Regulations on the Processing and Protection of Personal Data in Personal Data Databases Owned by the Seller
Table of Contents
- General Provisions and Scope
- List of Personal Data Databases
- Purpose of Personal Data Processing
- Procedure for Personal Data Processing: Obtaining Consent, Notification of Data Subject Rights, and Processing of Personal Data
- Location of Personal Data Databases
- Conditions for Disclosure of Personal Data to Third Parties
- Protection of Personal Data: Security Measures, Responsible Person, Employees Authorized to Process Personal Data, and Data Retention Period
- Rights of the Personal Data Subject
- Procedure for Handling Requests from Personal Data Subjects
- State Registration of Personal Data Databases
1. General Provisions and Scope
1.1 Definitions
For the purposes of these Regulations, the following terms shall have the meanings set forth below:
Personal Data Database means a named collection of structured personal data maintained in electronic form and/or in the form of paper filing systems.
Responsible Person means an individual designated to organize and supervise activities related to the protection of personal data during its processing in accordance with applicable law.
Website means the publicly accessible website located at https://rollupcasters.com, owned or lawfully operated by PROMPROFIT GROUP LLC, through which goods are offered for sale.
Personal Data Controller means an individual or legal entity that, by law or with the consent of the data subject, is authorized to process personal data, determines the purpose of processing, establishes the composition of such data, and defines the procedures for its processing, unless otherwise provided by law.
State Register of Personal Data Databases means the unified state information system for the collection, storage, and processing of information regarding registered personal data databases.
Publicly Available Sources of Personal Data means directories, address books, registers, lists, catalogues, and other structured collections of publicly available information containing personal data published with the knowledge of the data subject. Social networks and Internet resources where individuals independently publish their personal data shall not be regarded as publicly available sources unless the individual has expressly indicated that such data is intended for unrestricted dissemination and use.
Consent of the Personal Data Subject means any documented, voluntary expression of the individual's will granting permission for the processing of his or her personal data for a specified purpose.
Depersonalization (Anonymization) means the removal of information that makes it possible to identify an individual.
Processing of Personal Data means any operation or set of operations performed wholly or partly within an information (automated) system and/or paper filing systems relating to the collection, registration, accumulation, storage, adaptation, modification, updating, use, dissemination (distribution, sale, transfer), anonymization, or destruction of information relating to an identified or identifiable natural person.
Personal Data means any information or set of information relating to an identified or identifiable natural person.
Personal Data Processor means an individual or legal entity authorized by the Personal Data Controller or by law to process personal data on behalf of the Controller. A person engaged solely to perform technical maintenance of a personal data database without access to its contents shall not be deemed a Personal Data Processor.
Personal Data Subject means a natural person whose personal data is processed in accordance with applicable law.
Third Party means any person other than the Personal Data Subject, the Personal Data Controller, the Personal Data Processor, or the authorized governmental authority responsible for personal data protection, to whom personal data is disclosed in accordance with applicable law.
Special Categories of Personal Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in political parties or trade unions, as well as data concerning health or an individual's sex life.
1.2
These Regulations shall be mandatory for the Responsible Person and all employees of the Seller who directly process personal data and/or have access to personal data in connection with the performance of their official duties.
2. List of Personal Data Databases
2.1
The Seller is the owner of the following Personal Data Database:
- Personal Data Database of counterparties (customers, suppliers, and business partners).
3. Purpose of Personal Data Processing
3.1
Personal data is processed for the purpose of establishing, performing, and administering civil-law relationships, providing and receiving goods and services, processing payments for purchased goods and services, and complying with the requirements of the Tax Code of Ukraine, the Law of Ukraine "On Accounting and Financial Reporting in Ukraine", and other applicable legislation.
4. Procedure for Personal Data Processing: Obtaining Consent, Notification of the Rights of the Personal Data Subject, and Processing of Personal Data
4.1
The consent of the Personal Data Subject shall constitute a voluntary expression of the individual's intention to authorize the processing of his or her personal data for a specific and clearly defined purpose.
4.2
The consent of the Personal Data Subject may be provided in one of the following forms:
- a paper document containing sufficient details to identify both the document and the individual;
- an electronic document containing mandatory identification details sufficient to identify both the document and the individual. The voluntary expression of consent to the processing of personal data may be confirmed by the electronic signature of the Personal Data Subject;
- a confirmation mark placed on an electronic page or within an electronic document processed by an information system using documented software and technical solutions.
4.3
The consent of the Personal Data Subject shall be obtained when entering into civil-law relations in accordance with the applicable legislation of Ukraine.
4.4
The Personal Data Subject shall be informed, at the time of entering into civil-law relations, about:
- the inclusion of his or her personal data in the relevant Personal Data Database;
- the rights granted under the Law of Ukraine "On Personal Data Protection";
- the purpose of collecting personal data; and
- the persons to whom such personal data may be disclosed,
in accordance with applicable legislation.
4.5
The processing of Special Categories of Personal Data, including information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in political parties or trade unions, as well as data relating to health or an individual's sex life, is prohibited unless otherwise permitted by applicable law.
5. Location of the Personal Data Databases
5.1
The Personal Data Databases specified in Section 2 of these Regulations are maintained at the registered address of the Seller.
6. Conditions for Disclosure of Personal Data to Third Parties
6.1
Access to Personal Data by third parties shall be granted only in accordance with:
- the consent provided by the Personal Data Subject; or
- the requirements established by applicable law.
6.2
Access to Personal Data shall not be granted to any third party that refuses or is unable to comply with the requirements of the Law of Ukraine "On Personal Data Protection" concerning the protection and processing of Personal Data.
6.3
Any participant in legal relations involving Personal Data may submit a request (the "Request") to the Personal Data Controller for access to Personal Data.
6.4
The Request shall include:
- the full name, residential (or temporary) address, and identification details of the applicant (for an individual);
- the legal name, registered address, position, and full name of the authorized representative submitting the Request on behalf of a legal entity, together with confirmation of the representative's authority;
- the full name and any additional information necessary to identify the Personal Data Subject concerned;
- information identifying the relevant Personal Data Database or the Personal Data Controller or Processor responsible for it;
- the specific Personal Data requested; and
- the purpose of, and legal grounds for, the Request.
6.5
The Controller shall review the Request within ten (10) business days from the date of receipt.
Within this period, the Controller shall notify the applicant whether:
- the Request will be fulfilled; or
- access to the requested Personal Data is denied, indicating the legal grounds for such denial.
Unless otherwise provided by law, the Request shall be fulfilled within thirty (30) calendar days from the date of receipt.
6.6
Where the requested Personal Data cannot reasonably be provided within thirty (30) calendar days, the Controller may postpone granting access.
In such case, the total period for resolving the Request shall not exceed forty-five (45) calendar days.
6.7
The applicant shall receive written notice of any postponement together with an explanation of the procedure for appealing such decision.
6.8
The notice of postponement shall include:
- the full name of the responsible official;
- the date of the notice;
- the reason for the postponement; and
- the expected date on which the Request will be fulfilled.
6.9
Access to Personal Data may be denied where disclosure is prohibited by applicable law.
6.10
The notice of refusal shall specify:
- the full name of the authorized official issuing the refusal;
- the date of the notice; and
- the reasons for refusing access.
6.11
Any decision to postpone or refuse access to Personal Data may be appealed before a court in accordance with applicable law.
7. Protection of Personal Data
Security Measures, Responsible Person, Employees Authorized to Process Personal Data, and Data Retention Period
7.1
The Personal Data Controller shall implement appropriate organizational, technical, and software security measures, including communication protection systems, designed to prevent the loss, theft, unauthorized destruction, alteration, forgery, copying, or disclosure of Personal Data. Such measures shall comply with the applicable national legislation of Ukraine and recognized international standards for information security.
7.2
The Responsible Person shall organize and supervise all activities related to the protection of Personal Data during its processing in accordance with applicable law.
The Responsible Person shall be appointed by an official order of the Personal Data Controller.
The duties and responsibilities of the Responsible Person relating to the organization of Personal Data protection shall be specified in his or her job description.
7.3
The Responsible Person shall be responsible for:
- ensuring compliance with the legislation of Ukraine governing Personal Data protection;
- developing procedures regulating employee access to Personal Data in accordance with their professional duties;
- ensuring that employees comply with applicable Personal Data Protection legislation and the Controller's internal policies governing the processing and protection of Personal Data;
- establishing internal monitoring and audit procedures to verify compliance with Personal Data protection requirements, including determining the frequency of such audits;
- notifying the Personal Data Controller of any identified violation of Personal Data Protection legislation or internal policies by employees no later than one (1) business day after becoming aware of such violation;
- ensuring the proper retention of documents confirming the Personal Data Subject's consent to the processing of Personal Data and the notification of the Data Subject regarding his or her statutory rights.
7.4
For the purpose of performing his or her duties, the Responsible Person shall have the right to:
- obtain any documents, including internal orders, instructions, and other administrative documents relating to the processing of Personal Data;
- make copies of such documents, including electronic files and records stored in local computer networks and standalone computer systems;
- participate in discussions concerning the organization and implementation of Personal Data protection measures;
- submit proposals for improving Personal Data processing procedures and eliminating identified deficiencies;
- request explanations regarding the processing of Personal Data;
- sign and endorse documents within the scope of his or her authority.
7.5
Employees who process Personal Data and/or have access to Personal Data in connection with the performance of their employment duties shall comply with the legislation of Ukraine governing Personal Data protection and with all internal policies regulating the processing and protection of Personal Data.
7.6
Employees authorized to access or process Personal Data shall maintain the confidentiality of all Personal Data entrusted to them or obtained in connection with the performance of their professional duties.
This confidentiality obligation shall remain in force after termination of employment or other professional relationship, except where disclosure is required by law.
7.7
Persons who process or otherwise have access to Personal Data shall be liable for violations of the Law of Ukraine "On Personal Data Protection" and other applicable legislation in accordance with the laws of Ukraine.
7.8
Personal Data shall not be retained for longer than is necessary to achieve the purposes for which it was collected and processed.
In any event, Personal Data shall not be retained beyond the retention period established by applicable law or by the consent provided by the Personal Data Subject, whichever is applicable.
8. Rights of the Personal Data Subject
8.1
The Personal Data Subject shall have the right to:
- be informed of the location, purpose, and designation of the Personal Data Database containing his or her Personal Data, as well as the name and registered address (or place of residence) of the Personal Data Controller or Processor, or to authorize another person to obtain such information on his or her behalf, except where otherwise provided by law;
- obtain information regarding the conditions under which access to his or her Personal Data is granted, including information concerning third parties to whom such Personal Data has been disclosed;
- access his or her Personal Data contained in the relevant Personal Data Database;
- receive, within thirty (30) calendar days from the date of submission of a request, unless otherwise provided by law, confirmation as to whether his or her Personal Data is being processed, together with access to the content of such Personal Data;
- submit a reasoned objection to the processing of his or her Personal Data by public authorities or local self-government authorities acting within the scope of their statutory powers;
- submit a reasoned request requiring the correction, updating, blocking, or deletion of his or her Personal Data where such data is processed unlawfully or is inaccurate;
- protect his or her Personal Data against unlawful processing, accidental loss, destruction, damage, intentional concealment, failure to provide access, delayed provision, or the dissemination of inaccurate information that may affect the honor, dignity, or business reputation of the individual;
- file complaints concerning violations of Personal Data protection legislation with competent public authorities or local self-government bodies authorized to ensure Personal Data protection;
- seek judicial or other legal remedies in the event of violations of Personal Data protection legislation.
9. Procedure for Handling Requests from Personal Data Subjects
9.1
The Personal Data Subject shall have the right to obtain information relating to his or her Personal Data from any participant involved in the processing of such Personal Data without being required to specify the purpose of the request, except where otherwise provided by law.
9.2
Access by the Personal Data Subject to his or her own Personal Data shall be provided free of charge.
9.3
A Personal Data Subject shall submit a request (the "Request") for access to Personal Data to the Personal Data Controller.
The Request shall include:
- the full name, residential (or temporary) address, and identification details of the Personal Data Subject;
- any additional information necessary to identify the Personal Data Subject;
- information identifying the relevant Personal Data Database or the Personal Data Controller or Processor responsible for maintaining such database;
- a description of the Personal Data requested.
9.4
The Controller shall review the Request within ten (10) business days from the date of its receipt.
Within this period, the Controller shall notify the Personal Data Subject whether:
- the Request will be satisfied; or
- the requested Personal Data cannot be disclosed, together with the legal grounds for such refusal.
9.5
Unless otherwise provided by applicable law, the Request shall be fulfilled within thirty (30) calendar days from the date of its receipt.
10. State Registration of Personal Data Databases
10.1
The state registration of Personal Data Databases shall be carried out in accordance with Article 9 of the Law of Ukraine "On Personal Data Protection" and other applicable legislation governing the registration of Personal Data Databases.