Personal Data Processing Policy

1. Personal data operator

2. What personal data we collect and for what purpose

3. Legal bases for processing personal data

Personal data is processed on the following legal bases (Article 6 of Law No. 99-Z):

• Performance of a contract — the data is necessary to provide the services you have ordered (booking, payment, certificate delivery, payment confirmations);
• Consent of the data subject — for purposes not related to the performance of a contract (newsletter, analytics cookies, publication of photos). Consent is given by a separate tick box; the fact, date and document version are recorded by the Operator;
• Fulfilment of obligations under legislation — retention of accounting documents, ensuring security (CCTV).

4. Who the data is shared with and where

To operate the website and provide services, the Operator engages authorised persons (service providers), who receive only the data required for the respective function:

5. Cross-border transfer of personal data

Some of the providers listed in section 4 are located outside the Republic of Belarus. The Russian Federation and the EU member states are foreign states that ensure an adequate level of protection of the rights of data subjects (the list is set by Order No. 14 of the National Personal Data Protection Centre dated 15 November 2021): data is transferred to these states freely.

The United States of America (Vercel, Neon, Resend, Google) is not included in that list. Data is transferred to the USA on the grounds provided for in Article 9 of Law No. 99-Z:

• for data necessary to perform the contract concluded with you (booking, payment, certificate delivery) — on the basis of the contract concluded with the data subject;
• in other cases (analytics cookies) — on the basis of your consent, given after being informed of the possible risks of such a transfer.

Notice of risks: the legislation of the USA has not been recognised as providing a level of personal data protection equivalent to that of the Republic of Belarus; data held on servers in the USA may be accessed at the request of the authorised bodies of a foreign state, and the exercise of certain rights of the data subject may be more difficult. By giving consent, you confirm that you have been informed of these risks.

6. Your rights as a data subject

In accordance with Articles 10–16 of Law No. 99-Z, you have the right to:

• Withdraw consent to processing at any time by sending a request to info [at] maka.by (in the form in which consent was given, or in writing). The Operator will cease processing and delete the data within fifteen days unless it has other lawful grounds for processing;
• Obtain information about the processing of your data: its scope, purposes, retention periods, and to whom it has been provided;
• Request the correction of inaccurate or incomplete data;
• Request that processing cease and that data be deleted where there are no lawful grounds for processing;
• Appeal against the actions (inaction) and decisions of the Operator to the National Personal Data Protection Centre of the Republic of Belarus (cpd.by), as well as in court.

Requests from data subjects are handled by the Operator within the time limits set by Law No. 99-Z.

7. Cookies

The website uses two types of cookies. Technical cookies keep the website working (language selection, basket, form protection) and are processed without consent. Analytics cookies (Yandex Metrica, Google Analytics) help us understand site traffic and work only after you have given consent via the cookie banner on your first visit. You can decline analytics cookies in the banner (the “Decline” button) — this does not limit the website’s functionality — and change your choice later by clearing cookies in your browser settings.

8. CCTV in the studio

CCTV surveillance may be carried out on the studio premises to ensure the safety of visitors and the security of property. Signs placed in the recording area inform visitors of the surveillance. No audio is recorded and no facial recognition is performed. Recordings are kept for no more than 30 days, after which they are deleted automatically, unless a recording is needed to investigate an incident.

9. Protection of personal data

• Data is transferred between your device and the server over the encrypted HTTPS protocol;
• Personal data is accessible only to persons who need it to perform their functions and to the authorised persons listed in section 4;
• We do not store payment card data — it is processed by certified payment services;
• In the event of an incident resulting in a personal data breach, the Operator notifies the National Personal Data Protection Centre in the manner and within the time limits set by legislation.

10. Changes to the Policy

The Operator may amend this Policy by publishing a new edition with its date indicated at https://maka.by/legal/privacy-policy. If the changes affect the purposes or scope of processing carried out on the basis of consent, the Operator requests new consent.