the rights of the personal data subject.
6.1 The personal data subject has the right to withdraw his/her consent to the processing of personal data by submitting to the Operator an application in writing sent by registered mail or in the form of an electronic document. The application must contain:
Within 15 days after receipt of the application, the operator stops processing of personal data (if there are no grounds for processing, according to the legislation), deletes them, in the absence of technical possibility of deletion - takes measures to prevent further processing of personal data, including their blocking, and notifies the subject of personal data within the same period.
6.2 The personal data subject has the right to obtain information from the Operator regarding the processing of his/her personal data by submitting an application to the Operator in accordance with the procedure stipulated in p. 6.1 of these Rules. Within 5 working days after receiving the application, the Operator shall provide the personal data subject with the relevant information or notify him/her on the reasons for refusal to provide such information.
6.3 The personal data subject has the right to request the Operator to amend his/her personal data if they are incomplete, outdated or inaccurate, by submitting an application to the Operator in the manner prescribed by p. 6.1 of these Rules, attaching documents (duly certified copies) confirming the need to make such changes. Within 15 days after receipt of the application, the Operator shall make changes to the personal data and notify the personal data subject thereof or notify the reasons for refusal to make changes.
6.4 The subject of personal data has the right to receive information from the Operator about the provision of his/her personal data to third parties once a calendar year free of charge, by submitting an application to the Operator in the manner prescribed by p. 6.1 of these Rules. Within 15 days after receipt of the application, the Operator shall provide the personal data subject with information on what personal data of this subject and to whom it was provided during the year preceding the date of submission of the application, or notify him/her of the reasons for refusal to provide such information.
6.5 The subject of personal data has the right to demand from the Operator to stop processing of his/her personal data, including its deletion, in the absence of grounds for processing, by submitting an application to the Operator in the manner prescribed by p. 6.1 of these Rules. Within 15 days after receipt of the application, the Operator shall cease processing of personal data (if there are no grounds for processing, according to the legislation), perform their deletion, in the absence of technical possibility of deletion - take measures to prevent further processing of personal data, including their blocking, and notify the personal data subject thereof within the same period.
7. Measures to ensure protection of personal data
7.1 The Company shall be obliged to take legal, organizational and technical measures to ensure protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other unlawful actions in respect of personal data.
7.2 To protect personal data, the Company shall take the following measures:
7.3 The Company shall provide unrestricted access, including via the global computer network Internet, to the documents defining the Company's policy on personal data processing prior to the commencement of such processing.
7.4 Classification of information resources (systems) containing personal data in order to determine the requirements of technical and cryptographic protection of personal data shall be established by the authorized body for the protection of the rights of personal data subjects.
8. Final provisions
8.1. Issues related to the processing of personal data not set forth in this Policy shall be regulated by the legislation of the Republic of Belarus.
8.2 In case any provision of the Policy is recognized as contradictory to the legislation, the remaining provisions complying with the legislation shall remain in force and valid, and any invalid provision shall be deemed deleted/amended to the extent necessary to ensure its compliance with the legislation.
8.3 The Operator shall have the right at its discretion to amend and/or supplement the terms of this Policy without prior and/or subsequent notification of personal data subjects. The current version of the Policy is permanently available at: https://4rm.org/privacy-policy.
8.4 The subject of personal data may obtain any clarifications on issues of interest regarding the processing of his/her personal data by contacting the Website Administration via e-mail at info@4rm.org.