Regulation on the Personal Data Processing Policy

This Personal Data Processing Policy (hereinafter — the Policy) determines the procedure for personal data processing and the measures to ensure their security applied by the limited liability company "Sivur" (Sivur LLC) (hereinafter — the Operator). Publishing the Policy is one of the measures to ensure personal data protection provided for in the third paragraph of Clause 3 of Article 17 of the Law of the Republic of Belarus of 7 May 2021 No. 99-Z "On Personal Data Protection" (hereinafter — the Law).

1. General provisions

Operator: limited liability company "Sivur", UNP 193667988.
Location (legal address): 220004, Minsk, 25 Kalvariyskaya Street, office 200.
Postal address for correspondence: 220079, Republic of Belarus, Minsk, P.O. Box 147.
Contact e-mail: ritiko.by@yandex.by; website address: ritiko.by

The Policy applies to the processing of personal data of clients (potential clients), visitors of the Ritiko.by website (hereinafter — the Website) and of the salon, representatives of counterparties and other persons listed in Annex 1 to the Policy, including when orders are placed, an account is created, a fitting is booked, enquiries are sent and cookies are used.

The procedure for processing cookies is additionally determined by the Cookie Policy published on the Website. The Policy does not apply to the processing of personal data of employees (former employees, job candidates) of the Operator, or to video surveillance — such processing is regulated by the Operator's separate local legal acts.

Key terms (personal data, personal data processing, personal data subject, operator, authorised person, depersonalisation, provision, dissemination, cross-border transfer) are used as defined by Article 1 of the Law.

In fulfillment of Clause 4 of Article 17 of the Law the Operator ensures unlimited access to the Policy by publishing it on the Website. The Policy takes effect from the date it is approved.

2. Categories of subjects and list of processed personal data

The Operator processes personal data of the following categories of subjects:

Website visitors (including users who have not placed an order);
buyers and renters of goods, customers of tailoring and alteration services;
users who have created an account (account area);
persons who have booked a fitting or asked for advice (by phone, through Website forms, in Viber and WhatsApp messengers, in the Instagram social network);
persons who have sent enquiries (including entries made in the book of comments and suggestions) and applications concerning personal data processing;
individual entrepreneurs and representatives of legal entities that are counterparties of the Operator.

The following personal data is processed:

surname, first name and middle name (where any) (provided when placing an order and in the account area);
phone number;
e-mail address;
delivery address (when delivery is selected);
order details (contents, amount, date), payment details (amount, date, payment method, order number);
body measurements (fitting measurements) and requests regarding the garment — when tailoring and alteration services are provided;
details of an identity document — when a rental (hire) contract is concluded, if its terms so provide;
date and time of the fitting booking, contents of enquiries and correspondence;
login and password for the account area (the password is stored in encrypted (hashed) form);
technical data automatically transmitted by the browser: IP address, device and browser information, cookies (see the Cookie Policy).

The Operator does not process special personal data and does not knowingly collect data of minors.

The specific list of personal data processed for each purpose is set out in Annex 1 to the Policy.

3. Purposes of personal data processing

placing, confirming and fulfilling orders (sale, rental, tailoring, alterations);
booking a fitting and conducting it in the salon;
communication with the buyer regarding the order, consultation, status updates;
delivery of orders and ensuring payments are made;
providing access to the account area and displaying order history;
handling enquiries and requests, including applications by personal data subjects and requests by state bodies;
concluding and performing contracts with counterparties;
maintaining accounting and tax records;
improving the Website and analysing traffic (analytical data — only with consent).

The Operator processes only the personal data required to achieve the stated purposes and does not allow it to be processed excessively. Processing of personal data incompatible with the purposes originally stated is not allowed.

4. Legal basis for personal data processing

Personal data is processed on the following legal bases:

consent of the personal data subject (analytical cookies; advertising cookies — if they are used);
processing of personal data when a contract is concluded and performed and the personal data subject is a party to it (sale, rental, tailoring, alterations, booking a fitting, use of the account area on the terms of the User Agreement) — the fifteenth paragraph of Article 6 of the Law;
performance of duties (powers) provided for by legislative acts (accounting and tax records, answers to enquiries of citizens and legal entities, handling of applications by personal data subjects, execution of requests by state bodies) — the twentieth paragraph of Article 6 of the Law.

Consent is given by an active action (selecting cookie categories in the banner). Consent may be withdrawn at any time — see section 7.

Before consent is given the Operator provides the personal data subject with the information required by Clause 5 of Article 5 of the Law and explains their rights, the mechanism for exercising them, and the consequences of giving consent or refusing to give it (the documents “Terms of Personal Data Processing” and “Rights of the Personal Data Subject” , published on the Website, as well as sections 4 and 7 of this Policy).

Withdrawal of consent does not entail the deletion of personal data processed on other grounds provided for by the Law and other legislative acts, and does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Personal data storage periods

Personal data is stored no longer than the purposes of its processing require:

account data — until the account is deleted by the personal data subject or by the Operator in the cases provided for by the User Agreement;
order data — 3 years after a tax authority has carried out an audit of compliance with tax legislation, and if no audit has been carried out — 10 years after the end of the term (performance) of the contract;
enquiry data — 5 years from the date of the last enquiry (for enquiries entered in the book of comments and suggestions — 5 years after the book is closed); applications by personal data subjects — 1 year;
fitting booking data and correspondence on consultations that did not result in a contract — 1 year from the date of the last enquiry;
cookies — according to the periods specified in the Cookie Policy.

Once the processing purposes are achieved, the storage periods expire or consent is withdrawn, personal data is deleted or depersonalised unless otherwise provided by legislative acts. Documents containing personal data are destroyed in the procedure established by legislation on archival affairs and record keeping. The storage periods for each processing purpose are set out in Annex 1 to the Policy.

6. Transfer of personal data to third parties

The Operator does not sell or transfer personal data to third parties for purposes unrelated to order fulfilment. Personal data may be provided to third parties, and its processing may be entrusted to authorised persons, in the following cases:

analytics services (Google Analytics, Yandex.Metrica) — cookie identifiers and Website visit details, only with consent to analytical cookies;
courier services and postal operators (delivery services) — to the extent necessary to deliver the order;
banks and payment services (including when payment is made through the Settlement (ERIP) system and with bank payment cards) — to the extent necessary to make the payment;
authorised persons who process personal data on the Operator's instruction (the Website's hosting provider, an e-mail service) — the list is set out in Annex 2 to the Policy;
state bodies — upon their requests in the cases provided for by legislative acts.

An authorised person processes personal data under a contract with the Operator that sets out the purposes of processing, the list of operations with personal data, the obligations to maintain confidentiality and the measures to ensure personal data protection in accordance with Article 17 of the Law (Article 7 of the Law). The Operator is liable to the personal data subject for the acts of the authorised person.

When the personal data subject contacts the Operator through Viber, WhatsApp messengers or the Instagram social network, their personal data is additionally processed by the owners of those services in accordance with their privacy policies. The personal data subject chooses this channel of communication themselves and may use a phone or e-mail instead.

Cross-border transfer of personal data is carried out:

to the Russian Federation (Yandex LLC: Yandex.Metrica and Yandex 360 services) — to a state that ensures an adequate level of protection of personal data subjects' rights;
to the United States of America (Google LLC: Google Analytics service) — to a state that does not ensure an adequate level of protection of personal data subjects' rights — only on the basis of the personal data subject's consent to analytical cookies, given subject to being informed of the risks;
to postal services that serve the e-mail address given by the personal data subject (Gmail, Outlook, etc.) — when messages are sent to them in the performance of the contract (the third paragraph of Clause 1 of Article 9 of the Law).

Because personal data is transferred to states that do not ensure an adequate level of protection of personal data subjects' rights, the Operator informs about the existence of the following risks:

the absence of special legislation governing the processing of personal data, including requirements to comply with such norms;
the absence of an independent authorised state body for the protection of personal data subjects' rights;
a limited set of rights for personal data subjects;
the use of improper methods of obtaining personal data and unlawful processing of personal data, as a result of which personal data may become available to an unlimited circle of persons.

7. Rights of personal data subjects

The personal data subject has the right to:

obtain information concerning the processing of their personal data (the Operator's location, confirmation that their personal data is processed, the personal data itself and the source of its acquisition, the legal bases and purposes of processing, the period for which consent is given, the names and locations of authorised persons, and other information provided for by legislation);
obtain information about the provision of their personal data to third parties — once a calendar year, free of charge;
require that their personal data be amended where it is incomplete, outdated or inaccurate, enclosing supporting documents (copies thereof), and amend it themselves in the account area;
require that processing of their personal data be discontinued free of charge, including by deletion, where there are no grounds for processing provided for by the Law and other legislative acts;
withdraw consent to personal data processing at any time without giving reasons (if processing is carried out on the basis of consent);
appeal the Operator's acts (omissions) and decisions that violate their rights in the processing of personal data to the authorised body for the protection of personal data subjects' rights (the National Centre for Protection of Personal Data of the Republic of Belarus) in the procedure established by legislation on appeals of citizens and legal entities; a decision of the authorised body may be appealed in court.

To exercise their rights the personal data subject submits an application to the Operator in writing (in person or by post to 220079, Minsk, P.O. Box 147) or as an electronic document signed with an electronic digital signature, sent to ritiko.by@yandex.by. Consent may also be withdrawn in the same form in which it was given.

The application must contain:

surname, first name, middle name (where any), address of residence (place of stay);
date of birth;
identification number (or, if there is none, the number of the document certifying identity), if this information was given when consent was given or processing is carried out without consent;
a statement of the substance of the requirements;
a personal signature or an electronic digital signature.

An application for the provision of information concerning the processing of personal data is considered within 5 working days; other applications are considered within 15 days after they are received. The procedure for exercising rights and the consequences of giving consent or refusing to give it are explained in the document “Rights of the Personal Data Subject” , published on the Website, as well as in sections 4 and 7 of this Policy.

8. Obligations of the Operator

The Operator must:

explain to the personal data subject the rights related to the processing of their personal data;
obtain the consent of the personal data subject, except in the cases provided for by the Law and other legislative acts;
ensure the protection of personal data during its processing;
provide the personal data subject with information about their personal data and about the provision of their personal data to third parties, make amendments, discontinue processing and delete personal data in the cases and in the procedure provided for by the Law;
take measures to ensure that the personal data processed is accurate;
notify the authorised body for the protection of personal data subjects' rights of breaches of personal data protection systems immediately, but not later than three working days after the Operator becomes aware of such breaches;
comply with the requirements of the authorised body for the protection of personal data subjects' rights to eliminate breaches of personal data legislation;
perform other duties provided for by the Law and other legislative acts.

9. Measures to ensure personal data security

The Operator takes legal, organisational and technical measures to ensure personal data security, including: appointing a structural unit or a person responsible for internal control over the processing of personal data, issuing documents that determine the Operator's policy on personal data processing, familiarising employees with the provisions of personal data legislation and with the Operator's local legal acts, establishing the procedure for access to personal data and restricting access, applying encryption during data transmission (HTTPS), backup, accounting of storage media and control over access to them, and technical and cryptographic protection of personal data in accordance with the classification of information resources (systems).

10. Final provisions

The Operator may amend this Policy. The current version is published on this page indicating the date of the last change, and takes effect from the moment it is published unless the new version provides otherwise. Compliance with the Policy is supervised by the person responsible for internal control over the processing of personal data.

Matters concerning the processing of personal data that are not regulated by the Policy are governed by the legislation of the Republic of Belarus.

All matters concerning the processing of personal data may be raised by contacting ritiko.by@yandex.by.

Annex 1 to the Policy — list of personal data processed by Sivur LLC

Purpose of processing	Categories of data subjects	List of personal data	Legal basis	Retention period
Concluding and performing retail sale contracts (including distance selling), rental (hire) of products, tailoring and alterations contracts	Buyers, renters, customers — natural persons	Surname, first name, middle name (where any), phone number, e-mail, delivery address, order details, measurements and requests regarding the garment, payment details; for rentals — details of an identity document (if provided for by the contract)	Contract (the fifteenth paragraph of Article 6 of the Law)	3 years after a tax audit has been carried out, and if no audit has been carried out — 10 years after the end of the term of the contract
Registration and use of the account area on the Website	Website users	Surname, first name, phone number, e-mail, login, password (in hashed form), order history	User Agreement (the fifteenth paragraph of Article 6 of the Law)	Until the account area is deleted; order details — for the periods stated above
Booking a fitting, consultation by phone, through Website forms, in messengers and social networks	Persons who have contacted the Operator	Name, phone number, e-mail or messenger account details, date and time of the fitting, contents of the correspondence	Contract to be concluded (the fifteenth paragraph of Article 6 of the Law)	1 year from the date of the last enquiry
Delivery of orders	Buyers, recipients of orders	Surname, first name, phone number, delivery address, order number	Contract (the fifteenth paragraph of Article 6 of the Law)	For the period during which order data is stored
Ensuring payments are made (the Settlement (ERIP) system, bank payment cards)	Buyers, customers	Surname, first name, middle name, payment amount and identifier, order number, phone number, e-mail	Contract (the fifteenth paragraph of Article 6 of the Law)	5 years from the payment is made
Handling enquiries of citizens and legal entities, including those entered in the book of comments and suggestions	Persons who have sent an enquiry; other persons whose data is mentioned in the enquiry	Surname, first name, middle name (where any) or initials, address of residence (place of stay), substance of the enquiry, other data stated in the enquiry	The twentieth paragraph of Article 6 of the Law, the Law of the Republic of Belarus "On Appeals of Citizens and Legal Entities"	5 years from the date of the last enquiry; for the book of comments and suggestions — 5 years after the book is closed
Handling applications by personal data subjects	Applicants	Surname, first name, middle name (where any), address of residence (place of stay), date of birth, identification number, other data stated in the application	The twentieth paragraph of Article 6 of the Law	1 year
Concluding and performing contracts with counterparties	Individual entrepreneurs; representatives of legal entities	Surname, first name, middle name (where any), position, contact phone number, e-mail; for individual entrepreneurs — also UNP, address, bank details	For individual entrepreneurs — a contract (the fifteenth paragraph of Article 6 of the Law); for representatives of legal entities — the twentieth paragraph of Article 6 of the Law, Article 49 and Clause 5 of Article 186 of the Civil Code of the Republic of Belarus	3 years after a tax audit has been carried out, and if no audit has been carried out — 10 years after the end of the term of the contract
Ensuring that the Website functions (necessary cookies)	Website visitors	Session identifier, form and shopping cart protection tokens, information about the choice of cookie settings	User Agreement (the fifteenth paragraph of Article 6 of the Law)	In accordance with the Cookie Policy
Analysing Website traffic (analytical cookies)	Website visitors	Cookie identifiers, IP address, device and browser information, pages visited, date and time of the visit	Consent of the personal data subject	Until consent is withdrawn, but no longer than the periods stated in the Cookie Policy
Execution of requests by state bodies	Persons to whom the request relates	Determined by the contents of the request	The twentieth paragraph of Article 6 of the Law, other legislative acts	In accordance with the storage periods for the corresponding correspondence

Annex 2 to the Policy — list of authorised persons processing personal data on the instruction of Sivur LLC

Name, UNP (INN)	Location	Purposes of processing	List of personal data
LLC "Aktivnye Tekhnologii", UNP 690277669	220030, Minsk, 50 Lenina Street, office 301	Storage of website data, ensuring its operation	All data entered on the website and stored in its database
LLC YANDEX (Yandex 360 service), INN 7736207543	Russian Federation, 119021, Moscow, 16 Lev Tolstoy Street	E-mail services (ritiko.by@yandex.by)	E-mail address, contents of messages and other data stated in the correspondence
JSC "Tekhnobank", UNP 100706562	220002, Minsk, 44 Kropotkina Street	Ensuring the technical possibility of making payments	First name, surname, amount and identifier of the payment, order number, e-mail, phone number