Policy on the Processing of Personal Data

Home >
Policy on the Processing of Personal Data

Policy on the Processing of Personal Data of the Limited Liability Company «DNA Test Center»

1. General Provisions

1.1.

This Personal Data Processing Policy (hereinafter referred to as the Policy) has been developed in accordance with:

the Law of the Republic of Belarus No. 99-Z dated May 7, 2021 «On Personal Data Protection»;
the Law of the Republic of Belarus «On Information, Informatization and Information Protection»;
the Civil Code of the Republic of Belarus;
other regulatory legal acts of the Republic of Belarus governing relations in the field of personal data processing and protection.

This Policy defines the procedure for personal data processing carried out by the Limited Liability Company «DNA Test Center» (hereinafter referred to as the Operator), and establishes measures to ensure the security of personal data, the rights of personal data subjects, and the procedure for the exercise of these rights.

1.2.

This Policy applies to the processing of personal data carried out:

through the official website https://dnk-lab.by;
when concluding and performing contracts;
when individuals contact the Company;
when placing orders for genetic testing;
when using feedback services;
when processing requests from personal data subjects;
when communicating with clients by telephone, email, instant messengers, and other means of communication.

1.3.

This Policy is a publicly available document and is published on the Operator’s official website.

1.4.

The Operator processes personal data solely on the basis of lawful grounds provided for by the legislation of the Republic of Belarus.

1.5.

The Operator complies with the following principles of personal data processing:

lawfulness;
fairness;
transparency;
data minimization;
purpose limitation;
storage limitation;
accuracy of personal data;
confidentiality;
security of personal data.

1.6.

This Policy applies to all personal data received by the Operator directly from personal data subjects or from other persons in cases provided for by the legislation of the Republic of Belarus.

2. Information about the Operator

Full name:

Limited Liability Company «DNA Test Center»

Short name:

LLC «DNA Test Center»

Registered office: Office 75, 66 Karl Liebknecht Street, Minsk, 220036, Republic of Belarus

UNP (Business Registration Number): 193700536

Email address for exercising the rights of personal data subjects:

info@dnk-lab.by

Official website:

https://dnk-lab.by

3. Key Definitions

For the purposes of this Policy, the following definitions shall apply.

Personal Data

Any information relating to an identified natural person or a natural person who can be identified.

Personal Data Subject

A natural person whose personal data are being processed.

Processing of Personal Data

Any operation or set of operations performed on personal data, including:

collection;
recording;
systematization;
accumulation;
storage;
modification;
use;
transfer;
disclosure;
depersonalization (anonymization);
blocking;
deletion;
destruction.

Automated Processing

Processing of personal data using computer technology.

Biological Material

Material provided by a personal data subject for the purpose of conducting genetic testing.

Genetic Data

Personal data relating to genetic characteristics. Genetic data constitute a special category of personal data and are subject to enhanced protection.

Cross-border Transfer of Personal Data

The transfer of personal data to the territory of a foreign state, to a foreign legal entity or individual, or to an international organization.

4. Purposes of Personal Data Processing

The Operator processes personal data solely for predetermined and lawful purposes.

The main purposes include:

4.1.

Identification of the client.

4.2.

Conclusion and performance of a contract.

4.3.

Placing an order for DNA testing.

4.4.

Organization of biological sample collection.

4.5.

Transfer of biological material and the necessary personal data to a partner laboratory for genetic testing.

4.6.

Receipt of test results.

4.7.

Delivery of test results to the client.

4.8.

Client consultation.

4.9.

Providing feedback and communication with clients.

4.10.

Processing inquiries from individuals.

4.11.

Compliance with the legislation of the Republic of Belarus.

4.12.

Accounting and tax record keeping.

4.13.

Protection of the Operator’s legitimate interests.

4.14.

Ensuring the security of information resources.

4.15.

Administration of the official website.

4.16.

Website traffic analysis where the user has consented to the use of analytical cookies.

5. Categories of Personal Data Subjects

5.1. General Provisions

The Operator processes personal data only in relation to individuals whose personal data are necessary to achieve the processing purposes established by this Policy and the legislation of the Republic of Belarus.

Personal data are processed only to the minimum extent necessary to achieve the stated purposes.

5.2. Categories of Personal Data Subjects

Within the scope of its activities, the Operator processes the personal data of the following categories of data subjects.

5.2.1. Clients

Individuals who apply to LLC «DNA Test Center» to obtain services, including genetic testing services.

Processed data include:

last name;
first name;
patronymic (if applicable);
date of birth;
gender;
telephone number;
email address;
residential address (where necessary);
information about the services ordered;
information about the concluded agreement;
payment information;
test results;
correspondence with the client;
client inquiries and requests;
information contained in documents provided by the client.

5.2.2. Legal Representatives of Clients

If an order is placed by the legal representative of a minor or an incapacitated person.

The following data may be processed:

full name;
passport details (where necessary);
information about the document confirming authority;
telephone number;
email address;
address.

5.2.3. Individuals Providing Biological Material

The Operator processes the personal data of individuals who provide biological material for genetic testing.

The following data may be processed:

information identifying the sample;
information about the date the sample was received;
information about the sample type;
laboratory test results.

Biological material is not used for purposes unrelated to the performance of the agreement or the requirements of applicable legislation.

5.2.4. Website Visitors

When visiting the website, the following data may be processed automatically:

IP address;
browser type;
operating system version;
device information;
information about visited pages;
visit time information;
cookies;
session identifiers;
browser language;
referral source.

Analytical cookies are used only after obtaining the user’s consent.

5.2.5. Users of the Contact Form

When completing the contact form, the following data may be processed:

name;
telephone number;
email address;
message content;
date of submission.

5.2.6. Users of the Test Order Form

When placing an order, the following data may be processed:

full name;
telephone number;
email address;
document delivery address;
order details;
selected type of test;
payment information;
client comments.

5.2.7. Users of the «Request a Call» Form

The following data may be processed:

name;
telephone number;
preferred call time.

5.2.8. Users Sending Requests by Email

The following data may be processed:

email address;
name;
message content;
attached documents.

5.2.9. Business Partners (Contractors)

With respect to representatives of legal entities, the following data may be processed:

full name;
position;
business telephone number;
corporate email address.

6. Categories of Personal Data

Depending on the purposes of processing, the Operator may process the following categories of personal data.

6.1. General Personal Data

General personal data include:

last name;
first name;
patronymic (if applicable);
date of birth;
gender;
citizenship;
telephone number;
email address;
residential address;
mailing address;
agreement information;
payment information;
history of inquiries and requests;
information about services received.

6.2. Special Categories of Personal Data

In cases provided for by the legislation of the Republic of Belarus and where necessary for the provision of services, the Operator may process special categories of personal data.

These include:

information on genetic characteristics;
results of genetic testing;
information contained in laboratory reports;
information identifying biological material.

Special categories of personal data are processed only where an appropriate legal basis exists and in compliance with enhanced security requirements.

6.3. Technical Data

When using the website, the following data may be collected automatically:

IP address;
MAC address (where applicable);
browser information;
device information;
operating system version;
screen resolution information;
date and time of the visit;
URLs of visited pages;
session duration;
cookies;
device identifier.

7. Legal Grounds for Processing Personal Data

The Operator processes personal data only where one or more legal grounds provided for by the legislation of the Republic of Belarus exist.

Such legal grounds include:

7.1.

The consent of the personal data subject.

7.2.

The conclusion of an agreement with the personal data subject or the performance of an agreement to which the personal data subject is a party.

7.3.

Compliance with obligations established by the legislation of the Republic of Belarus.

7.4.

Protection of the Operator’s legitimate interests in cases provided for by law.

7.5.

Consideration of requests and inquiries submitted by individuals and legal entities.

8. Purposes of Personal Data Processing

Purpose of Processing	Category of Data	Legal Basis
Registration of a request	Full name, telephone number, email address	Consent
Conclusion of an agreement	Passport details (where necessary), contact information	Agreement
Conducting a genetic test	Identification data, sample information	Agreement, payment
Transfer of biological material to the laboratory	Identification information	Agreement and consent (where required), payment
Issuance of test results	Contact information	Agreement, payment
Accounting and bookkeeping	Payment document information	Legislation
Responding to inquiries	Contact information	Legislation
Ensuring website security	IP address, technical data	Legitimate interest / necessary technical measures
Website analytics	Cookies, IP address	Consent

9. Processing of Genetic Data

Genetic data belong to a special category of personal data.

LLC «DNA Test Center» implements additional organizational and technical measures to protect such data.

Access to genetic data is granted exclusively to employees who require such access to perform their official duties.

Genetic data may be transferred to third parties only:

where there are lawful grounds;
for the purpose of fulfilling the genetic testing request;
under an agreement concluded with an authorized person;
in compliance with the legislation of the Republic of Belarus.

10. Procedure for Processing Personal Data

10.1. General Provisions

Personal data are processed by LLC «DNA Test Center» in accordance with the legislation of the Republic of Belarus, this Policy, the Company’s internal legal acts, and concluded agreements.

Personal data processing includes the following operations:

collection;
recording;
systematization;
accumulation;
storage;
updating (modification);
use;
transfer;
provision;
disclosure (where provided by law);
anonymization;
blocking;
deletion;
destruction.

10.2. Methods of Collecting Personal Data

Personal data may be obtained:

directly from the personal data subject;
from the subject’s legal representative;
through forms completed on the official website;
via email;
by telephone communication;
during a personal visit to the Company’s office;
when concluding an agreement;
from documents provided by the personal data subject;
from other sources in cases provided for by the legislation of the Republic of Belarus.

10.3. Methods of Processing

Personal data may be processed:

using automated means;
without the use of automated means;
using a combination of automated and non-automated methods.

10.4. Automated Processing

Automated processing is carried out using the information systems of LLC «DNA Test Center» for the following purposes:

client registration;
order processing;
agreement management;
payment accounting;
delivery of test results;
processing inquiries;
accounting and bookkeeping;
ensuring the operation of the website.

11. Transfer of Personal Data to Third Parties

11.1.

Personal data may be transferred only in cases provided for by the legislation of the Republic of Belarus or by an agreement with the personal data subject.

11.2.

Personal data may be transferred to:

government authorities;
banks and payment organizations;
postal service providers;
courier services;
organizations providing information technology support services;
laboratories performing genetic testing;
other persons where lawful grounds exist.

11.3.

Personal data are transferred only to the extent necessary to achieve the specific purpose of processing.

The transfer of excessive personal data is not permitted.

11.4.

Each recipient of personal data is obliged to ensure their protection in accordance with the legislation of the Republic of Belarus and the terms of the concluded agreement, including confirmation of payment for the genetic test where applicable.

12. Cross-Border Transfer of Personal Data

12.1. General Provisions

Due to the specific nature of the activities of LLC «DNA Test Center», personal data may be transferred outside the Republic of Belarus only where such transfer is necessary for the performance of an agreement with the personal data subject or where other lawful grounds exist.

12.2.

Cross-border transfer is carried out solely to the extent necessary for conducting the genetic test.

12.3.

Where laboratory testing is required, biological material and the accompanying personal data may be transferred to a partner laboratory located in the Russian Federation.

Such transfer is carried out exclusively for the purpose of performing the agreement concluded with the personal data subject.

12.4.

The following data may be transferred in the course of a cross-border transfer:

last name, first name, and patronymic (where necessary for identification);
date of birth;
test identification number;
information about the ordered test;
biological material identifier;
information necessary for conducting the laboratory test.

Personal data unrelated to the purpose of the genetic test shall not be transferred.

12.5.

Prior to any cross-border transfer, LLC «DNA Test Center» takes measures to ensure an adequate level of personal data protection as required by the legislation of the Republic of Belarus.

12.6.

Cross-border transfers of personal data are carried out under relevant agreements concluded with the receiving party or on other lawful grounds provided for by the legislation of the Republic of Belarus.

13. Processing of Genetic Data

13.1.

Genetic data constitute a special category of personal data.

LLC «DNA Test Center» ensures an enhanced level of protection for such data.

13.2.

Genetic data are used exclusively:

for conducting the ordered genetic test;
for preparing the laboratory report;
for providing the test results to the customer;
for complying with the legislation of the Republic of Belarus.

The use of genetic data for any other purposes is prohibited.

13.3.

LLC «DNA Test Center» does not use genetic data:

for automated decision-making;
for marketing purposes;
for transfer to third parties not involved in conducting the test;
for publication in publicly available sources.

13.4.

Access to genetic data is granted only to employees who require such access to perform their official duties.

Each employee is obliged to maintain confidentiality and may not disclose the obtained information to third parties, except where required by the legislation of the Republic of Belarus.

14. Storage of Personal Data

14.1.

Personal data shall not be stored longer than required for the purposes of processing or for the retention periods established by the legislation of the Republic of Belarus.

14.2.

Upon achievement of the processing purposes, personal data shall be:

deleted;
destroyed;
anonymized,

unless otherwise provided by the legislation of the Republic of Belarus.

14.3.

Documents containing personal data are stored in restricted-access premises or in information systems protected by organizational and technical information security measures.

15. Ensuring the Security of Personal Data

15.1. General Provisions

LLC «DNA Test Center» implements the necessary legal, organizational, and technical measures to ensure the security of personal data and to prevent their accidental loss, destruction, alteration, blocking, copying, dissemination, disclosure, or any other unlawful processing.

15.2. Organizational Security Measures

To ensure the security of personal data, the Operator:

appoints a person responsible for organizing personal data processing;
approves internal legal acts governing personal data processing and protection;
determines the list of employees authorized to access personal data;
grants access to personal data only to the extent necessary for the performance of official duties;
ensures that employees are familiar with the legislation of the Republic of Belarus and internal legal acts;
implements measures to prevent unauthorized access to personal data;
conducts internal monitoring of compliance with personal data protection legislation;
maintains records of information systems containing personal data;
considers requests submitted by personal data subjects in accordance with the established procedure.

15.3. Technical Security Measures

The following measures are applied, among others, to ensure the security of personal data:

user access control;
use of individual employee accounts;
use of strong passwords and authentication tools;
use of secure data transmission channels (HTTPS/TLS);
data backup;
use of antivirus software;
use of firewall protection;
maintenance of security event logs;
timely software updates;
restriction of physical access to servers and workstations.

15.4. Confidentiality

Employees of LLC «DNA Test Center» who have access to personal data are required to maintain confidentiality and may not use personal data for personal purposes or disclose them to third parties, except where provided by the legislation of the Republic of Belarus.

15.5. Personal Data Security Incidents

Where unauthorized access, loss, destruction, alteration, or any other personal data security incident is detected, the Operator shall:

take measures to contain the incident;
eliminate the causes of the incident;
assess the possible consequences;
document the circumstances of the incident;
take measures to prevent similar incidents from recurring;
notify the competent public authorities and personal data subjects where required by law.

16. Rights of Personal Data Subjects

A personal data subject has the right to:

16.1.

Receive information regarding the processing of their personal data in accordance with the legislation of the Republic of Belarus.

16.2.

Receive information about:

the name and location of the Operator;
the purposes of personal data processing;
the legal grounds for processing;
the categories of personal data being processed;
the source from which the personal data were obtained (where applicable);
the retention periods for personal data;
the persons to whom personal data are transferred.

16.3.

Request amendments to personal data if such data are incomplete, outdated, or inaccurate.

16.4.

Receive information on the disclosure of personal data to third parties.

16.5.

Withdraw previously granted consent to the processing of personal data where processing is based on consent.

16.6.

Request the cessation of personal data processing and/or deletion of personal data where there are no other legal grounds for processing.

16.7.

Appeal against actions (or omissions) of the Operator that violate their rights to the National Center for Personal Data Protection of the Republic of Belarus or to a court of law.

17. Procedure for Exercising the Rights of Personal Data Subjects

17.1.

To exercise their rights, a personal data subject may submit an application to LLC «DNA Test Center»:

in writing;
in the form of an electronic document signed with a digital signature (where technically available);
by any other method provided for by the legislation of the Republic of Belarus.

17.2.

The application should contain:

last name, first name, and patronymic (if any);
residential or temporary residence address;
date of birth;
a description of the request;
the applicant’s handwritten signature (for written applications).

17.3.

A response to the application shall be provided within the time limits established by the legislation of the Republic of Belarus.

17.4.

If an application is improperly completed or does not allow the identity of the applicant to be established, the Operator may refuse to satisfy the request in accordance with the legislation of the Republic of Belarus.

18. Procedure for Withdrawing Consent

18.1.

Where personal data are processed based on consent, the personal data subject may withdraw their consent at any time.

18.2.

Consent is withdrawn by submitting an application to the Operator.

18.3.

Upon receipt of the application, the Operator shall cease processing personal data based solely on the subject’s consent unless other legal grounds for continued processing exist.

18.4.

The withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal was received.

19. Deletion and Destruction of Personal Data

Personal data shall be deleted or destroyed:

upon achievement of the purposes of processing;
upon expiration of the applicable retention period;
upon withdrawal of consent where no other legal grounds for processing exist;
pursuant to a court decision;
in other cases provided for by the legislation of the Republic of Belarus.

20. Use of the Official Website and Cookies

20.1. General Provisions

When visiting the official website of LLC «DNA Test Center» (https://dnk-lab.by), users’ personal data may be processed through cookies and other similar technologies.

Cookies are used to ensure the proper functioning of the website, improve usability, maintain security, analyze website performance, and enhance the quality of the services provided.

The processing of personal data using cookies is carried out in accordance with the Law of the Republic of Belarus «On Personal Data Protection,» this Policy, and the Cookie Policy published on the Company’s official website.

LLC «DNA Test Center» does not use cookies for automated decision-making, user profiling, or the delivery of personalized advertising without the prior consent of the personal data subject.

20.2. What Are Cookies?

Cookies are small text files stored on a user’s device when visiting a website. They enable the website to recognize the user’s device during subsequent visits.

Cookies may contain technical information about the operation of the website and information about user preferences; however, they are not intended by themselves to directly identify an individual user.

20.3. Categories of Cookies Used

The following categories of cookies may be used on the official website.

20.3.1. Essential (Technical) Cookies

These cookies are used to ensure the proper functioning of the website.

Without essential cookies, certain website functions cannot operate correctly.

Such cookies may be used without obtaining separate user consent in cases provided for by the legislation of the Republic of Belarus.

Essential cookies may include:

user session identifiers;
cookies ensuring secure authentication;
cookies storing the user’s consent preferences;
cookies required for the proper operation of website forms.

20.3.2. Analytical Cookies

Analytical cookies are used only after obtaining the user’s consent.

They are intended to analyze website traffic, identify errors, evaluate the popularity of specific website sections, and improve the quality of the services provided.

When analytical services are used, the following information may be processed:

IP address (where necessary, in shortened or anonymized form);
user device information;
browser version;
operating system version;
information about visited pages;
visit duration;
referral source;
date and time of the website visit.

20.3.3. Functional Cookies

Functional cookies are used to store user preferences.

These cookies make it possible to:

save the selected language;
remember specific interface settings;
provide a more convenient user experience during future visits.

The use of functional cookies is subject to the user’s consent where such consent is required by the legislation of the Republic of Belarus.

20.4. Use of Third-Party Services

Subject to the user’s consent, the website may use web analytics services and other software tools provided by third parties.

Information is transferred to such services only to the extent necessary to achieve the relevant processing purposes.

The list of services used is specified in the Cookie Policy.

20.5. User Consent

Except where essential cookies are used, information is processed using cookies only after obtaining the user’s consent.

Consent is expressed by selecting the appropriate settings in the cookie consent banner (window) displayed during the user’s first visit to the website.

Analytical, functional, and marketing cookies are not used until consent has been obtained.

20.6. Withdrawal of Consent

The user may change previously selected cookie preferences or withdraw consent at any time.

Consent may be withdrawn by:

changing the settings in the cookie management banner;
changing the settings of the web browser used;
submitting a request to the Operator.

The withdrawal of consent does not affect the lawfulness of information processing carried out before such withdrawal.

20.7. Disabling Cookies

The user may independently restrict the use of cookies by changing the settings of the web browser used.

Disabling essential cookies may result in certain website functions becoming unavailable or individual services functioning incorrectly.

20.8. Website Logs

For the purposes of ensuring information security, detecting technical failures, and preventing unauthorized use of the website, the Operator may maintain event logs (log files).

Log files may contain:

date and time of access to the website;
the user’s device IP address;
browser information;
operating system information;
requested page address;
server response code;
information about technical errors.

This information is used solely for ensuring website security, providing technical support, and investigating information security incidents where necessary.