Privacy policy

Policy Regulation
on Personal Data Processing

Chapter 1

GENERAL PROVISIONS

1. The approval of this policy on personal data processing (hereinafter – the Policy) at the Private Research and Production Unitary Enterprise «Automated Tourism Technologies» (hereinafter – the Organization) is one of the measures taken by the Organization for the protection of personal data in accordance with Article 17 of the Law of the Republic of Belarus dated May 7, 2021 No. 99-Z «On Personal Data Protection» (hereinafter – the Law).

2. The Policy explains to personal data subjects how and for what purposes their personal data is collected, used, or otherwise processed, and describes their rights and mechanisms for exercising those rights.

The Policy does not apply to the processing of personal data:

during employment and administrative procedures (concerning employees and former employees);
under video surveillance (Video Surveillance Policy at PRPUE “Automated Tourism Technologies” is available online at:

• https://beltur.by/?videonabludenie;

when processing cookies on the Organization’s website (Cookie Policy is published at:

• https://beltur.by/?cookie;

3. Organization contact details:

Postal address: Republic of Belarus, Minsk, Surazhskaya St. 10, office 21;
Websites: https://att.by
E-mail: info@att.by.

4. The terms and definitions used in this Policy shall have the meanings established by the Law.

5. Personal data may be used by the Organization for scientific or other research purposes after mandatory anonymization, particularly for:

preparing and publishing annual activity reports;
providing clarifications on the application of personal data legislation;
preparing and delivering publications and presentations related to the duties of the Organization's employees.

6. The Organization processes only those personal data necessary to achieve declared purposes and does not allow excessive processing.

7. The Policy is publicly available online at the following addresses:

https://beltur.by/?Politika_konfidencialinosti;
and is also available at the Organization’s office.

8. The Organization may amend the Policy at any time unilaterally without prior notice to data subjects. The new version takes effect upon approval.

Chapter 2

PURPOSES, CATEGORIES OF DATA SUBJECTS, LIST OF PROCESSED PERSONAL DATA, LEGAL GROUNDS AND TERMS OF PERSONAL DATA PROCESSING

9. The Organization processes personal data of data subjects for purposes, within scope, on legal grounds, and for the duration applicable to each category of data subjects as specified in Appendix 1 to this Policy.

10. The processing of personal data by the Organization is carried out based on the consent of data subjects, as well as other legal grounds provided by the Law, namely:

on the basis of a contract concluded (or being concluded) with the data subject;
performance of obligations established by legislative acts.

11. The Organization processes personal data using both automated means and without them, by performing the following actions depending on the processing purpose: collection, systematization, storage, modification, use, provision (including cross-border transfer), deletion.

12. The Organization limits the processing of personal data to achieving specific, pre-declared purposes, and stores personal data in a form allowing the identification of the data subject no longer than required to achieve those purposes.

13. When determining the retention period for personal data, the Organization follows the timeframes defined in the List of standard documents generated in the activities of public bodies, other organizations and individual entrepreneurs, approved by the Resolution of the Ministry of Justice of the Republic of Belarus No. 140 of May 24, 2012 “On the list of standard documents” (hereinafter – the List). If the retention period is not specified in the List, the Organization determines it independently, based on the purposes of processing and the specifics of its activities, avoiding excessive data processing.
After the retention period expires, documents containing personal data are destroyed in accordance with Belarusian legislation; data contained in the Organization’s information systems (resources) are deleted.

Chapter 3

AUTHORIZED PERSONS. PROVISION OF PERSONAL DATA TO THIRD PARTIES

14. The Organization processes personal data with the involvement of authorized persons for the purposes specified in the Appendix to this Policy, who perform the following:

IT support for the Organization's information resources (systems) — LLC «Aktivnye Tekhnologii»;
provision of services included in the tourist product (accommodation in sanatoriums / resorts / hotels, transfers, excursions);
hosting services — LLC “Aktivnye Tekhnologii”.

15. For the purpose of sending informational, promotional, and other messages:

via SMS — personal data processing is entrusted to authorized persons: LLC «BambuGroup Bay» (220076, Minsk, Frantsiska Skaryny St., 15B-2).

16. Authorized persons process personal data based on a contract with the Organization (data processing assignment) and must comply with the principles and rules for data processing and protection established by the Law. Each contract specifies permitted actions, processing purposes, confidentiality obligations, and security requirements. The Organization regularly monitors compliance with these obligations.

17. The Organization provides personal data to third parties for the purposes set out in the Appendix to this Policy, including:

telecommunications operators of the Republic of Belarus, email services — for SMS and Email distribution;
RUE “Belpochta” (220050, Minsk, Nezavisimosti Ave., 10) — for postal correspondence;
legal electronic document exchange service podpis.by «YurSpektr» (220141, Minsk, F. Skaryny St., 40, office 328) — for document exchange;
social networks and messengers — for communication and sharing participant information from Organization events;
cloud services, IT infrastructure, and hosting provider — LLC «Aktivnye Tekhnologii»;
government agencies (organizations), when legally justified under Belarusian data protection law.

Chapter 4

CROSS-BORDER TRANSFER OF PERSONAL DATA

18. The Organization may carry out cross-border transfers of personal data to a foreign state if:

the foreign state ensures an adequate level of protection of the rights of personal data subjects — without restrictions if legal grounds specified by the Law exist;
the foreign state does not ensure an adequate level of protection of the rights of personal data subjects — in cases provided for by Article 9 of the Law, including:

• when the subject has given consent after being informed of the risks associated with the lack of adequate protection;
• when such transfer is necessary to protect the life, health, or other vital interests of the data subject or others, if obtaining consent is impossible;
• when processing is necessary to fulfill duties (powers) stipulated by legislative acts.

19. The Organization transfers personal data to foreign countries that do not ensure an adequate level of protection of personal data subjects' rights:

to social networks and instant messaging services (messengers) — for the purpose of communication and publishing information about participants in the Organization’s events on social networks and messengers.

20. In this regard, the Organization additionally informs data subjects about the following risks related to the lack of adequate personal data protection in such foreign countries:

absence of specific legislation regulating personal data processing, including compliance requirements;
lack of an independent government authority responsible for protecting personal data subjects’ rights;
limited scope of personal data subject rights;
use of inappropriate methods of personal data collection;
unlawful data processing, potentially making personal data accessible to an unlimited number of individuals.

Chapter 5

METHODS FOR OBTAINING DATA SUBJECT’S CONSENT TO PERSONAL DATA PROCESSING

21. Consent of the personal data subject is a free, unambiguous, and informed expression of their will, by which they allow the processing of their personal data.

22. The consent of the data subject may be obtained by the Organization in written form or in another electronic format. In electronic form, the Organization receives the subject’s consent through the placement of a mark (a "check" in a checkbox) by the subject on the Website.

23. Prior to obtaining consent, the Organization provides the personal data subject with information regarding the processing of their data, including:

location of the Organization;
purpose of personal data processing;
list of personal data to be processed, required to achieve the declared purpose;
list of actions performed with personal data and method of processing (automated or non-automated);
details about authorized persons involved (if applicable);
in case of cross-border transfers to countries without adequate protection — information on risks associated with such transfer;
the period for which the consent is granted.

The Organization also provides information to the data subject about their rights related to personal data processing, the mechanism for exercising these rights, and the consequences of giving or refusing consent.

Chapter 6

RIGHTS OF PERSONAL DATA SUBJECTS

24. The personal data subject has the right to:

24.1. withdraw their consent if the Organization requested consent to process personal data. This right does not apply when processing is based on other legal grounds (e.g., legislation or a contract).
The Organization shall cease processing, delete the data, and notify the subject within 15 calendar days of receiving the request, unless legal grounds allow continued processing;
24.2. receive information regarding the processing of their personal data by the Organization, including:

• location of the Organization;
• confirmation of processing of their personal data;
• which personal data are processed and their source;
• legal grounds and purposes of processing;
• period of consent (if applicable);
• name and location of the authorized person(s);
• other information as required by law.

The Organization shall respond within 5 working days or inform of refusal with justification;
24.3. request updates to personal data if incomplete, outdated, or inaccurate, supported by relevant documents or certified copies;
The Organization shall make the changes within 15 calendar days;
24.4. once per calendar year, free of charge, receive information about the transfer of their personal data to third parties, unless otherwise provided by law;
The Organization shall provide such information within 15 calendar days or explain the reason for refusal;
24.5. request free termination of processing and deletion of their data if no legal grounds for processing exist;
The Organization shall comply within 15 calendar days, unless otherwise permitted by law;
24.6. appeal actions (or inaction) and decisions of the Organization that violate their rights in accordance with the law;
The subject may file a complaint with the National Center for Personal Data Protection. Complaints are reviewed in accordance with legislation on citizens’ appeals.

25. To exercise their rights, the data subject shall submit a request to the Organization by one of the following methods:

• in writing (by hand, mail, or in person) to: Republic of Belarus, Minsk, Surazhskaya St. 10, office 21;
• as an electronic document signed with a digital signature to: info@att.by;
• for withdrawal of consent — in the same form as consent was given.

26. The request must include:

last name, first name, patronymic (if applicable), place of residence (or stay);
date of birth;
substance of the request;
identification number, or — if unavailable — ID document number, if such data were previously provided or the processing occurs without consent;
personal signature (for written requests) or digital signature (for electronic documents).

The Organization does not consider requests submitted by means not specified in clause 27 of this Policy.

27. The response is provided in the same format as the request, unless otherwise indicated in the request.

28. The data subject may contact the responsible person within the Organization for assistance in exercising their rights via email: info@att.by.

Appendix 1
to the Regulation on the Personal Data Processing Policy