APPROVED
Order of the CEO
"Reliable Software" LLC
May 31, 2023 No. 66-P/2023

CHAPTER 1

GENERAL PROVISIONS

1. This Policy defines the activities of the Limited Liability Company "Reliable Software" (TIN 100160363), registered at the address: 8, Aranskaya Str., block 1, 4th floor, 220006, Minsk (hereinafter referred to as the Company) with respect to the processing of personal data of users of the information resource (website) igf.by (hereinafter referred to as the Site), whose data is processed by the Company as the operator within the meaning of the Law of the Republic of Belarus of May 7, 2021 No. 99-Z "On Personal Data Protection" (hereinafter referred to as the Law).

2. The policy is developed in accordance with the provisions of the Law and other legislative acts of the Republic of Belarus.

3. The objectives of this Policy are to ensure the proper protection of personal data as well as other information about personal data subjects from unauthorized access and disclosure, as well as to standardize the procedure for processing such data by the Company in accordance with the requirements of the legislation of the Republic of Belarus.

4. This Policy applies to all actions taken by the Company with personal data using automation tools.

5. The following terms are used for the purpose of this Policy:
- event - Forum on Internet Governance (Belarus IGF-2023), organized by the Company
- personal data subject or subject - a Site user who is a natural person, to whom personal data processing applies.
- Other terms used in this Policy are used in the meanings defined by the Law.

6. The Policy is mandatory for review and implementation by all persons authorized to process personal data in the Company, as well as persons involved in organizing the processes of processing and ensuring the protection of personal data in the Company.

7. This Policy comes into force from the moment of its approval.

8. Ensuring unlimited access to the Policy is implemented by publishing it in open access on the Site.

CHAPTER 2

PRINCIPLES OF PERSONAL DATA PROCESSING

9. The company takes actions to protect the privacy of personal data subjects, as well as their rights to confidentiality, regardless of the methods of collecting personal data, taking into account the following principles of their processing:


- principle of legality and transparency. Personal data will be processed lawfully, fairly and transparently on the basis of this Policy and the laws of the Republic of Belarus. In case the subject does not agree with the processing of personal data, the Company notifies that services directly related to the processing of personal data may not be available, and the use of the Site is limited;
- principle of purpose limitation. Personal data is processed by the Company only for explicitly expressed and lawful purposes and should not be further processed in a way incompatible with these purposes;
- principle of data minimization. The list of personal data should be limited to only the information that is necessary in relation to the purposes for which it is processed;
- principle of accuracy and reliability of data. Personal data must be accurate and reliable. The personal data subject must take all reasonable measures to remove or correct incomplete, outdated, or inaccurate personal data, depending on the purposes of their processing, without delay;
- principle of storage limitation. Personal data must be stored in a form that allows identifying the personal data subject, but no longer than required by the purposes of processing personal data;
- principle of confidentiality and data security. Personal data must be processed by the Company in such a way as to ensure proper security of personal data, including protection against unauthorized or unlawful processing, as well as accidental loss, destruction or damage using appropriate legal, organizational and technical measures.

CHAPTER 3

OBJECTIVES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA.
CATEGORIES OF SUBJECTS AND VOLUME OF PROCESSED PERSONAL DATA

10. The company, acting as the operator, processes personal data of subjects for the purposes and on the grounds specified in table 1.


Table 1

Subjects	Processed data	Purpose of processing	Legal basis
Site Users - participants (potential participants) Events	Full Name; Job title; E-mail address; Phone number	Providing access to the Event (registration of participants, registration of speakers, consideration of partnership applications within the Event, grouping the sectors of the Event, identification at the Event) placement of the last name, first name, position and place of work of the speaker / moderator in the program of the Event, which is publicly available and is subject to distribution to an unlimited circle of people (for speakers and moderators)	Agreement
Performing the actions required in accordance with the request of the subject of personal data (responding to a request, advising on the subject of personal data, etc.)	par. 20 st. 6 and par. 16 p. 2 art. 8 of the Law, paragraph 1 of Art. 3 of the Law of the Republic of Belarus dated July 18, 2011 No. 300-З "On appeals of citizens and legal entities”
Implementation information in connection with participation in the Event through personal contact or through the use of means of communication	Agreement
Ensuring the implementation of the norms of the current legislation, the execution of judicial acts, acts of other bodies or officials subject to execution in accordance with the law	Compliance with the requirements of the legislation of the Republic of Belarus
Suppression of dishonest behavior on the part of personal data subjects, assistance in the prevention, detection and suppression of offenses and crimes.	Compliance with the requirements of the legislation of the Republic of Belarus

11. The company ensures compliance of the content and volume of processed personal data with the stated processing purposes and, if necessary, takes measures to eliminate their excessiveness in relation to the stated processing purposes.

In case of any changes in the processing purposes stated in table 1, for which the Company obtained the consent of the data subject, and in the absence of other grounds for such processing, the Company is obliged to request the data subject's renewed consent in accordance with the changed purpose.

12. The Company may process personal data of data subjects within the following (or combination of) actions: collection, systematization, storage, modification, use, depersonalization, provision, deletion of personal data.

13. The ways of processing personal data by the Company are:
- using automation tools.

14. The Company, if necessary to achieve the data processing purposes, has the right to transfer personal data to third parties in compliance with the requirements of the legislation of the Republic of Belarus.

The processing periods of personal data by the Company are determined taking into account:

- established purposes of personal data processing;
- validity periods of data subjects' consents to the processing of their personal data;
- periods defined by the legislation of the Republic of Belarus.

15. The processing period of personal data based on the data subject's consent is 3 (three) years, unless a longer processing period is provided for by the legislation of the Republic of Belarus.

16. The Company terminates the processing of personal data in the following cases:
- upon the occurrence of conditions for the termination of personal data processing or upon the expiration of the established periods;
- upon the achievement of their processing purposes or in case of the loss of the need to achieve these purposes;
- at the request of the data subject, in cases provided for by the legislation of the Republic of Belarus on the protection of personal data;
- in case of detection of unlawful processing of personal data, if it is impossible to ensure the lawfulness of the processing of personal data;
- in case of liquidation of the Company.

CHAPTER 4

OTHER INFORMATION ABOUT DATA SUBJECTS
PERSONAL DATA PROCESSED BY THE COMPANY

17. The Company is also entitled to process other information about data subjects, which includes:
- data automatically obtained by the server when accessing the Site using bookmarks (cookie files);
- data automatically obtained by the server when accessing the Site and subsequent actions of the Site user (including, but not limited to: host IP address, type of operating system of the Site user, browser type, Site pages visited by the user).

18. The information specified in clause 17 of this Policy is processed by the Company for the purpose of obtaining anonymous (depersonalized) and aggregate statistics to improve functionality and quality of the Site, improve the services of the Company, as well as to prevent and detect fraudulent behavior of data subjects, assist in preventing, detecting, and suppressing offenses and crimes, and provide personalized and relevant content to Site users.

19. The Company, if necessary and to achieve the goals of processing information about data subjects specified in clause 18 of this Policy, may transfer such information to third parties in compliance with the requirements of the legislation of the Republic of Belarus.

20. The Company may process information about data subjects specified in clause 17 of this Policy within the actions, conditions, methods, and time periods specified in clauses 12, 13, 15, 16 of this Policy.

CHAPTER 5

ORDER AND CONDITIONS OF PROCESSING
PERSONAL DATA

21. One of the grounds for processing personal data is the consent of the personal data subject, except for cases established by the legislation of the Republic of Belarus when personal data processing is carried out without obtaining such consent.

22. The consent of the personal data subject is a free, unambiguous, informed expression of their will, by means of which they authorize the processing of their personal data. Refusal to give consent to the processing of personal data gives the Company the right to refuse to provide services (work) to the personal data subject, the implementation of which is directly related to the processing of personal data.

23. Personal data is stored in a form that allows the personal data subject to be identified for a period not exceeding the time required for the purposes of processing personal data, except in cases when the storage period of personal data is established by the legislation of the Republic of Belarus, a contract concluded (concluded) with the personal data subject, for the purpose of performing actions specified in this contract.

24. The condition for terminating the processing of personal data may be the achievement of the purposes of processing personal data, the expiration of the processing period of personal data, the revocation of the consent of the personal data subject to the processing of their personal data, as well as the identification of unlawful processing of personal data.

25. The Company, acting as an authorized person, processes the personal data of subjects who are clients of third parties, acts on behalf of processing personal data in accordance with the legislation of the Republic of Belarus.

CHAPTER 6

RIGHTS OF PERSONAL DATA SUBJECTS AND MECHANISMS FOR IMPLEMENTATION OF THESE RIGHTS

26. The personal data subject has a set of rights regarding their personal data, as specified in Table 2:

Table 2

№	The right of the subject of personal data	Content of law	Operator actions
1.	Right to receive information regarding the processing of personal data	The subject has the right to receive information regarding the processing of his personal data, containing: the name and location of the operator, confirmation of the fact of processing personal data by the operator, personal data of the subject and the source of their receipt, legal grounds and purposes of personal data processing, the period for which the consent of the subject is given, name and location of the authorized person.	The Operator, within 5 working days after receiving an application from the personal data subject, provides the requested information or notifies the personal data subject of the reasons for refusal to provide it.
2.	The right to receive information about the provision of personal data to third parties	The subject of personal data has the right to receive information from the operator about the provision of his personal data to third parties once a calendar year free of charge.	The operator, within 15 calendar days from the moment the subject sends the corresponding request, provide the subject of personal data with information about what personal data of this subject and to whom were provided during the year preceding the date of filing the application, or notifies the subject of personal data about the reasons for the refusal to provide it.
3.	Right to make changes to personal data	The subject of personal data has the right to require the operator to make changes to his personal data if they are incomplete, outdated or inaccurate.	The operator, within up to 15 calendar days from the moment the subject sends the corresponding request, makes changes to personal data if they are incomplete, outdated or inaccurate.
4.	The right to demand the termination of the processing of personal data and (or) their deletion of personal data	The subject of personal data has the right to demand from the operator the free termination of the processing of his personal data, including their deletion, in the absence of grounds for the processing of personal data.	The Operator, within 15 calendar days from the date of sending the relevant request by the subject, terminates the processing of personal data, except for cases when the operator has the right to continue processing personal data if there are grounds established by the legislation of the Republic of Belarus.
5.	The right to withdraw previously granted consent to the processing of personal data	The subject of personal data has the right to withdraw his consent to the processing of personal data at any time without giving reasons.	The operator, within 15 calendar days from the moment the subject sends the relevant request, stops processing personal data, deletes them and notifies the subject of personal data about this, except in cases where the operator has the right to continue processing personal data if there are grounds established by the legislation of the Republic of Belarus.
6.	The right to appeal against actions (inaction) and decisions of the operator related to the processing of personal data	The subject of personal data has the right to appeal against the actions (inaction) and decisions of the operator that violate his rights in the processing of personal data to the authorized body.

27. Implementation of one or several of the rights listed in Table 2 is carried out by the personal data subject by submitting a request (application) in writing via registered mail or in the form of an electronic document. The right to withdraw previously given consent for personal data processing may be exercised in electronic form corresponding to the form of such consent.

28. The request (application) must contain:
- Last name, first name, patronymic of the personal data subject;
- Residential address (place of stay);
- Date of birth;
- Identification number (if specified when giving consent or personal data processing is carried out without the consent of the personal data subject);
- Description of the essence of the demand;
- Personal signature or electronic digital signature.

29. The request (application) should be submitted:
- In writing to the address: 220006, Minsk, Aranskaya str., 8, block 1, 4th floor or;
- In the form of an electronic document to the email address: info@igf.by;
- In electronic form to the email address: info@igf.by.

30. Any information (including personal data) provided by the personal data subject when registering a personal account may be used by the Company in accordance with this Policy.

31. Termination of personal data processing by the Company may make it impossible to further provide services to this personal data subject by the Company.

32. The person who provided the Company with incomplete, outdated, or inaccurate information about himself/herself, or information about another personal data subject without his/her consent, is responsible in accordance with the legislation of the Republic of Belarus.

CHAPTER 7

MEASURES APPLIED BY THE COMPANY TO PROTECT THE PERSONAL DATA OF SUBJECTS

33. The company takes and constantly improves the necessary legal, organizational, and technical measures to ensure the protection of personal data from unauthorized or accidental access, alteration, blocking, copying, distribution, provision, deletion of personal data, and other illegal actions with respect to personal data.

34. Legal measures taken by the Company: The Company has developed and implemented documents that establish the procedure for processing and ensuring the protection of personal data, which comply with the requirements of the Law and other legislation of the Republic of Belarus regulating relations in the field of personal data.

35. Organizational measures taken by the Company include:
- appointment by the Company of a person and/or structural unit responsible for internal control over the processing of personal data;
- familiarization of the Company's employees with the requirements of the legislation of the Republic of Belarus and regulatory documents of the Company in the field of working with personal data;
- determination by the Company of a list of persons who have access to personal data processed in the information system and are necessary for them to perform job duties;
- issuance of internal documents defining the Company's policy with respect to the processing of personal data, local legal acts on issues of personal data processing, as well as local legal acts establishing procedures aimed at preventing and detecting violations when working with personal data and eliminating the consequences of such violations.


36. Technical measures taken by the Company include:
- implementation of technical and cryptographic protection of personal data in the manner established by the Operational and Analytical Center under the President of the Republic of Belarus, in accordance with the classification of information resources (systems) containing personal data.

CHAPTER 8

CROSS-BORDER TRANSFER OF PERSONAL DATA

37. Before initiating the cross-border transfer of personal data, the company must ensure that the foreign state, to whose territory the transfer of personal data is intended, provides reliable protection of the rights of personal data subjects.

38. Cross-border transfer of personal data to the territories of foreign states that do not meet the above requirement can only be carried out in cases provided for by the Law.

CHAPTER 9

FINAL PROVISIONS

39. Issues related to the processing of personal data not specified in this Policy are regulated by other local legal acts of the Company, as well as the legislation of the Republic of Belarus.

40. In case any provision of the Policy is recognized as conflicting with the legislation of the Republic of Belarus, the remaining provisions that comply with the legislation of the Republic of Belarus remain in force and valid, and any invalid provision will be considered deleted/modified to the extent necessary to comply with the legislation of the Republic of Belarus.

41. The Operator has the right at his discretion to change and/or supplement the conditions of this Policy without prior and/or subsequent notice to personal data subjects. The current version of the Policy is always available on the Site.