POLICY regarding the processing of personal data
in LLC "Agropishcheprom" No. 01 dated 15.11.2021
Approved by the Head of the Company on 15.11.2021
CHAPTER 1
GENERAL PROVISIONS
1.1. The Personal Data Processing Policy at Agropishcheprom LLC (hereinafter referred to as the Policy) defines the basic principles, goals, conditions and methods of personal data processing, lists of subjects and personal data processed at Agropishcheprom LLC, functions of Agropishcheprom LLC in the processing of personal data, the rights of personal data subjects, as well as those implemented in LLC "Agropishcheprom" requirements for the protection of personal data.
1.2. The Policy has been developed taking into account the requirements of the Constitution of the Republic of Belarus, legislative and other regulatory legal acts of the Republic of Belarus in the field of personal data.
1.3. The provisions of the Policy serve as the basis for the development of local legal acts regulating the processing of personal data of employees of LLC "Agropishcheprom" and other personal data subjects in LLC "Agropishcheprom".
CHAPTER 2
LEGISLATIVE AND OTHER REGULATORY LEGAL ACTS OF THE REPUBLIC OF BELARUS, IN ACCORDANCE WITH WHICH THE POLICY OF PROCESSING PERSONAL DATA IN LLC "AGROPISHCHEPROM" IS DETERMINED
2.1. The personal data processing policy at Agropishcheprom LLC is determined in accordance with the following regulatory legal acts:
Constitution of the Republic of Belarus;
Labor Code of the Republic of Belarus;
The Law of the Republic of Belarus of 07.05.2021 N 99-Z "On the protection of personal data" (hereinafter — the Law on the Protection of Personal Data);
Law of the Republic of Belarus No. 418-Z of 21.07.2008 "On the Population Register";
Law of the Republic of Belarus of 10.11.2008 N 455-Z "On information, informatization and information protection";
other regulatory legal acts of the Republic of Belarus and regulatory documents of authorized state authorities.
2.2. In order to implement the provisions of the Policy, Agropishcheprom LLC develops relevant local legal acts and other documents, including:
Regulation on the processing and protection of personal data in Agropishcheprom LLC (Appendix 1 to this Policy);
Regulation on the procedure for ensuring confidentiality in the processing of information containing personal data (Appendix 2 to this Policy);
other local legal acts and documents regulating the processing of personal data in Agropishcheprom LLC.
CHAPTER 3
THE MAIN TERMS AND DEFINITIONS USED IN THE LOCAL LEGAL ACTS OF LLC "AGROPISHCHEPROM" REGULATING THE PROCESSING OF PERSONAL DATA
3.1. Biometric personal data — information characterizing the physiological and biological characteristics of a person, which is used for his unique identification (fingerprints, palms, iris, facial characteristics and its image, etc.).
3.2. Blocking of personal data — termination of access to personal data without their deletion.
3.3. Genetic personal data — information related to inherited or acquired genetic characteristics of a person, which contains unique data about his physiology or health and can be identified, in particular, by examining his biological sample.
3.4. Depersonalization of personal data — actions as a result of which it becomes impossible to determine the identity of personal data to a specific subject of personal data without the use of additional information.
3.5. Processing of personal data — any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion of personal data.
3.6. Publicly available personal data — personal data distributed by the personal data subject himself or with his consent or distributed in accordance with the requirements of legislative acts.
3.7. Personal data — any information related to an identified individual or an individual who can be identified.
3.8. Provision of personal data — actions aimed at familiarization with the personal data of a certain person or circle of persons.
3.9. Dissemination of personal data — actions aimed at familiarization with the personal data of an indefinite circle of persons.
3.10. Special personal data — personal data concerning race or nationality, political views, membership in trade unions, religious or other beliefs, health or sexual life, bringing to administrative or criminal responsibility, as well as biometric and genetic personal data.
3.11. The subject of personal data is an individual in respect of whom personal data is processed.
3.12. Cross—border transfer of personal data - transfer of personal data to the territory of a foreign state.
3.13. Deletion of personal data — actions as a result of which it becomes impossible to restore personal data in information resources (systems) containing personal data, and (or) as a result of which the material carriers of personal data are destroyed.
3.14. A natural person who can be identified is a natural person who can be directly or indirectly identified, in particular, through a surname, proper name, patronymic, date of birth, identification number or through one or more features characteristic of his physical, psychological, mental, economic, cultural or social identity.
3.15. Information — information (messages, data) about persons, objects, facts, events, phenomena and processes, regardless of the form of their presentation.
3.16. Automated processing of personal data — processing of personal data using computer technology.
CHAPTER 4
PRINCIPLES AND PURPOSES OF PERSONAL DATA PROCESSING
4.1. LLC "Agropishcheprom", being the operator of personal data, processes the personal data of employees of LLC "Agropishcheprom" and other personal data subjects who are not in labor relations with LLC "Agropishcheprom".
4.2. The processing of personal data in LLC "Agropishcheprom" is carried out taking into account the need to ensure the protection of the rights and freedoms of employees of LLC "Agropishcheprom" and other subjects of personal data, including the protection of the right to privacy, personal and family secrets, based on the following principles:
the processing of personal data is carried out on a legal and fair basis;
the processing of personal data is carried out in proportion to the stated purposes of their processing and ensures at all stages of such processing a fair balance of interests of all interested parties;
the processing of personal data is carried out with the consent of the subject of personal data, except in cases provided for by legislative acts;
the processing of personal data is limited to the achievement of specific, pre-stated legitimate goals. Processing of personal data that is incompatible with the originally stated purposes of their processing is not allowed;
the content and volume of the processed personal data correspond to the stated purposes of their processing. The processed personal data is not redundant in relation to the stated purposes of their processing;
the processing of personal data is transparent. The subject of personal data may be provided with relevant information regarding the processing of his personal data;
the operator takes measures to ensure the accuracy of the personal data processed by it, updates them if necessary;
the storage of personal data is carried out in a form that allows identifying the subject of personal data, no longer than the stated purposes of personal data processing require.
4.3. Personal data is processed in LLC "Agropishcheprom" for the purposes of:
ensuring compliance with the Constitution of the Republic of Belarus, legislative and other regulatory legal acts of the Republic of Belarus, local legal acts of LLC "Agropishcheprom";
implementation of the functions, powers and duties assigned by the legislation of the Republic of Belarus to LLC "Agropishcheprom", including the provision of personal data to state authorities, to the Social Protection Fund of the Ministry of Labor and Social Protection of the Republic of Belarus, as well as to other state bodies;
regulation of labor relations with employees of Agropishcheprom LLC (assistance in employment, training and promotion, personal safety, control of the quantity and quality of work performed, ensuring the safety of property);
protection of life, health or other vital interests of personal data subjects;
preparation, conclusion, execution and termination of contracts with counterparties;
provision of access and intra-facility modes at the facilities of LLC "Agropishcheprom";
provision of additional social guarantees to employees of Agropishcheprom LLC;
formation of reference materials for internal information support of the activities of LLC "Agropishcheprom";
execution of judicial acts, acts of other bodies or officials subject to execution in accordance with the legislation of the Republic of Belarus on enforcement proceedings;
exercising the rights and legitimate interests of LLC "Agropishcheprom" within the framework of the activities provided for by the Charter and other local legal acts of LLC "Agropishcheprom", or achieving socially significant goals;
for other legitimate purposes.
CHAPTER 5
THE LIST OF SUBJECTS WHOSE PERSONAL DATA ARE PROCESSED IN LLC "AGROPISHCHEPROM"
5.1. Agropishcheprom LLC processes personal data of the following categories of subjects:
employees of structural divisions of LLC "Agropishcheprom";
employees of contractors of LLC "Agropishcheprom";
students (students) sent to practice and industrial training in LLC "Agropishcheprom";
candidates for employment in Agropishcheprom LLC;
other subjects of personal data (to ensure the implementation of the processing purposes specified in Chapter 4 of the Policy).
CHAPTER 6
THE LIST OF PERSONAL DATA PROCESSED IN LLC "AGROPISHCHEPROM"
6.1. The list of personal data processed in Agropishcheprom LLC is determined in accordance with the legislation of the Republic of Belarus and local legal acts of Agropishcheprom LLC, taking into account the purposes of processing personal data specified in Chapter 4 of the Policy.
CHAPTER 7
FUNCTIONS OF LLC "AGROPISHCHEPROM" IN THE PROCESSING OF PERSONAL DATA
7.1. LLC "Agropishcheprom" when processing personal data:
takes measures necessary and sufficient to ensure compliance with the requirements of the legislation of the Republic of Belarus and local legal acts of LLC "Agropishcheprom" in the field of personal data;
takes legal, organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, dissemination of personal data, as well as from other illegal actions with respect to personal data;
appoints a structural unit or a person responsible for the implementation of internal control over the processing of personal data;
issues local legal acts defining the policy and issues of processing and protection of personal data in LLC "Agropishcheprom";
carries out familiarization of employees of LLC "Agropishcheprom", directly engaged in the processing of personal data, with the provisions of the legislation of the Republic of Belarus and local legal acts of LLC "Agropishcheprom" in the field of personal data, including the requirements for the protection of personal data, and training of these employees;
publishes or otherwise provides unrestricted access to this Policy;
informs the personal data subjects or their representatives in accordance with the established procedure about the availability of personal data related to the relevant subjects, provides an opportunity to get acquainted with these personal data when contacting and (or) receiving requests from these personal data subjects or their representatives, unless otherwise established by the legislation of the Republic of Belarus;
stops processing and destroys personal data in cases stipulated by the legislation of the Republic of Belarus in the field of personal data;
performs other actions stipulated by the legislation of the Republic of Belarus in the field of personal data.
CHAPTER 8
TERMS OF PROCESSING OF PERSONAL DATA IN LLC "AGROPISHCHEPROM"
8.1. The processing of personal data in Agropishcheprom LLC is carried out with the consent of the personal data subject to the processing of his personal data, unless otherwise provided by the legislation of the Republic of Belarus in the field of personal data.
8.2. Agropishcheprom LLC does not disclose or distribute personal data to third parties without the consent of the subject of personal data, unless otherwise provided by the legislation of the Republic of Belarus.
8.3. Agropishcheprom LLC has the right to entrust the processing of personal data on behalf of Agropishcheprom LLC or in its interests to an authorized person on the basis of an agreement concluded with this person. The contract must contain:
purposes of personal data processing;
the list of actions that will be performed with personal data by an authorized person;
obligations to respect the confidentiality of personal data;
measures to ensure the protection of personal data in accordance with Article 17 of the Law on the Protection of Personal Data.
The authorized person is not obliged to obtain the consent of the personal data subject. If it is necessary to obtain the consent of the subject of personal data for the processing of personal data on behalf of LLC "Agropishcheprom", such consent is obtained by LLC "Agropishcheprom".
8.4. For the purposes of internal information support, Agropishcheprom LLC may create internal reference materials, which, with the written consent of the subject of personal data, unless otherwise provided by the legislation of the Republic of Belarus, may include his surname, first name, patronymic, place of work, position, year and place of birth, address, subscriber number, e-mail address mail, other personal data reported by the subject of personal data.
8.5. Access to personal data processed in LLC "Agropishcheprom" is allowed only to employees of LLC "Agropishcheprom" holding positions included in the list of positions of structural divisions of LLC "Agropishcheprom", when replacing which personal data is processed.
CHAPTER 9
LIST OF ACTIONS WITH PERSONAL DATA AND METHODS OF THEIR PROCESSING
9.1. Agropishcheprom LLC processes personal data (any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion of personal data).
9.2. Processing of personal data in LLC "Agropishcheprom" is carried out in the following ways:
using automation tools;
without the use of automation tools, if at the same time the search for personal data and (or) access to them is provided according to certain criteria (card files, lists, databases, journals, etc.).
CHAPTER 10
RIGHTS OF PERSONAL DATA SUBJECTS
10.1. Personal data subjects have the right to:
revocation of the consent of the personal data subject;
obtaining information concerning the processing of personal data and changing personal data;
the requirement to terminate the processing of personal data and (or) their deletion;
appeal against actions (inaction) and decisions of the operator related to the processing of personal data.
CHAPTER 11
MEASURES TAKEN BY AGROPISHCHEPROM LLC TO ENSURE THE FULFILLMENT OF THE OPERATOR'S DUTIES WHEN PROCESSING PERSONAL DATA
11.1. The measures necessary and sufficient to ensure that LLC "Agropishcheprom" fulfills the obligations of the operator provided for by the legislation of the Republic of Belarus in the field of personal data include:
providing personal data subjects with the necessary information before obtaining their consent to the processing of personal data;
clarification of personal data subjects of their rights related to the processing of personal data;
obtaining written consent of personal data subjects to the processing of their personal data by putting a corresponding mark on the notification of the provision of information by the subject, except in cases provided for by the legislation of the Republic of Belarus;
appointment of a structural unit or person responsible for the implementation of internal control over the processing of personal data in LLC "Agropishcheprom";
publication of documents defining the policy of LLC "Agropishcheprom" regarding the processing of personal data;
familiarization of employees directly engaged in the processing of personal data in LLC "Agropishcheprom" with the provisions of the legislation on personal data;
establishing the procedure for accessing personal data, including those processed in an information resource (system);
implementation of technical and cryptographic protection of personal data in Agropishcheprom LLC in accordance with the procedure established by the Operational and Analytical Center under the President of the Republic of Belarus, in accordance with the classification of information resources (systems) containing personal data;
ensuring unrestricted access, including through the use of the global computer network Internet, to the documents defining the policy of LLC "Agropishcheprom" in relation to the processing of personal data, prior to the start of such processing;
termination of processing of personal data in the absence of grounds for their processing;
immediate notification of the authorized body for the protection of the rights of personal data subjects on violations of personal data protection systems;
modification, blocking, deletion of false or illegally obtained personal data;
limiting the processing of personal data to the achievement of specific, pre-stated legitimate goals;
the storage of personal data in a form that allows the identification of personal data subjects for no longer than the stated purposes of personal data processing require.
11.2. Measures to ensure the security of personal data during their processing in personal data information systems are established in accordance with the local legal acts of LLC "Agropishcheprom" regulating the issues of ensuring the security of personal data during their processing in the personal data information systems of LLC "Agropishcheprom".
CHAPTER 12
MONITORING COMPLIANCE WITH THE LEGISLATION OF THE REPUBLIC OF BELARUS AND LOCAL LEGAL ACTS OF LLC "AGROPISHCHEPROM" IN THE FIELD OF PERSONAL DATA, INCLUDING REQUIREMENTS FOR PERSONAL DATA PROTECTION
12.1. Control over compliance by the structural divisions of Agropishcheprom LLC with the legislation of the Republic of Belarus and local legal acts of Agropishcheprom LLC in the field of personal data, including personal data protection requirements, is carried out in order to verify compliance of personal data processing in the structural divisions of Agropishcheprom LLC with the legislation of the Republic of Belarus and local legal acts of Agropishcheprom LLC in the field of personal data, including the requirements for the protection of personal data, as well as the measures taken, aimed at preventing and detecting violations of the legislation of the Republic of Belarus in the field of personal data, identifying possible channels of leakage and unauthorized access to personal data, eliminating the consequences of such violations.
12.2. Internal control over compliance by the structural divisions of Agropishcheprom LLC with the legislation of the Republic of Belarus and local legal acts of Agropishcheprom LLC in the field of personal data, including requirements for personal data protection, is carried out by the person responsible for organizing the processing of personal data in Agropishcheprom LLC.
12.3. Personal responsibility for compliance with the requirements of the legislation of the Republic of Belarus and local regulations of LLC "Agropishcheprom" in the field of personal data in the structural subdivision of LLC "Agropishcheprom", as well as for ensuring confidentiality and security of personal data in these divisions of LLC "Agropishcheprom" is assigned to their managers.