Personal Data Processing Policy

Last updated: 16 October 2026

1. General provisions

1.1. This Personal Data Processing Policy (the "Policy") defines the procedure for processing personal data and the measures taken to ensure its security by the operator of the website bipsystem.by (the "Operator") in respect of website users and persons who submit enquiries through the forms on the website.

1.2. The Policy is drafted in accordance with the Constitution of the Republic of Belarus, the Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" (the "Law"), Decree of the President of the Republic of Belarus No. 449 of 9 December 2019, and Order No. 66 of the Operational and Analytical Center under the President of the Republic of Belarus of 20 February 2020.

1.3. The Policy applies to all personal data that the Operator receives and processes in connection with the operation of the website bipsystem.by.

2. Key definitions

• Personal data — any information relating to an identified natural person or a natural person who can be identified.
• Data subject — the natural person to whom the personal data relates.
• Processing of personal data — any action (operation) or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, dissemination, provision, and deletion.
• Operator — the person that organizes and/or performs the processing of personal data and determines the purposes and content of such processing.
• Consent of the data subject — the free, unambiguous, informed and conscious expression of the data subject's will by which they permit the processing of their personal data.

3. Legal grounds for processing

3.1. The Operator processes personal data on the following grounds:

• consent of the data subject, given by pressing the submit button on the website form;
• performance of a contract to which the data subject is a party or which is concluded at the data subject's initiative;
• performance of duties imposed on the Operator by the legislative acts of the Republic of Belarus.

4. Categories of data subjects and data processed

4.1. The Operator processes personal data of the following categories of data subjects: website visitors; persons who submit an enquiry through the contact form; contact persons of client and partner organizations.

4.2. The following data is processed through the website forms: first and last name; organization name; email address; phone number; the text of the enquiry. In addition, technical data may be collected automatically: IP address, browser and device type, date and time of the request, and cookie data.

4.3. The Operator does not process special categories of personal data and does not collect personal data of minors.

5. Purposes of personal data processing

• reviewing enquiries submitted through the website and providing responses;
• arranging technical presentations, platform demonstrations and consultations on cooperation;
• preparing, concluding and performing contracts, and providing technical support;
• informing about products and services (subject to separate consent);
• ensuring the operability, information security and protection of the website from unlawful actions.

6. Processing procedure and conditions. Retention periods

6.1. Personal data is processed both with and without the use of automation tools, including within the Operator's information systems.

6.2. Personal data is retained no longer than is required for the purposes of processing. Data submitted through the contact form is processed for the period of handling the enquiry and thereafter for no more than 3 (three) years from the last interaction with the data subject, unless a different period is established by law or by contract.

6.3. Upon withdrawal of consent, the processing of personal data is terminated and the data is deleted or depersonalized within the period established by the Law, unless there are other lawful grounds for its further processing.

7. Transfer of personal data to third parties. Cross-border transfer

7.1. The Operator does not sell or transfer personal data to third parties, except where: contractors are engaged for technical support or maintenance of the website (subject to confidentiality and data protection), or data is provided in response to lawful requests from authorized state bodies.

7.2. The databases, servers and technical infrastructure used for processing and storing personal data are located in the territory of the Republic of Belarus. No cross-border transfer of personal data is carried out.

8. Cookies and technical data

8.1. The website uses technical cookies necessary for its proper operation and may use analytical cookies to assess traffic and improve the quality of the service.

8.2. The user may disable or delete cookies at any time in their browser settings. This may affect the availability of certain website functions.

9. Rights of the data subject

The data subject has the right to:

• receive information about the processing of their personal data, including the purposes, the composition of the data and the retention periods;
• request the modification of personal data if it is incomplete, outdated or inaccurate;
• withdraw their consent to the processing of personal data;
• request the termination of personal data processing and/or its deletion where there are no lawful grounds for processing;
• appeal the actions (inaction) of the Operator to the National Center for Personal Data Protection of the Republic of Belarus and/or in court.

To exercise their rights, the data subject sends a corresponding request to the Operator's email address indicated in section 12, stating their first and last name and the substance of the request. A response is provided within the period established by the Law (as a rule, no later than 15 business days).

10. Measures to ensure personal data security

The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful access, modification, blocking, copying, dissemination and destruction, including:

• appointment of a person responsible for organizing the processing of personal data;
• restricting access to personal data on the principle of least privilege;
• use of secure communication channels when transmitting data;
• placement of data in information systems certified in accordance with the legislation of the Republic of Belarus;
• backup and logging of processing operations.

11. Final provisions

11.1. The Operator may amend this Policy. A new version takes effect from the moment it is published on the website.

11.2. The current version of the Policy is always available at bipsystem.by/privacy_en.html.

12. Operator details and contacts