Tchaikovsky online academy

Privacy Policy

APPROVED
by order of the Director (Manager) LLC «Online Technologies» from 09/06/2024 No 1- P
POLITICS limited liability companies
«Online Technologies» regarding the processing of personal data
09/06/2024
Page 1 from 19

1. General provisions
1.1. Limited company responsibility «Online Technologies» (hereinafter also – The Operator (s) pays special attention to the protection of personal data during their processing and respects the rights of personal data subjects . The Operator’s activities, among other things, consist of accepting payments from payers to its bank account and further transferring funds to their recipients in accordance with commission agreements concluded by the Operator with the recipients of funds. Persons referred to in para. 5.5 Policies, when concluding an agreement via the network «Internet» with the seller of goods (works, services) who has entered into relevant transactions with the Operator, go to the payment page owned by the Operator and fill out the payment form. The funds are either transferred to the Operator’s bank account ( with further listing funds to the final recipient ), or to the recipient directly through a form of payment owned by the Operator. After crediting funds to the Operator’s account, monetary obligations persons specified in paragraph. 5.5 Policies are considered fulfilled.
1.2. Approved Personal Data Processing Policy (hereinafter – Policy) is one of those adopted by the Operator measures to protect personal data provided for in Article 17 of the Law of the Republic of Belarus dated May 7, 2021 No 99- Z «On the protection of personal data» .
1.3. The policy explains to personal data subjects, as does for the for what purposes is their personal data collected, used or otherwise processed, and also reflects what is available in connection with this subjects of personal data rights and the mechanism for their implementation .
1.4. Operator employees are personally responsible for ensuring the protection of personal data and compliance by employees
requirements of the legislation of the Republic of Belarus and local acts of the Operator in the field of processing and protection of personal data .
1.5. The legality of processing personal data is ensured, first of all, by obtaining the free, unambiguous, informed consent of the subject of personal data to grant the Operator the right to process his personal data.
1.6. The conditions for processing personal data are: obtaining the consent of the subject of personal data and (or) processing in the cases specified in the section 13 Policies, as well as in other cases provided for by the legislative acts of the Republic of Belarus.
1.7. The consent of the subject of personal data to the processing of his personal data can be given by him or his authorized representative in any form that allows confirming the fact of obtaining consent, unless otherwise established by the legislative acts of the Republic of Belarus and (or) the Policy.
Page 2 from 19

1.8. Operator and other persons who have gained access to personal data are obliged not to disclose or transfer personal data to third parties without the consent of the subject of personal data, except for cases provided for by the legislative acts of the Republic of Belarus.
1.9. The operator has the right to entrust the processing of personal data to a third person (authorized person) with the consent of the subject of personal data, unless otherwise provided by the legislative acts of the Republic of Belarus, on the basis of an agreement concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of processing personal data provided for by the legislative acts of the Republic of Belarus
international treaties, as well as Politics. The processing of personal data by an authorized person is carried out to the extent and within the limits provided for by this Policy. The list of authorized persons is indicated in the Appendix to the Policy.
1.10. Operator has the right to transfer personal data of subjects to third parties
third parties to the agreement. Transfer of personal data to persons, c including to their counterparties, and other legal entities, only with the consent of the subject of personal data, unless otherwise provided by legislative acts, on the basis of concluded with
it is being carried out for the purpose of fulfilling contracts and agreements between the Operator and third parties, which indicate the list of processed data. All third parties to whom the transfer of personal data of subjects is carried out, they are obliged to comply with the principles and
rules processing personal data, provided legislative acts and international treaties of the Republic of Belarus.
1.11. Detailed information o third faces, involved in the processing
personal data (names, addresses and the goal transfers
personal data), can be provided to the subject personal data by his request .
1.12. Operator contact details:
Operator’s name
Legal address
Contact details of the responsible person
2. Concepts used
Limited Liability Company «Online Technologies»
Republic of Belarus, 220088, Minsk, st. Zakharova, 59, office. 307
Full name: Turku Evgeniy Sergeevich e-mail: eugene.turku@gmail.com
2.1. automated processing of personal data – processing of personal data, in which such actions with personal data as clarification, distribution, destruction of personal data
Page 3 from 19

data in relation to each of the subjects of personal data is carried out without the direct participation of a person;
2.2. biometric personal data – information characterizing physiological and biological characteristics of humans, which
used for his unique identification (fingerprints, palms, iris, facial characteristics, etc his image and other);
2.3. blocking of personal data – termination of access k personal data without deleting it;
2.4. counterparty – legal person; sole trader; natural person with whom contracts have been concluded or may be concluded by the Operator ;
2.5. non-automated processing of personal data – processing of personal data, in which such actions with personal data as clarification, distribution, destruction of personal data in relation to each of the subjects of personal data are carried out with the direct participation of a person. The processing of personal data cannot be recognized as carried out using automation tools (automated) solely on the grounds that personal data is contained in the personal data information system or has been extracted from it ;
2.6. depersonalization of personal data – actions that make it impossible to determine whether personal data belongs to a specific subject of personal data without the use of additional information;
2.7. processing of personal data – any action or set of actions performed with personal data, including the collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion of personal data;
2.8. publicly available personal data – personal data distributed by the subject of personal data himself or with his consent or distributed in accordance with the requirements of legislative acts;
2.9. operator – state body, legal entity of the Republic
Belarus, other organization, individual, including individual entrepreneur (hereinafter, unless otherwise defined, – (individual), organizing and/or processing personal data independently or jointly with other specified persons;
2.10. personal data – any information, relating k to an identified natural person or a natural person who can be identified;
2.11. provision of personal data – actions aimed at
familiarization with the personal data of certain individuals or a circle of individuals;
Page 4 from 19

2.12. dissemination of personal data – actions aimed at
familiarization with personal data of an unknown number of persons;
2.13. special personal data – personal data,
relating to race or nationality, political views, membership in trade unions, religious or other beliefs, health or sex life, administrative or criminal liability, as well as biometric and genetic personal data;
2.14. subject personal data – an individual in respect of whom the processing of personal data is carried out;
2.15. cross-border transfer of personal data personal data to the territory of a foreign state;
2.16. deletion of personal data – actions resulting from which it becomes impossible restore
personal data
– transmission
in the
information resources (systems) containing personal data, and (or) as a result of which material carriers of personal data are destroyed;
2.17. authorized person – state body, legal entity
Republic of Belarus, another organization, individual who, in accordance with an act of legislation, a decision of a government body that is the operator, or on the basis of an agreement with the operator, process personal data on behalf of the operator or in his interests;
2.18. an individual who can be identified – physical
a person who may be directly or indirectly identified, in particular
through the last name, own name, patronymic, date births, identification number or through one or more features characteristic of his physical, psychological, mental,
economic, cultural or social identity.
3. Purposes of collecting personal data
The processing of personal data by the Operator is carried out in the following objectives:
3.1. Execution transactions, prisoners or subject to conclusion (to commit) Operator with Counterparties;
3.2. Proper compliance with the requirements of the legislation of the Republic of Belarus regarding the processing of personal data;
3.3. Organization of accounting for Operator employees in accordance with the requirements of the law, assisting them in career growth, training, for health insurance, and assignment to official services business trips, control of the quantity and quality of work performed, etc ensuring the safety of property in accordance with the Labor Code of the Republic of Belarus, as well as for the purpose of implementing social programs, fulfilling contractual obligations with Counterparties (registration)
Page 5 from 19

powers of attorney, copies of documents containing personal data, registration of bank cards as part of salary projects etc;
3.4. Accepting payments from Clients;
3.5. Transfer of processed personal data of clients to payment service providers and (or) to the bank for the transfer of funds.
4. Legal basis for processing personal data
The legal basis for the processing of personal data by the Operator is, in particular:
4.1. Law of the Republic of Belarus dated 05/07/2021 No 99-Z «On the protection of personal data» ;
4.2. Decree President of the Republic of Belarus dated October 28, 2021 No 422 «On measures to improve the protection of personal data» ;
4.3. Order Promptly-analytical Center under the President of Belarus No 94 dated 06/01/2022 «About the state information resource «Register of personal data operators»;
4.4. Order of the National Center for Personal Data Protection of the Republic of Belarus dated December 26, 2022 No 114;
4.5. Other legal acts and international treaties of the Republic of Belarus;
4.6. Transactions (including contracts)(which are or may be concluded between the Counterparties and the Operator) .
5. Categories of personal data subjects
Operator performs processing personal data of the following categories of personal data subjects :
5.1. Counterparties;
5.2. Counterparty Representatives;
5.3. Candidates for vacant positions (hereinafter – applicants) – individuals applying for vacant positions in Operator ;
5.4. Workers – natural persons who are or have been with the Operator in labor relations ;
5.5. Persons who have expressed their consent to the Operator processing personal data for their further transfer to the bank – acquirer and/or payment aggregator or to another person for the purpose of making a non-cash payment (further – Customers) .
6. List processed Operator personal data Counterparties
Operator processes the following personal data of the Counterparties: 6.1. Last name, first name and patronymic (last – if available);
Page 6 from 19

6.2. Date of birth;
6.3. Passport details;
6.4. Payer account number (UPN) or him foreign analogs;
6.5. Gender;
6.6. Citizenship;
6.7. Contact details, phone number, email address;
6.8. Data from a bank payment card or bank account;
6.9. Other personal data necessary to achieve the purposes provided for in Section 3 of the Policy.
7. List processed Operator personal data Representatives of Counterparties
Operator processes the following personal data of Counterparty Representatives :
7.1. Last name, first name and patronymic (last – if available); 7.2. Date of birth;
7.3. Passport details;
7.4. Payer account number (UNP) or its foreign counterparts; 7.5. Gender;
7.6. Citizenship;
7.7. Contact details, phone number, email address;
7.8. Data from a bank payment card or bank account;
7.9. Other personal data necessary to achieve the purposes provided for in Section 3 of the Policy.
8. List of personal data processed by the Operator Applicants
Operator processes the following personal data of Applicants: 8.1. Last name, first name and patronymic (last – if available); 8.2. Date of birth;
8.3. Passport details;
8.4. Information about marital status;
8.5. Payer account number (UPN) or its foreign analogues; 8.6. Meta residence address;
8.7. Education, further training;
8.8. Work experience;
8.9. Previous jobs;
8.10. Gender;
Page 7 from 19

8.11. Contact phone number and email address;
8.12. Email address;
8.13. Other personal data necessary to achieve the purposes provided for in Section 3 of the Policy.
9. List of processed by the Operator personal data of Employees
The Operator processes the following personal data of Employees: 9.1. Last name, first name and patronymic (last – if available); 9.2. Date and place of birth;
9.3. Passport details;
9.4. Gender;
9.5. Registration address;
9.6. Marital status;
9.7. Education;
9.8. Work experience;
9.9. Previous jobs;
9.10. Military records;
9.11. Payer account number (UPN) or its foreign counterparts;
9.12. Contact phone number and email address;
9.13. Salary;
9.14. Social benefits;
9.15. Position;
9.16. Details for the transfer of wages;
9.17. Others personal data necessary to achieve the objectives envisaged section 3 Policies.
10. List personal data processed by the Operator Clients
The Operator processes the following personal data of Clients:
10.1. Last name, first name and patronymic if the Client enters the relevant data in payment form on the Operator’s website;
10.2. Client’s bank payment card details;
10.3. Data on transactions using a bank payment card.
Page 8 from 19

11. Principles for processing personal data
The processing of personal data is carried out by the Operator based on the following principles:
11.1. legality, fair basis and transparency in relation to the data subject;
11.2. restrictions on the processing of personal data to the achievement of specific, predetermined and legitimate purposes (target limitation);
11.3. preventing the processing of personal data that is incompatible with the purposes of collecting personal data;
11.4. preventing the consolidation of databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
11.5. processing only those personal data that meet the purposes of their processing;
11.6. compliance of the content and volume of processed personal data with the stated purposes of processing;
11.7. preventing the processing of personal data that is redundant in relation to the stated purposes of their processing (the principle of data minimization);
11.8. ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of processing personal data (principle of accuracy);
11.9. the storage of personal data must be carried out in a form that allows us to identify the subject of personal data no longer than required by the purpose of processing personal data, if the period of storage of personal data is not established by law, agreement to which the beneficiary or guarantor under which the subject of personal data is;
11.10. destruction or depersonalization of personal data upon achievement
the purposes of their processing or in case of loss of the need to achieve these purposes, if it is impossible for the Operator to eliminate them violations of personal data committed, unless otherwise provided by law (principle of limiting data storage);
11.11. legality of the purposes and methods of processing personal data and integrity;
11.12. personal responsibility of the Operator’s employees, as well as individuals
working on the basis of a civil contract-of a legal nature, or employees of a third- party organization to whom the Operator entrusted the processing of personal data, for the safety and confidentiality of personal data;
11.13. availability of a permissive system for access of Operator employees to documents and databases containing personal data;
11.14. impartiality of the processing of personal data;
11.15. ensuring the confidentiality of personal data during their transfer, c including cross-border ones, to third parties;
Page 9 from 19

11.16. ensuring the security of personal data, including protection against
unauthorized or illegal processing and accidental loss, destruction or damage, using appropriate technical or organizational measures (principle of integrity and
privacy).
12. Permissibility of processing personal data without the consent of the subject
The processing of personal data is permitted without the consent of the subject of personal data in the following cases:
12.1. for the purposes of conducting administrative and (or) criminal proceedings, carrying out operationally – investigative activities;
12.2. for the administration of justice, execution of court orders and other enforcement documents;
12.3. for the purpose of implementation control (supervision) in accordance with s legislative acts;
12.4. when implementing the norms of legislation in the field of national security, on the fight against corruption, on the prevention of money laundering, financing of terrorist activities and financing of the proliferation of weapons of mass destruction;
12.5. when implementing the norms of legislation on elections, referendums, on the recall of a deputy of the House of Representatives, a member of the Council of the Republic of the National Assembly of the Republic of Belarus, a deputy of the local Council of Deputies;
12.6. to maintain individual (personalized) records of information about
insured persons for the purposes of state social insurance, including occupational pension insurance;
12.7. when registering labor (service) relations, as well as in the process of labor (service) activities of the subject of personal data in cases provided for by law;
12.8. to carry out notarial activities;
12.9. when considering issues related to citizenship of the Republic of Belarus, granting refugee status, additional protection, asylum and temporary protection in the Republic of Belarus;
12.10. for the purpose of assigning and paying pensions and monthly salary certain categories of civil servants, benefits;
12.11. for the organizations and carrying out state statistical observations, generation of official statistical information;
12.12 p.m. for scientific or other research purposes, subject to mandatory anonymization of personal data;
12.13. when accounting, calculating and calculating fees for housing-
utilities, residential use fees and energy reimbursement, other service fees and tax refunds, as well as benefits and collection
Page 10 from 19

arrears in housing payments-utilities, payment for
use of residential premises and reimbursement of electricity costs;
12.14. when receiving personal data by the operator on the basis of an agreement,
a prisoner (prisoner) with a personal subject data for the purpose of performing actions established by this agreement;
12.15. when processing personal data, when it is indicated in the document,
addressed to the operator and signed by the subject of personal data, in accordance with the content of such document;
12.16. for the purposes of carrying out legitimate professional activities
journalist and (or) activities of the media, an organization carrying out publishing activities aimed at protecting public interest, which is the need of society to detect and disclose information about threats to national security, public order, public health and the environment, information affecting the performance of their duties by government officials holding responsible positions, public figures, except in cases provided for by civil procedure and economic figures
procedural, criminally-procedural legislation, legislation defining the procedure for the administrative process;
12.17. to protect the life, health or other vital interests of the subject
personal data or other persons, if obtaining the consent of the subject of personal data is impossible;
12.18. in relation to previously distributed personal data up to the moment
statements by the subject of personal data of demands to stop processing distributed personal data, as well as to delete them in the absence of other grounds for processing personal data provided for by this Law and other legislative acts;
12.19. in cases where the processing of personal data is necessary for
execution responsibilities (authority), provided legislative acts;
12.20. in cases where legislative acts directly provide
processing of personal data without the consent of the subject of personal data.
13. List of actions with personal data carried out by the Operator
By giving consent to the processing of personal data, the relevant subjects of personal data agree to the following actions with personal data by the Operator and (or) an authorized person:
13.1. collection; 13.2. record; 13.3. storage;
Page 11 from 19

13.4. accumulation;
13.5. systematization;
13.6. clarification (update, change);
13.7. extraction;
13.8. use;
13.9. transfer (provision of access), including cross-border (including transfer to an authorised person for further processing) ;
13.10. depersonalization;
13.11. blocking;
13.12. deletion;
13.13. destruction;
13.14. other actions provided for active legislation
Republic of Belarus, s using funds automation, in the including in the informationally – telecommunications networks (in particular, networks «Internet») , or without use of such funds , if processing of personal data without use of such funds matches the character actions ( operations ), committed s personal data using funds automation , that’s it there is allows implement in accordance with s given an algorithm search personal data , recorded on the material carrier and contained in the card indexes or others systematized meetings personal data , and / or access k so personal data .
14. Cross-border processing and transfer of personal data
14.1. Operator must ensure that the foreign state to whose territory the transfer of personal data is intended is provided with an appropriate level protection rights of personal data subjects before the start of such transfer ;
14.2. Cross-border transfer of personal data on the territory of foreign states that do not provide an adequate level protection of rights subjects of personal data may be carried out exclusively in the next one cases :
the consent of the subject of personal data is given, provided that the subject of personal data is informed about the risks arising from the lack of an adequate level of protection;
personal data is obtained on the basis of an agreement concluded (concluded) with the subject of personal data for the purpose of performing actions established by this agreement;
personal data may be obtained by any person by sending a request in cases and in the manner prescribed by law;
Page 12 from 19

such transfer is necessary to protect the life, health or other vital interests of the subject of personal data or other persons, if obtaining the consent of the subject of personal data is impossible;
the processing of personal data is carried out within the framework of the implementation of international treaties of the Republic of Belarus;
such transfer shall be carried out by the financial monitoring body in order to take measures to prevent the laundering of proceeds of crime, the financing of terrorist activities and the financing of the proliferation of weapons of mass destruction in accordance with the law;
the appropriate permission from the authorized body for the protection of the rights of personal data subjects has been received;
in other cases provided for by the legislative acts of the Republic of Belarus.
14.3. In other cases, cross-border transfer of personal data to foreign states that do not provide an adequate level of protection of the rights of personal data subjects is not allowed.
14.4. Cross-border transfer of personal data is also made when personal data is transferred to authorized persons specified in the Appendix to the Policy. Since the Russian Federation (country of registration
one of the authorized persons) according to By order National Center for Personal Data Protection of the Republic of Belarus dated November 15, 2021 No 14
is a state that provides an appropriate level of protection, cross-border transfer of personal data is legal and
produced without notifications from the National center protection personal data of the Republic of Belarus.
15. Deadlines for processing personal data
15.1. Personal data of subjects processed by the Operator is subject to destruction or depersonalization in the event :
achieving the purposes of processing personal data or loss the need to achieve these goals;
revoking the subject’s consent to the processing of his personal data;
receiving from the subject or his authorized representative notification of the deletion
of his personal data;
termination of the Operator’s activities.
15.2. At the same time, the purposes of processing personal data of Clients cannot be
considered achieved before the expiration of the storage period for their personal data.
15.3. Storage personal data in the form, allowing define the subject personal data , it is being carried out not longer , than this is required objectives processing personal data , if term storage personal data not installed legislative acts , agreement ,
Page 13 from 19

by the side which, the beneficiary or guarantor, by which is subject personal data .
15.4. For the subjects of personal data who are citizens
European Union, the maximum storage period for personal data is 30 days, from the date of execution of transactions concluded by the Operator with personal data subjects. Consent to the processing of personal data by EU citizens is given for a maximum period.
15.5. For other entities, the storage period for personal data is 1 year, from the date of execution of transactions concluded by the Operator with subjects of personal data .
15.6. Consents of personal data subjects to the processing of their personal data are stored by the Operator for 1 year after the end of the period for which consent is given.
15.7. Applications of personal data subjects for the processing of their personal data are stored by the Operator for 1 year .
15.8. Notifications of violations of the personal data protection systems of personal data subjects are stored by the Operator for 3 years.
15.9. If the fact of inaccuracy of personal data or the illegality of their processing by the Operator is confirmed, personal data is subject to updating, and their processing is terminated.
15.10. When achieving the purposes of processing personal data, as well as in the case
revocation by the subject of personal data of consent to their processing of personal data is subject to destruction, in the following cases:
unless otherwise provided in the contract, by the side which, the beneficiary or guarantor for whom the subject of personal data is;
if the operator does not have the right to carry out processing without the consent of the subject
personal data by legislative acts ;
on the
the reasons provided
unless otherwise provided by another agreement between the operator and the subject of personal data .
16. The procedure for responding to applications (requests, appeals) of subjects personal data, their representatives and authorized state body
16.1. To exercise his rights related to the processing of personal data by the Operator, the subject of personal data submits an application to the Operator in writing at the postal or email address, paragraph. 1.12 Politics, or through the state unified (integrated) republican information systems for recording and processing requests from citizens and legal entities (https://обращения.бел), and in case of exercise of the right to revoke consent – in the form in which such consent was obtained. Such a statement shall contain
Page 14 from 19

last name, proper name, patronymic (if any) of the subject of personal data, address of his place of residence (place of stay);
the personal data subject’s date of birth;
a statement of the nature of the personal data subject’s requirements;
identification number of the subject of personal data, in the absence of such a number – the number of the identity document of the subject of personal data, in cases where this information was indicated by the subject of personal data when giving his consent or the processing of personal data is carried out without the consent of the subject of personal data;
personal signature (for a written application) or electronic digital signature (for an application in the form of an electronic document) of the subject of personal data.
16.2. The Operator does not consider applications from personal data subjects received to him in ways not provided for by legislative acts and (or) Policy, as well as in the absence of information required by law in the application.
16.3. For assistance in exercising rights related to the processing of personal data by the Operator, the subject of personal data may contact the person responsible for implementation of internal control over
by processing personal data by the Operator, sending a message to the email address specified in paragraph. 1.12 Policies.
16.4. When contacting or requesting in written or electronic form the subject of personal data or his legal representative to access his personal data, the Operator is guided by the provisions of the Law of the Republic of Belarus dated 05/07/2021 No 99- Z «On the protection of personal data», as well as other legislative acts.
16.5. Depending on the information provided in the request, a decision is made to provide the subject with access to his personal data.
16.6. In case the data provided by the subject is insufficient to establish his identity or for the provision of personal data in accordance with Article 14 of the Law of the Republic of Belarus dated 05/07/2021 No 99- Z «On the protection of personal data», the Operator prepares a reasoned response containing the reasons for the refusal satisfaction of the application and (or) leaving it without consideration on the merits.
16.7. Information about the availability of personal data is provided to the subject upon responding to the request within thirty days from the date of receipt of the request of the personal data subject or his authorized representative representative.
16.8. If a request is received from the subject of personal data to refuse to process his personal data (withdrawal of consent to the processing of personal data), data in the Operator’s systems subject to immediate removal.
Page 15 from 19

16.9. If a request is received from a personal data subject to upload his personal data, his personal data is uploaded in any format available in the system.
17. Rights subjects of personal data
The subject of personal data has the following rights:
17.1. to revoke your consent if the Operator processes personal data addressed to the subject of personal data to obtain consent. The right to withdraw consent is not can be implemented in cases where processing is carried out on other legal grounds (for example, c in accordance with legal requirements or the basis of the contract);
17.2. to receive information regarding the processing of his personal data by the Operator, containing :
location of the Operator;
confirmation of the fact of processing the personal data of the applicant operator’s
faces;
personal data and the source of its receipt;
legal basis and purposes of processing personal data;
the period for which consent has been given (if the processing of personal data is carried out on the basis of consent) ;
name and place finding authorized faces (authorized persons);
other information provided for by law
17.3. require from the Operator making changes to your personal data if the personal data is incomplete, outdated or inaccurate. IN THE for these purposes, the subject of personal data attaches the relevant documents and (or) their duly certified copies attesting to the need to amend personal data ;
17.4. to receive information from the Operator about the provision of his personal data processed by the Operator to third parties once in the calendar year free unless otherwise is provided for
legislation of the Republic of Belarus;
17.5. require from the Operator free termination of processing of your personal data, including them deletion, in the absence of grounds for processing personal data provided for legislation of the Republic of Belarus ;
17.6. to appeal actions (inaction) and decisions of the Operator that violate his rights when processing personal data, in the manner prescribed by law;
17.7. other rights provided for by the legislation of the Republic of Belarus.
Page 16 from 19

18. Ensuring the security of personal data
18.1. Protection of personal data is one of the main tasks of the Operator. In order to prevent unauthorized access, unspecified transfer of personal data to third parties or misuse of personal data, the Operator constantly develops and modernizes means of protecting the information received. The collection, storage and processing processes are regularly checked
personal data, special security mechanisms and technologies are used.
18.2. Security of personal data processed by the Operator, ensured by the implementation of legal, organizational and technical measures necessary to ensure the requirements of legislation in the field of personal data protection.
18.3. To prevent unauthorized access to personal data, the Operator uses the following organizationally – technical measures :
appointing officials responsible for organising the processing and protection of personal data;
limiting the number of persons with access to personal data;
limiting the list of premises where personal data is processed;
familiarization of subjects with the requirements of legislation and local acts Operator on the processing and protection of personal data;
arranging for the recording, storage and circulation of data carriers;
identifying threats to the security of personal data during their processing, forming a
threat model based on them;
developing a personal data protection system based on a threat model;
checking the readiness and effectiveness of information security tools; delimitation of user access to information resources and software – hardware
processing of personal data;
establishment rules access personal to data,
processed in the information system, as well as ensuring registration and accounting of all actions performed with personal data in the Operator’s information system, established by the Operator order;
use of antivirus products;
use of personal data protection recovery tools;
Page 17 from 19

in
application the necessary cases funds internetwork
shielding, intrusion detection, security analysis, and cryptographic information security tools;
use data encryption when necessary;
use of encryption of personal data traffic (HTTPS, IPSec, TLS, PPTP, SSH)
use of security; tools for monitoring information events
application of two-factor authentication for information security administration;
use of technical backup and duplication of arrays and storage media containing personal data.
19. Final provisions
19.1. Other rights and obligations of the Operator determined by the legislation of the Republic of Belarus.
19.2. Officials and employees of the Operator who are guilty of violating the rules governing the processing and protection of personal data bear financial, disciplinary, administrative, and civil penalties – legal or criminal liability in accordance with the procedure established
legislation of the Republic of Belarus.
Page 18 from 19

Annex: List of authorised persons
No Authorized person p/p
1 OOO «ONELIA PRO» (Russian Federation,
TIN: 7714444389, OGRN: 1197746306977)
2 LLC «IComCharge» (Republic of Belarus, UNP: 191670289)
Location of the authorized
person
Russian Federation, 125252, Moscow,
Purpose of processing
1. Accepting payments from Clients;
2. Transfer of processed personal data of clients st. Aircraft designer Mikoyan, 12,to payment service providers and (or) to the
floor 6, room 1, room. 7-8). bank for the transfer of funds;
3. Execution of transactions concluded or to be concluded (committed) by the Operator with Counterparties.
Republic of Belarus, 220083, 1. Accepting payments from Clients;
Minsk, pr. Dzerzhinsky, 104, office 2. Transfer of processed personal data of clients 1801 to payment service providers and (or) to the
bank for the transfer of funds;
3. Execution of transactions concluded or to be concluded (committed) by the Operator with Counterparties.
Page 19 from 19