Personal Data Protection Policy

valid as of September 20th, 2023

1. General provisions

1.1. This Personal Data Protection Policy (hereinafter “the Policy”) of Radmetron Limited Liability Company (hereinafter “the Company”, “the Operator”) has been developed in pursuance of the requirements of the Law of the Republic of Belarus dated May 7, 2021 No. 99-3 "On Personal Data Protection" (hereinafter “the Law”). Contact details of the Company: 220084, Minsk, Skorina str., 51/1, e-mail: dpo@radmetron.com.
1.2. The Policy explains to the personal data subjects the mechanisms and purposes of their personal data collection, usage or any further processing, and also reflects the rights of the personal data subjects in this regard and their implementation techniques.
1.3. The Policy applies to relations involving personal data processing by the Operator of the following personal data subjects’ categories: users of the Company's website "radmetron.com" (hereinafter “the Site”), applicants, job candidates, counterparties of the Company.
1.4. The Policy is publicly available. Unrestricted access to the Policy is provided by publishing it on the Company's Site.
1.5. Unless otherwise provided by the Policy, the terms used in it shall be interpreted in accordance with the Law.

2. Personal data processing terms and procedure

2.1. The Company processes personal data in the following cases:

Providing a callback request opportunity via the Site online-form

Data subjects whose personal data are processed	the Site users
The scope of personal data processed	name; telephone number
Legal basis for personal data processing	Consent (Article 5 of the Law)
Personal data retaining period	1 year from the date of the consent receipt

Processing “Ask a question” message (the Site feedback form)

Data subjects whose personal data are processed	the Site users
The scope of personal data processed	last name, first name, patronymic; telephone number; name of the company; e-mail address
Legal basis for personal data processing	Consent (Article 5 of the Law)
Personal data retaining period	1 year from the date of the consent receipt

Processing “Order a product” message (the Site feedback form)

Data subjects whose personal data are processed	the Site users
The scope of personal data processed	last name, first name, patronymic; name of the company; Country/region; e-mail address; other information specified in the attached file
Legal basis for personal data processing	Consent (Article 5 of the Law)
Personal data retaining period	3 years from the date of the consent receipt

Processing “"Contact Technical Support" message (the Site feedback form)

Data subjects whose personal data are processed	the Site users
The scope of personal data processed	last name, first name, patronymic; name of the company; Country/region; e-mail address; other information specified in the attached file
Legal basis for personal data processing	Consent (Article 5 of the Law)
Personal data retaining period	1 year from the date of the consent receipt

Communication within the contracts being concluded/have been concluded between the Operator and the counterparty

Data subjects whose personal data are processed	Counterparty
The scope of personal data processed	last name, first name, patronymic; contact details; job position; other information specified by the counterparty in the accompanying correspondence
Legal basis for personal data processing	When communicating with a counterparty - an individual or an individual entrepreneur – data are processed basing on the agreement with the personal data subject (paragraph 15 of Article 6 of the Law). When communicating with a representative of a counterparty - a legal entity – his personal data are processed to the scope, required to perform his duties (powers) provided for by legislative acts (paragraph 20 of Article 6 of the Law, Article 49, paragraph 5 of Article 186 of the Civil Code)
Personal data retaining period	For correspondence on contract execution as well as contracts on financial and economic activities - 3 years after the contract expiration date, a tax law compliance audit being conducted. Tax law compliance audit has not been conducted - 10 years after the contract expiration date.

Conclusion, execution and termination of civil law contracts

Data subjects whose personal data are processed	Counterparty
The scope of personal data processed	last name, first name, patronymic of the counterparty – individual/ representative and (or) employee of the counterparty-legal entity or individual entrepreneur; passport or other identity document details of the person signing the contract (for counterparties-individuals and individual entrepreneurs); registration address; contact details; other data provided by the counterparty for the contract conclusion and within its execution
Legal basis for personal data processing	1. For the contract being concluded with an individual, an individual entrepreneur – data are processed basing on the agreement with the personal data subject (paragraph 15 of Article 6 of the Law). 2. The contract being concluded with a legal entity - his personal data are processed to the scope, required to perform his duties (powers) provided for by legislative acts (paragraph 20 of Article 6 of the Law, Article 49, paragraph 5 of Article 186 of the Civil Code)
Personal data retaining period	3 years after the contract expiration date, a tax law compliance audit being conducted. Tax law compliance audit has not been conducted - 10 years after the contract expiration date.

Consideration of appeals, including those in the customer comment book

Data subjects whose personal data are processed	Applicants
The scope of personal data processed	last name, first name, patronymic; registration address; e-mail address; other information specified in the appeal
Legal basis for personal data processing	Abs. 20 Art. 6 of the Law, Art. 9 of the Law of the Republic of Belarus of 18.07.2011 No. 300-3 "On Appeals of Citizens and Legal Entities"
Personal data retaining period	5 years from the date of the last appeal; 5 years after the customer comment book termination

Consideration of job applicants’ CVs, questionnaires, reference letters, etc.

Data subjects whose personal data are processed	Job applicants
The scope of personal data processed	personal data to the scope of CVs (questionnaires, reference letters, etc.) content
Legal basis for personal data processing	1. Consent (as per Article 5 of the Law) – while CV sending by e-mail. 2. Paragraph 16 of Article 6 of the Law - when sending (providing) a CV in writing or as electronic document and signed by the personal data subject
Personal data retaining period	in case of employment - 1 month from the employment date, in case of non-employment - 1 year after data submission

Consideration of job applicants’ CVs, questionnaires submitted through the Site

Data subjects whose personal data are processed	Job applicants
The scope of personal data processed	surname, name, patronymic; photo image; citizenship; date of birth; contact details; information about education, work experience, qualifications, computer skills; medical details (in cases provided for by law); personal skills; other information included by the applicant to the CV (questionnaire)
Legal basis for personal data processing	Consent (as per Article 5 of the Law)
Personal data retaining period	in case of employment - 1 month from the employment date, in case of non-employment - 1 year after data submission

2.2. The Operator shall process personal data to the scope required for the purpose(s) specified for processing, and shall not allow their excessive processing.
2.3. The consent of the personal data subject may be obtained:

in writing (with a personal signature);
in the form of an electronic document (using an electronic digital signature);
in another electronic form.

In another electronic form, the Company shall obtain the consent of the Subject by ticking an “I agree” field on the Operator's Website, with a link to the present Policy.

3. Grounds and procedure for personal data transfer to third parties

3.1. The Operator shall not disclose to third parties the subject personal data, except as provided by law and the Policy.
3.2. The Subjects’ personal data may be transferred to authorized persons basing on the contracts concluded with such persons in the following cases:
3.2.1. to deliver goods to the Operator and to the Operator's counterparties;
3.2.2. for the purpose of administration, functionality upgrade, informational and technological support of the Company's information systems, including the Site.
3.3. With the account of the law requirements, the Operator may carry out cross-border personal data transfer to the Operator’s dealers (https://radmetron.com/ru/dealers/), or Service centers (https://radmetron.com/ru/support/), while:
3.3.1. cross-border transfer may be carried out both to countries where an adequate level of protection of personal data subjects’ rights is ensured (Russian Federation, Republic of Kazakhstan), as well as to other countries (Uzbekistan, People's Republic of China, Republic of India).
3.3.2. cross-border personal data transfer on the territory of other countries may be carried out by the Operator with the account of the requirements of the current legislation of the Republic of Belarus in cases where:

the consent of the personal data subject is obtained, provided that the personal data subject is informed about the risks arising from the lack of an adequate level of their protection;
personal data is obtained on the terms and pursuant to the conditions set out in an agreement concluded (being concluded) with the personal data subject, in order to perform the actions within this agreement.

4. Rights of personal data subjects

4.1. You, as a personal data subject, have the following rights:
4.1.1. the right to demand Your personal data to be modified by the Operator;
You have the right to require the Operator to make changes to Your personal data if the personal data are incomplete, outdated or inaccurate.
The Operator shall make changes to Your personal data within 15 calendar days from the date of receipt of the request.
4.1.2. The right to be informed about Your personal data processing;
You have the right to receive information regarding Your personal data processing, containing:

location of the Operator;
confirmation of the fact of personal data processing;
Your personal data and the source of their receipt;
legal grounds and purposes for the personal data processing;
the period covered by the consent (if personal data are processed basing on Your consent);
name and location of the authorized person(s);
other information provided for by legislation.

Within 5 working days after receiving Your request, the Operator shall provide the information You require or notify You of the reasons to decline Your request.

4.1.3. The right to be informed about Your personal data transfer to third parties;
You have the right to receive information from the Operator about Your personal data transfer to third parties free of charge once a calendar year.
Within 15 calendar days from the date of the request receipt, the Operator shall provide the details and the recipient of Your personal data transferred within a year preceding the date of Your request, or notify You of the reasons to decline Your request.
4.1.4. The right to demand the termination of personal data processing;
You have the right to demand from the Operator to terminate Your personal data processing free of charge, including data deletion, in case there is no grounds for further personal data processing.
The Operator shall stop processing Your personal data within 15 calendar days from the date of receipt of the request, except in cases where the Operator has the right to continue personal data processing under the legislation of the Republic of Belarus.
4.1.5. The right to withdraw the previously granted consent for personal data processing;
You have the right to withdraw Your consent only if the Operator has previously asked you for such consent for personal data processing. In this regard, the request for consent withdrawal shall not be granted in the event the processing is carried out under contractual or legal obligations.
Within 15 calendar days from the date of receipt of the request, the Operator shall seize processing Your personal data, delete them and notify You about it, except in cases where the Operator has the right to continue Your personal data processing under the legislation of the Republic of Belarus.
4.1.6. The right to appeal against the actions (inaction) and decisions of the Operator that violate your rights while Your personal data processing;

If You consider Your personal data processing being carried out in violation of the legislation of the Republic of Belarus, You may file a complaint with an authorized body for the protection of the rights of personal data subjects.
The complaint is considered in accordance with the procedure prescribed by the Law “On appeals of citizens and legal entities”.

4.2. To exercise his rights specified in paragraphs. 4.1.1 – 4.1.4. of the Policy, personal data subject should submit a request to the Operator:
- in writing to the address: 220084, Minsk, Skaryna str., 51/1;
- in the form of an electronic document to the e-mail address dpo@radmetron.com.

The request shall contain:

surname, first name, patronymic (if any) of the personal data subject, his residential or actual address;
date of birth of the personal data subject;
statement of the scope of the requirements of the personal data subject;
identification number of the personal data subject; such a number being unavailable - the number of the identity document of the personal data subject, in cases this information was provided by the personal data subject when giving his consent or personal data processing is carried out without the consent of the personal data subject;
personal signature (for a written request) or an electronic digital signature (for requests submitted in the form of an electronic document) of the personal data subject.

4.3. To exercise his right for consent withdrawal (clause 4.1.5 of the Policy), the personal data subject should send an appropriate request to the Operator as per Clause 4.2 of the Policy, or send an electronic message to the e-mail address dpo@radmetron.com if the consent was provided by the personal data subject in another electronic form. An electronic message to exercise his right for consent withdrawal, submitted by the personal data subject in another electronic form, should contain:

the scope of personal data to be processed provided in the personal data subject’s consent submitted in another electronic form;
statement of the scope of the requirements.

4.4. To get assistance in exercising Your rights, You may contact a person in charge of internal control over the personal data processing in the Company by sending a message to the email address: dpo@radmetron.com.

5. Final provisions

5.1. The Company has the right, at its discretion, to unilaterally change and (or) supplement the terms of this Policy without prior notice to the personal data subject by posting a new version of the Policy on the Site.
5.2. Issues relating to personal data processing not covered by this Policy are governed by the legislation of the Republic of Belarus.