Privacy Policy regarding the processing of personal data in the online store of the publishing house of the educational institution "Grodno State Medical University"

1. DEFINITION OF TERMS

1.1. The following terms are used in this Privacy Policy regarding the processing of personal data in the online store of the publishing house of the educational institution "Grodno State Medical University" (hereinafter referred to as the "Privacy Policy"):

1.1.1. "Site Administration" – authorized employees of the educational institution "Grodno State Medical University" (hereinafter referred to as the "Operator") responsible for managing the site, who organize and/or carry out the processing of personal data, as well as determine the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data.

1.1.2. "Personal data" – any information relating to an identified natural person or a natural person who can be identified (the personal data subject).

1.1.3. "Processing of personal data" – any action or set of actions performed with personal data, including collection, systematization, storage, modification, use, depersonalization, blocking, dissemination, provision, and deletion of personal data.

1.1.4. "Confidentiality of personal data" – a requirement, mandatory for the Operator or any other person who has gained access to personal data, to prevent their dissemination without the consent of the personal data subject or the existence of another legal basis.

1.1.5. "Publicly available personal data" – personal data disseminated by the personal data subject themselves or with their consent, or disseminated in accordance with the requirements of legislative acts.

1.1.6. "Cookies" are text files saved in the browser of the computer (or mobile device) of a user visiting the market.grsmu.by website to record actions taken. These files eliminate the need to re-enter or re-select settings—such as language preference—during subsequent visits to the site.

1.1.7. "User of the market.grsmu.by website" – an individual who accesses and uses the website via the Internet.

2. GENERAL PROVISIONS

2.1. Use of the market.grsmu.by website by the User constitutes agreement with this Privacy Policy and the terms regarding the processing of the User's personal data.

2.2. If the User does not agree with the terms of the Privacy Policy, they must cease using the market.grsmu.by website.

2.3. The Site Administration verifies the accuracy of the personal data provided by the User of the market.grsmu.by online store.

3. SUBJECT MATTER OF THE PRIVACY POLICY

3.1. This Privacy Policy establishes the obligations of the Site Administration regarding non-disclosure and the protection of the confidentiality of personal data provided by the User at the request of the Site Administration—whether during site registration, while using any site services (including feedback forms, etc.), or when placing an order (for goods or services).

3.2. Personal data authorized for processing under this Privacy Policy is provided by the User by filling out forms on the market.grsmu.by website:

3.2.1. student ID number;

3.2.2. User's surname and first name;

3.2.3. phone number;

3.2.4. email address; 3.2.5. User’s contact telephone number.

4. PURPOSES OF COLLECTING USER PERSONAL INFORMATION

4.1. The Administration of the market.grsmu.by website may use the User’s personal data for the following purposes:

4.1.1. Identifying the User registered on the online store website in order to place an order (for goods or services) online.

4.1.2. Establishing communication with the User, including sending notifications and inquiries regarding website usage and product delivery, and processing requests and applications from the User.

4.1.3. Providing the User, subject to their consent, with service updates, special offers, pricing information, newsletters, and other information.

4.1.4. Conducting advertising activities with the User’s consent.

4.1.5. Improving the quality of service and website performance.

5. METHODS AND TIMEFRAMES FOR PROCESSING PERSONAL INFORMATION

5.1. The processing of the User’s personal data is carried out without time limitation, by any lawful means, including within personal data information systems, whether using automation tools or without them.

5.2. The User’s personal data may be transferred to authorized state authorities of the Republic of Belarus only on the grounds and in the manner established by the legislation of the Republic of Belarus.

5.3. In the event of the loss or disclosure of personal data, the Site Administration shall inform the User of such loss or disclosure.

5.4. The Site Administration takes necessary organizational and technical measures to protect the User’s personal information against unauthorized or accidental access, destruction, alteration, blocking, copying, or dissemination, as well as against other unlawful actions by third parties.

6. RIGHTS AND OBLIGATIONS OF THE PARTIES

6.1. The User shall:

6.1.1. Provide the personal data required to use the market.grsmu.by website.

6.1.2. Update or supplement the provided personal data in the event of any changes to such information.

6.2. In the context of personal data processing within the online store of the publishing house of the educational institution "Grodno State Medical University," and in accordance with the Law of the Republic of Belarus No. 99-Z dated May 7, 2021, "On Personal Data Protection" (hereinafter referred to as the "Law"), the User has the right to:

6.2.1. Withdraw their consent at any time, without providing a reason, in accordance with Article 10 of the Law—either via the procedure established in Article 14 of the Law or in the same form in which the consent was originally obtained.

The Operator undertakes, within fifteen days of receiving the User's request, to cease processing the personal data and delete them in accordance with the request's content, and to notify the applicant accordingly, provided there are no other grounds for such actions regarding the personal data as stipulated by the Law or other legislative acts.

6.2.2. Obtain information regarding the storage and use of their personal data, including:

details of the Operator’s name and location;

confirmation that the personal data of the inquiring person is being stored and used;

the source from which the personal data was obtained;

the legal grounds and purposes for processing the personal data;

the duration for which consent was granted;

other information prescribed by legislation.

6.2.3. Demand amendments to their personal data if such data is incomplete, outdated, or inaccurate. To this end, the User shall attach relevant documents and/or copies thereof, certified in the prescribed manner, confirming the necessity of amending the personal data.

The Operator shall refuse to amend personal data if the information provided does not indicate that the User’s personal data is incomplete, outdated, or inaccurate.

6.2.4. To receive information from the Operator regarding the disclosure of their personal data to third parties. Such information may be obtained free of charge once per calendar year, unless otherwise provided by the Law or other legislative acts.

6.2.5. In accordance with Article 10 of the Law, to demand that the Operator cease processing their personal data—including its deletion—free of charge, in the absence of grounds for processing personal data as provided for by the Law and other legislative acts.

6.2.6. To appeal against the actions (inaction) and decisions of the Operator that violate the User's rights regarding the processing of their personal data in the online store of the publishing house of the educational institution "Grodno State Medical University" to the National Center for Personal Data Protection, in the manner prescribed by legislation governing appeals by citizens and legal entities.

6.2.7. To exercise the aforementioned rights, the User shall submit a request to the Operator in writing (delivered in person or by mail) or as an electronic document; in the case of exercising the right to withdraw consent, the request must be submitted in the same form in which the consent was originally obtained.

Such a request must contain:

surname, first name, and patronymic (if applicable), and the address of the place of residence (or place of stay);

date of birth;

identification number, or, in the absence thereof, the number of the identity document;

a statement of the substance of the request;

a personal signature (for a written request) or an electronic digital signature (for a request in the form of an electronic document). The Operator shall not consider User requests that do not meet the aforementioned requirements, including those submitted via other channels (e-mail, telephone, fax, etc.).

6.3. The Site Administration shall:

6.3.1. Use the information obtained exclusively for the purposes specified in Clause 4 of this Privacy Policy.

6.3.2. Ensure the confidentiality of the information, not disclose it without the User’s prior written consent, and refrain from selling, exchanging, publishing, or otherwise disclosing the User’s personal data, except as provided for in Sub-clause 5.2 of Clause 5 of this Privacy Policy.

6.3.3. Take precautions to protect the confidentiality of the User’s personal data in accordance with standard business practices for protecting such information.

6.3.4. Block the personal data of the relevant User upon receiving a request from the User, their legal representative, or the authorized personal data protection authority—pending verification—in the event that inaccurate personal data or unlawful actions are identified.

7. LIABILITY OF THE PARTIES

7.1. The Site Administration shall not be held liable for the loss or disclosure of confidential information if such confidential information:

7.1.1. Became publicly available prior to its loss or disclosure.

7.1.2. Was obtained from a third party prior to its receipt by the Site Administration.

7.1.3. Was disclosed with the User's consent.

8. ADDITIONAL TERMS

8.1. This site does not store information that would allow the Operator to identify individual Users without their consent. Any cookies on this site are used solely during a specific session or to save User preferences. Cookies are not transferred to third parties.

The User may change browser settings to refuse the use of cookies, but this may limit access to certain site functions.

8.2. The Site Administration reserves the right to amend this Privacy Policy without the User's consent.

8.3. The new Privacy Policy enters into force upon its posting on the website market.grsmu.by, unless otherwise provided for in the new version of the Privacy Policy.

8.4. The current Privacy Policy is available at the following address: https://market.grsmu.by/index.php?route=information/information/agree&information_id=5h.

8.5. The current legislation of the Republic of Belarus applies to this Privacy Policy and the relationship between the User and the Site Administration.