Personal Data Protection Policy

Regulations on the Processing and Protection of Personal Data in Databases Owned by the Seller

Contents:

1. General concepts and scope of application.
2. Purposes of using personal data.
3. Procedure for processing personal data: obtaining consent, notification of rights, and actions with personal data of the data subject.
4. Location of the personal data database.
5. Conditions for disclosing personal data to third parties.
6. Protection of personal data: protection methods, responsible persons, employees directly involved in the processing or having access to personal data due to their official duties, and the storage period of personal data.
7. Rights of the data subject.
8. Procedure for handling requests from the data subject.
9. State registration of the personal data database.

1. General Concepts and Scope of Application

1.1. Definitions:

• Personal data database: A named collection of organized personal data in electronic form and/or in the form of personal data card files.
• Responsible person: A designated individual responsible for organizing work related to the protection of personal data during their processing in accordance with the law.
• Owner of the personal data database: A natural or legal person authorized by law or by the subject of personal data to process such data, and who determines the purpose of processing personal data, establishes the composition of such data, and sets procedures for processing unless otherwise specified by law.
• State Register of Personal Data Databases: A unified state information system for collecting, accumulating, and processing information about registered personal data databases.
• Public sources of personal data: Directories, address books, registries, lists, catalogs, and other systematized collections of open information containing personal data, published with the consent of the subject of personal data. Social networks and internet resources where personal data are shared by the subject are not considered public sources unless explicitly stated otherwise by the subject.
• Consent of the subject of personal data: Any documented voluntary expression of the individual’s will regarding the permission to process their personal data in accordance with a specified purpose.
• Anonymization of personal data: The removal of information that allows identifying an individual.
• Processing of personal data: Any operation or set of operations performed in an information (automated) system and/or personal data card files, related to the collection, registration, accumulation, storage, adaptation, alteration, updating, use, and distribution (transfer), anonymization, destruction of information about an individual.
• Personal data: Information or a set of information about an individual who is identified or can be specifically identified.
• Administrator of the personal data database: A natural or legal person authorized by the owner of the personal data database or by law to process such data. An entity performing technical work with the database without access to its content is not considered an administrator.
• Subject of personal data: A natural person whose personal data is being processed in accordance with the law.
• Third party: Any person other than the subject of personal data, the owner, or the administrator of the personal data database, as well as the authorized state body for the protection of personal data, to whom the personal data is transferred by the owner or administrator in accordance with the law.
• Special categories of data: Personal data regarding racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties and trade unions, as well as data related to health or sexual life.

2. Purposes of Using Personal Data

Your personal data is used to provide Internet services, facilitate information/news exchange, advertising and communication activities, in compliance with Ukrainian legislation including the following laws: "On the Protection of Personal Data," "On the Ratification of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data," "On Information," "On Advertising," "On Telecommunications," "On the Protection of Information in Information and Telecommunication Systems," and others regulating the Company's activities.

3. Procedure for Processing Personal Data: Obtaining Consent, Notification of Rights, and Actions with Personal Data

3.1. Consent of the data subject must be a voluntary expression of will regarding permission for processing personal data according to the stated purpose. Consent may be provided in the following forms:

• A paper document with details allowing identification of the document and the individual.
• An electronic document containing necessary details for identifying the document and the individual, preferably confirmed by the data subject's electronic signature.
• A checkmark on an electronic page or file in an information system based on documented software solutions.

3.2. Consent is provided during the execution of civil-law relations in accordance with current legislation. 3.3. The subject of personal data is informed about their inclusion in the personal data database, their rights under the Law of Ukraine "On the Protection of Personal Data," the purpose of data collection, and the entities to whom their data will be transferred when entering into civil-law relations. 3.4. Processing of personal data related to race, ethnicity, political, religious, or philosophical beliefs, party or union membership, health, or sexual life is prohibited.

4. Location of the Personal Data Database

4.1. Personal data databases are located at the seller’s address.

5. Conditions for Disclosing Personal Data to Third Parties

5.1. The access of third parties to personal data is determined by the consent provided by the data subject to the owner of the data, or in accordance with legal requirements. Access to personal data held by the public information administrator is regulated by the Law of Ukraine "On Access to Public Information," except for certain data obtained by the Ministry of Finance of Ukraine as part of their budgetary oversight functions. 5.2. Access is not granted if the third party refuses to comply with the requirements of the Law of Ukraine "On the Protection of Personal Data" or cannot ensure compliance.

6. Protection of Personal Data

6.1. The owners, administrators, and third parties involved must protect personal data from accidental loss, destruction, illegal processing, and unauthorized access in accordance with Ukrainian law.

7. Rights of the Subject of Personal Data

7.1. The subject has the right to:

• Know the location, purpose, and name of the database, and the location or residence of the owner/administrator.
• Access their personal data and receive information about third parties to whom their data has been transferred.
• Request changes or deletion of their personal data if it is processed illegally or inaccurately.

8. Procedure for Handling Requests from the Data Subject

8.1. Requests for access must be handled within 10 working days, and any decision on the request must be communicated within 30 calendar days, unless otherwise provided by law.

9. State Registration of the Personal Data Database

9.1. State registration of personal data databases is carried out in accordance with Article 9 of the Law of Ukraine "On the Protection of Personal Data."