Consent to the processing, storage, distribution, personal data
This Consent of the subject of personal data on the processing of his personal data was developed in accordance with the Law of Ukraine dated 06/01/2010 No. 2297-VI "On the protection of personal data" as amended on 12/21/2019 (hereinafter referred to as the "Law") and determines the main provisions for processing , use, distribution, protection, collection, accumulation and other necessary actions with personal data, concluded between the "High Up" online store (hereinafter referred to as the Owner / Manager of personal data) and individuals (hereinafter referred to as the "personal data subject"), entering into a contractual relationship with the Manager.
1. Definition of terms
Personal data base - a named set of ordered personal data in electronic form and / or in the form of personal data files.
Processing of personal data - any action or set of actions, such as collection, registration, accumulation, storage, adaptation, modification, renewal, use and distribution (distribution, sale, transfer), depersonalization, destruction of personal data, including using information ( automated) systems.
Blocking of personal data - temporary suspension of the processing of personal data.
The owner of personal data - an individual or legal entity, determines the purpose of processing personal data, establishes the composition of this data and the procedures for their processing, unless otherwise provided by law.
Recipient - a natural or legal person to whom personal data is provided, including a third party;
Third party - any person, with the exception of the subject of personal data, the owner or manager of personal data and the Commissioner of the Verkhovna Rada of Ukraine for Human Rights, to whom the owner or manager of personal data transfers personal data.
Use of personal data - any actions of the owner to process this data, actions to protect them, as well as actions to grant partial or full rights to process personal data to other subjects of relations related to personal data, performed with the consent of the subjects "of the personal data object or in accordance with by law.
Collection of personal data - actions to select or organize information about an individual.
Accumulation of personal data - actions to combine and systematize information about an individual or a group of individuals or enter these data into a personal data base.
Dissemination of personal data - actions to transfer information about an individual with the consent of the subject of personal data.
Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state of the authority of a foreign state, a foreign individual or a foreign legal entity.
Destruction of personal data - actions, as a result of which it becomes impossible to restore the content of personal data in the information system of personal data and (or) as a result of which material carriers of personal data are destroyed.
The subject of personal data - an individual, voluntarily and with full awareness of the consequences, provides the owners and / or the Manager of personal data with his personal data.
The consent of the subject of personal data is a voluntary expression of the will of an individual (subject to her knowledge) to grant permission for the processing of his personal data in accordance with the formulated purpose of their processing, expressed in writing or in a form that allows us to conclude that consent has been granted.
Personal data - information or a set of information about an individual who is identified or can be specifically identified.
2. General provisions
2.1 The Company processes, stores and uses personal data, and also determines the purposes of processing personal data, the composition of personal data to be processed, as well as actions (operations) performed with personal data, namely:
2.1.1. Collection of personal data;
2.1.2. Accumulation and storage of personal data;
2.1.3. Dissemination of personal data;
2.1.4. Use of personal data;
2.1.5. Recovery of personal data;
2.1.6. Destruction of personal data;
2.1.7. Inclusion of personal data in databases;
2.1.8. Depersonalization of personal data;
2.1.9. Other actions on personal data that are necessary for the purposes of this Consent.
2.2 The Company processes and stores personal data in accordance with the Law of Ukraine "On the Protection of Personal Data" and other regulatory legal acts of the legislation of Ukraine.
2.3 This consent also applies to cases where the Company acts as a third party, processes the personal data of subjects on behalf of another owner / manager of personal data or other persons providing intermediary services to the Company and receives personal data of subjects of personal data in order to further fulfill the personal data of the conclusion and execution of transactions (contracts) between the Manager and such subjects of personal data.
3. Principles of personal data processing
3.1 The Company accepts and ensures the implementation of the following principles of personal data processing:
3.1.1. personal data should only be processed for lawful purposes;
3.1.2. processing is carried out subject to the consent of the subject of personal data to the processing of such data;
3.1.3. only personal data that correspond to the purposes of their processing are subject to processing;
3.1.4. the content and scope of the processed personal data must correspond to the stated purposes of processing;
3.1.5. when processing personal data, the accuracy of personal data, their sufficiency, and, if necessary, their relevance in relation to the purposes of processing personal data, must be ensured;
3.1.6. personal data must be processed in compliance with data protection requirements;
3.1.7. personal data should not be transferred to foreign subjects of relations related to personal data, if the jurisdictions of such foreign subjects do not provide adequate protection of personal data;
3.1.8. processed personal data is subject to destruction or depersonalization upon achievement of the purposes of processing or in case of loss of the need to achieve these purposes, unless otherwise provided by this agreement or other legislation of Ukraine;
3.1.9. when obtaining access to personal data, the Company is obliged not to disclose to third parties and not to distribute personal data without the consent of the subject of personal data, unless otherwise provided by this agreement or other legislation of Ukraine.
3.1.10. The subject of personal data of personal data, by joining the terms of this Consent, gives his consent to the entry and use of his personal data in the User Base and to the processing of his personal data by the Owner (in particular, to collect, register, accumulate, store, adapt, change, renew, use and distribution, depersonalization, destruction of personal data, including using information (automated) systems and other actions that the Owner of his personal data can perform: name, surname, atkovi, communication number, electronic identification data (IP address, telephone, e-mail), data on the place of residence, as well as other personal data and information that is provided to fulfill the requirements of the current legislation and / or voluntarily by the Owner's Personal Data Subject solely for the purpose of registering the Personal Data Subject in the user database with subsequent by sending them to the Personal Data Subject mail messages and sms messages, including advertising and information mailings, in order to ensure the implementation of civil law and economic legal relations, settlements, accounting and tax accounting, for communication and contractual relations with state authorities, contractors and other third parties in the course of business activities, as well as for other purposes that do not contradict the current legislation.
4. Conditions and purposes of processing
4.1. Processing of personal data by the Manager is carried out in the following cases:
4.1.1. subject to the provision by the subject of personal data of consent to the processing of such data, which is expressed in writing or in a form that allows us to conclude that consent has been granted;
4.1.2. necessary to exercise the rights and legitimate interests of the Company or third parties or to achieve public interests;
4.1.3. necessary for the execution of an agreement to which the subject of personal data is a party or beneficiary or guarantor, as well as to conclude an agreement on the initiative of the subject of personal data or an agreement under which the subject of personal data will be the beneficiary or guarantor;
4.1.4. is necessary to exercise the rights and fulfill the obligations of the subject of personal data in the field of labor relations in accordance with the law, with appropriate protection.
5. Processing of personal data
5.1. When processing personal data, the Company performs the following actions (operations) or a set of actions (operations), using automation tools or without using such tools with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion and destruction, except in cases where a narrower scope of actions with personal data is determined on behalf of the subject of personal data on behalf of which the Partnership is acting, or follows from the conditions for processing personal data.
5.2. Processing of special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, health status, intimate life, private life, information about the membership of the subject of personal data in public associations or their trade union activities is not carried out.
5.3. The subject of personal data may withdraw this consent by sending written notice to the owners at least 90 (ninety) days before the expected date of withdrawal of this consent. The personal data subject agrees that during the specified period the Owner is not obliged to stop processing personal data and destroy the personal data of the personal data subject. The revocation will not have retroactive effect in relation to personal data processed before the entry into force of such revocation.
5.4. The owner / manager of personal data undertakes, in accordance with the requirements of the legislation of Ukraine in the field of personal data protection, to ensure adequate protection of personal data from illegal processing, as well as from illegal access to them, including taking the necessary measures to prevent the disclosure of personal data by employees and / or others authorized persons of the owners to whom such personal data were entrusted or which became known to them in connection with the implementation of the Agreement.
6. Terms of storage and requirements for the destruction of personal data
6.1. Personal data is subject to deletion or destruction in the event of:
6.1.1. the period of data storage, the specific consent of the subject of personal data to the processing of these data or the law;
6.1.2. termination of legal relations between the subject of personal data and the owner or manager, unless otherwise provided by law;
6.1.3. the entry into force of a court decision on the deletion or destruction of personal data.
6.2. The period of storage of personal data is 3 (three) years from the date the subject of personal data provides this consent.
6.3. After the expiration of the personal data storage period, which is provided for in clause 6.2. of this Consent, the Owner and / or the Manager of personal data has the right to automatically extend the period of storage of personal data for 3 (three) years, if the subject of personal data does not require the destruction of personal data after the expiration of the period of storage of personal data.
7. Ensuring the protection of personal data
7.1. Owners, processors of personal data and third parties are obliged to ensure the protection of these data from accidental loss or destruction, from illegal processing, including illegal destruction or access to personal data.
7.2. The Owner is not responsible for any processing, failure to ensure the mode of access and protection of personal data of personal data subjects by third parties, including employees of the Owner, if the provision of access to such personal data (or other action that created the possibility of further unauthorized processing by third parties) was committed By the owner or another person with the permission of the subject of personal data outside the performance of obligations under the Agreement for personal purposes or other purposes not related to the performance of obligations under the C OVOR, using technical means or other materials / equipment of the owner.
8. Other terms
8.1. The subject of personal data joins and accepts the terms of this Agreement by providing written consent or consent in a form that allows us to conclude that the subject of personal data has given consent and identify such subject of personal data.
8.2. The subject of personal data joins this Consent by his free will, without any coercion and realizing the legal consequences of this Agreement.
8.3. By joining this Consent, the subject of personal data confirms that the provisions of this Consent are clear and understandable to him.
8.4. The destruction of the personal data of the subject of personal data is carried out in the event of the requirement of the subject of personal data to destroy his personal data within the time limits provided for in clauses 6.2-6.3 of this Consent.
8.5. This Consent is considered concluded and enters into legal force from the moment the subject of personal data joins the terms of this Agreement.
8.6. The text of this Consent is available on the website of the owner/manager of personal data, which is available to an unlimited number of people at the link.