Personal data policy

Personal Data Processing Policy Version of 19 August 2026 1. General provisions 1.1. This policy governs the processing and protection of personal data by sole trader Anatoly Viktorovich Gorchonok, taxpayer number 691842051, address: 223060, Minsk Region, Minsk District, Bolshoy Trostenets, Molodyozhnaya Street, 3/1-7 (the Operator). 1.2. Contact: vipautovoz@mail.ru; +375 29 335-74-10. 1.3. The policy is based on Belarus Law No. 99-Z of 7 May 2021 on Personal Data Protection (the Law), Law No. 455-Z of 10 November 2008 on Information, Informatisation and Information Protection, Presidential Decree No. 422 of 28 October 2021 on Measures to Improve Personal Data Protection and other applicable Belarusian legislation. 1.4. It applies to visitors to https://anycar.by, rental applicants, people contacting the Operator by phone or messenger, customers, additional drivers and customer representatives. 1.5. Personal data, processing, operator, data subject, provision, dissemination, cross-border transfer, authorised person and other terms have the meanings established by the Law. 2. Processing principles 2.1. Processing is lawful, fair, proportionate to stated purposes and not excessive. 2.2. Data and retention periods are limited to what is necessary for the purpose, contract and legal duties. 2.3. Data is processed with consent or without consent where expressly permitted by Belarusian legislation. 2.4. The Operator does not disseminate personal data or sell it to third parties. Provision requires a legal basis and is limited to the relevant purpose. 3. Purposes, data, grounds and retention 3.1. Rental enquiries Purpose: receive an enquiry, contact the applicant, check the car, dates, price and terms, and prepare a contract at the applicant's initiative. Subjects: website visitors and other prospective customers. Data: name, phone, chosen car, pickup and return dates, comment, referring page, enquiry date and time. Grounds: consent expressed by ticking the checkbox and sending the enquiry; for steps to conclude a contract at the subject's initiative, paragraph fifteen of Article 6 of the Law. Actions: collection, organisation, storage, modification, use, provision to authorised persons, blocking and deletion, by automated and non-automated means. Retention: until the enquiry is completed, no longer than one year after submission if no contract is signed. After consent withdrawal, processing ends within the statutory period unless another legal basis applies. 3.2. Phone and messenger contact Purpose: answer, advise, agree rental terms and communicate at the person's initiative. Data: name or account display name, phone, messenger identifier and public profile information, correspondence, documents and information provided by the subject. Grounds: consent shown by actions clearly expressing the wish to receive a reply and communicate; when preparing a contract, paragraph fifteen of Article 6. Retention: until communication ends, no longer than one year after the last message if no contract is signed and no other statutory period applies. 3.3. Rental contracts Purpose: identify renters and drivers, check driving entitlement, conclude and perform the contract, receive payment and deposit, document pickup and return, settle enquiries, debts, damage, fines and contract claims. Subjects: customers, representatives and additional drivers. Data: full name, birth date, identity document information, residential or temporary address, phone and email, driving licence and experience, chosen car and rental period, contract, payment, pickup and return information, offences, incidents, damage and claims as needed to perform the agreement and protect lawful rights. Grounds: paragraph fifteen of Article 6 for an existing or prospective contract with the subject, and other grounds under Belarusian legislation. Retention: during the contract and subsequently for statutory retention periods for contracts, primary accounting and related records under archive, accounting and tax law. Data not subject to mandatory retention is deleted after settlement and resolution of claims. 3.4. Website security and form protection Purpose: operate and protect the website, limit automated and repeated submissions, identify technical errors and prevent abuse. Data: IP address, request date and time, source, automatic check result, browser and device information that the form protection provider may process. Grounds: the Operator's statutory duties to protect personal data and secure information systems. Retention: the website retains the IP address in memory for rate limiting for no longer than 15 minutes. The protection provider's retention is governed by its privacy policy. 3.5. Web analytics Purpose: collect visit and usage statistics, assess page effectiveness and improve the website. Data: cookie identifiers, IP address, approximate location, browser and device, visited pages and actions. Grounds: separate consent to statistical cookies. Analytics is not enabled before consent. Retention and processing follow the Operator's Cookie Policy and the service's rules. 3.6. Exercising data subject rights Purpose: receive, verify and carry out requests and record responses. Data: full name, birth date, residential or temporary address, request, signature, identification or identity document number only if previously provided or processing is without consent, and other information needed to identify and answer the applicant. Grounds: duties under Articles 10–14 and 17 of the Law. Retention: during consideration and for the subsequent statutory document retention period. 4. Processing and protection 4.1. The Operator uses automated and non-automated processing. 4.2. Legal, organisational and technical measures protect against unlawful or accidental access, modification, blocking, copying, provision, dissemination, deletion and other unlawful actions. 4.3. Access is limited to people who need it for their duties and who must maintain confidentiality and comply with protection requirements. 4.4. Processing ends and data is deleted when the purpose is met, the period expires, consent is withdrawn or the legal basis ends, unless retention is required by law. 5. Authorised persons, recipients and cross-border transfer 5.1. The Operator may use hosting and support providers, Cloudflare Turnstile and Telegram to deliver enquiries to the responsible person. With separate statistical-cookie consent, Google Analytics and Yandex Metrica may be used. A service is used only if connected to the website. 5.2. Only data necessary for the service is provided. Recipients process it under their own rules and, where applicable, on the Operator's instructions. 5.3. Data may also be provided to state authorities, courts, insurers and others as required or permitted by law or necessary to perform the contract and protect lawful rights. 5.4. Foreign services may entail transfer to countries providing adequate protection and other countries, on a basis permitted by Article 9 of the Law. 5.5. Before transfer to a country without adequate protection, the subject is informed of risks: lack of dedicated laws and an independent data protection authority; limited guarantees of rights; unlawful access, use, provision or dissemination, or inadequate protection. Sending an enquiry after reading this policy and consenting confirms awareness of these risks. 5.6. A person who does not wish to use the website or a foreign messenger may contact the Operator by phone or post at the address in 1.1. 6. Data subject rights 6.1. Consent can be withdrawn at any time without explanation. Website consent can be withdrawn by email to vipautovoz@mail.ru with the name, enquiry phone number and withdrawal request. Within 15 calendar days, the Operator stops processing, deletes data and notifies the subject unless another lawful basis applies. 6.2. The subject may obtain information about processing. The Operator provides it or reasons for refusal within five working days of receiving the request. 6.3. The subject may request correction of incomplete, outdated or inaccurate data with supporting documents. Corrections or refusal reasons are provided within 15 calendar days. 6.4. Once per calendar year, the subject may obtain free information about provision to third parties. Information or refusal reasons are provided within 15 calendar days. 6.5. The subject may request processing to end and data to be deleted where no basis exists. The request is fulfilled or refusal reasons are provided within 15 calendar days. 6.6. The subject may challenge the Operator's actions, omissions and decisions before the National Personal Data Protection Centre of Belarus under the statutory procedure. 6.7. Except for withdrawal under 6.1, rights are exercised by written request to the address in 1.1 or an electronic document with an electronic digital signature sent to vipautovoz@mail.ru. 6.8. A request includes full name (patronymic if applicable), residential or temporary address, birth date, the request and a personal or digital signature. Identification number or, if absent, identity document number is required only if previously provided when consenting or if processing is without consent. The response uses the form of the request unless otherwise requested. 7. Final provisions 7.1. Belarusian legislation governs matters not covered here. 7.2. The Operator may update the policy when legislation, data or services change. A new version takes effect upon publication at https://anycar.by/personal-data-consent unless another date is stated. 7.3. Previous versions apply to relationships arising while they were in force to the extent needed to confirm processing terms and consent.