1. General provisions

1.1. The conduct of business activities of "Agrarian Food Technologies Production" LLC (hereinafter - the Company) involves the processing of personal data of buyers of goods and users of the Company's services, its counterparties and employees. The company defines as a priority obligation to process personal data exclusively on the grounds and in the manner determined by the legislation of Ukraine.

1.2. The purpose of the Policy of General Principles of Personal Data Processing LLC "Agrarian Food Technologies Production" (hereinafter - the Policy) is to ensure the appropriate level of accessibility, transparency and the process of personal data processing in the course of the Company's business activities.

1.3. The policy was developed in accordance with the Constitution of Ukraine, the laws of Ukraine "On the Protection of Personal Data"; "About information"; "On access to public information"; DSTU ISO/IEC 27001:2015 "Information technologies. Protection methods. Information security management systems. Requirements", DSTU ISO/IEC 27002:2015 "Information technologies. Protection methods. Compendium of practices regarding information security measures", adopted by the order of the State Enterprise "Ukrainian Research and Training Center for Standardization, Certification and Quality Problems" dated 18.12.2015 No. 193 (with amendments), Standard procedure for processing personal data, approved by the order of the Commissioner of the Verkhovna Rada of Ukraine on human rights dated January 8, 2014 No. 1/02-14, other legislative acts; Privacy policy at "Agrarian Food Technologies Production" LLC.

1.4. In this Policy, the terms are used in the meanings set forth in the laws of Ukraine "On Personal Data Protection", "On Information".

​

2. Scope and validity period of the Policy

2.1. The policy is mandatory for application in the Company as part of the personal data processing process and applies to all structural divisions of the Company.

2.2. The term of validity of the Policy is not limited. The Company has the right to make changes to the Policy, which it informs about by posting the updated version on the Company's official website http://www.afth.com.ua (hereinafter - the website).

​

3. Purpose of personal data processing

The purpose of the processing of personal data by the Company is to provide high-quality services for online ordering of the Company's products and services to subjects of economic activity and private individuals (subjects of personal data), processing of information that constitutes the profile of service consumption, settlement of issues in the field of labor relations and economic activity in the manner determined by legislation.

​

4. Principles of personal data processing

4.1. Transparency of the organization of the personal data processing process

The policy is published on the official website of the Company.

The grounds for processing personal data by the Company are:

• consent of the subject of personal data to their processing;

• a transaction to which the subject of personal data is a party, or which was concluded for his benefit;

• performance of the Company's duties provided for by law;

• protection of the Company's legitimate interests, except in cases where the need to protect the fundamental rights and freedoms of the subject of personal data in connection with the processing of his data outweighs such interests.

The terms of processing and storage of personal data are determined taking into account the peculiarities of the processes of online store services, analysis of the quality of the provision of such services.

4.2. Availability of personal data

Personal data are available to the subject of this data and access to them is provided in accordance with the law on personal data protection.

4.3. Consent of the subject of personal data

The company processes personal data of personal data subjects for the purpose of providing them with online store services on the basis of a personal data processing permit granted in accordance with current legislation for the exercise of its powers and for the execution of a transaction to which the subject of personal data is a party.

The subject can voluntarily give the Company consent to the processing of his personal data for the purpose of receiving advertising and informational materials or for another purpose determined by the Company. The subject's consent to the processing of his personal data must be voluntary and informed. Consent can be given by the subject in written or electronic form, which makes it possible to conclude that it has been given. Documents (information) confirming the subject's consent to the processing of his personal data are kept by the Company for the duration of the processing of such data.

The procedure for accessing personal data of third parties is determined by the terms of the personal data subject's consent given to the Company for the processing of this data, or in accordance with the requirements of the law.

​

5. Peculiarities of processing and definition of personal data

5.1. Types of personal data processing

Personal data in the Company is processed with the use of automation tools, or without the use of such tools, taking into account the peculiarities of the processes of providing online store services and the level of automation of such processes.

The order of processing, protection and access to personal data for different types of processing are determined by separate internal regulatory documents of the company.

5.2. Determination of subjects of personal data in the case of using the Company's web resources

Users using the Company's web resources are subjects of personal data only from the date of placing an order or their registration on the web resource and consent to the processing of their personal data.

5.3. Processing of personal data of subjects who receive online store services

Legal entities are not subjects of personal data.

Processing of personal data of users of the online store (individuals) is carried out in accordance with this Policy and legislation.

5.4. Use of information of the subject of personal data

The information received from the user of the online store services (subject of personal data) is used for:

• creation of an account by a user of online store services that uses information resources (web resources) of the Company;

• provision of a service or function ordered by the user;

• communication with users for the purpose of informing about personalized unique offers and promotions of the Company;

• assessment and analysis of market demand, products and services provided by the Company;

• effective customer service;

• providing updates and technical support for services, including the online store;

• other purposes in the amount sufficient for quality provision of services by the Company.

5.5. Restrictions on further transfer (distribution) of personal data

The company transfers information received from users of online store services (subjects of personal data) as part of the provision of services to third parties for the purpose of properly fulfilling their duties, in accordance with the requirements of the law, and personalized notification of users for the relevant services for the purpose of their improvement and awareness such users.

The transfer of personal data is possible exclusively on a contractual basis, provided that it is properly stored and protected by a third party and/or administrator, as well as a clear definition of his/her responsibility for ensuring adequate protection during the processing of personal data, with the exception of cases expressly provided for by law. The contract also defines the composition of personal data to be transferred, the method and purpose of their processing, a set of organizational and technical protection measures to be taken by a third party (administrator).

The transfer of personal data to foreign subjects of relations for the purpose of processing abroad is carried out in compliance with the conditions defined in Art. 29 of the Law of Ukraine "On Protection of Personal Data" (hereinafter - the Law).

The transfer of personal data to third parties in the framework of the provision of online store services is carried out in the manner determined by the Company's contractual obligations.

Dissemination of personal data involves the transfer of information about a natural person with the consent of the subject of personal data.

Dissemination of personal data by the Company without the consent of the subject or a person authorized by him is permitted in cases defined by law and only (if necessary) in the interests of national security, economic well-being and human rights.

​

6. Rights and obligations of the subject of personal data

6.1. Rights and obligations of the user of online store services — the subject of personal data

The subject of personal data has the right to receive information about the procedure for processing his personal data, as well as other rights defined by current legislation.

The subject of personal data is obliged to act in accordance with the requirements of the law.

The company is not responsible for the violation by the user of the online store services of the legislation on the protection of personal data, including his distribution of personal data of persons on whose behalf and in whose interests he receives the services of the online store.

6.2. The right to correct, destroy or block access to personal data

The subject of personal data has the right to free correction or removal (in whole or in part) of information about him in the Company's information systems, in the event that they are incorrect, inappropriate or excessive, or their storage is carried out beyond the time necessary to provide the relevant services. If the extraction of such data is technically impossible or not provided for by law, then such data are protected from their processing by blocking access to them or by other technically possible means.

6.3. The right of access to personal data

The subject of personal data has the right to free access to data about himself in accordance with the procedure determined by the Company.

The subject of personal data has the right to request access to his personal data. The company takes the necessary measures to clarify all the circumstances stated in the request.

6.4. Appealing the decision to delay or deny access to personal data

An appeal against a decision to delay or deny access to personal data is carried out in accordance with current legislation.

6.5. Withdrawal of consent to the processing of personal data

The subject of personal data has the right to withdraw consent to the processing of personal data by submitting a written request.

In the case of withdrawal of consent to the processing of personal data, which was given when registering in the personal account of the Company's web resource, such personal account shall be deleted.

​

7. Processing and protection of personal data

7.1. The processing and protection of personal data by the Company is based on a risk-oriented approach to the prevention, detection and elimination of threats of unauthorized access to personal data and/or their illegal processing.

7.2. The company undertakes to ensure the protection of personal data processed as part of the provision of online store services, in accordance with the requirements of the law, as well as the provisions of this Policy.

7.3. The General Director of the Company determines the persons and/or structural units responsible for the protection of personal data, in accordance with the legislation and this Policy.

7.4. The duties of the structural unit/person responsible for the organization of work related to the protection of personal data during their processing are defined in job instructions and regulations, other regulatory documents.

7.5. The company cooperates with state authorities, officials responsible for the protection of personal data in Ukraine, in accordance with the requirements of the law.

This Policy is available for review by users of online store services and is posted on the Company's official website.