POLICY
on the Processing of Personal Data
of LLC “DNA Test Center”

1. General Provisions

1.1. This Policy establishes the procedure for the processing and protection of personal data by Limited Liability Company “DNA Test Center” (hereinafter referred to as the Controller).

1.2. The Policy has been developed in accordance with the Law of the Republic of Belarus dated May 7, 2021 No. 99-Z “On the Protection of Personal Data” (hereinafter referred to as the Law), legislation on information, civil legislation, and other applicable legal acts.

1.3. The Policy applies to the processing of data through the website dnk-lab.by, when handling inquiries, placing and fulfilling orders, conducting telephone and electronic communications, organizing the delivery of biological samples independently obtained by clients to a specialized laboratory, receiving and transferring results, handling requests from data subjects, and other processes actually carried out.

1.4. For each purpose, the Controller determines the specific legal basis in advance. A remote inquiry, correspondence, telephone conversation, or payment does not in itself constitute consent to the processing of special, including genetic, personal data.

1.5. Where consent is the legal basis, it must be freely given, unambiguous, informed, and relate to a specific purpose. Separate purposes are not combined into a single consent where they require separate expressions of will.

1.6. The Controller complies with the principles of lawfulness, fairness, transparency, data minimization, purpose and retention limitation, accuracy, confidentiality, and security.

2. Information about the Controller

2.1. LLC “DNA Test Center”, UNP 193700536.

2.2. Legal address: 220036, Republic of Belarus, Minsk, 66 Karl Liebknecht St., premises 75.

2.3. Website: https://dnk-lab.by/. E-mail: info@dnk-lab.by. Telephone: +375 29 320-69-79.

3. Specifics of Activities and Terms

3.1. Terms used in the Law shall have the meaning established by the legislation of the Republic of Belarus.

3.2. Genetic data and the results of genetic studies constitute special personal data and require enhanced protection.

3.3. A biological sample is material independently obtained by the client (study participant) in accordance with the instructions provided and submitted for delivery to a specialized laboratory.

3.4. The Controller provides organizational information and instructions, organizes the delivery of independently obtained samples, interacts with the laboratory, receives the completed result, and transfers it to the customer.

3.5. The Controller does not perform laboratory genetic testing, laboratory processing of samples, collection of biological material from the client, diagnosis, prescription of treatment, or medical interpretation of the result. This clause describes the actual functions and does not constitute a conclusion regarding licensing.

4. Categories of Data Subjects

The data subjects include: clients and customers; study participants; legal representatives; website visitors; persons who submit an inquiry, application, or request a callback; representatives of counterparties; and other persons whose data has been lawfully obtained for a specific legitimate purpose.

5. Personal Data

5.1. The Controller processes only data necessary for the specific purpose. The relationship “purpose — subject — data list — legal basis — retention period” is established in Appendix 1.

5.2. Depending on the purpose, the following may be processed: full name, date of birth, sex, telephone number, e-mail, delivery address, information about the order and payment, correspondence, information about the representative’s authority, order and sample identifiers.

5.3. Special data may include genetic characteristics, laboratory results, and other information generated directly in connection with a genetic study.

5.4. The website may process IP address, browser/device information, date and time of access, URL, response code, session identifier, and necessary cookies. Optional analytics is used only where the required legal basis is present.

6. Legal Bases

6.1. General data necessary for entering into and performing a contract with the data subject themselves are processed on the basis of the contract being entered into or entered into, to the extent of the actions provided for by that contract, where such legal basis is applicable.

6.2. Special, including genetic, data are processed only where a legal basis provided for by legislation for special data exists. Where consent is the legal basis, it is obtained separately before the relevant processing begins.

6.3. The Controller’s agreement with the laboratory governs the relationship between the organizations but does not in itself replace the legal basis for processing a citizen’s data.

6.4. Payment for an order does not replace consent to the processing of special/genetic data.

6.5. If processing is necessary to perform obligations established by legislative acts, consent is not requested only where the relevant legal basis exists.

7. Information and Consent

7.1. Before consent is given, the data subject is provided with information about the Controller, purposes, data categories, actions performed with the data, consent period, recipients/authorized persons to the extent required, consequences of refusal, and the procedure for withdrawal.

7.2. A separate consent is used for organizing a specific genetic study and the corresponding processing of special/genetic data. It is not combined with advertising, mailings, reviews, website analytics, or other separate purposes.

7.3. The consent checkbox on the website is not pre-selected. The date, time, purpose, and version of the consent text are recorded.

7.4. For several adult participants, the legal basis for processing each person’s data is determined separately. For a minor, the authority of the legal representative is taken into account.

8. Processing Purposes

The main purposes are: responding to an inquiry before entering into a contract; entering into and performing a public contract; placing an order; organizing a specific genetic study; sending the necessary data and independently obtained sample to the laboratory; receiving and transferring the result; service communications; accounting and tax records; handling inquiries and exercising data subjects’ rights; website operation and security; and web analytics where the required consent is available.

9. Special and Genetic Data

9.1. Access to such data is granted only to persons for whom it is objectively necessary to perform a specific function.

9.2. Genetic data are not used for advertising, profiling, publication, or other incompatible purposes.

9.3. Enhanced protection measures are applied, including access restrictions, access logging, secure transmission channels, and other necessary measures.

9.4. After consent is withdrawn, processing based exclusively on that consent is terminated where there is no other lawful basis.

10. Processing Procedure

10.1. Processing may be automated, non-automated, or mixed.

10.2. Depending on the purpose, collection, recording, systematization, accumulation, storage, updating, use, provision, transfer, blocking, deletion, and destruction may be carried out.

10.3. Data may be received from the data subject or representative, through the website, e-mail, telephone, messengers, in person, and as part of contract performance.

10.4. Receiving information by telephone or messenger does not release the Controller from the obligation to establish the legal basis for further processing.

11. Recipients and Authorized Persons

11.1. Data are transferred only where a legal basis exists and to the minimum extent necessary.

11.2. Depending on the purpose, recipients may include a specialized laboratory, banks/payment organizations, postal and courier services, hosting/IT providers, e-mail/CRM services, and government authorities in cases provided by law.

11.3. The status of each counterparty (authorized person, independent controller, or other recipient) is determined based on its actual role and the agreement, rather than solely by the name of the service.

11.4. Specialized laboratory: LIMITED LIABILITY COMPANY “INLAB GENETICS”, 190005, St. Petersburg, 18 Izmailovsky Ave., Building D, Premises 28-N, Russian Federation. Its legal status must be formally established before the Policy is approved.

12. Transfer of Data and Samples to the Laboratory

12.1. The laboratory is provided only with the amount of data and materials objectively necessary for the specific study.

12.2. The exact list of data to be transferred is established in the internal processing record and disclosed to the data subject to the required extent before consent is obtained.

12.3. Full name, date of birth, and other directly identifying information are not transferred automatically if the study can be performed without them.

12.4. The transfer of special/genetic data is permitted only after verifying that a legal basis exists.

13. Cross-Border Transfer

13.1. The transfer of data and samples to the laboratory in the Russian Federation constitutes a cross-border transfer.

13.2. Before the transfer, the Controller determines its legal basis and complies with the applicable requirements of the legislation of the Republic of Belarus.

13.3. Where consent is the legal basis, before obtaining it the data subject is informed about the transfer to the Russian Federation, its purpose, and the scope of the data transferred.

13.4. A commercial agreement with a foreign laboratory does not replace the legal basis for processing the data subject’s data.

14. Processing and Retention Periods

14.1. The retention period is established separately for each purpose and specified in Appendix 1. Data are not retained indefinitely without a specific legal basis.

14.2. Contractual and accounting documentation is subject to the periods established by legislation on archival records management, accounting, and taxation. Working formula for contractual documentation: 3 years after termination of the contract and completion of a tax audit; if no audit was conducted — 10 years after termination of the contract. Before approval, applicability to each type of document must be verified.

14.3. For processing based on consent, a specific period or end criterion is established. Withdrawal terminates processing based exclusively on consent where there is no other legal basis.

14.4. After the purpose has been achieved and the retention period has expired, data are deleted, destroyed, or anonymized unless otherwise required by law.

15. Security and Confidentiality

The Controller applies legal, organizational, and technical measures, including the appointment of a responsible person, internal regulations, access restrictions, employee training, individual user accounts, authentication, secure channels, logging, backups, incident response, and compliance monitoring.

16. Rights of Data Subjects

The data subject has the right to receive information about processing as provided by law, request amendments to data, receive information about provision of data to third parties, withdraw consent, request termination of processing/deletion where grounds exist, and challenge the Controller’s actions. A specific right shall be exercised in accordance with the procedure and conditions established by the Law.

17. Exercise of Rights and Withdrawal of Consent

17.1. Requests may be sent to the Controller’s legal address or by another method permitted by law.

17.2. The e-mail address info@dnk-lab.by is used for communication; requirements regarding the form of an application for exercising a specific right are determined by law.

17.3. Withdrawal of consent terminates processing based exclusively on that consent where there is no other legal basis. It does not affect the lawfulness of processing carried out before the withdrawal was received.

18. Website and Cookies

18.1. Necessary technical cookies and server logs are used to the extent necessary for operation, security, and diagnostics, where a legal basis exists.

18.2. Analytics, functional, and marketing cookies for which consent is required are not activated until the user makes a choice.

18.3. Cookie consent is separate and is not combined with consent to genetic data processing.

18.4. The list of cookies, services, and retention periods is specified in a separate Cookie Processing Policy.

19. Deletion and Destruction

19.1. Data are deleted or destroyed after the purpose has been achieved and the retention period has expired, upon withdrawal of consent where there is no other legal basis, and in other cases provided by law.

19.2. The Controller ensures termination of processing by authorized persons as required by applicable legislation and the agreement.

20. Final Provisions

20.1. The Policy is publicly available and published on the website dnk-lab.by via a permanent link.

20.2. A new version shall apply from the date of its approval/publication unless otherwise specified.

20.3. An amendment to the Policy does not replace new consent where a separate consent is required for a new independent purpose.

20.4. The Policy must continuously correspond to the actual website forms, IT systems, data recipients, and internal processes.

APPENDIX 1
Register of Personal Data Processing Purposes