CHAPTER 1
GENERAL

1. This Policy University «Institute Confucius for Science and Technology BNTU» regarding the processing of personal data (hereinafter - the Policy) was developed in pursuance of the requirements of the Law of the Republic of Belarus dated 07.05.2021 No. 99-З "On the Protection of Personal Data"; (hereinafter referred to as the Law on Personal Data) and defines the main issues related to the processing of personal data.
2. The provisions of the Policy serve as the basis for the development of local legal acts and organizational and administrative documents regulating the processing of personal data by the Operator.
3. The Policy applies to all personal data processed by the Operator.
4. The Policy is a public document of the Operator and provides for the possibility of familiarization with it by any person on the main page of the site.
5. The terms of this Policy are used in the meaning determined by the Law on Personal Data and other regulatory legal acts of the Republic of Belarus.

CHAPTER 2
PRINCIPLES AND PURPOSE OF PROCESSING PERSONAL DATA

6. The processing of personal data by the Operator is carried out taking into account the need to ensure the protection of the rights and freedoms of subjects of personal data on the basis of the following principles:
processing of personal data is carried out on a legal and fair basis;
processing of personal data is carried out in proportion to the stated purposes of their processing and ensures a fair balance of interests of all interested parties at all stages of such processing;
processing of personal data is carried out with the consent of the subject of personal data or on other legal grounds established by legislative acts;
the content and volume of personal data correspond to the stated purposes of their processing, the processing of personal data that is incompatible with the stated purposes of their processing is not allowed;
the personal data being processed is not excessive in relation to the stated purposes of their processing;
the processing of personal data is transparent;
personal data is stored in a form that allows the identification of the subject
personal data, no longer than the stated purposes of processing personal data require.
7. The Operator may process personal data for the following purposes:
ensuring compliance with the requirements of legislative and other regulatory legal acts of the Republic of Belarus, fulfilling the requirements of the Charter, local legal acts of the Operator;
implementing the functions, powers and duties assigned by the legislation of the Republic of Belarus to the Operator, including maintaining personnel, individual (personalized), military, tax, accounting and other records, compiling tax, accounting, statistical and other forms of mandatory reporting of the Operator;
search, selection, evaluation and verification of candidates (applicants) for work / training with the Operator, as well as performing other actions prior to hiring / training with the Operator, including and maintaining a database of candidates for vacancies / a reserve of students, maintaining a personnel reserve, preparing reference and analytical information; relations related to them;
engaging individuals to perform work and (or) provide services on the basis of civil law contracts;
regulating labor and other directly related relations of the Operator with employees (maintaining a personnel reserve, training, promotion, ensuring personal security, assessing the work performed by employees, monitoring the proper performance of work duties by employees, orders and orders of the Operator’s management, requirements of local legal acts of the Operator, issuance of powers of attorney and other authorizations maintaining documents, ensuring the safety of property and material values, preventing offenses, implementing measures for adaptation, training, development, motivation, personnel assessment, visa support, voluntary medical insurance, organizing corporate events, performing other actions); due diligence of counterparties;
checking the authority of authorized persons to sign an agreement;
conclusion, amendment, termination, execution by the Operator of civil law agreements (transactions), including agreements on paid services in the field of education, accounting for such agreements, formation and use of a database of counterparties, their representatives; e, the student, their photo and video materials;
formation of reference materials for internal information support of the Operator’s activities, including inclusion in public sources of the Operator’s personal data (corporate directories, address books, etc.); />Conducting promotions, surveys, studies, and other similar events by the Operator;
advertising and promotion of services, including sending out information and promotional notices, special offers, providing information about the services of the Operator;
processing messages and requests received from the subject of personal data; fulfillment of the duty of a tax agent;
execution of court decisions, rulings, instructions, requests of other bodies or officials subject to execution in accordance with the legislation of the Republic of Belarus;
implementation of the educational process and (or) activities; providing medical care;
maintaining accounting and reporting medical documentation;
implementation of medical examination, immunoprophylaxis, vaccination, medical monitoring of the physical development and growth of children, including anthropometric measurements;
obtaining personal data of the student from a third party (characteristics), incl. by telephone conversations, by e-mail; information about offenses stored in the unified state data bank on offenses, etc.;
providing information to third parties (as part of the educational process, activities);
capturing video and transmitting video images to the Operator's server, as well as providing a parent (legal representative) with access to the video image online as part of the educational process (in the case of placing video surveillance in groups (masses) in order to provide video surveillance services to parents (legitimate representatives) of students);
observance of the procedure and rules for admission to the Operator;
providing information to state bodies and state information systems in order to ensure the implementation of procedures for assessing the quality of education, independent diagnostics, monitoring studies, state final certification of students who have mastered the basic educational programs of general secondary education, a data bank of documents on education; >implementation of psychological and pedagogical support of the educational process, including psychological and pedagogical diagnostics, correctional and developmental work, psychological and pedagogical counseling, psychological prevention and education, health-saving activities and methodological work; Applications/ proposals/ complaints/ appeals of an individual by the Operator;
other purposes for exercising the rights and legitimate interests of the Operator as part of the educational and other activities of the Operator;
other purposes provided for by the local legal acts of the Operator;
committing other actions that do not contradict the law.

CHAPTER 3
CATEGORIES OF PERSONAL DATA SUBJECTS AND LIST OF PERSONAL DATA PROCESSED

8. The Operator may process personal data of the following categories of personal data subjects:
individuals, candidates (applicants) for jobs, training;
individuals, employees and other representatives of the Operator, former employees of the Operator and their relatives;
individuals with whom the Operator has concluded (plans to conclude) civil law contracts, including contracts for paid services in the field of education;
individuals participating in promotions, as well as other activities carried out by the Operator;
individuals whose personal data are made public by them, and their processing does not violate their rights and legitimate interests and complies with the requirements established by the legislation on personal data;
individuals who have expressed their consent to the processing of their personal data by the Operator or whose personal data are processed by the Operator on other grounds provided for by law;
individuals mastering the content of educational programs from the Operator, as well as their legal representatives;
other subjects whose interaction with the Operator creates the need to process their personal data;
other persons who have provided personal data to the Operator.
9. The list of personal data, including special personal data processed by the Operator, is determined in accordance with the legislation, the charter, local legal acts and other organizational and administrative documents of the Operator, taking into account the purposes of processing personal data.
10. Depending on the purposes of processing personal data and subjects of personal data, the Operator may process the following personal data:
identification number;
last name, first name, patronymic (including previous last names, first names and (or) patronymics if they change);
sex;
day, month, year of birth, place of birth; information about nationality;
data on citizenship (nationality), including previous citizenships, other citizenships;
type, series, number, code of an identity document, date of issue, country of issue, name (code) of the issuing authority, its validity period;
data on registration at the place of residence and (or) stay, address of actual residence;
contact data (including work, home (stationary) and/or mobile phone numbers, e-mail, etc.);< br />data of the state social insurance certificate; information about marital status, data on marriage registration (dissolution of marriage),
on parents, guardians, caregivers, on family composition (spouse, child (children)) and close relatives, social status of the family;
information on military registration, data on military registration documents;
information on education, work experience, qualifications, training, the results of assessment and certification, professional knowledge and skills, academic degree and title);
data on the state of health affecting the performance of a job function and fitness to perform work duties, including disability;
information about the places (place) of work, positions (occupied) (occupied) (occupation), including previous ones;
information about state awards, other awards (encouragements), honorary titles and insignia;
photo and video images, audio recording of the voice (including video-audio recording in the Operator's premises);
information about bringing to administrative and criminal liability; information on membership in trade unions;
information on foreign language proficiency, including the level of proficiency; data on visas and other documents of migration registration;
information related to the labor activity of the Operator, as well as previous places of work (information about the length of service, hiring, transfer, dismissal, labor holidays, the presence of related professions, disciplinary sanctions, incentives, etc.);
information about income, wages, including from previous places of work; information on social guarantees, benefits and payments;
information on the details of a bank account, card account for transferring wages and social benefits;
data on tax liabilities;
data of a birth certificate of another document confirming birth/kinship;
information related to the educational process at the Operator, as well as at previous places of study;
medical information: data of a medical card; information about the state of health, including disability, data on the medical group, vaccinations, body temperature, information on passing medical examinations, vaccinations; the results of a medical examination (examination) required in the process of educational activities;
information about business and other personal qualities of an evaluative nature; educational achievements of the student: information about academic performance, educational work
of the child; form of education, class (group) number, availability/absence of benefits, data on additional education received;
religious or other beliefs;
other information related to the identified subject of personal data;
other data defined by the legislation as basic and additional personal data;
other personal data determined by the legislation of the Republic of Belarus, local legal acts of the Operator, taking into account the purposes of processing personal data;
other necessary information that the subject voluntarily reports personal data about himself in order to receive the services provided by the Operator, if its processing is not prohibited by law.
11. The operator processes special personal data only with the consent of the subject of personal data or without consent in other cases provided for by the legislation of the Republic of Belarus.

CHAPTER 4
RIGHTS AND OBLIGATIONS OF THE OPERATOR

12. The operator has the right to:
receive reliable information and (or) documents containing personal data from the subject of personal data;
request from the subject of personal data information on the relevance and reliability of the personal data provided;
if the subject of personal data withdraws consent to the processing of personal data, continue processing personal data without the consent of the subject of personal data if there are grounds specified in the Law on Personal Data; the grounds for processing provided for by the legislation of the Republic of Belarus, including if they are necessary for the stated purposes of their processing;
if necessary, to achieve the purposes of processing personal data, transfer them to third parties in compliance with the requirements of the law;
independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law.
13. The operator is obliged:
to process personal data in the manner prescribed by the legislation of the Republic of Belarus;
to ensure the protection of personal data in the process of their processing;
to take measures to ensure the accuracy of personal data processed by him, to make changes to personal data that are incomplete, outdated or inaccurate; to third parties;
stop processing personal data, as well as delete or block them if there are no grounds for their processing, as well as at the request of the subject of personal data;
explain to the subject of personal data his rights related to the processing of personal data;
obtain the consent of the subject of personal data to process personal data, except as provided by the Law and other legislative acts;
fulfill other duties provided for by the legislation of the Republic of Belarus.

CHAPTER 5
RIGHTS AND OBLIGATIONS OF THE PERSONAL DATA SUBJECT

14. The subject of personal data has the right:
to receive information regarding the processing of his personal data by the Operator;
to make changes to his personal data if the personal data is incomplete, outdated or inaccurate;
to withdraw his consent to the processing of personal data;
to receive information about the provision of his personal data to third parties;
to terminate the processing of his personal data, including their deletion, in the absence of grounds for their processing;
to appeal against the action / inaction ii and the decision of the Operator related to the processing of his personal data to the authorized body for the protection of the rights of subjects of personal data in the manner prescribed by law;
to exercise other rights provided for by the legislation of the Republic of Belarus.
15. The subject of personal data is obliged to:
provide the Operator with exclusively reliable information about himself;
if necessary, provide the Operator with documents containing personal data to the extent necessary for the purpose of their processing;
inform the Operator about changes in his personal data.

CHAPTER 6
MECHANISM FOR ENFORCING THE RIGHTS OF THE PERSONAL DATA SUBJECT

16. The subject of personal data has the right at any time without giving reasons to withdraw his consent to the processing of personal data by submitting an application to the Operator.
The Operator is obliged, within 15 days after receiving the application of the subject of personal data in accordance with its content, to stop processing personal data, delete them and notify the subject of personal data about this, if there are no other grounds for such actions with personal data provided for by legislative acts.
If there is no technical possibility of deleting personal data, the Operator is obliged to take measures to prevent further processing of personal data, including blocking them , and notify the subject of personal data about it within the same period.
17. The subject of personal data has the right to receive information regarding the processing of personal data, containing: the name and location of the operator; confirmation of the fact of processing personal data by the operator (authorized person); personal data of the subject of personal data and the source of their receipt; legal grounds and purposes of personal data processing; the period for which the consent of the subject to the processing of personal data is given; the name and location of the authorized person, if the processing of personal data is entrusted to such person; other information provided for by the legislation of the Republic of Belarus.
To obtain this information, the subject of personal data must submit an application to the Operator. At the same time, the subject of personal data does not have to justify his interest in the requested information.
The operator is obliged, within 5 working days after receiving the relevant application, to provide the subject of personal data in an accessible form with the requested information or notify of the reasons for refusal to provide it. Such information is provided free of charge, except for cases stipulated by legislative acts.
18. The subject of personal data has the right to require the Operator to make changes to their personal data if the personal data is incomplete, outdated or inaccurate. To do this, it is necessary to submit to the Operator an application with the relevant documents and (or) their duly certified copies confirming the need to make changes to personal data.
The Operator is obliged, within 15 days after receiving the application of the subject of personal data, to make appropriate changes to the personal data of the subject of personal data and notify him of this or notify him of the reasons for refusing to make such changes, unless another procedure for making changes to personal data is established by legislative acts.
19. The subject of personal data has the right to receive information from the Operator about the provision of his personal data to third parties once a calendar year free of charge, unless otherwise provided by other legislative acts. To obtain this information, the subject of personal data must submit an application to the Operator.
The Operator is obliged, within 15 days after receiving the application of the subject of personal data, to provide him with information about what personal data of this subject and to whom were provided during the year preceding the date of filing the application, or notify him of the reasons for refusing to provide such information.
20. The subject of personal data has the right to demand from the Operator the free termination of the processing of his personal data, including their deletion, in the absence of grounds for the processing of personal data provided for by legislative acts. To exercise this right, the subject of personal data must submit an application to the Operator.
In this case, the Operator is obliged, within 15 days after receiving the application, to stop processing personal data, as well as to delete them (ensure the termination of the processing of personal data, as well as their removal by an authorized person) and notify the subject of personal data about this.
If there is no technical possibility of deleting personal data, the Operator is obliged to take measures to prevent further processing of personal data, including their blocking, and notify the subject of personal data about this within the same period.
The Operator has the right to refuse the subject of personal data to satisfy the requirements for termination of processing of personal data and (or) their deletion if there are grounds for processing personal data provided for by legislative acts, including if they are necessary for the stated purposes of their processing, with notification of this to the subject of personal data within 15 days.
21. The subject of personal data, in order to exercise his rights specified in paragraphs 16-20 of this Policy, submits to the Operator an application in writing or in the form of an electronic document. Legislative acts may provide for the mandatory personal presence of the subject of personal data and the presentation of an identity document when he submits an application to the operator in writing.
The application of the subject of personal data must contain:
surname, first name, patronymic (if any) of the subject of personal data;
address of the place of residence (place of stay) of the subject of personal data; date of birth of the subject of personal data;
identification number of the subject of personal data, in the absence of such a number — the number of the identity document of the subject of personal data, in cases where this information was indicated by the subject of personal data when giving his consent or the processing of data is carried out without the consent of the subject of personal data; The subject of personal data has the right to appeal against the actions (inaction) and decisions of the Operator that violate the rights of the subject of personal data when processing personal data, to the authorized body for the protection of the rights of subjects of personal data in the manner prescribed by law on appeals of citizens and legal entities. The decision taken by the authorized body for the protection of the rights of subjects of personal data may be appealed by the subject of personal data to the court in the manner prescribed by law.
23. The legal consequence of the provision by the subject of personal data of consent to the processing of their personal data is the emergence of the Operator's right to process the personal data of the person who provided the consent, in accordance with the purposes, methods, volume, procedure and conditions for their processing. If the subject of personal data refuses to provide the Operator with consent to the processing of personal data, the Operator is not entitled to process his personal data, unless there are other grounds provided for by the legislation on the protection of personal data.

CHAPTER 7
TERMS AND CONDITIONS FOR PROCESSING PERSONAL DATA

24. The Operator processes the personal data of the Operator's employees and other personal data subjects who are not in an employment relationship with the Operator. The processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Republic of Belarus.
25. The basis for the processing of personal data is the current legislation of the Republic of Belarus, the Charter of the Operator, agreements concluded between the Operator and subjects of personal data, the consent of subjects of personal data to the processing of their personal data, except for the cases established by the legislation of the Republic of Belarus, when the processing of personal data is carried out without obtaining such consent.
26. The consent of the subject of personal data is a free, unambiguous, informed expression of his will, through which he authorizes the processing of his personal data.
27. The Operator may provide (transfer) personal data to third parties in compliance with the requirements of the law in order to achieve the goals declared by the Operator or determined by the legislation of the Republic of Belarus.
28. The operator has the right to entrust the processing of personal data on its own behalf or in its own interests to an authorized person on the basis of an agreement concluded with an authorized person, an act of legislation or a decision of a state body for the implementation of the relevant purposes for which personal data subjects provided their personal data. Such persons are: Meta Ads, Google Advertising, Yandex.Direct, VK Advertising.
The authorized person is not required to obtain the consent of the personal data subject. If the processing of personal data on behalf of the Operator requires the consent of the subject of personal data, such consent is obtained by the Operator.
If the Operator entrusts the processing of personal data to an authorized person, the Operator is liable to the subject of personal data for the actions of the specified person. An authorized person who processes personal data on behalf of the Operator is liable to the Operator.
29. The operator may process personal data as an authorized person within the framework of relevant contractual relations with other operators, as well as on the basis of a legislative act or a decision of a state body.
30. The processing of personal data by the Operator may include any actions with personal data, including: collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion, other actions that do not contradict the law. The processing of personal data by the Operator is carried out in the manner and on the terms determined by the legislation and local legal acts of the Operator.
31. The operator can process personal data using automation tools, without using automation tools, as well as using automation tools, and without using automation tools (mixed processing).
32. The storage of personal data is carried out in a form that allows determining the subject of personal data, for a period not longer than required by the purposes of processing personal data, except when the period of storage of personal data is established by the legislation of the Republic of Belarus, an agreement concluded (concluded) with the subject of personal data, in order to perform the actions established by this agreement.
33. The condition for terminating the processing of personal data may be: achieving the goals of processing personal data; expiration of the personal data processing period; withdrawal of the consent of the subject of personal data to the processing of his personal data or the requirement to stop processing the personal data of the subject of personal data; lack of grounds for the processing of personal data, as well as in other cases provided for by law.
34. When processing personal data, the Operator takes the necessary legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other illegal actions in relation to personal data.
35. The operator can carry out cross-border data transfer in compliance with the requirements established by law. The operator will take the necessary security measures to protect personal data in the event of a cross-border transfer of personal data.

CHAPTER 8
FINAL PROVISIONS

36. Issues related to the processing of personal data that are not reflected in this Policy are governed by the legislation of the Republic of Belarus, other local legal acts of the Operator.
37. In the event that any provision of the Policy is found to be contrary to the law, the remaining provisions corresponding to the law will remain in force and effect, and any invalid provision will be considered deleted/modified to the extent necessary to ensure its compliance with the law.
38. The Operator has the right, at its discretion, to change and (or) supplement the terms of this Policy without prior and (or) subsequent notification of personal data subjects.