This Privacy Policy (hereinafter — the Policy) applies to the processing of personal data that we may obtain from individuals (data subjects) on the basis of the Constitution of Ukraine and the Law of Ukraine “On Personal Data Protection” dated 01.06.2010 No. 2297-VI (hereinafter — the Law), as well as the General Data Protection Regulation (EU) 2016/679 dated 27.04.2016 (EU General Data Protection Regulation, hereinafter — GDPR) and other applicable European data protection legislation, collectively referred to hereinafter as the Legislation.
This Privacy Policy is designed to explain:
- what personal data of yours we collect;
- how and why we use it;
- to whom we disclose your personal data;
- how we protect the confidentiality of your personal data;
- how to contact us and whom to address if you have questions regarding the processing of your personal data.
We process your personal data only if one of the conditions specified in Article 6 of the GDPR is met, including but not limited to:
- you have given consent to the processing of your personal data;
- the processing is necessary for the provision of services to you;
- such processing is required by the legislation of the country in which you are located.
We take the security of the personal data of our clients, prospective clients and other persons who contact us very seriously and therefore do everything necessary to protect your personal data.
The Administration undertakes to take all necessary measures to prevent misuse of your personal data that becomes known to us. We will process your personal data in strict compliance with the requirements of the applicable Legislation and solely on lawful grounds.
You are not obliged to provide us with personal data, but without certain information about you we will not be able to provide you with some of our services. If we control the methods of collecting your personal data and determine the purposes for which such personal data is used, the Administration is the “data controller” for the purposes of the GDPR and other applicable European data protection legislation, as well as the “owner of personal data” within the meaning of the Law.
1. Terms and Definitions
1.1 Personal data — information or a set of information about an individual who is identified or can be specifically identified (User).
1.2 Special categories of personal data — so-called “sensitive” personal data that may harm the data subject at work, in an educational institution, in the living environment or may lead to discrimination in society. For example, personal data containing information about racial origin, political or religious views, trade union membership, health status, sexual life, biometric or genetic data. In the terminology of Ukrainian legislation, these are personal data the processing of which carries a special risk for data subjects.
1.3 Data subject — an individual to whom personal data relate and who can be identified or has already been identified by this personal data.
1.4 Site Administration (Administration, and hereinafter also — we, us, our) — all information available at www.barmash.com.ua/en.
1.5 Processing of personal data — any action or set of actions such as collection, registration, accumulation, storage, adaptation, alteration, retrieval, use and dissemination (distribution, sale, transfer), depersonalisation, destruction of personal data, including using information (automated) systems.
1.6 Dissemination of personal data — actions to transfer information about an individual with the consent of the data subject.
1.7 Use of personal data — any actions of the Administration regarding the processing of this data, actions to protect it, as well as actions to grant partial or full rights to process personal data to other entities involved in personal data relations, performed with the consent of data subjects or in accordance with the Legislation.
1.8 Depersonalisation of personal data — removal of information that allows direct or indirect identification of a person.
1.9 User — a data subject, any capable individual who has accepted this Policy in their own interests.
1.10 Authorization procedure — the process of recognizing a user on the site according to the data entered during authorization and subsequent assignment of an ID for contacting the server.
1.11 Cookie — a file containing an identifier (a string consisting of letters and numbers) that is sent by a web server to a web browser and stored by the browser. Subsequently, the identifier is sent back to the server each time the browser requests a web page from the server.
2. General Provisions
2.1 The Policy applies to all your personal data that may be obtained by us in the course of your use of the program or the website. This Policy extends to personal data obtained both before and after this Policy enters into force.
2.2 The purpose of the Policy is to provide you with the necessary information allowing you to assess what personal data and for what purposes are processed by us, to explain the methods of processing and security.
2.3 By using the site and providing the Administration with your personal data, including through third parties, you acknowledge your consent to the processing of your personal data in accordance with this Policy.
2.4 In case of disagreement with the terms of this Policy, you must stop using the website.
2.5 Consent to the processing of personal data (hereinafter — PD) may be withdrawn by the data subject. In case of withdrawal of consent, the Administration has the right to continue processing PD without the consent of the subject if there are grounds specified in the Legislation.
2.6 The Site Administration does not verify the accuracy of personal data provided by the User and has no possibility to assess their legal capacity. However, the Administration assumes that the User acts in good faith, prudently, provides reliable and sufficient personal data and makes all necessary efforts to keep such data up to date and does not violate the rights of third parties.
2.7 By agreeing to the terms of this Policy, you confirm that at the time of collection of personal data you are aware of the persons to whom personal data is transferred, the content and purposes of collection of personal data. You confirm (guarantee) that the personal data transferred to us for processing is transferred with the consent of the owner of personal data and within the framework of the Legislation.
2.8 The Administration, having received personal data from the User, does not assume the obligation to inform the subjects (their representatives) whose personal data has been transferred to it about the start of processing of personal data, since the obligation to provide appropriate information when concluding a contract with the data subject and/or when obtaining consent for such transfer lies with the User who transferred the personal data.
2.9 The processing of your personal data is carried out in accordance with the requirements of the Law. The processing of personal data of persons located in the EU or who are EU citizens is governed, inter alia, by the General Data Protection Regulation (EU) 2016/679 (hereinafter — GDPR). Legislation of other countries may also establish additional requirements.
2.10 This Policy is an internal document of the Administration.
2.11 The Policy applies to all information that the Administration may obtain about the User when using the site, as well as in the course of the Administration performing any agreements and contracts with the User.
2.12 The data controller is released from liability for consequences arising in connection with the processing of personal data if it is not responsible for the event that caused such consequences.
2.13 You also agree that the owner of personal data has the right to provide access and transfer your personal data to third parties without any additional notices, solely if the purpose of their processing does not change and only in cases provided for by this privacy policy and/or the legislation of Ukraine.
2.14 No one under the age of 18 should provide us with personal information through the site. We do not knowingly collect personal information from persons under the age of 18. Parents and guardians must constantly monitor the related activities of their children.
3. Composition of Personal Data
3.1 For the purpose of its activities and fulfilment of its obligations, the Administration processes the User’s personal data provided by the User during registration on the site and ensures their storage.
3.2 The User’s personal data include:
3.2.1 information about your visits to and use of this site, including referral sources, length of visit, page views;
3.2.2 information about your computer, including your IP address, geographic location, browser type and version, and operating system;
3.2.3 information you enter when creating a profile on our site — for example, your name, profile pictures, IP addresses;
3.2.4 information such as your name and email address that you enter to set up subscriptions to our emails and/or newsletters;
3.2.5 information you enter when using the services on our site;
3.2.6 information generated when using our site, including when, how often and under what circumstances you use it;
3.2.7 information relating to anything you purchase, services you use, including your name, country and city, phone number, email address, cargo delivery cost calculation data;
3.2.8 information you post on our site with the intent to publish it on the internet, including your username, profile pictures;
3.2.9 information contained in any messages you send to us by email;
3.2.10 any other personal information you send to us.
3.3 Before disclosing another person’s personal information to us, you must obtain that person’s consent both to the disclosure and to the processing of that personal information in accordance with this Policy.
3.4 The Administration has the right to set requirements for the composition of personal data that must be provided when using the site. If certain information is not marked by the Administration as mandatory, its provision or disclosure is at the User’s discretion.
3.5 Data automatically transmitted to the Administration when the User uses the site by means of software installed on the device: IP address, type of operating system of the device, technical characteristics of equipment and software, date and time of access to the site.
3.6 Within the scope of its activities, we may collect certain information using advertising identifiers and analytical services.
3.7 We may allow third parties, such as analytics service providers, to collect information. The data they collect is protected in accordance with the current privacy policies of those third parties.
4. Grounds and Purposes of Personal Data Processing
4.1 The grounds for processing personal data are:
4.1.1 consent of the data subject to the processing of their personal data by the Administration;
4.1.2 conclusion and performance of a contract to which the data subject is a party or which is concluded for the benefit of the data subject, or to take measures preceding the conclusion of a contract at the request of the data subject;
4.1.3 the need for the Administration to comply with the requirements provided for by the Legislation.
4.2 The purposes of personal data processing are:
4.2.1 performance of functions assigned to the Administration in accordance with the legislation of Ukraine and the GDPR;
4.2.2 collection, storage and processing of personal data received on the site within the framework of the Law and the GDPR;
4.2.3 sending commercial (marketing) messages to the User containing additional information about services, current promotions and special offers regarding services provided by the Administration on the site;
4.2.4 identification of the data subject when using the service;
4.2.5 communication with the data subject if necessary, including sending offers, informational materials, messages, information and requests, advertising, as well as processing requests from the data subject;
4.2.6 improving the quality of the site, ease of use, development of new functionality and improvement of service quality;
4.2.7 conducting statistical and other studies based on depersonalised data;
4.2.8 fulfilment by the Administration of contractual and other obligations to the User under agreements concluded between the Administration and the User or third parties in the interests of the User.
5. Basic Principles of Personal Data Processing
5.1 The Administration processes personal data based on the following principles:
5.1.1 lawfulness of the purposes and methods of personal data processing;
5.1.2 good faith of the Administration as the owner of personal data (achieved by complying with the requirements of Ukrainian legislation on personal data processing);
5.1.3 achievement of specific, pre-defined purposes of personal data processing;
5.1.4 compliance of the purposes of personal data processing with the purposes pre-defined and declared at the time of collection;
5.1.5 compliance of the list and volume of processed personal data, as well as the methods of processing, with the declared purposes;
5.1.6 reliability of personal data, their sufficiency for the purposes of processing, inadmissibility of processing personal data excessive in relation to the purposes;
5.1.7 ensuring accuracy of personal data, their sufficiency when processing;
5.1.8 inadmissibility of combining databases containing personal data processed for incompatible purposes;
5.1.9 storage of personal data in a form that allows identification of the data subject no longer than required by the purposes of processing. Processed personal data is subject to destruction or depersonalisation upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by the legislation of Ukraine and the GDPR.
5.2 We must also take into account the periods for which we may need to retain your personal data to fulfil our legal obligations to you or supervisory authorities.
5.3 The Administration processes personal data for statistical or other research purposes subject to mandatory depersonalisation. The Administration does not process personal data concerning racial or ethnic origin, political, religious or philosophical beliefs, membership in political parties and trade unions, criminal convictions, as well as data concerning health, sex life, biometric and genetic data. Processing is carried out in compliance with the conditions defined by the legislation of Ukraine and the GDPR.
6. Terms of Personal Data Processing
6.1 The terms of personal data processing are determined based on the purposes of processing, but not longer than stipulated by the Legislation.
6.2 Personal data whose processing (storage) term has expired must be destroyed or depersonalised, unless otherwise provided by law. Storage is carried out in a form that allows identification of the data subject no longer than required by the purposes of processing, unless the storage term is established by law. Processed personal data is subject to destruction or depersonalisation upon achievement of the processing purposes or in case of loss of the need to achieve these purposes, unless otherwise provided by law. We must also take into account the periods for which we may need to retain your personal data to fulfil our legal obligations to you or supervisory authorities (in accordance with EU Regulation 261/2004).
6.3 Over time, we may minimise your personal data that we use or even make your data anonymous so that it can no longer be associated with you personally. In this case, we will be able to use this information without further notice to you.
6.4 If there has been no activity in your profile for more than 24 months, we reserve the right to delete your account, including all personal data stored in it. This means that you will no longer be able to access it.
7. Persons Authorised to Process Personal Data on behalf of the Administration
7.1 To achieve the purposes of this Policy, only those employees of the Administration who are assigned such duty in accordance with their official (employment) duties are authorised to process personal data. Access for other employees may be granted only in cases provided for by law. The Administration guarantees confidentiality and security of personal data from its employees during processing.
7.2 We have the right to disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors as reasonably necessary for the purposes set out in this Policy.
7.3 We have the right to disclose your personal information to any member of our group of companies to the extent reasonably necessary for the purposes set out in this Policy.
7.4 The Administration has the right to transfer personal data to third parties in the following cases:
7.4.1 the data subject has given written consent to such actions;
7.4.2 the transfer is provided for by Ukrainian or other applicable legislation within the framework of the procedure established by law. At the same time, access to personal data is not granted to a third party if the said party refuses to assume obligations to ensure compliance with the requirements of the Law or cannot ensure them;
7.4.3 in connection with any ongoing or prospective legal proceedings;
7.4.4 in order to establish, exercise or protect our legal rights (including providing information to others for the purposes of fraud prevention or credit risk reduction);
7.4.5 to the buyer (or prospective buyer) of any business or assets that we are selling (or contemplating selling);
7.4.6 to any person who, as we reasonably believe, may apply to a court or other competent authority for disclosure of that personal data where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal data.
7.5 The Administration has the right to entrust the processing of personal data to a third party with the consent of the data subject, unless otherwise provided by the legislation of Ukraine, on the basis of a contract concluded with the third party, the condition of which is confidentiality and non-disclosure of personal data.
7.6 Representatives of state authorities (including supervisory, law enforcement and other bodies) gain access to personal data processed by the Administration in the amount and manner determined by the Legislation.
7.7 Information we collect may be stored, processed and transferred between any countries in which we operate to enable us to use the information in accordance with this Policy.
7.8 Information we collect may be transferred to the following countries which do not have data protection laws equivalent to those in force in the European Economic Area: the United States of America, Japan, China and India.
7.9 Personal information that you publish on our site or submit for publication may be available via the internet around the world. We cannot prevent the use or misuse of such information by others.
8. Implementation of Personal Data Protection
8.1 The Administration’s activities regarding the processing of personal data in information systems are inextricably linked to the protection of confidentiality of the information received, unless this contradicts applicable law.
8.2 The personal data protection system includes organisational and/or technical measures determined taking into account current threats to the security of personal data and information technologies used in information systems. The Administration updates these measures as new technologies appear when necessary.
8.3 Exchange of personal data during their processing in information systems is carried out through communication channels protected by technical means of information protection.
8.4 When processing personal data in information systems, the Administration ensures:
8.4.1 measures aimed at preventing unauthorised access to personal data and/or their transfer to persons who do not have the right of access to such information;
8.4.2 timely detection of unauthorised access to personal data;
8.4.3 prevention of impact on technical means of automated processing of personal data that may disrupt their functioning;
8.4.4 possibility of immediate recovery of personal data modified or destroyed due to unauthorised access;
8.4.5 constant control over the level of personal data protection.
8.5 Confidentiality is maintained with respect to personal information, except in cases where the site technology or settings of the software used by the User provide for open exchange of information with other site Users or any internet users.
8.6 The Administration implements the following requirements of Ukrainian legislation in the field of personal data:
8.6.1 confidentiality requirements for personal data;
8.6.2 requirements for ensuring the exercise of the data subject's rights;
8.6.3 requirements for ensuring the accuracy of personal data, and in certain cases their relevance to the purpose of processing, with measures taken to delete or clarify incomplete or inaccurate data;
8.6.4 requirements for the protection of personal data from unauthorised or accidental access, destruction, distortion, blocking, copying, provision, dissemination, as well as from other unlawful actions;
8.6.5 other requirements of the Law.
8.7 In accordance with the Law, the Administration independently determines the composition and list of measures necessary and sufficient to fulfil the obligations provided for by the legislation in the field of personal data.
8.8 The Administration adheres to the principle of minimisation of personal data. We process only the information about you that we need, or information beyond the necessary processing that you provide with your consent.
8.9 In addition, we have configured the site to provide services in a way that ensures maximum confidentiality that can be adjusted at your discretion. When transferring personal data to state authorities, we always use the most secure and proven methods.
9. Rights of the Data Subject
9.1 Rights of data subjects under the legislation of Ukraine:
9.1.1 to know about the sources of collection, location of their personal data, the purpose of their processing, location of the controller or to give an appropriate instruction to obtain this information to authorised persons, except in cases established by law;
9.1.2 to receive information about the conditions of providing access to personal data, including information about third parties to whom their personal data is transferred;
9.1.3 to access their personal data;
9.1.4 to receive no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, an answer as to whether their personal data is processed or stored, and which ones;
9.1.5 to submit a reasoned request to the Administration objecting to the processing of their personal data;
9.1.6 to submit a reasoned request for the change or destruction of their personal data if the data is processed unlawfully or is inaccurate;
9.1.7 to protect their personal data from unlawful processing and accidental loss, destruction, damage in connection with intentional concealment, failure to provide or untimely provision, as well as to protect against the provision of information that is inaccurate or discredits the honour, dignity and business reputation of an individual;
9.1.8 to lodge complaints about the processing of their personal data with the Administration, the Ukrainian Parliament Commissioner for Human Rights or the court;
9.1.9 to apply legal remedies in case of violation of the legislation on personal data protection;
9.1.10 to make reservations about limiting the right to process their personal data when giving consent;
9.1.11 to withdraw consent to the processing of personal data;
9.1.12 to familiarise themselves with the mechanism of automated processing of personal data;
9.1.13 to protection from an automated decision that has legal consequences for them.
9.2 The Administration has the right to entrust the processing of personal data to a third party with the consent of the data subject, unless otherwise provided by the legislation of Ukraine, on the basis of a contract concluded with the third party, the condition of which is confidentiality and non-disclosure of personal data.
9.3 Representatives of state authorities (including supervisory, law enforcement and other bodies) gain access to personal data processed by the Administration in the amount and manner determined by the legislation of Ukraine.
9.4 Other rights of data subjects under the GDPR:
9.4.1 In addition to Ukrainian legislation on personal data protection, the Administration carefully ensures your rights established by the GDPR;
9.4.2 Right to information.
9.5 We are ready to provide data subjects with information about which of their personal data we process.
9.6 If you wish to know which of your personal data we process, you can request this information at any time, including by contacting the Administration. The list of data we must provide can be found in Articles 13 and 14 of the GDPR. When contacting us, you must inform us of your specific requirements so that we can lawfully consider your request and respond.
9.7 Please note that if we cannot verify your identity through electronic messages or phone calls, or in case of reasonable doubts about your identity, we may ask you to provide an identity document, including in person at the Administration’s location. This is the only way we can avoid disclosing your personal data to a person who may impersonate you.
9.8 We process requests as quickly as possible, but please remember that providing a full and lawful response regarding personal data is a complex process that may take up to one month (up to 30 working days).
10. Cookies
10.1 Our site uses cookies. Cookies can be “persistent” or “session”: persistent cookies will be stored by the browser and will remain valid until their set expiry date, unless deleted by the user beforehand; session cookies, on the contrary, will be deleted after the end of the session or when the browser is closed. Cookies usually do not contain any information that identifies the user. However, your personal information that we have may be linked to information stored in and obtained from cookies.
10.2 On our website, we use Google Analytics and Google Ads (formerly known as AdWords) to recognise a computer when a user visits the website, navigates the site, uses the shopping cart on the site, etc.
10.3 We use cookies for the following purposes: ease of use of the site; analysis of website use; site administration; fraud prevention and improvement of site security; personalisation of the site for each user; targeted advertising that may be of interest to individual users.
11. Right to Rectification of Data About You
11.1 If you find that some personal data we process about you is incorrect or outdated, please inform us. In this case, we may ask you to provide an identity document, including in person at the Administration’s location.
11.2 If you want to correct personal data processed by us, you can do it yourself by logging into your personal account on the site or by contacting the Administration.
11.3 In certain cases, we cannot change your personal data. In particular, this includes cases where your personal data has already been used in the process of contract performance and/or is contained in a tax document issued in accordance with tax legislation.
12. Withdrawal of Consent to Personal Data Processing and Right to Be Forgotten
12.1 If the Administration processes your personal data on the basis of consent to processing (in particular for marketing/advertising mailings), further processing can be stopped at any time. It is sufficient to withdraw consent to such processing.
12.2 You can also exercise your right to be forgotten. In cases provided for in Article 17 of the GDPR, the Administration will destroy your personal data that it processes, except for personal data that we are obliged to retain in accordance with legal requirements.
12.3 In this case as well, for security purposes, the Administration may ask you to provide an identity document, including in person at the Administration’s location.
13. Place of Storage of Personal Data
13.1 The Administration has a personal data database. To ensure their security, we use cloud storage of the company www.barmash.com.ua/en. The data is located in data processing centres in Ukraine.
14. Changes to the Privacy Policy
14.1 This Policy may be changed or terminated by the Administration unilaterally without prior notice to users, including if required by law. The new version of the Policy enters into force from the moment it is posted on the site, unless otherwise provided by the new version of the Policy. Therefore, we ask you to periodically check the current Policy to ensure you are aware of the most up-to-date version.
15. Who You Can Contact for the Protection of Your Personal Data
15.1 If you have any questions, comments, complaints or wishes regarding the protection and processing of personal data, you can contact us via the link www.barmash.com.ua/en or write to the email: order@glyanec.net.
15.2 Be sure to indicate your first name, last name, email address, as well as detailed questions, comments, complaints or requirements in all correspondence.
15.3 The administrative body for the protection of personal data in Ukraine is the Department for Personal Data Protection of the Secretariat of the Ukrainian Parliament Commissioner for Human Rights. You can contact it with complaints or suggestions if you believe that your rights have been violated in connection with the processing of personal data.