Personal data processing and privacy policy
ArmGrossCorporation LLC
1. General Provisions
1.1. This Personal Data Processing and Privacy Policy (hereinafter – the Policy) is developed in accordance with the Constitution of the Republic of Belarus, the Law of the Republic of Belarus No. 99-Z “On Personal Data Protection” dated May 7, 2021 (hereinafter – the Law), and other regulatory legal acts of the Republic of Belarus.
1.2. The Policy defines the procedure and conditions for processing personal data and applies to all information that ArmGrossCorporation LLC (hereinafter – the Operator, the Company) may obtain about an individual (data subject) when using the website uac.by (hereinafter – the Site), during the processing of inquiries, resumes, execution of contracts, correspondence, as well as when providing accounting, legal, and related services.
1.3. The purpose of this Policy is to ensure proper protection of personal data against unlawful access and disclosure, as well as to provide data subjects with comprehensive information about the procedure for processing their data by the Operator.
2. Personal Data Operator
Full name: Limited Liability Company “ArmGrossCorporation”
UNP: 193485868
Legal address: 220113, Minsk, Literaturnaya St. 27, Prem. 1-19/1
Email: info@uac.by
Phone: +375 17 395-16-51
3. Categories of Personal Data Subject to Processing
The Operator may process the following categories of personal data received from data subjects, including through forms on the Site, by email, phone, mail, or in person:
last name, first name, patronymic;
contact information (phone number, email address, postal address);
information contained in inquiries, applications, proposals, questions, feedback;
data contained in questionnaires, resumes (education, work experience, qualifications, etc.);
data contained in contracts and concluded agreements (details, position, signature, information about the representative, etc.);
information contained in business correspondence and during consultations;
information automatically transmitted when visiting the Site (IP address, browser data, device type, operating system, location, cookies data, etc.). The processing of cookies is regulated by a separate Cookie Policy;
other data voluntarily provided by the personal data subject.
4. Purposes of Processing Personal Data
The Operator processes personal data solely for the purposes of:
reviewing and registering inquiries, applications, proposals, questions, feedback from data subjects;
organizing feedback, consulting, and informing upon requests from data subjects;
processing resumes, considering candidates for vacancies, personnel selection;
concluding, executing, and terminating civil contracts (including contracts for accounting, legal, and related services);
maintaining business correspondence and interaction with clients, partners, and other counterparties;
fulfilling obligations stipulated by the legislation of the Republic of Belarus (including tax, labor, archival legislation, accounting legislation);
ensuring the functioning, analysis, and improvement of the quality of the Site and customer service;
implementing the Operator’s lawful interests, provided that such processing does not violate the rights and freedoms of the data subject (e.g., protecting the Operator’s rights and interests in court, maintaining records of interactions).
5. Legal Bases for Processing
The Operator processes personal data on the following legal bases:
voluntary consent of the personal data subject (when consent is the sole basis and required by law, e.g., for marketing communications or installation of certain types of cookies);
necessity to process personal data for the conclusion or execution of a contract to which the data subject is a party or for whose benefit he/she acts;
compliance with the requirements of the legislation of the Republic of Belarus (fulfillment of legally established obligations);
existence of a lawful interest of the Operator (e.g., maintaining correspondence, ensuring business security, maintaining statistics), provided that such interest does not contradict the rights and legitimate interests of the personal data subject.
6. Principles of Personal Data Processing
The processing of personal data by the Operator is based on the following principles:
legality, fairness, and transparency;
processing data for strictly defined, pre-declared, and legitimate purposes;
preventing excessiveness of processed data in relation to the stated purposes;
ensuring accuracy and relevance of personal data;
limiting the storage period of personal data;
ensuring security and confidentiality of personal data.
7. Storage Period of Personal Data
The storage period of personal data depends on the purpose of processing, the legal basis, and the requirements of the legislation of the Republic of Belarus:
inquiries, applications, proposals — up to 5 years after completion of review or last interaction;
resumes of candidates for vacancies — no more than 1 (one) year from receipt, if an employment contract is not concluded;
civil contracts and related documents — from 3 to 10 years after the expiration of the contract, depending on the type of document and the requirements of archival and tax legislation;
business correspondence — up to 5 years, unless a different period is established by law or contract;
data processed based on consent — until the purpose of processing is achieved or until consent is withdrawn by the data subject (whichever comes first), unless another period is established by law;
other cases — in accordance with the requirements of archival legislation and the Operator’s internal regulations.
Upon expiration of the storage period, personal data shall be deleted or anonymized, unless otherwise provided by law.
8. Transfer of Personal Data to Third Parties
The Operator does not disclose or transfer personal data of subjects to third parties without legal grounds. Transfer is possible solely in the following cases:
with the explicit consent of the personal data subject;
if the transfer is necessary for the execution of a contract to which the data subject is a party, or for taking pre-contractual measures (e.g., transferring data to a third-party service provider, if expressly provided for in the contract or necessary for its execution);
upon a justified request from state bodies, courts, law enforcement, and supervisory authorities within their competence and in accordance with legal requirements;
in other cases expressly provided for by the legislation of the Republic of Belarus.
The Operator ensures that third parties receiving personal data take measures to protect it in accordance with the law.
9. Rights of the Personal Data Subject
The personal data subject has the right to:
Right to information: Know whether their personal data is being processed, and receive information about the Operator, purposes, categories of data, processing periods, data recipients, and the source of their receipt.
Right of access to their data: Access their personal data and obtain a copy.
Right to rectification: Demand changes to their personal data if the data is incomplete, inaccurate, or outdated.
Right to erasure (“right to be forgotten”): Demand the deletion of their personal data in cases provided for by law (e.g., data is no longer needed for the stated purposes, storage period has expired, consent is withdrawn in the absence of other processing grounds).
Right to blocking: Demand blocking of their personal data if it is inaccurate or processed unlawfully.
Right to restriction of processing: Demand restriction of processing of their personal data if there are grounds provided for by law.
Right to withdraw consent: Withdraw their consent to the processing of personal data at any time without giving reasons, if the processing is based on such consent.
Right to appeal: Appeal the actions (inaction) and decisions of the Operator related to the processing of their personal data to the authorized body for the protection of the rights of personal data subjects or to the court.
Procedure for exercising the right to withdraw consent:
To withdraw consent, it is necessary to send a written application to the Operator in free form.
The application must contain: last name, first name, patronymic of the personal data subject; address of the personal data subject; date of birth of the personal data subject (if date of birth data was provided); identification number of the personal data subject (if available and if data about it was provided when giving consent); statement of the essence of the requirements; personal signature or electronic digital signature of the personal data subject. It is also recommended to indicate in the application which specific data or processing purposes the withdrawal affects.
The application may be sent:
by email: info@uac.by (the application must be signed with an electronic digital signature);
by mail: 220113, Minsk, Literaturnaya St. 27, Prem. 1-19/1.
The Operator is obliged, within 5 working days after receiving the application of the personal data subject, to terminate the processing of personal data in accordance with its content, carry out their deletion, and notify the personal data subject about it.
Important exceptions: Withdrawal of consent is not retroactive and does not apply to the processing of personal data that has already been carried out. Withdrawal of consent is not a ground for termination of processing of personal data if there are other legal grounds provided for by the Law and other legislative acts (e.g., processing for the execution of a contract or legal requirements).
Consequences of withdrawal: Withdrawal of consent may entail the impossibility of further provision of services if their provision requires processing of data covered by the withdrawn consent (e.g., impossibility of feedback on an inquiry, execution of a contract, provision of consultation).
10. Measures to Protect Personal Data
The Operator takes necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, alteration, blocking, copying, dissemination, provision, deletion, as well as from other unlawful actions regarding personal data. Such measures include:
restricting access to personal data only to authorized employees;
storing data in secure information systems and on secure media;
implementing access control to personal data;
applying technical means of information protection (encryption, antivirus protection, intrusion detection systems, etc.);
conducting internal audits of data processing and protection processes;
regularly assessing risks and threats to personal data security.
11. Responsibility for Providing Inaccurate Information
The personal data subject is responsible for the completeness, accuracy, and reliability of the data provided by them. Providing the Operator with false, incomplete, or incorrect data may result in refusal to process the inquiry, provide information, or render services.
In case of transfer of third parties’ personal data through forms on the Site or in other ways, the data subject guarantees that they have legal grounds for such transfer, including obtaining the necessary consent from the data subject. The Operator has the right to suspend data processing or take other measures provided for by law upon detecting signs of violation of data subjects’ rights or legislation.
12. Changes to the Policy
The Operator has the right to make changes to this Policy in case of changes in the legislation of the Republic of Belarus, requirements of regulatory authorities, or changes in internal data processing processes. The updated version of the Policy is published on the website uac.by. Data subjects can familiarize themselves with the current version of the Policy on the Site.
Date of publication of the current version: 23.06.2025