Security policy when working with the EURO-CONTRACT online store

SECURITY POLICY

This Security Policy is an integral part of the Purchase and Sale Agreement (Contract) and/or the Public Offer Agreement, which was concluded with us at the time of signing the Purchase and Sale Agreement (Contract) or prior payment of the price (full or partial) of the goods. It also applies if you have ordered a derivative service (for example cash on delivery) from another company (for example a partner). At the same time, these third parties may also have their own privacy policies (other similar documents) that apply when collecting information about you. In addition, this Policy on security and use of cookies applies to the personal data of the recipient in whose interests the goods are delivered.

I. GENERAL INFORMATION

1. This security policy and the use of cookies is a set of rules for the processing of personal data and the collection of cookies (hereinafter: the Policy) of “EVRO-CONTRAKT” LLC with its registered office at 18028, Cherkasy, Vyacheslava Chornovola Street, 164, office 228, EDPROU code 37551479 (hereinafter: “EVRO-CONTRAKT” LLC or "Administrator" or "Company"), incl. on the website https://ek.ck.ua/ (hereinafter: "Service") determines what data we collect about consumers who use our services, as well as about other persons whose personal data we process as part of our activities, including job candidates.
2. This Policy also applies to the processing of personal data and communication in the Company's accounts on social networks (for example, Facebook, Viber, Skype, Signal, WhatsApp, Telegram, Google), by phone, e-mail or letter, how we use it and with whom let's share. This information also describes the measures we take to protect your personal data.
3. Users can contact the Administrator in the following way:
   • A. by letter to the following address: “EVRO-CONTRAKT” LLC, 18028, Cherkasy, Vyacheslava Chornovola Street, 164, office 228;
   • B. by e-mail: vv@ek.ck.ua;
   • C. by phone: +380-95-742-99-56

   If you have any questions, comments or wishes regarding the protection and processing of your personal data, you can contact us:

   • A. by letter to the following address: “EVRO-CONTRAKT” LLC, 18028, Cherkasy, Vyacheslava Chornovola Street, 164, office 228
   • B. by e-mail: vv@ek.ck.ua

   Be sure to include your full name, email address, and detailed questions, comments, complaints, or requests in all correspondence.

4. Personal data is any information or a set of them relating to a natural person who is identified or can be specifically identified. The scope of this type of data includes, but is not limited to, first name, patronymic, last name, address, telephone number and email address. Information from which it is not possible to identify or specify an individual (for example, statistical data) is not considered personal data.

II. CURRENT LEGISLATION ON PERSONAL DATA PROTECTION AND CONFIDENTIALITY OBLIGATIONS

“EVRO-CONTRAKT” LLC is subject to the Law of Ukraine “On the Protection of Personal Data” dated June 01, 2010 No. 2297-VI and the provisions of the Regulation of the European Parliament and Council (EU) 2016/679 of April 27, 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (hereinafter: - GDPR), as well as other relevant national legislation on data protection.

III. PROTECTION OF INFORMATION

1. "EVRO-CONTRAKT" LLC, applying appropriate technical and organizational measures, makes all physical and technical efforts to protect personal data from loss, damage, disclosure to unauthorized persons, alteration or improper use.
2. All notifications regarding the protection of personal data are registered and explained in detail and analyzed in accordance with current legislation.

IV. RIGHTS OF DATA SUBJECTS

1. Your rights regarding the processing of personal data in accordance with the legislation of Ukraine:
   • to know about the sources of collection, the location of their personal data, the purpose of their processing, the location or place of residence (residence) of the owner or manager of personal data or to give an appropriate mandate to receive this information to persons authorized by them, except for cases established by law;
   • to receive information about the terms of providing access to personal data, including information about third parties to whom personal data is provided;
   • to access your personal data;
   • to receive no later than thirty calendar days from the date of receipt of the request, except for cases provided by law, an answer on whether his personal data is being processed, as well as to receive the content of such personal data;
   • present a motivated demand to the owner of personal data with an objection to the processing of his personal data;
   • make a motivated demand for the change or destruction of your personal data by any owner and manager of personal data, if these data are processed illegally or are unreliable;
   • to protect your personal data from illegal processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision of data, as well as protection from providing information that is unreliable or defames the honor, dignity and business reputation of a natural person;
   • file complaints about the processing of your personal data to the Human Rights Commissioner of the Verkhovna Rada of Ukraine or to the court;
   • apply legal remedies in case of violation of the legislation on the protection of personal data;
   • enter a disclaimer on the limitation of the right to process one's personal data when giving consent;
   • withdraw consent to the processing of personal data;
   • know the mechanism of automatic processing of personal data;
   • to protect against an automated decision that has legal consequences for him.
2. Other rights of personal data subjects in accordance with the GDPR

   In addition to the Ukrainian legislation on the protection of personal data, “EVRO-CONTRAKT” LLC pays close attention to ensuring your rights established by the GDPR, including:

   • A. to receive information and have access to data concerning him/her (data subject's right of access according to Art. 15 GDPR);
   • B. correct your personal data that is incorrect and update your data (right to data rectification, Article 16 GDPR);
   • C. request the deletion of your personal data (the right to data deletion according to Article 17 of the GDPR);
   • D. requests to stop processing (the right to limit processing according to Article 18 GDPR);
   • E. request the transfer of data to another administrator (the right to transfer data in accordance with Article 20 GDPR);
   • F. objection to the processing of his/her personal data (right to object according to Art. 21 GDPR).

V. EXERCISE OF RIGHTS UNDER GDPR

Access to personal data. You have the right to request confirmation from us as to whether we are processing personal data relating to you and, in such cases, to request access to your personal data that we are processing, or to provide information about the personal data if direct access is not available.

Correction of personal data. If you believe that information about you is incorrect or incomplete, you have the right to ask us to correct it.

Withdrawal of consent. Since we process your personal data based on your consent, you have the right to withdraw your consent to the processing of personal data at any time.

Objection to data processing for the purpose of providing direct marketing and sending commercial and marketing information. You have the right to object at any time to the processing of your personal data for the purpose of placing targeted advertising.

Objection to processing based on legitimate interests. You have the right to object to the processing of personal data that we process based on our legitimate interests, but we will continue to process your data even if you object if we have compelling reasons to continue processing the personal data. To exercise the above rights, please send a written request to us at the address specified in Section I of this Policy.

Removal. In certain circumstances, you have the right to ask us to delete your personal data, but this does not apply to cases where the law requires us to retain the data. To exercise the above rights, please send us a written request at the address indicated in Section I of this Policy.

Restrictions on processing. Under certain circumstances, you have the right to restrict the processing of your personal data. Please note that if you submit a request to restrict the processing of your data, this may affect your ability to receive the ordered product. To exercise the above rights, please send a written request to us at the address specified in Section I of this Policy.

VI. CATEGORIES OF PERSONAL DATA. PURPOSES OF THEIR PROCESSING AND LEGAL BASIS

1. In order to fulfill the Purchase and Sale Agreement (Contract) and/or the Public Offer Agreement [According to Art. 6 part 1b) GDPR] “EVRO-CONTRAKT” LLC as an Administrator processes such necessary data as:
   • A. Customer data (registration data, data of contact persons on the customer's side, i.e. name, surname, phone number, signature, e-mail address);
   • B. Data of the addressee (name and surname, signature, address, postal code, city, country and, if desired, other data necessary for the implementation of the Purchase and Sale Agreement (Contract) and/or the Public Offer Agreement provided to the Data Administrator are specified himself as the addressee, such as e-mail address, phone number, name of the responsible person).
2. Provision of personal data is voluntary, but necessary for the delivery of goods ordered from “EVRO-CONTRAKT” LLC. The client is responsible for the correctness of the data provided by “EVRO-CONTRAKT” LLC.
3. In some cases, data is also processed:
   • A. on the basis of consent [According to Art. 1 a) and Art. 7 GDPR] - in particular, for marketing purposes.
   • B. in the legitimate interests of the Administrator [According to Art. 6 part 1 f) GDPR] - in particular, such as: control of solvency, compliance programs or sanctions, surveys (including telephone) regarding satisfaction with the services provided (as well as for analyzing the results of surveys conducted as part of this survey, and the possibility feedback from the person who provides the answer).
4. “EVRO-CONTRAKT” LLC, as a legal entity, also processes personal data for the purpose of fulfilling its legal obligations, which follows, in particular, from the Law of Ukraine "On Accounting and Financial Reporting in Ukraine".
5. The use of the “EVRO-CONTRAKT” LLC website may involve the processing of personal data for the following purposes:
   • A. Placement of the order and measures aimed at its execution.
   • B. Tracking shipments [According to Art. 6 ch. 1b) GDPR] – the parcel number is required to provide information on the status of the parcel.
   • C. Application through the contact form [According to Art. 6 part 1f) GDPR] – data sent through the contact form, such as: first and last name, address, postal code, city, e-mail address, necessary for processing and responding to the request; [According to Art. 6 h. 1a) GDPR] consent to the processing of such data as: e-mail address, telephone number is necessary for communication in order to submit a commercial offer.
   • D. Communication with the consultant via chat [According to Art. 6 ch. 1f) GDPR] - data sent during a conversation with a consultant, such as e-mail address, first and last name, address, postal code, city, are processed for the purpose of checking the question posed and answering the question.
6. Direct marketing and sales promotion. In order to inform about promotions and new offers of goods and services, the Administrator will process your data provided during registration on the Website. The legal basis for data processing is the legitimate interest of the Administrator, which consists in the direct marketing of the Administrator's products and services (Article 6 part 1 letter f) GDPR)
   • A. Sending commercial and marketing information using electronic means of communication and push notifications. In order to inform about promotions and new products from the joint offer of goods and services of the Administrator and Partners using electronic means of communication (SMS, e-mail, push-notifications), the Administrator will process your data, for which you have voluntarily given consent to their use, as stated above. The legal basis for data processing is the consent obtained by the administrator (Article 6 Part 1 Letter a GDPR). You have the right to withdraw your consent at any time, the withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.
7. Registration of telephone conversations. The following phone call identification data is registered:
   • - subscriber number;
   • - Name of the official;
   • - name of consultant and client in chats.

   Chat sessions store the content of the session between the customer and the advisor, while chatbot sessions store the content of the session between the automated chatbot and the customer.

   The customer is not asked any personal questions and the customer cannot resolve personal questions through the chatbot service. If a customer provides digital identification data, such as a phone number, to the chatbot service, the data is automatically deleted after one hour.

   The following data is registered for the identification of customers who receive information about the actual beneficial owners:

   • Person's name and identification code.

VII. DATA EXCHANGE "EURO-CONTRACT" LLC

1. “EVRO-CONTRAKT” LLC may provide personal data:
   • A. To subcontractors (for example, transport partners, operating parcel reception points or parcel storage chambers) within the borders of Ukraine and the European Union or outside them for the purpose of delivering parcels from the sender to the addressee [According to Art. 49 part 1b) respectively c) GDPR];
   • B. entities that are the subjects of a contract for the supply of goods for “EVRO-CONTRAKT” LLC;
   • C. other persons or organizations in accordance with current legislation;
   • D. banks and payment operators to carry out the transaction (including payments made using codes);
   • E. to law enforcement officers and authorities to comply with national security requirements or as part of a legal process regarding the protection of property, or to continue the investigation of a violation of the principles and policies of “EVRO-CONTRAKT” LLC unauthorized access or use of “EVRO-CONTRAKT” LLC equipment, or any other illegal activity.
   • F. mobile cellular operators (PJSC “VF Ukraine” (Ukraine 14333937) and/or PJSC “KYIVSTAR” (Ukraine 21673832) and/or LLC “LIFECELL” (Ukraine 22859846), which provide the Client with telecommunications services and process data, related to the provision of such services - (hereinafter - the Operator), information in the following composition: the known telephone number of the Client in the Operator's mobile network for the purpose of preventing unauthorized access and protecting interests from fraudulent actions by third parties.
2. The right to receive information about the status of the delivery of goods is determined by the responsible persons of the Client or the individual Client. “EVRO-CONTRAKT” LLC can provide such information to other persons only in the cases specified in the relevant provisions of the law, in particular in the Law of Ukraine "On Personal Data Protection".

VIII. TERM OF DATA STORAGE AND DELETE

1. “EVRO-CONTRAKT” LLC processes personal data only for the time necessary to achieve the purpose for which they were collected. The data storage period is determined based on the following requirements:
   • A. operational requirements: the period during which the information is necessary for the execution of the Purchase Agreement (Contract) and/or the Public Offer Agreement.
   • B. legal requirements: the period during which “EVRO-CONTRAKT” LLC must retain data for a specified period of time in order to comply with the law.
   • C. legitimate interests of “EVRO-CONTRAKT” LLC: the period during which the data is processed for the purpose of their implementation, in particular, to establish and consider possible lawsuits in connection with the provided Services.