Personal Data Processing Policy

CHAPTER 1:

GENERAL PROVISIONS

This regulation defines the Policy of Limited Liability Company "BLS Solutions" (hereinafter - LLC "BLS Solutions", Operator) regarding the processing of personal data of individuals who have contacted the Operator (hereinafter - Applicant, Applicants) in the course of statutory activities in accordance with the Law of the Republic of Belarus dated May 7, 2021, No. 99-Z "On Personal Data Protection" (hereinafter - the Law) and other legislative acts of the Republic of Belarus in the field of personal data processing and protection. The terms and definitions used in this Regulation correspond to the meanings applied in the legislation of the Republic of Belarus.

Basic concepts used in the Policy:

• personal data - any information related to an identified or identifiable natural person;
• subject of personal data - a natural person whose personal data is being processed;
• operator - a state body, legal entity of the Republic of Belarus, another organization, or an individual, including an individual entrepreneur (hereinafter, unless otherwise specified - individual), independently or jointly with other persons organizing and/or carrying out the processing of personal data;
• cross-border transfer of personal data - the transfer of personal data to the territory of a foreign state;
• special personal data - personal data concerning racial or ethnic origin, political views, membership in trade unions, religious or other beliefs, health or sex life, being subject to administrative or criminal liability, as well as biometric and genetic personal data;
• publicly available personal data - personal data disseminated by the subject of personal data or with their consent or disseminated in accordance with the requirements of legislative acts;
• processing of personal data - any action or set of actions performed with personal data, including collection, systematization, storage, alteration, use, anonymization, blocking, dissemination, provision, deletion of personal data;
• automated processing of personal data - processing of personal data using computing technology;
• dissemination of personal data - actions aimed at making personal data known to an indefinite circle of persons;
• provision of personal data - actions aimed at making personal data known to specific persons or a circle of persons;
• blocking of personal data - cessation of access to personal data without its deletion;
• deletion of personal data - actions resulting in the impossibility of restoring personal data in information resources (systems) containing personal data, and/or resulting in the destruction of physical media containing personal data;
• anonymization of personal data - actions resulting in the impossibility of determining the affiliation of personal data to a specific subject of personal data without using additional information;
• authorized person - a state body, legal entity of the Republic of Belarus, another organization, individual who, in accordance with legislative acts, decisions of the state body acting as the operator, or based on an agreement with the operator, processes personal data on behalf of or in the interests of the operator;
• identifiable natural person - a natural person who can be directly or indirectly identified, particularly through surname, first name, patronymic, date of birth, identification number, or through one or more attributes characteristic of their physical, psychological, mental, economic, cultural, or social identity;
• information network - a combination of information systems or complexes of software and hardware of the information system interacting via telecommunication networks;
• user of an information system and/or information network - a subject of information relations who has access to and uses the information system and/or information network.

The purpose of this Policy is to define the procedure and conditions for the processing of personal data to ensure the protection of personal data from unauthorized or accidental access, as well as from other unlawful actions concerning personal data during the Operator's statutory activities.

The Policy applies to the business processes of the Operator, during which personal data is processed.

The Policy in electronic form is posted on the Operator's website: "blsspain-belarus.com", and is also provided in paper form for review at the request of the Data Subject. The Policy in paper form is kept by the internal control specialist for personal data protection.

CHAPTER 2

PRINCIPLES OF PERSONAL DATA PROCESSING. PROCESSED PERSONAL DATA AND PURPOSES OF THEIR PROCESSING

The processing (collection, systematization, anonymization, blocking, dissemination, provision, deletion, and any other actions) of personal data by the Operator is based on the principles of ensuring the protection of an individual's private life and personal data, rights, and freedoms.

The processing of personal data by the Operator is carried out in accordance with the following principles:

• The processing of personal data is conducted in accordance with the Law and other legislative acts;
• The processing of personal data is proportionate to the declared purposes of their processing and ensures at all stages of such processing a fair balance of interests of all concerned parties;
• The processing of personal data is carried out with the consent of the Data Subject, except in cases provided by the Law and other legislative acts. If personal data is processed without the Data Subject's consent, the purposes of processing the personal data are established by the Law and other legislative acts;
• The processing of personal data is limited to achieving specific, pre-declared lawful purposes. It is not allowed to process personal data incompatible with the initially declared purposes of their processing. If it is necessary to change the initially declared purposes of personal data processing, the Operator obtains the Data Subject's consent to process their personal data in accordance with the amended purposes of personal data processing, in the absence of other grounds for such processing provided by the Law and other legislative acts;
• The content and volume of processed personal data correspond to the declared purposes of their processing. The processed personal data is not excessive in relation to the declared purposes of their processing;
• The processing of personal data is transparent. For this purpose, the Data Subject is provided with relevant information regarding the processing of their personal data, in cases stipulated by the Law and this Policy;
• The Operator takes measures to ensure the accuracy of the personal data it processes and updates them when necessary;
• The storage of personal data is carried out in a form that allows the identification of the Data Subject no longer than required by the declared purposes of personal data processing.

The Policy defines the procedure for processing the Applicant's personal data:

• Obtained through the submission of documents for obtaining visas from Schengen Agreement countries in (from) the respective consulates (tourist, business, and other trips), the delivery of documents, as well as the transfer of biometric data to consulates.
• This Policy does not regulate the processing of employees' personal data, nor the processing of cookies.
• The Operator is "BLS Solutions" LLC, located at: Republic of Belarus, Minsk, Tolstoy St. 8-2, 2nd floor, TIN: 193623587.
• "BLS Solutions" LLC provides logistic services for the receipt of documents for obtaining a visa from Schengen Agreement countries, a permit, or a travel document on behalf of the Customer and in accordance with the contract concluded with them regarding such services.

When making an appointment to submit documents:

• The Customer provides personal data to organize a visit to the visa center and to inform the consulate about the Customer's intention to submit documents to the consulate to obtain a visa, permit, or other travel document.

Personal data provided by the Customer when creating a personal account and making an appointment:

• Surname, first name, date of birth, passport number, passport expiration date, citizenship, phone number, identification number, photograph, email (the volume of provided data may differ depending on the consulate to which the Applicant is making an appointment).

Purpose of processing personal data:

• Booking the date and time of the Applicant's appointment for a visit to the visa center, verifying the Applicant at the entrance to the visa center, and informing the consulate about the Applicant.

Legal basis for collecting personal data:

• Consent of the Applicant. The Operator obtains consent to process the Applicant's personal data during the registration of the user's personal account.

By concluding a contract with the Operator:

• The Applicant entrusts the Operator to perform a set of actions for processing personal data, sorting documents, entering data into the information system for the issuance of short-term visas for various travel purposes, and delivering documents to (from) the respective consulates, including the transfer of biometric data to the Consulate, etc.

Personal data collected for consulates:

• Data indicated in the application: surname, first name, date of birth, place of birth, country of birth, nationality, nationality at birth (if different), other nationality, gender, marital status, identification number (if any), type of travel document, travel document number, date of issue, expiration date of the travel document, issuing authority, family relationship with an EU, EEA, or Swiss citizen, home address, phone number, email address, country of residence if different from citizenship (residence permit or equivalent document), professional activity, place of work (address and phone number of employer; for students and schoolchildren - the name and address of the educational institution), purpose of the trip, travel details (destination country, start and end dates of the trip, other details);
• Surname(s), first name(s), residential address, and email address of the inviting person(s) in the Schengen country. If there is no inviting party, the name of the hotel(s) or address of temporary residence in the Schengen country;
• Biometric data: photograph, fingerprints;
• Passport data contained in copies of passport pages;
• Data contained in medical insurance;
• In the case of minors: surname, first name, address (place of residence or registration) if different from the applicant's address, phone number, email address, and citizenship of the legal guardian;
• Data indicated in the employment certificate: employee's position, date of employment, and end date of the employment contract (if applicable), salary for the last three months (optional);
• For individual entrepreneurs: data contained in the individual entrepreneur's registration certificate, a certificate of no debt to the budget of the Republic of Belarus;
• For pensioners: data indicated in the pension certificate;
• Data confirming the availability of sufficient financial means for the trip (bank statement with account movements for 3 months and other documents confirming financial solvency);
• Data on the payment of the consular fee.

Purpose of personal data processing:

• The Operator processes personal data to fulfill a contract with the Applicant for the purpose of preparing documents to apply for a visa, permit, or other travel document.

Legal basis for personal data processing:

• Consent of the Applicant is required for collecting special personal data (such as photographs, fingerprints). A contract is used for processing other personal data of the Applicant. In case of refusal by the Applicant to provide consent or withdrawal of previously given consent, LLC "BLS Solutions" will not be able to provide the service to the Applicant under the concluded contract.

Retention period of personal data of Applicants:

• Personal data of the Applicant, including special personal data of the applicant submitting documents to obtain visas of the Slovak Republic, the Republic of Portugal, are deleted as soon as the documents are submitted to the consulate, except for: surname, first name, contact details (phone number, email), passport number, which are deleted immediately upon return of the documents from the consulate and transfer to the Customer.
• Personal data of the Applicant, including special personal data of the applicant submitting documents to obtain visas of the Kingdom of Spain, are deleted upon return of the documents to the Customer.
• Data matching the data in visa applications is deleted from the Organization's systems after the passport is issued to the Applicant. Documents containing other data (bank financial guarantees, insurance, etc.) are transferred to the consulate or Applicant after receipt by the Operator without being stored in the company's information systems.

Authorized persons in processing personal data:

• Limited Liability Company "Murud Logistics", Limited Liability Company "AUTOLIGHT EXPRESS" carry out delivery of documents for consideration of issuance of visas of the Schengen agreement countries (these legal entities do not have direct access to personal data indicated in documents for visa issuance).

Cross-border transfer of personal data:

• The Operator, performing a complex of actions for processing personal data, sorting documents, entering data into the information system for issuing short-term visas for various travel purposes, delivering documents to (from) the respective Consulates, transmitting biometric data to Consulates, etc., carries out cross-border transfer of personal data subjects to the territory of foreign states. Before carrying out cross-border transfer of personal data subjects, the Operator undertakes the following actions:
  • Determines whether such a country is included in the list of foreign states approved by the authorized body for the protection of the rights of personal data subjects, providing an adequate level of protection of the rights of personal data subjects.
  • Determines whether such a country is a party to the "Convention of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data," adopted in Strasbourg on January 28, 1981, on the protection of individuals with regard to automatic processing of personal data.
  • Ensures that there are contractual relations with official representatives of foreign embassies and/or consulates to which personal data are transferred, which have taken technical and organizational measures to protect personal data of Applicants, as well as the legal basis and purposes of processing personal data of Applicants.
  • Ensures that cross-border data transfer is not excessive and complies with the purpose of transfer provided by this Regulation, as well as other requirements of the legislation of the Republic of Belarus on personal data protection.

Personal data may be transferred by the Operator to the following categories of subjects:

• Companies providing hosting services to LLC "BLS Solutions" and companies with which LLC "BLS Solutions" has concluded agreements to provide access to software.

At the time of approval of this Regulation, cross-border data transfer is carried out to:

• The Consulate General of the Kingdom of Spain in Moscow, located at: Russian Federation, 1150545, Moscow, Stremyanny Lane, 31/1;
• Consulate of the Slovak Republic, located at: Republic of Belarus, 220030, Minsk, Volodarskogo Street, 6, 3rd floor.

Grounds for cross-border transfer of personal data of the Applicant:

• Consent of the personal data subject to the processing of personal data, in accordance with paragraph 3 of Article 4 and paragraph 2 of Article 8 of the Law;
• Other grounds for processing personal data specified in Article 6 of the Law.

Method of personal data processing during cross-border transfer:

• The method of processing personal data during cross-border transfer is automated processing with data transmission over the Internet, as well as document delivery by courier service, with the adoption of necessary legal, organizational, and technical measures of protection.
• The Operator does not carry out cross-border transfer of personal data of the Applicant to countries that do not provide adequate protection of the rights of personal data subjects.

CHAPTER 3

RIGHTS OF THE PERSONAL DATA SUBJECT AND OBLIGATIONS OF THE OPERATOR

The Operator and the personal data subject have respective rights and obligations in the processing of the personal data of the subject.

Obligations of the Operator:

• Explain to the personal data subject their rights related to the processing of personal data.
• Obtain consent from the personal data subject, except in cases provided for by this Law and other legislative acts.
• Ensure the protection of personal data during their processing.
• Provide the personal data subject with information about their personal data, as well as about the provision of their personal data to third parties, except as provided by law.
• Make changes to personal data that are incomplete, outdated, or inaccurate, except when another procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not imply further changes to such data.
• Cease processing personal data, as well as delete or block (ensure the cessation of processing personal data, as well as their deletion or blocking by an authorized person) in the absence of grounds for processing personal data provided by the Law and other legislative acts.
• Notify the authorized body for the protection of the rights of personal data subjects about violations of personal data protection systems promptly, but no later than three business days after the Operator becomes aware of such violations, except as provided by the authorized body for the protection of the rights of the personal data subject.
• Implement changes, block or delete inaccurate or unlawfully obtained personal data of the personal data subject upon the request of the authorized body for the protection of the rights of personal data subjects, if another procedure for making changes, blocking or deletion of personal data is not established by legislative acts.
• Fulfill other requirements of the authorized body for the protection of the rights of personal data subjects regarding the elimination of violations of personal data legislation.
• Fulfill other obligations provided by this Law and other legislative acts.

Rights of the Personal Data Subject:

• The right to withdraw consent to the processing of personal data (the personal data subject has the right to withdraw their consent at any time without explaining the reasons by submitting a statement to the Operator in the manner prescribed by Article 14 of the Law, or in the form through which their consent was obtained).
• The right to obtain information concerning the processing of personal data and to amend personal data (the personal data subject has the right to obtain information concerning the processing of their personal data, including: the name (surname, first name, patronymic (if any)) and location (address of residence (place of stay)) of the Operator; confirmation of the fact of processing personal data by the Operator (authorized person); their personal data and the source of their receipt; legal grounds and purposes of processing personal data; the period for which their consent is given; the name and location of the authorized person, which is a state authority, legal entity of the Republic of Belarus, or another organization if the processing of personal data is entrusted to such person; other information provided by legislation).
• The right to obtain information about the provision of personal data to third parties (the personal data subject has the right to obtain from the Operator information about the provision of their personal data to third parties once a calendar year free of charge, unless otherwise provided by this Law and other legislative acts. To obtain the information specified in the first part of this paragraph, the personal data subject submits an application to the Operator in the manner prescribed by Article 14 of the Law).
• The right to demand the cessation of processing of personal data and/or their deletion (the personal data subject has the right to demand from the Operator the free cessation of processing their personal data, including their deletion, in the absence of grounds for processing personal data provided by the Law and other legislative acts. To exercise this right, the personal data subject submits a statement to the Operator in the manner prescribed by Article 14 of the Law).
• The right to appeal actions (inaction) and decisions of the Operator related to the processing of personal data (the personal data subject has the right to appeal actions (inaction) and decisions of the Operator that violate their rights in the processing of personal data to the authorized body for the protection of the rights of personal data subjects in the manner established by legislation on appeals of citizens and legal entities). Decisions taken by the authorized body for the protection of the rights of personal data subjects can be appealed by the personal data subject in court in accordance with the procedure established by legislation.

CHAPTER 4

FINAL PROVISIONS

• In all other matters not regulated by this Policy, the provisions of the organization's local legal acts and the current legislation of the Republic of Belarus apply. The organization has the right to make changes and/or additions to the Policy at any time. This Policy enters into force from the moment of its approval by the director of the organization.