Title

Main
Privacy Policy

REGULATION
on the Procedure for Processing and Protecting Personal Data at the Republican Scientific and Production Unitary Enterprise “Research and Development Center “LEMT”

CHAPTER 1
GENERAL PROVISIONS

1. This Regulation defines the policy of the Republican Scientific and Production Unitary Enterprise “Research and Development Center “LEMT” (hereinafter referred to as the “Enterprise”) regarding the processing of personal data, including the procedures for the collection, systematization, storage, modification, use, anonymization, blocking, dissemination, provision, deletion, transfer, and protection of personal data.

2. The Regulation has been developed on the basis of and in pursuance of:

the Constitution of the Republic of Belarus;
of the Labor Code of the Republic of Belarus;
Law of the Republic of Belarus No. 99-Z dated May 7, 2021, "On Personal Data Protection" (hereinafter – the Law on Personal Data Protection);
Law of the Republic of Belarus No. 418-Z of July 21, 2008, "On the Population Register";
Law of the Republic of Belarus No. 455-Z of November 10, 2008, "On Information, Informatization, and Information Protection";
Decree of the President of the Republic of Belarus No. 422 dated October 28, 2021, “On Measures to Improve Personal Data Protection”;
other regulatory legal acts.

3. The Regulation uses terms and definitions in accordance with Article 1 of the Law on the Protection of Personal Data.

4. The processing of personal data of data subjects is carried out in accordance with the requirements set forth in Article 4 of the Law on the Protection of Personal Data, as well as in accordance with the local legal acts of the Company.

5. The Company processes the personal data of the following categories of personal data subjects:

job candidates;
employees of the Company;
retired persons and those registered as non-working pensioners of the Company;
other personal data subjects whose interaction with the Company necessitates the processing of personal data.

6. The content and volume of personal data of each category of personal data subjects is determined by the need to:

achieve specific processing goals;
implement the Company's rights and obligations;
implement the rights and obligations of personal data subjects.

7. The processing of personal data of personal data subjects is carried out for the following purposes:

performing the functions, tasks, powers, and duties imposed on the Enterprise by law;
performing the duties of a tax agent;
ensuring security, preserving the property of the Enterprise, and preventing offenses;
screening candidates upon hiring;
considering the employment possibilities of candidates upon hiring;
considering the personnel matters of the Enterprise when selecting management personnel, appointing (approving the appointment) to certain positions of the Enterprise, and dismissing (approving the dismissal) from the said positions, as well as extending (concluding a new) employment contract (agreeing the extension (concluding a new) employment contract (agreeing the extension);
maintaining a personnel reserve;
implementing incentives and rewards for the employees of the Enterprise;
organization and support of business trips, reception of delegations;
holding events and ensuring the participation of personal data subjects;
issuing powers of attorney and other authorizing documents;
checking counterparties;
identifying conflicts of interest;
negotiating, concluding and executing contracts;
considering appeals from citizens and legal entities, as well as individual entrepreneurs;
reviewing claims;
implementing additional guarantees for the social protection of persons who have retired and are registered as non-working pensioners of the Enterprise, as stipulated by local legal acts of the Enterprise;
providing one-time financial assistance to family members or to the person who has undertaken to organize the funeral of a person who has retired and was registered as a non-working pensioner of the Enterprise, in the event of death.

Personal data may be processed for other purposes if necessary to ensure compliance with the law.

The list of personal data processed by the Company is attached as Appendix 1 to this Policy.

CHAPTER 2
PERSONAL DATA PROCESSING RULES

8. Personal data is processed using mixed processing (both with and without the use of automated tools).

Personal data is processed in information systems in accordance with the Company's local legal acts.

9. In cases established by law, the primary condition for processing personal data is obtaining the consent of the relevant personal data subject.

The consent of the personal data subject to the processing of their personal data must include the information specified in paragraph 6 of Article 5 of the Law on the Protection of Personal Data:

last name, first name, and patronymic (if any);
date of birth;
identification number, or if no such number is available, the number of the identity document;
signature of the personal data subject.

10. The consent of the personal data subject to the processing of their personal data, with the exception of special personal data, is not required in cases established by Article 6 of the Law on the Protection of Personal Data:

for the purposes of administrative proceedings;
for the execution of court decisions and other writs of execution;
for the purposes of exercising control (supervision) in accordance with legislative acts;
in the implementation of legislative norms in the area of national security, the fight against corruption, the prevention of money laundering, the financing of terrorist activities, and the financing of the proliferation of weapons of mass destruction;
for maintaining individual (personalized) records of information on insured persons for the purposes of state social insurance, including professional pension insurance;
when formalizing labor (service) relations, as well as in the course of labor (service) activities of the subject of personal data in cases stipulated by law;
for the purposes of assigning and paying pensions and benefits;
for organizing and conducting state statistical observations, the formation of official statistical information;
in scientific or other research purposes, subject to mandatory anonymization of personal data;
when the Enterprise receives personal data on the basis of an agreement concluded (being concluded) with the personal data subject, for the purposes of performing the actions established by this agreement;
when processing personal data, when they are specified in a document addressed to the Enterprise and signed by the personal data subject, in accordance with the content of such document;
to protect the life, health, or other vital interests of the personal data subject or other persons, if it is impossible to obtain the consent of the personal data subject;
with respect to previously disseminated personal data until the personal data subject submits requests to cease processing of the disseminated personal data, as well as to delete them, in the absence of other grounds for processing personal data provided for by the Law on the Protection of Personal Data and other legislative acts;
in cases where the processing of personal data is necessary to fulfill the duties (powers) stipulated by legislative acts;
in cases where the Law on the Protection of Personal data and other legislative acts expressly provide for the processing of personal data without the consent of the personal data subject.

11. The processing of special personal data without the consent of the personal data subject is prohibited, except in cases established by Article 8 of the Law on the Protection of Personal Data:

if special personal data is made publicly available by the personal data subject;
when formalizing employment (service) relationships, as well as during the employment (service) activities of the personal data subject in cases stipulated by law;
for the execution of court decisions and other executive documents;
for the purposes of conducting administrative proceedings;
in cases stipulated by criminal-executive legislation, legislation in the field of national security, defense, the fight against corruption, the fight against terrorism and countering extremism, the prevention of money laundering, the financing of terrorist activities and the financing of the proliferation of weapons of mass destruction;
in order to ensure the functioning of the unified state system for registering and recording offenses;
for the organization and conduct of state statistical observations, the formation of official statistical information;
for the implementation of administrative procedures;
to protect the life, health, or other vital interests of the personal data subject or other persons, if obtaining the consent of the personal data subject is impossible;
in cases where the processing of special personal data is necessary to fulfill the duties (powers) stipulated by legislative acts;
in cases where the Law on the Protection of Personal Data and other legislative acts expressly provide for the processing of special personal data without the consent of the personal data subject.

12. The source of information regarding all personal data is the personal data subject directly.

Unless otherwise provided by the Law on Personal Data Protection, the Company has the right to receive the personal data of a personal data subject from third parties only upon notification of the personal data subject, or with the personal data subject's written consent to receive their personal data from third parties.

13. When storing personal data, conditions must be observed that ensure the safety of the personal data.

Documents containing personal data on paper must be stored in specially designated places with limited access under conditions that ensure their protection from unauthorized access.

Personal data stored in electronic form must be protected from unauthorized access using special technical and software protection tools. Storing personal data in electronic form outside of the information systems used by the Company (external storage of personal data) is not permitted.

Personal data must be stored in a form that allows for the identification of the personal data subject, but for no longer than required for the purposes of processing, unless otherwise specified by law.

14. Unless otherwise provided by law, processed personal data are subject to destruction or anonymization upon the achievement of the processing purposes, if the need for achieving these purposes is no longer necessary, or upon the expiration of the storage period.

The destruction or depersonalization of personal data must be performed in a manner that precludes further processing of this personal data. However, if necessary, the ability to process other data stored on the relevant tangible medium (deletion, redaction, or destruction) must be preserved.

If it is necessary to destroy or block some personal data, the tangible medium is destroyed or blocked, with a preliminary copy of the information not subject to destruction or blocking made in a manner that precludes the simultaneous copying of the personal data subject to destruction or blocking.

15. Access to personal data is granted only to those Company employees whose job responsibilities involve working with personal data. The list of employees directly involved in the processing of personal data is attached as Appendix 2 to this Regulation.

If it becomes necessary to grant access to personal data to employees not included in the list of persons with access to personal data, they may be granted temporary access to a limited range of personal data by order of the Director of the Enterprise or another person authorized by the Director of the Enterprise. Relevant employees must be familiarized with all local legal acts regarding the protection of personal data, and they must sign off on them.

16. Personal data, when processed without the use of automated tools, is updated by updating or amending the data on a tangible medium, and if this is not permitted by the technical features of the tangible medium, by recording information about the changes made to it on the same tangible medium or by producing a new tangible medium with the updated personal data.

17. The transfer of personal data of data subjects to third parties is permitted in the minimum necessary amounts and only for the purpose of performing tasks corresponding to the objective reason for collecting this data.

The transfer of personal data of data subjects to third parties, including for commercial purposes, is permitted only with the consent of the data subject or other legal basis.

When transferring personal data of a data subject to third parties, the data subject must be notified of such transfer, except in cases specified by law.

The transfer of information containing the personal data of data subjects must be carried out in a manner that ensures protection from unauthorized access, destruction, modification, blocking, copying, distribution, and other illegal actions in relation to such information.

18. Persons receiving personal data must be warned that this data may only be used for the purposes for which it was communicated and in compliance with the confidentiality regime. The Company has the right to require these individuals to confirm that this rule has been observed.

19. In cases where government agencies have the right to request personal data from data subjects, or personal data must be provided by law, or in accordance with a court request, the relevant information may be provided to them in the manner prescribed by law.

20. To protect the personal data of data subjects, the Company takes the following measures:

Limits and regulates the composition of employees whose functional duties require access to information containing the personal data of personal data subjects;
Ensures conditions for storing documents containing the personal data of personal data subjects in a restricted access location;
Organizes the procedure for the destruction of information containing the personal data of personal data subjects, unless the legislation establishes requirements for storing the relevant data;
Monitors compliance with the requirements for ensuring the security of the personal data of personal data subjects, including those established by this Regulation (by conducting internal audits, establishing special monitoring tools, etc.);
Investigates cases of unauthorized access or disclosure of the personal data of personal data subjects, holding the guilty employees accountable and taking other measures;
Implements software and hardware means of protecting electronic information;
Ensures the ability to restore the personal data of personal data subjects modified or destroyed due to unauthorized access to him;
other measures to ensure the protection of personal data.

21. To protect personal data when processed in the Company's information systems, the following measures may be taken:

identifying threats to the security of personal data during its processing;
implementing organizational and technical measures to ensure the security of personal data of data subjects during their processing in personal data information systems, necessary to meet the requirements for the protection of personal data of data subjects;
keeping records of machine-readable media containing personal data of data subjects;
detecting instances of unauthorized access to personal data of data subjects and taking appropriate measures;
restoring personal data of data subjects modified or destroyed due to unauthorized access;
establishing rules for access to personal data of data subjects processed in a personal data information system, as well as ensuring the registration and accounting of all actions performed with personal data in the personal data information system;
other activities permitted by the Law on the Protection of Personal Data.

CHAPTER 3
RIGHTS, RESPONSIBILITIES, AND LIABILITIES IN PROTECTING PERSONAL DATA

22. The personal data subject has the right:

22.1. to revoke their consent at any time without explanation by submitting an application to the Company in the manner prescribed by Article 14 of the Law on the Protection of Personal Data, or in the form in which their consent was obtained;

22.2. to receive information regarding the processing of their personal data, containing:

confirmation of the fact that the personal data is being processed by the Company;
the personal data of the personal data subject and the source thereof;
the legal basis and purposes for processing the personal data;
the period for which their consent is given;
other information stipulated by law;

22.3. Request amendments to their personal data if such data is incomplete, outdated, or inaccurate. For these purposes, the personal data subject shall submit an application to the Enterprise in accordance with the procedure established by Article 14 of the Law on the Protection of Personal Data, along with relevant documents and/or their duly certified copies confirming the need to amend the personal data;

22.4. Receive information regarding the provision of their personal data to third parties. To obtain this information, the personal data subject shall submit an application to the Enterprise. The personal data subject's application must contain:

the personal data subject's last name, first name, patronymic (if any), and residence (place of stay) address;
the personal data subject's date of birth;
the personal data subject's identification number, or, if such number is not available, the number of the personal data subject's identity document, if this information was provided by the personal data subject when giving consent to the Enterprise or if the personal data is being processed without the personal data subject's consent;
a statement of the personal data subject's requirements;
the personal signature or electronic digital signature of the personal data subject;

22.5. To demand that the Company cease processing their personal data, including deletion, if there are no grounds for processing the personal data stipulated by the Law on the Protection of Personal Data and other legislative acts. To exercise this right, the personal data subject shall submit an application to the Company in the manner prescribed by the Law on the Protection of Personal Data;

22.6. To appeal the actions (inactions) and decisions of the Company that violate their rights in the processing of personal data to the authorized body for the protection of the rights of personal data subjects in the manner prescribed by the legislation on appeals from individuals and legal entities.

23. The personal data subject is obligated to:

provide the Company with accurate personal data;
promptly notify the Company of any changes or additions to their personal data;
exercise their rights in accordance with legislation and local legal acts of the Company regarding the processing and protection of personal data;
fulfil other obligations stipulated by legislation and local legal acts of the Company regarding the processing and protection of personal data.

24. The Company has the right to:

establish rules for processing personal data at the Company, amend and supplement this Policy, and independently, within the framework of legal requirements, develop and apply document forms necessary for the performance of obligations regarding the processing and protection of personal data;
exercise other rights stipulated by legislation and local legal acts regarding the processing and protection of personal data.

25. The Company's Responsibilities:

explain to the personal data subject their rights related to the processing of their personal data;
obtain consent from the personal data subject, except in cases stipulated by the Law on the Protection of Personal Data and other legislative acts;
ensure the protection of personal data during its processing;
provide the personal data subject with information about their personal data, as well as about the provision of their personal data to third parties, except in cases stipulated by legislative acts;
make changes to personal data that are incomplete, outdated, or inaccurate, except in cases where a different procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not require subsequent changes to such data;
terminate the processing of personal data, as well as delete or block it (ensure the termination of the processing of personal data, as well as its deletion or blocking by an authorized person) in the absence of grounds for processing the personal data, provided for by legislative acts;
notify the authorized body for the protection of the rights of personal data subjects of violations of personal data protection systems immediately, but no later than three business days after the Company becomes aware of such violations, except in cases stipulated by the authorized body for the protection of the rights of personal data subjects;
modify, block, or delete inaccurate or illegally obtained personal data of a personal data subject at the request of the authorized body for the protection of the rights of personal data subjects, unless another procedure for amending, blocking, or deleting personal data is established by legislative acts;
comply with other requirements of the authorized body for the protection of the rights of personal data subjects to eliminate violations of personal data legislation;
fulfill other obligations stipulated by legislative acts.

26. Violation of personal data protection legislation is subject to civil, disciplinary, administrative, and criminal liability.

Appendix 1
to the Regulation on the Procedure for Processing and Protecting Personal Data at the Republican Scientific and Production Unitary Enterprise “Research and Development Center “LEMT”

LIST of personal data processed by the Enterprise:

1. Personal data of candidates for employment:

last name, first name, patronymic (if any), and all previous last names;
gender;
citizenship details;
date and place of birth;
passport details or details of another identity document (series, number, date of issue, name of the issuing authority, etc.);
birth certificate details (number, date of issue, name of the issuing authority, etc.);
information about marital status and family composition, indicating the last names, first names, and patronymics of family members, date of birth, place of work and/or study;
information about registration at the place of residence (including address, date of registration);
information about the place of actual Residence;
Number and series of the state social insurance certificate;
Information on education, advanced training and professional retraining, academic degree, academic title;
Information on work experience (including length of service and work experience, employment information indicating position, department, information about the employer, etc.);
Specialty, profession, qualification;
Information on military registration;
Medical information (in cases provided for by law);
Biometric personal data (including photographs);
Information on social benefits and payments;
Information on criminal record and administrative offenses (in cases provided for by law);
Contact information (including home and/or mobile phone numbers, email, etc.);
information on awards and incentives;
information provided by the candidate during personality questionnaires and psychometric testing, as well as the results of such testing (psychometric profile, abilities, and characteristics);
income and property declaration, if required by law;
other information that may be included in the candidate's resume or application form.

2. Personal data of the Company's employees:

last name, first name, patronymic (if any);
gender;
citizenship data;
date and place of birth;
biometric personal data (including photographs, images from CCTV cameras);
passport data or data from another identity document (series, number, date of issue, name of the issuing authority, etc.);
birth certificate data (number, date of issue, name of the issuing authority, etc.);
information about marital status and family composition, indicating the last names, first names, and patronymics of family members, date of birth, place of work and/or study;
information about registration at the place of residence (including address, date registration);
information about the place of actual residence;
number and series of the state social insurance certificate;
information about education, advanced training and professional retraining, academic degree, academic title;
medical information (medical certificate form 1 med/u-10, etc.);
information provided during the completion of questionnaires, personality questionnaires and passing the test methods of the psychological examination;
results of the psychological examination;
contact information (including home and/or mobile phone numbers, email, etc.);
information about work experience (including length of service and work experience, employment data indicating the position, department, information about the employer, etc.);
card account number for the transfer of wages;
information about military registration;
information on disability;
information on alimony deductions;
other personal data provided by employees in accordance with labor law requirements.

3. Personal data of retired individuals and those registered as non-working pensioners of the Enterprise, for the purpose of resolving issues of providing social guarantees stipulated by the local legal acts of the Enterprise:

last name, first name, patronymic (if any), and, if necessary, documents confirming the change of surname;
documents confirming the degree of kinship;
date of birth;
place of work and/or study;
information on registration at the place of residence (including address, date of registration);
passport details or details of another identity document (series, number, date of issue, name of the issuing authority, etc.);
contact details (including home and/or mobile phone numbers);
card account number (if necessary);
medical information (medical certificate form 1 med/u-10, etc.);
other personal data necessary for the fulfillment of mutual rights and obligations.

4. Personal data of counterparty representatives, citizens (individuals):

last name, first name, patronymic (if any);
passport details or details of other identification documents (series, number, date of issue, name of issuing authority, etc.);
residential registration information (including address, date of registration);
contact details (including home and/or mobile phone numbers);
taxpayer identification number;
other personal data necessary for the fulfillment of mutual rights and obligations.

Appendix 2
to the Regulation on the Procedure for Processing and Protecting Personal Data at the Republican Scientific and Production Unitary Enterprise “Research and Development Center “LEMT”

LIST of employees directly involved in the processing of personal data:

Yulia Sergeevna Khmelnitskaya, Head of HR.
Raisa Vladimirovna Narchuk, Leading HR Specialist.
Marina Aleksandrovna Shtytsko, Deputy Chief Accountant.
Olga Sergeevna Tishenkova, Leading Accountant.
Nadezhda Vladimirovna Nazarenko, 1st Category Accountant.
Yulia Igorevna Ustilko, Leading Protocol Specialist.
Sergey Konstantinovich Kilesso, Leading Legal Counsel.

REGULATION on the Procedure for Processing and Protecting Personal Data at the Republican Scientific and Production Unitary Enterprise “Research and Development Center “LEMT”

CHAPTER 1 GENERAL PROVISIONS

CHAPTER 2 PERSONAL DATA PROCESSING RULES

CHAPTER 3 RIGHTS, RESPONSIBILITIES, AND LIABILITIES IN PROTECTING PERSONAL DATA

Appendix 1 to the Regulation on the Procedure for Processing and Protecting Personal Data at the Republican Scientific and Production Unitary Enterprise “Research and Development Center “LEMT”

Appendix 2 to the Regulation on the Procedure for Processing and Protecting Personal Data at the Republican Scientific and Production Unitary Enterprise “Research and Development Center “LEMT”