Chapter 1. General Provisions
1.1. This Personal Data Processing Policy (hereinafter — the Policy) defines the policy of FouraUp Limited Liability Company (hereinafter — the Organization, Operator) regarding the processing of personal data, the procedure for the Organization's processing of personal data of individuals who are not its employees, including the procedure for collection, storage, use, transfer, and protection of such data.
1.2. The regulation of personal data handling is aimed at ensuring the rights and freedoms of individuals in the processing of their personal data, maintaining the confidentiality of personal data, and their protection.
1.3. The Policy and amendments thereto are approved by the Director of the Organization.
1.4. The Policy is a local legal act of the Organization, mandatory for compliance and execution by employees, as well as by other persons participating in the processing of personal data in accordance with this Policy.
1.5. This Policy has been developed on the basis of and in execution of:
- the Constitution of the Republic of Belarus;
- the Law of the Republic of Belarus dated 07.05.2021 No. 99-Z "On Personal Data Protection" (hereinafter — the Personal Data Law);
- the Law of the Republic of Belarus dated 10.11.2008 No. 455-Z "On Information, Informatization, and Information Protection";
- the Law of the Republic of Belarus dated 21.07.2008 No. 418-Z "On the Population Register";
- the Law of the Republic of Belarus dated 18.07.2011 No. 300-Z "On Appeals of Citizens and Legal Persons";
- other regulatory legal acts of the Republic of Belarus.
1.6. The Organization considers compliance with human rights and freedoms in the processing of their personal data, including the protection of the right to inviolability of private life, personal and family privacy, as its paramount objective and condition for conducting its activities.
1.7. This Policy applies to all information that the Organization may obtain about visitors to the website https://fouraup.by.
Chapter 2. Basic Terms Used in the Policy
2.1. Automated processing of personal data — processing of personal data using computer equipment.
2.2. Blocking of personal data — temporary suspension of the processing of personal data (except in cases where processing is necessary for clarification of personal data).
2.3. Website — a collection of graphic and information materials, as well as computer programs and databases ensuring their availability on the Internet at the network address https://fouraup.by.
2.4. Information resource (system) containing personal data — a collection of personal data contained in databases and information technologies and technical means ensuring their processing.
2.5. Depersonalization of personal data — actions as a result of which it becomes impossible to determine, without using additional information, the attribution of personal data to a specific personal data subject.
2.6. Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation means with personal data, including collection, recording, systematization, accumulation, storage, modification, supplementation, use, dissemination, provision, access, depersonalization, blocking, deletion of personal data.
2.7. Operator — a legal entity independently organizing and/or carrying out the processing of personal data, as well as determining the purposes of such processing and the composition of personal data subject to processing, unless otherwise established by legislative acts of the Republic of Belarus.
2.8. Personal data — basic and/or additional information about an individual who can be identified directly or indirectly, in particular through surname, given name, patronymic, date of birth, identification number, or through one or more characteristics specific to their physical, psychological, mental, economic, cultural, or social identity.
2.9. User — any visitor to the website https://fouraup.by.
2.10. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.11. Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite group of persons, including placing personal data in information and telecommunication networks.
2.12. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual, or a foreign legal entity.
2.13. Deletion of personal data — actions as a result of which it becomes impossible to restore personal data in information resources (systems) containing personal data, and/or as a result of which material carriers of personal data are destroyed.
2.14. Authorized person — a legal entity, other organization, or individual that, on the basis of an agreement with the Operator, processes personal data on behalf of the Operator or in its interests.
2.15. Authorized body for the protection of personal data subjects' rights — a state body determined by the President of the Republic of Belarus, exercising control over the processing of personal data by operators (authorized persons) and the protection of personal data subjects' rights in accordance with the Personal Data Law (National Center for Personal Data Protection of the Republic of Belarus).
2.16. Personal data subject — an individual to whom the processed personal data relate.
Chapter 3. Basic Rights and Obligations of the Operator
3.1. The Operator has the right to:
- receive accurate information and/or documents containing personal data from the personal data subject;
- independently determine the composition and list of measures necessary and sufficient to ensure fulfillment of obligations provided for by the Personal Data Law, unless otherwise provided by legislative acts of the Republic of Belarus;
- continue processing personal data without the consent of the personal data subject if grounds provided for by the Personal Data Law exist, in case of withdrawal of consent by the personal data subject or submission of a demand to cease processing.
3.2. The Operator is obliged to:
- explain to the personal data subject their rights related to the processing of personal data and the procedure for their implementation;
- obtain the consent of the personal data subject, except in cases provided for by the Personal Data Law and other legislative acts;
- ensure the protection of personal data during their processing;
- provide the personal data subject with information about their personal data, as well as about the provision of their personal data to third parties, except in cases provided for by legislation;
- make changes to personal data that are incomplete, outdated, or inaccurate;
- cease the processing of personal data, as well as delete or block them in the absence of grounds for processing provided for by the Personal Data Law;
- immediately, but no later than three working days, notify the authorized body for the protection of personal data subjects' rights of breaches of personal data protection systems known to the Operator;
- comply with the requirements of the authorized body for the protection of personal data subjects' rights to eliminate violations of personal data legislation;
- publish or otherwise ensure unrestricted access to this Policy;
- fulfill other obligations provided for by the Personal Data Law and other legislative acts of the Republic of Belarus.
Chapter 4. Basic Rights and Obligations of Personal Data Subjects
4.1. Personal data subjects have the right to:
- withdraw consent to the processing of personal data (Article 10 of the Personal Data Law);
- receive information concerning the processing of their personal data, and to modify personal data that are incomplete, outdated, or inaccurate (Article 11 of the Personal Data Law);
- receive information about the provision of their personal data to third parties (Article 12 of the Personal Data Law);
- demand cessation of the processing of their personal data and/or their deletion in the absence of grounds for processing provided for by the Personal Data Law (Article 13 of the Personal Data Law);
- appeal the actions (inaction) and decisions of the Operator related to the processing of their personal data to the authorized body for the protection of personal data subjects' rights or in court (Article 15 of the Personal Data Law);
- exercise other rights provided for by the legislation of the Republic of Belarus.
4.2. To exercise the aforementioned rights, the personal data subject submits a written statement or electronic document to the Operator containing surname, given name, patronymic (if any), place of residence (place of stay), date of birth, identification number (or, in its absence, the number of an identity document), the substance of the demands, and the signature of the personal data subject, in the manner provided for by Article 14 of the Personal Data Law. The response to the statement is sent to the personal data subject in a form corresponding to the form of submission of the statement, within the timeframes established by the legislation on appeals of citizens and legal persons: as a general rule — no later than 15 days from the date of registration of the statement, and for statements requiring additional study and verification — no later than one month.
4.3. Persons who have provided the Operator with inaccurate information about themselves or information about another personal data subject without the latter's consent shall bear responsibility in accordance with the legislation of the Republic of Belarus.
Chapter 5. Principles and General Requirements for Processing of Personal Data
5.1. Processing of personal data is carried out in accordance with the Personal Data Law and other acts of the legislation of the Republic of Belarus.
5.2. Processing of personal data must be proportionate to the stated purposes of processing and ensure, at all its stages, a fair balance of interests of all interested parties.
5.3. Processing of personal data is carried out with the consent of the personal data subject, except in cases provided for by the Personal Data Law and other legislative acts.
5.4. Processing of personal data is limited to achieving specific, previously stated lawful purposes. Processing of personal data incompatible with the initially stated purposes of their collection is not permitted.
5.5. The content and volume of processed personal data must correspond to the stated purposes of processing. Excessiveness of personal data in relation to the stated purposes of their processing is not permitted.
5.6. Processing of personal data is transparent: the personal data subject is provided with relevant information about it in cases provided for by the Personal Data Law.
5.7. The Operator takes measures to ensure the accuracy of processed personal data and updates them when necessary.
5.8. Storage of personal data is carried out in a form allowing identification of the personal data subject for no longer than required by the stated purposes of processing, unless a different storage period is established by legislative acts of the Republic of Belarus or by agreement. Upon achievement of the purposes of processing or loss of the need to achieve them, personal data shall be deleted or depersonalized, unless otherwise provided for by legislation.
Chapter 6. Purposes of Processing of Personal Data
Purpose of processing: informing the User by sending electronic messages.
Personal data:
- Surname, given name, patronymic
- Email address
- Phone numbers
Legal basis for processing: consent of the personal data subject obtained in the manner provided for by Article 5 of the Personal Data Law.
Types of processing: collection, storage, use, transfer (provision, access) of personal data.
Chapter 7. Conditions for Processing of Personal Data
7.1. As a general rule, processing of personal data is carried out with the consent of the personal data subject obtained in the manner provided for by Article 5 of the Personal Data Law — in written form, as an electronic document, or in another electronic form, including by the personal data subject placing a corresponding mark on the Website. Prior to obtaining consent, the Operator provides the personal data subject with information about the purposes of processing, the list of personal data, the validity period of consent, and other information provided for by paragraph 5 of Article 5 of the Personal Data Law.
7.2. Processing of personal data without the consent of the personal data subject is permitted in cases provided for by Article 6 of the Personal Data Law, in particular if:
- personal data are obtained by the Operator on the basis of an agreement concluded (being concluded) with the personal data subject, for the purposes of performing actions established by such agreement;
- personal data are indicated in a document addressed to the Operator and signed by the personal data subject — in accordance with the content of such document;
- processing is necessary to protect the life, health, or other vital interests of the personal data subject or other persons, if obtaining their consent is impossible;
- processing is necessary to fulfill obligations (powers) provided for by legislative acts of the Republic of Belarus;
- in other cases directly provided for by the Personal Data Law and other legislative acts.
Chapter 8. Procedure for Collection, Storage, Transfer, and Other Types of Processing of Personal Data
8.1. The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of the legislation of the Republic of Belarus on personal data protection.
8.2. The Operator ensures the preservation of personal data and takes measures to exclude access to personal data by unauthorized persons.
8.3. The User's personal data are not transferred to third parties, except in cases provided for by the legislation of the Republic of Belarus, or with the consent of the personal data subject to such transfer.
8.4. In case of discovering inaccuracies in their personal data, the User may update them independently by sending a notification to the Operator at the email address
8.5. The period of processing of personal data is determined by the achievement of the purposes for which they were collected, unless a different period is provided for by agreement or by the legislation of the Republic of Belarus. The User has the right to withdraw their consent to the processing of personal data at any time by sending a notification to the Operator at the email address
8.6. Information collected by third-party services, including payment systems, communication means, and other service providers, is stored and processed by the aforementioned persons in accordance with their own user agreements and personal data processing policies. The Operator is not responsible for the actions of third parties specified in this paragraph.
8.7. In processing personal data, the Operator ensures their confidentiality.
8.8. The Operator is obliged to immediately, but no later than three working days, notify the authorized body for the protection of personal data subjects' rights of breaches of personal data protection systems known to it.
8.9. Grounds for ceasing the processing of personal data are the achievement of the purposes of processing, expiration of the validity period of the personal data subject's consent, withdrawal of such consent, the personal data subject's demand to cease processing, as well as detection of unlawful processing of personal data.
Chapter 9. List of Actions Performed by the Operator with Personal Data
9.1. The Operator carries out collection, recording, systematization, accumulation, storage, modification, supplementation, use, dissemination, provision, access, depersonalization, blocking, and deletion of personal data.
9.2. The Operator carries out automated processing of personal data with receipt and/or transmission of obtained information via information and telecommunication networks or without such.
Chapter 10. Cross-Border Transfer of Personal Data
10.1. Cross-border transfer of personal data is prohibited if an adequate level of protection of personal data subjects' rights is not ensured in the territory of the foreign state, except in cases provided for by Article 9 of the Personal Data Law, in particular if:
- consent of the personal data subject has been given on the condition that they have been informed of the risks arising from the lack of an adequate level of protection of their personal data;
- personal data are obtained on the basis of an agreement concluded (being concluded) with the personal data subject, for the purposes of performing actions established by such agreement;
- such transfer is necessary to protect the life, health, or other vital interests of the personal data subject or other persons, if obtaining their consent is impossible;
- corresponding permission has been obtained from the authorized body for the protection of personal data subjects' rights.
10.2. The list of foreign states in whose territory an adequate level of protection of personal data subjects' rights is ensured is determined by the authorized body for the protection of personal data subjects' rights.
Chapter 11. Confidentiality of Personal Data
The Operator and other persons who have gained access to personal data are obliged not to disclose to third parties and not to disseminate personal data without the consent of the personal data subject, unless otherwise provided for by legislative acts of the Republic of Belarus.
Chapter 12. Final Provisions
12.1. The User may obtain clarifications on issues concerning the processing of their personal data by contacting the Operator via email at
12.2. Any changes to this Policy are reflected in this document. The Policy is valid indefinitely until replaced by a new version.
12.3. The current version of the Policy is freely available on the Internet at https://fouraup.by/privacy/.