vfs-global-logo
Home Privacy Policy

CONSENT TO THE PROCESSING OF PERSONAL DATA

Pursuant to Article 5 and paragraph 1 of Article 8 of the Law of the Republic of Belarus dated 7 May 2021 No. 99-Z “On Personal Data Protection” (the “Law”), I hereby give my consent to Limited Liability Company “VFS BY”, 220006, Belarus, Minsk, 6 Bobruiskaya Street, premises 7 (the “Operator”), to process my special personal data:

Purpose of Processing List of Personal Data Consent Period
Carrying out the automated identity verification process, which forms part of the appointment-booking process for the submission of documents to obtain a visa Facial image obtained from the passport; photograph taken in real time; date and time of verification; verification status; device IP address; session identifier; status; number of attempts; confidence score Until the date of submission of documents to obtain a visa

 

List of actions involving personal data for which consent is granted; general description of the methods used to process personal data

During the verification process, the facial image obtained from your passport is automatically matched against your photograph taken in real time. Your special (biometric) personal data will be processed in order to ensure that the appointment booking for the submission of documents to obtain a visa through VFS is in fact made by you and not by someone else impersonating you.

The processing of personal data is carried out using automation tools and includes collection, analysis, systematisation, receipt, use, storage, transfer, and deletion. Personal data shall not be disseminated.

The personal data of data subjects are transferred, for storage purposes, to the territory of a foreign state in which an adequate level of protection of the rights of personal data subjects is ensured (the Federal Republic of Germany). The organisation responsible for the storage of personal data is VF Worldwide Holdings Ltd. (Unit No: 1804-A, Preatoni Tower, Plot No: JLT-PH1-L2A, Jumeirah Lakes Towers, Dubai, UAE).

To protect personal data, the Operator implements a set of technical measures, establishes differentiated access by the Operator’s employees to personal data, and carries out internal monitoring of the processing of personal data in order to prevent unlawful acts in relation to personal data.

The processing of special personal data is permitted with the consent of the personal data subject. If you refuse to grant the Operator consent to the processing of personal data, the Operator shall be entitled to refuse to provide services (perform the engagement).

By consenting to the processing of personal data, you also confirm that your rights related to the processing of personal data, the mechanism for exercising those rights, and the consequences of granting or refusing to grant such consent have been explained to you.

NOTICE

on the explanation of rights related to the processing of personal data and the mechanism for exercising them

We hereby explain that you, as a personal data subject, are entitled at any time, without giving reasons, to:

  1. Withdraw your consent to the processing of personal data by sending the Operator (VFS BY LLC) a written request containing your full name, residential address (or place of stay), date of birth, identification number, a statement of the substance of your claims as a personal data subject, and your personal signature.

    The Operator must, within fifteen days of receipt of your application, cease the processing of personal data, delete such personal data, and notify the personal data subject accordingly. Where deletion of personal data is technically impossible, the Operator must cease processing, anonymise or block the data, and notify you accordingly within the same period.

  2. Obtain information relating to the processing of your personal data including: the name and location of the Operator; confirmation that personal data are being processed by the Operator (or an authorised person); the personal data held by the Operator and the source from which they were obtained; the legal grounds and purposes for the processing of personal data; the period for which your consent was granted; and the name and location of the structural subdivision (or person) authorised to process the data.

    The Operator must, within five business days of receipt of the relevant application, provide you with the information in an accessible form or notify you of the reasons for refusing to provide it. Such information shall be provided free of charge.

  3. Require the Operator to amend your personal data if the personal data are incomplete, outdated, or inaccurate. For that purpose, you shall submit to the Operator an application together with the relevant documents and/or duly certified copies thereof confirming the need to amend the personal data.

    The Operator must, within fifteen days, make the relevant amendments to your personal data and notify you accordingly, or notify you of the reasons for refusing to make such amendments.

  4. Obtain from the Operator information on the disclosure of your personal data to third parties free of charge once per calendar year.

    The Operator must, within fifteen days of receipt of the relevant application, provide information as to which of your personal data were disclosed and to whom during the year preceding the date of the application, or notify you of the reasons for refusal.

  5. Require the Operator, free of charge, to cease processing your personal data including deleting them, where there are no grounds for the processing of personal data. To exercise this right, you must submit an application to the Operator.

    The Operator must, within fifteen days of receipt of your application, cease processing the personal data and delete them, and notify you accordingly. Where deletion of personal data is technically impossible, the Operator must take measures to prevent any further processing of the personal data, including blocking them, and notify you accordingly within the same period.

  6. Appeal against the actions (or omissions) and decisions of the Operator (or an authorised person) that infringe your rights in the processing of personal data to the competent authority for the protection of the rights of personal data subjects, and challenge before a court any decision adopted by such competent authority for the protection of the rights of personal data subjects.

    The Operator shall be entitled to refuse requests to cease the processing of personal data and/or to delete them where there are legal grounds for the processing of personal data, including where such data are necessary for the stated purposes of their processing, with notice to you to that effect within fifteen days.

Privacy Notice

on personal data processing

of VFS BY LLC

Limited Liability Company “VFS BY” (hereinafter referred to as “VFS BY LLC” or the “Company”) is part of the VFS Global group of companies, a major provider of outsourcing and technology services to governments and diplomatic missions worldwide.

The Company performs an exclusively administrative function related to receiving documents from citizens applying to diplomatic missions for visas and other authorization and travel documents, and provides additional services, including in accordance with existing obligations to governments/diplomatic missions of foreign states. The Company does not participate in and does not influence decision-making by diplomatic missions.

CHAPTER 1

GENERAL PROVISIONS. SCOPE 

  • 1.1. The Company pays special attention to ensuring the protection of personal data. Taking into account the specifics of the Company’s activities, in the course of its processes it is guided not only by the legislation of the Republic of Belarus, but also by foreign legislation (in particular, Regulation (EU) 2016/679 (General Data Protection Regulation) and the Visa Code of the European Union).

  • 1.2. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) describes how and for what purposes the Company collects, uses, and otherwise processes personal data. The Policy also sets out the rights of persons whose personal data are processed and the procedure for exercising such rights.

  • 1.3. This Policy applies to relations connected with the Company’s processing of personal data of applicants at all stages of submission of documents for obtaining a visa, visitors to visa application centre premises, persons submitting appeals to the Company, job candidates, and the Company’s counterparties (hereinafter referred to as “personal data subjects”).

  • 1.4. This Policy does not apply to the processing of personal data of the Company’s employees in the course of employment, to the processing of personal data in the course of video surveillance in visa application centres, or to the processing of cookies.

  • 1.5. Information about the Company:

    Company name: VFS BY LLC;

    Registered and postal address of the Company: Republic of Belarus, 220006, Minsk, 6 Bobruyskaya St., premises 7 (Galileo Shopping Center, 5th floor);

    Website address: https://vfsglobal.by

    General e-mail: [email protected]

  • 1.6. Terms used in this Policy have the meanings set out in the Law of the Republic of Belarus dated 7 May 2021 No. 99-Z “On Protection of Personal Data” (hereinafter referred to as the “Law”), as well as the following:

    Diplomatic mission (or mission) means a diplomatic representation or consular institution, the government of a foreign state, or another immigration state authority of a foreign state responsible for issuing visas and other authorization and travel documents, within the framework of existing relations with which the Company provides support to citizens in submitting their documents.

  • 1.7. Compliance with the requirements of the Policy is monitored by the person responsible for internal control over personal data processing in the Company. For issues related to implementation of this Policy, you may contact this person by sending a message to [email protected]

CHAPTER 2

PROCEDURE AND CONDITIONS FOR PERSONAL DATA PROCESSING

  • 2.1. The Company processes only the personal data that are necessary to achieve the declared purposes and does not allow excessive processing. Detailed information on personal data processing is provided in the Appendix to this Policy (hereinafter referred to as the “Appendix”).

  • 2.2. Within certain processes (as indicated in the Appendix), the Company acts as an Authorized Person, i.e., it processes personal data on behalf of other entities (controllers). Those entities determine the purposes, conditions of processing, and the volume of data processed, and are directly responsible to the subject for the processing. As an Authorized Person, the Company is bound by the instructions of such persons and must follow them.

    For example, the list of documents required for a visa application is always determined by the government/diplomatic mission and depends on the country to which the application is submitted. It is the government/diplomatic mission that determines the purpose and conditions for the processing of personal data that will be collected, processed, and transferred by the Company within the visa application process. This means that the controller for this process is the government/diplomatic mission of the foreign state, while the Company acts as an Authorized Person. Similarly, the Company acts as an Authorized Person when collecting biometric data in the course of processing visa applications. Detailed information on how the relevant government/diplomatic mission processes applicants’ personal data can be obtained on the website of the relevant diplomatic mission.

  • 2.3. The Company processes personal data both with the use of automation tools (i.e., in electronic form) and without using them, performing, depending on the purpose(s) of processing, the following actions with personal data: collection, systematization, storage, modification, use, anonymization, provision, transfer (including cross-border transfer), deletion (destruction), as well as other actions permitted by applicable law. Personal data are not subject to dissemination.

    Processing is carried out only to the extent necessary to achieve the specific purposes of processing.

  • 2.4. In cases where there is no other legal basis for personal data processing, the Company obtains the consent of the personal data subject.

  • 2.5. Personal data are stored in a form that permits identification of the personal data subject for no longer than required by the stated processing purposes. Retention periods are determined taking into account the requirements of legislation, the specifics of the Company’s activities, and its duty to act with regard to the requirements of diplomatic missions and foreign legislation (including, but not limited to, the requirements of the EU Visa Code), and are specified in the Appendix to this Policy.

    Upon expiry of the established retention periods, documents containing personal data are destroyed, and personal data contained in information systems (resources) are deleted.

CHAPTER 3

TRANSFER OF PERSONAL DATA TO THIRD PARTIES (AUTHORIZED PERSONS). CROSS-BORDER TRANSFER

  • 3.1. Authorized Persons

  • 3.1.1. The Company engages the following categories of authorized persons for personal data processing:

    • companies engaged by the Company to provide additional services (for example, courier delivery of documents, SMS mailings);
    • companies performing call centre functions;
    • companies performing archive functions;
    • companies otherwise involved in data processing processes and acting on behalf of and in accordance with the instructions of the Company (if any).

  • 3.1.2. The Company analyses the authorized persons engaged for processing, assessing their reliability in matters of personal data protection. The Company keeps records of its authorized persons and also regularly monitors their implementation of measures to ensure protection of personal data processed on behalf of the Company.

  • 3.2. Cross-border transfer

  • 3.2.1. In the course of its activities, the Company may transfer personal data to the territory of foreign states.

    The Company may carry out cross-border data transfer for the following purposes:

    • to perform a contract concluded (or being concluded) with the personal data subject, for the purpose of carrying out actions established by that contract. In particular, to process a subject’s visa application, information collected by the Company on behalf of the relevant diplomatic mission is transferred to that diplomatic mission (i.e., the information will be transferred abroad - from the country where the application is submitted to the country whose visa the subject is applying for). If performance of the contract requires transfer of documents to a consulate/embassy/other authority of a foreign state located outside the Republic of Belarus (for example, where the diplomatic mission has no presence in Belarus), cross-border transfer of data to the territory of the relevant foreign state is also carried out;
    • for the purposes of considering a request/appeal/withdrawal;
    • for control and to ensure enhanced security of data processing, as well as due to the requirements of diplomatic missions, the Company may transfer applicants’ personal data to servers (cloud storage) located abroad, in particular to the territory of a foreign state where an adequate level of protection of the rights of personal data subjects is ensured (Federal Republic of Germany). The organization ensuring storage of personal data is VF Worldwide Holdings Ltd. (Unit No: 1804-A, Preatoni Tower, Plot No: JLT-PH1-L2A, Jumeirah Lakes Towers, Dubai, UAE).

  • 3.2.2. Data are transferred by the Company to the territory of states where an adequate level of protection of the rights of personal data subjects is ensured (the list is established by Order No. 14 of the National Personal Data Protection Center of the Republic of Belarus dated 15 November 2021 “On Cross-Border Transfer of Personal Data”; examples of countries: European Union countries, in particular Germany, the United Kingdom, Russia). General processing grounds apply to such transfer without the need to obtain any additional permits/consents.

  • 3.3. Cases of provision of personal data

  • 3.3.1. Personal data may be provided by the Company to authorized state bodies and organizations, and to other organizations, if such provision is permitted in accordance with legislation (including upon request of the relevant body or organization).

CHAPTER 4

RIGHTS OF PERSONAL DATA SUBJECTS AND THE MECHANISM FOR THEIR EXERCISE

  • 4.1. In accordance with the legislation of the Republic of Belarus, personal data subjects have the right to exercise, in relation to the Company acting as a Controller, the following rights (at any time without stating reasons):

  • 4.1.1. The right to receive information about personal data processing.

    The subject has the right to receive information about the name and location of the Controller, confirmation of the fact of personal data processing, the specific list of personal data being processed, the source of their receipt, the legal grounds and purposes of processing, the period for which consent to processing was given, and the name and location of the authorized person(s), if personal data processing has been entrusted to such person(s).

  • 4.1.2. The right to make changes to personal data if the personal data are incomplete, outdated, or inaccurate. An application shall be submitted with the relevant documents and/or their certified copies confirming the need to make changes to the personal data.

    At the same time, the Company is not obliged and cannot make changes to the subject’s personal data if the purposes of personal data processing do not provide for subsequent changes to such data. Examples of such situations include the impossibility of making changes to an already created appointment booking, directly in the documents accepted from applicants, etc.

  • 4.1.3. The right to receive information about provision of personal data to third parties.

    The subject has the right to receive information on what personal data and to whom (which third parties) were provided during the year preceding the date of submission of the application. This right may be exercised once in a calendar year free of charge, unless otherwise provided by law.

  • 4.1.4. The right to terminate processing of personal data and/or to delete them,, in the absence of grounds for further processing of personal data. If termination of processing and/or deletion is impossible, the Controller takes measures to prevent further processing.

  • 4.1.5. The right to withdraw consent to the processing of personal data. Withdrawal of consent does not apply to processing carried out before such withdrawal.

  • 4.1.6. The right to appeal actions (inaction) and decisions of VFS BY LLC that violate the subject’s rights in personal data processing to the National Personal Data Protection Center. Its decision may be appealed in court.

  • 4.2. The rights indicated above may be exercised in relation to the Company only in cases where it acts as the Controller of personal data.

    In cases where the Company acts as an Authorized Person (for example, directly within the process of receiving documents from applicants on behalf of a diplomatic mission), in considering received requests it acts in accordance with the instructions of the relevant controller and reserves the right to leave an application without substantive consideration if it is not authorized by the controller to provide a response (with notification to the personal data subject of the reasons for refusal). Detailed information on rights and the mechanism for their exercise, as ensured by diplomatic missions, can be found on the websites of the relevant diplomatic missions.

    In general, in situations where the controller is a foreign organization, government/diplomatic representation of a foreign state, the rights of subjects may differ from those indicated in clause 4.1 above (since provisions of foreign law apply to them, in particular Regulation (EU) 2016/679 (General Data Protection Regulation)). Rights and mechanisms for their exercise are in such cases determined by the relevant controllers.

    In all cases, the Company facilitates the exercise of the rights of personal data subjects and proceeds from the principle of observing their legitimate interests.

  • 4.3. To exercise rights, it is necessary to submit to the Company an application in writing or in the form of an electronic document using an electronic digital signature recognized in the Republic of Belarus, and in the case of exercising the right to withdraw consent, also in the form in which such consent was obtained.

    The application must contain full name, residential address (place of stay), date of birth, a statement of the substance of the request, and a personal signature or electronic digital signature.

    A written application must be sent to: Republic of Belarus, 220006, Minsk, 6 Bobruyskaya St., premises 7 (Galileo Shopping Center, 5th floor). An application in the form of an electronic document must be sent to [email protected].

  • 4.4. The period for consideration of an application is no more than 15 days after receipt of the relevant application. An exception is consideration of an application to exercise the right to receive information concerning personal data processing, which will be considered within 5 working days after receipt of the relevant application.

  • 4.5. Legislation establishes cases in which the Controller may refuse to exercise the rights indicated above. In such a case, the Company notifies the subject within the indicated periods of the reasons for refusal.

  • 4.6. In addition to submitting an application in accordance with clause 4.3 of this Policy, because the Company is part of the VFS Global group of companies, the subject may use the unified dedicated request form relating to personal data processing used within the VFS Global group of companies, or the e-mail address [email protected]. However, in this case, the request (and the personal data contained in it) will be processed, inter alia, in Germany (a jurisdiction ensuring an adequate level of personal data protection). These communication channels are alternative to those provided by legislation. Therefore, requests sent through them, as well as responses to such requests, are not official appeals/responses under the legislation of the Republic of Belarus.

  • 4.7. When a request is sent by a subject by any method and the data are insufficient for accurate identification of the sender, the Company may request additional information minimally necessary for accurate identification. The Company does not consider anonymous requests.

  • 4.8. The Company reserves the right to leave without substantive consideration applications from personal data subjects aimed at exercising the rights set out in clause 4.1 of this Policy if they are sent in a form or by methods other than those specified in this Chapter.

  • 4.9. In the event of loss or disclosure of personal data, the Company informs subjects affected by the loss or disclosure of personal data of that fact.

CHAPTER 5

MEASURES TO ENSURE PROTECTION OF PERSONAL DATA

  • 5.1. The Company takes the necessary legal, technical, and organizational measures to protect subjects’ personal data. In particular, the Company takes the following measures:

    • appoints a person responsible for internal control over personal data processing;

    • differentiates access of employees and other authorized persons to personal data depending on their job responsibilities;

    • ensures access control to visa application centre premises;

    • ensures timely deletion (destruction) of personal data in accordance with established retention periods;

    • ensures employees’ awareness of personal data protection;

    • uses technical and organizational data processing security measures in its work;

    • regularly checks data transfer methods and procedures for compliance with internal policies and applicable law;

    • implements other protection measures aimed at enhanced data protection (including in accordance with international standards).

Appendix to the

Policy

on personal data processing

of VFS BY LLC

DETAILS OF PERSONAL DATA PROCESSING IN VFS BY LLC

Processing of personal data by the Company as an Authorized Person

Purposes of processing

Data subject categories

List of personal data processed

Legal grounds for processing

Storage period

Performance of applicants’ instructions (within the framework of a public offer agreement) on processing applicants’ data, sorting documents, entering data into the information system, delivery of documents to/from the relevant consulate, and transfer of biometric data for these persons to obtain visas, authorization documents, or travel documents, and return of the travel document

The controller within this process is the relevant diplomatic mission / government of the foreign state. To achieve this purpose, personal data are transferred to it.

Applicants; other persons whose personal data are indicated in the documents submitted (sponsor, inviting party, family members, etc.)

Depends on the mission and the type of visa. The exact list of data (determined by the mission) can be found on the website page dedicated to the requirements of the relevant diplomatic mission.

The following personal data are most frequently processed:
- Data indicated in the visa application form: full name, date of birth, place of birth, gender, marital status, nationality, citizenship, passport details (passport number, identification number, place and date of issue of the passport, passport validity period), residential address, telephone number, e-mail address, occupation, place of work, purpose of travel, trip data (date and time of commencement and end of the trip, country of first entry, other data), sponsor/inviting party data, information on whether fingerprints had been submitted previously
- Biometric data
- Photo
- Passport data contained in copies of passport pages (pages 31-33 of the passport)
- Data contained in medical insurance
- Data indicated in the certificate from the place of work
- Data confirming the availability of sufficient financial means for the trip
- Hotel reservation data or residential rental data
- Travel ticket data
- Other data as determined by the relevant diplomatic mission.
The diplomatic mission may request additional information/documents at its own discretion.

Paragraph 15 of Article 6 of the Law
Processing of biometric personal data - Consent

Visa application form data:
Deleted from the Company’s systems after transfer to the diplomatic mission

Documents containing other data:
Transferred to the diplomatic mission or to the applicant upon receipt, without retention in the Company’s information systems

Contact data (first name, last name, telephone number, passport number):
for European Union countries (Schengen area) - 5 calendar days after the documents are returned to the subject

for other countries - depends on the diplomatic mission, but no more than 30 calendar days after the documents are returned to the subject

Processing of personal data by the Company as a Controller

Purpose of personal data processing

Categories of personal data subjects

List of personal data processed

Legal grounds for personal data processing

Retention period of personal data

Processing of personal data within the main activity of visa centers

Booking and organization of a visit to a visa application centre for submission of documents

 

 

 

 

 

 

 

 

Persons registering a personal account (where a personal account is available), applicants

When registering a personal account - first name, last name, date of birth, e-mail address, mobile telephone number.
When booking a visit to a visa application centre - first name, last name, gender, date of birth, citizenship, passport number, passport validity period, mobile telephone number, e-mail address, visa application centre, country, visa category, date and time of appointment, registration number, waiting list number and other information regarding placement on the waiting list (if a waiting list exists).
When selecting the passport-page reading method using OCR technology - the passport page image converted into encrypted text format and related metadata (in particular, timestamps, etc.).
Where verification is carried out that the booking is made by a real person - a real-time facial image and related metadata (in particular, timestamps, etc.).
The scope of data may differ depending on the diplomatic mission.

 

 

 

 

 

 

Paragraph 15 of Article 6 of the Law

The personal account is deactivated if the user shows no activity for 30 calendar days, including from the date of the last booking for a visit to the visa application centre.
Information about booking a visit to a visa application centre:
- For European Union countries (Schengen area): 7 calendar days after the date for which the applicant is booked;
- For other countries: depends on the Diplomatic Mission, but no more than 30 calendar days after the date for which the applicant is booked.
Data of successfully completed bookings for a visit to the visa application centre are deleted on the day the documents are submitted.
If an attempt to book a visit to a visa application centre or to be placed on the waiting list is unsuccessful, the data are deleted within 2 hours from the moment of receipt.
If a booking is cancelled or the person is removed from the waiting list, the data are deleted immediately. If the appointment for a visit to the visa application centre is not confirmed when the turn comes, the data are deleted after the period granted for booking expires.

Providing information on the status of consideration of a visa application

Applicants who submitted documents for visa issuance

Visa application number; surname or passport number or date of birth (depending on the diplomatic mission)

Paragraph 15 of Article 6 of the Law

Data are not stored

 

 

Maintaining a visitors’ log

 

Visitors, except employees and applicants

 

Full name, organization (if applicable), date, time, and purpose of visit

Paragraph 20 of Article 6 of the Law (Clause 1 of Article 17 of the Law)

 

1 year after completion of the log

Processing of personal data as part of the provision of additional services related to the application for a visa

Completion of a visa application form

Applicants, other persons whose personal data are indicated in the application form (sponsors, relatives, inviting party, etc.)

Depends on the application form (this is affected by the type of visa and the country to which the applicant applies). The following data are most often processed (Schengen countries): full name, date of birth, place of birth, gender, marital status, nationality, citizenship, passport details (passport number, identification number, place and date of issue of the passport, passport validity period), residential address, telephone number, e-mail address, occupation, place of work, purpose of travel, trip data (date and time of commencement and completion of the trip, country of first entry, other data), sponsor/inviting party data, information on whether fingerprints had been submitted previously, and other data indicated in the application form.

Paragraph 15 of Article 6 of the Law

1 day (the day the service is provided)

SMS notification that the passport is ready. This is carried out by an authorized person providing SMS notification services to applicants - UniCallExpert LLC (Republic of Belarus).

Applicants

- Mobile telephone number
- Application registration number or application tracking identifier
- Status or stages of consideration of the visa application (expressed in general terms such as “application received”, “under processing”, “passport ready for collection”)
- Metadata related to message delivery (for example, timestamp, delivery status, sender identifier)

 

 

 

Paragraph 15 of Article 6 of the Law

 

Deleted by the authorized person no later than the day following the day the SMS is sent

 

 

Photo services

Applicants

Facial image

Paragraph 15 of Article 6 of the Law

 

Image (as well as its negative) - 1 day (deleted at the end of the day on which the service is provided)

Courier delivery of passports. Data are transferred to the authorized person providing courier services - Autolight Express LLC (Republic of Belarus).

Applicants

Full name, delivery address, telephone number

Paragraph 15 of Article 6 of the Law

Retention by the authorized person - 6 months

Organization and processing of payments by applicants using bank payment cards and other payment methods online on the Website https://vfsglobal.by. The “BePaid” service provider - IKomCharge LLC (Republic of Belarus) - is engaged for processing payments.

Applicants making payments online on the Website https://vfsglobal.by

The Company directly processes only the date, amount, transaction number, and list of services. The Controller has no access to the cardholder’s card information. The “BePaid” service provider processes: cardholder’s surname and first name, bank card number, CVC/CVV, telephone number, e-mail address, and other data necessary for making the payment.

Paragraph 15 of Article 6 of the Law

Retention period by the “BePaid” provider: 5 years from the date of payment (Paragraph 14, Part 1, Article 6 of the Law of the Republic of Belarus dated 30 June 2014 No. 165-Z)

Processing of personal data as part of the provision of additional services related to the application for a visa

Handling appeals from citizens and legal entities, including entries made in the book of comments and suggestions (within the framework of legislation on appeals of citizens and legal entities)

Citizens, representatives of legal entities submitting appeals; other persons whose personal data are indicated in the appeal

Full name, residential address (place of stay), substance of the appeal, and other information indicated in the appeal

Paragraph 20 of Article 6, Paragraph 17 of Clause 2 of Article 8 of the Law (Clause 1 of Article 3; Article 12 of the Law of the Republic of Belarus dated 18 July 2011 No. 300-Z “On Appeals of Citizens and Legal Entities”)

5 years from the date of the last appeal
5 years after completion of the book of comments and suggestions

Handling applications from personal data subjects (within the framework of personal data protection legislation)

 

Applicant citizens; other persons whose personal data are indicated in the application

If sent in writing or in the form of an electronic document: full name, residential address (place of stay), date of birth, substance of the requirements; other information indicated in the appeal

 

Paragraph 20 of Article 6, Paragraph 17 of Clause 2 of Article 8 of the Law (Articles 10-14 of the Law)

 

1 year

Providing consultations to persons contacting the contact centre by telephone on matters related to the services provided by the Company. Performance of contact centre functions is entrusted to the authorized person - UniCallExpert LLC (Republic of Belarus).

Persons contacting the contact centre

A minimally necessary list of personal data determined depending on the substance and content of the consultation (processed only where necessary):
- surname, first name
- telephone number
- application registration number or application tracking identifier
- passport number or part thereof (if the applicant communicated it during the call)
- location of the visa application centre or type of service (if applicable)
- preferred language and country
- any other information voluntarily provided by the applicant during communication (for example, travel dates, details of the request)
The call centre records customer support calls.

Paragraph 15 of Article 6 of the Law

Recordings of telephone conversations - 30 calendar days

Organizing preliminary booking for a personal reception conducted by the Director of the Company

 

Persons requesting a personal reception

Full name, contact telephone number, substance of the issue

Paragraph 20 of Article 6 of the Law (Clause 7 of Article 6 of the Law of the Republic of Belarus dated 18 July 2011 No. 300-Z “On Appeals of Citizens and Legal Entities”)

 

5 years

Handling requests from state bodies and organizations. Requested personal data are provided to the requesting person where there are legal grounds for this.

Persons in respect of whom a request is sent to VFS BY LLC

Depending on the content of the request

Paragraph 20 of Article 6, Paragraph 17 of Clause 2 of Article 8 of the Law (the legal basis for the request must be indicated in the request itself)

 

Depending on the content of the request, in accordance with the established retention periods for the relevant type of correspondence

Processing of personal data within the framework of other processes

Conclusion (performance) of contracts with counterparties providing services to VFS BY LLC

Individual - a party to the contract

Full name, current account, passport data (number, date and issuing authority, identification number)

Paragraph 15 of Article 6 of the Law

3 years after a tax audit of compliance with tax legislation is conducted by the tax authorities. If no such tax audit has been conducted - 10 years after expiry of the contract term

Upon conclusion of a contract with an individual entrepreneur / legal entity:
1. persons authorized to sign the contract
2. contact persons of the counterparty

 

 

1. Full name, position of the person signing the contract
2. Data of the contact person (full name, position, telephone number, e-mail - depending on the content of the contract)

 

 

1. Paragraph 20 of Article 6 of the Law (Articles 49 and 186 of the Civil Code)
2. Paragraph 20 of Article 6 of the Law (Clause 1 of Article 55 of the Labour Code)

Dispute resolution. Data are provided to courts, law enforcement authorities, notaries, enforcement authorities, and other authorized bodies; they may be provided to third parties rendering legal services.

Individuals - parties to a dispute, representatives of legal entities - parties to a dispute; third parties whose personal data need to be processed for dispute resolution

Depending on the nature of the dispute

Paragraph 20 of Article 6, Paragraph 17 of Clause 2 of Article 8 of the Law (the legal basis depends on the nature of the dispute: Code of Civil Procedure, Law “On Enforcement Proceedings”, etc.)

3 years

Search, attraction, selection, and record-keeping of job candidates

Job candidates

In accordance with the content of the CV and job candidate application form, including full name, education (educational institution, specialty), work experience, mobile telephone number or other contact telephone number, e-mail address; other data indicated in the application form (CV), as well as, where applicable, data communicated by the candidate during the interview and recorded in the documentation of the person conducting such interview.

Article 5 of the Law (Consent) - when sending a CV by e-mail (obtained electronically by replying to the Company’s message)
Paragraph 16 of Article 6 of the Law - upon the candidate’s personal submission of a CV (provided the CV document bears a personal signature)
Paragraph 19 of Article 6 of the Law - when using candidate search services

1 year - in case of non-employment