Personal Data Processing Policy

This page is a translation of the Personal Data Processing Policy; the original text is available in the main version of the website.

1. General provisions

1.1. This Policy sets out the procedure and conditions for processing personal data on the website b2blistby.com (the “Website”) and the measures for protecting it. It has been developed in accordance with Law of the Republic of Belarus No. 99-Z of May 7, 2021 “On Personal Data Protection” (the “Law”) and is freely available on the Website before personal data processing begins.

1.2. The personal data operator is the owner of the Website b2blistby.com (the “Operator”). For all matters related to personal data, the Operator can be contacted by email at [email protected].

1.3. Terms are used in the meanings established by Article 1 of the Law. The terms “Account”, “Database”, “Export”, “Sample”, “Reveal” and “Order” have the meanings given in the Terms of Use.

2. Processing principles

2.1. The Operator processes personal data in accordance with the requirements of Article 4 of the Law: proportionately to the stated purposes, only for specific, lawful purposes stated in advance, to an extent not excessive in relation to these purposes, transparently for the personal data subject, taking measures to ensure its accuracy, and stores it for no longer than the stated purposes require.

3. Purposes, data, legal grounds and retention periods

3.1. The Operator processes personal data for the following purposes.

3.2. Registration and maintenance of the Account, logging in to the Website

• Subjects: registered users.
• Data: email address, name (if provided), password in the form of a cryptographic hash (the Operator does not store the password itself), date and time of registration, the fact and time of acceptance of the Terms of Use, IP address, date and time of logins.
• Legal ground: an agreement with the personal data subject — the Terms of Use (Article 6 of the Law: obtaining personal data on the basis of an agreement concluded with the subject in order to perform the actions established by that agreement).
• Retention period: until the Account is deleted; login log — 12 months; information on acceptance of the Terms — 3 years after the Account is deleted.

3.3. Revealing contacts in Samples and enforcing the limit

• Subjects: registered users.
• Data: Account identifier, the revealed organization, date and time of the Reveal, IP address.
• Legal ground: an agreement with the subject — the Terms of Use (Article 6 of the Law).
• Retention period: 12 months.

3.4. Placing and fulfilling Orders, settlements and accounting

• Subjects: buyers, representatives and contact persons of buyers that are organizations and sole proprietors.
• Data: name, email address, phone number (if provided), name of the organization or sole proprietor, invoice details, comment to the Order, payment method, contents and amount of the Order, payment information, IP address, the fact, date and time of consent to the terms of the Order. Bank card details are entered on the side of the bank or payment service; the Operator does not receive them.
• Legal grounds: an agreement with the subject (Article 6 of the Law); fulfilment of obligations established by legislative acts on accounting and taxation (Article 6 of the Law).
• Retention period: for the document retention periods established by accounting legislation; unpaid Orders — 1 year.

3.5. Feedback and requests for custom data

• Subjects: persons who have sent a message or a request.
• Data: name, email address, phone number (if provided), subject and text of the message, address of the page from which the form was sent, IP address.
• Legal ground: the consent of the personal data subject, given by ticking a checkbox in the form on the Website (Article 5 of the Law); if the request is aimed at concluding an agreement — also an agreement with the subject (Article 6 of the Law).
• Retention period: until the request has been answered and the correspondence completed, but no more than 3 years, or until consent is withdrawn.

3.6. Ensuring the operation and security of the Website

• Subjects: visitors of the Website.
• Data: IP address, information about the browser and device (user agent), date and time of the request, address of the requested page and of the referring page, cookie identifiers (Section 6).
• Legal ground: fulfilment of the Operator’s obligation to ensure the protection of personal data (Articles 16 and 17 of the Law) and the Terms of Use as regards protecting the Website against automated data collection and attacks.
• Retention period: server logs — no more than 12 months; in the event of an incident investigation — until it is completed.

3.7. The Operator does not process special personal data (Article 8 of the Law), does not make decisions producing legal consequences for the subject solely on the basis of automated processing, and does not send advertising messages without separate prior consent.

4. Information about organizations in the Database

4.1. The Database contains information about organizations: name, business address, coordinates, phones, websites, email addresses, links to social media pages, chain affiliation and categories. This is mainly information about legal entities and their separate subdivisions, which is not personal data.

4.2. Some records may relate to sole proprietors, artisans, independent professionals and other individuals engaged in business. If the information makes it possible to identify such a person, it is their personal data. The Operator includes in the Database only information related to the person’s business or professional activity (name, business address, work contacts) and does not collect information about their private life.

4.3. The source of the information is publicly available sources: organization listings in map services and directories, organizations’ websites and their social media pages.

4.4. The purpose is maintaining the reference Database and providing Samples and Exports to users of the Website for business purposes. The legal ground is the processing of previously disseminated personal data until the personal data subject demands that their processing be stopped and the data deleted (Article 6 of the Law).

4.5. Removal from the Database on request. If the Database contains your personal data and you do not want it to be processed, send an application to [email protected] (Section 9), specifying a phone number, email address or other information by which the record can be found (preferably with a link to the organization on the Website). Within fifteen days after receiving the application, the Operator stops processing this information — showing it on the Website and including it in Exports — deletes it from the Database and notifies you of this (Article 13 of the Law). So that the information is not collected from the sources again, the Operator keeps only a minimal identifier (for example, a phone number or email address) in the exclusion list.

4.6. Exports provided to buyers before the application was received remain with the buyers, who process the data as independent operators. At the subject’s request, the Operator informs them to whom and which of their personal data has been provided (Article 12 of the Law).

4.7. Representatives of organizations may also ask to correct or delete information about an organization — at the same address.

5. Actions with personal data

5.1. The Operator collects, systematizes, stores, modifies, uses, depersonalizes, blocks, provides and deletes personal data. Processing is carried out both with and without the use of automation tools.

5.2. When the processing purposes have been achieved, consent has been withdrawn or the agreement has been terminated (if there are no other grounds for processing), the Operator stops processing and deletes the personal data; if deletion is technically impossible, it takes measures to prevent their further processing, including blocking (Articles 10 and 13 of the Law).

6. Cookies and browser local storage

6.1. The Website uses only strictly necessary cookies: a session cookie — for logging in to the Account and for forms to work, and a cookie protecting forms against cross-site request forgery (CSRF). Without them, logging in, placing an Order and submitting forms are impossible. The Website does not use advertising cookies or third-party web analytics systems.

6.2. The contents of the cart are stored in the browser’s local storage (localStorage) on the user’s device and are sent to the server only when an Order is placed. They can be deleted by clearing the website data in the browser settings.

6.3. The user can block cookies in the browser settings; in this case, some features of the Website will be unavailable.

6.4. Additional cookies — for remembering settings, analytics and marketing — are set by the Website only with the consent of the user, which they give in the cookie window on their first visit. Consent can be changed or withdrawn at any time via the “Cookie settings” link at the bottom of every page.

7. Disclosure of personal data to third parties

7.1. The Operator does not sell the personal data of users and buyers and does not provide it to third parties, except where necessary for the purposes of Section 3:

• to the hosting and data center provider — for storing the Website’s data;
• to the bank and the payment service — for accepting payment;
• to the email delivery service — for delivering emails with invoices, links to files and replies to requests;
• to government authorities — in cases provided for by legislative acts.

7.2. If processing is entrusted to an authorized person, the Operator concludes an agreement with them that sets out the purposes and the list of actions with personal data and the authorized person’s obligations to protect it (Article 7 of the Law).

7.3. Cross-border transfer of personal data is carried out only in the cases permitted by Article 9 of the Law, including where the personal data has been obtained on the basis of an agreement concluded with the personal data subject in order to perform the actions established by that agreement.

8. Rights of personal data subjects

8.1. The personal data subject has the right to:

• withdraw their consent to the processing of personal data at any time without giving reasons (Article 10 of the Law);
• receive information concerning the processing of their personal data and demand that changes be made to their personal data if it is incomplete, outdated or inaccurate (Article 11 of the Law);
• once a calendar year, receive free of charge information about the provision of their personal data to third parties (Article 12 of the Law);
• demand, free of charge, that the processing of their personal data be stopped, including its deletion, if there are no grounds for processing (Article 13 of the Law), including the removal of their data from the Database (clause 4.5);
• appeal against actions (inaction) and decisions of the Operator that violate their rights in the processing of personal data to the authorized body for the protection of the rights of personal data subjects — the National Personal Data Protection Center of the Republic of Belarus — and the decision taken by it, in court (Article 15 of the Law).

9. How to submit an application

9.1. To exercise the rights specified in Section 8, the subject submits an application to the Operator in writing or in the form of an electronic document in accordance with Article 14 of the Law. The application must contain the subject’s surname, first name, patronymic (if any) and address of residence (place of stay), date of birth, identification number (or, if there is none, the number of the identity document) in cases where this information was provided by the subject when giving consent or where processing is carried out without consent, a statement of the substance of the demands, and the subject’s personal signature or electronic digital signature.

9.2. Consent given by ticking a checkbox on the Website can also be withdrawn in the same form in which it was obtained (Article 10 of the Law) — for example, by an email to [email protected] from the address specified in the Account, the Order or the request.

9.3. The Operator considers applications within the periods established by the Law: it provides information on the processing of personal data within five business days; it makes changes to personal data, stops processing and deletes data, and provides information on transfers to third parties within fifteen days after receiving the application. The reply is sent in a form corresponding to the form in which the application was submitted, unless the application itself specifies otherwise.

10. Protection of personal data

10.1. The Operator takes legal, organizational and technical measures to protect personal data against unauthorized or accidental access, modification, blocking, copying, dissemination, provision, deletion, and other unlawful actions (Article 17 of the Law): it determines and restricts the procedure for access to personal data; stores passwords only as a hash; uses encryption for data transmission (HTTPS); keeps event logs; and ensures unrestricted access to this Policy.

10.2. The Operator notifies the authorized body for the protection of the rights of personal data subjects of breaches of personal data protection systems within the period established by Article 16 of the Law.

11. Miscellaneous

11.1. The Website is intended for organizations and professional users and is not intended for persons under 18.

11.2. The Operator may change the Policy. A new version takes effect upon publication on this page unless it specifies otherwise.

11.3. The Operator’s contacts: website b2blistby.com, email [email protected]. The terms of using the Website are set out in the Terms of Use.