AFFIRMED
First Deputy General Director
of China-Belarus Joint-Stock Company
"Industrial Park Development Company"
K.Yu. Koroteev
09.12.2022

CHAPTER 1

GENERAL PROVISIONS

1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") has been developed in compliance with the requirements of the Law of the Republic of Belarus dated May 7, 2021 No. 99-3 "On Personal Data Protection" (hereinafter referred to as the "Law") and defines the activities of the China-Belarus Joint-Stock Company "Industrial Park Development Company" (hereinafter referred to as the "joint company") in relation to the processing of personal data accessed by the joint company in order to ensure the protection of the rights of personal data subjects. This Policy is the new edition of Personal Data Processing Policy approved by First Deputy General Director of the joint company 15.11.2021.

2. This Policy applies to all types of personal data that the joint company, including in the person of its employees, receives about the subject of personal data. This Policy also applies to all types and processes (operations) of personal data processing carried out by the joint company as an operator of personal data using automation tools or without their use.

3. This Policy uses terms in the meanings defined by Law, as well as the following term and its definition: automation means - technical means, as well as computer programs that provide automated data processing, including electronic document management (1C, financial management system, other automated information systems for managing digital processes and documents).

CHAPTER 2

CATEGORIES OF PERSONAL DATA SUBJECTS AND THE LIST OF PERSONAL DATA PROCESSED BY THE JOINT COMPANY

4. The joint company processes personal data that can be obtained from the following personal data subjects:
employees, including former employees, of the joint company, candidates for employment in the joint company;
persons who are candidates for the personnel reserve of the joint company;
family members and other close relatives (hereinafter referred to as the "family members") of the joint company employees;
affiliates of the joint company;
persons who are not employees of the joint company when processing award documents;
students, other persons who have arrived at the joint company for practice, internship;
counterparties, clients of the joint company, including potential individuals;
representatives and (or) employees of counterparties, clients of the joint company, including potential ones who are legal entities or individual entrepreneurs;
site visitors who have sent a request to the address of the joint company through the website;
persons who have provided personal data by filling out questionnaires, proposals and other materials or in any other way during contests held by the joint company or with its participation, procurement procedures, advertising and other events, as well as when sending feedback, appeals;
other persons not specified in paragraphs from two to eleven of this clause.

5. The joint company processes the following personal data of personal data subjects, depending on the specific case and the purposes of processing:
5.1. surname, first name, patronymic;
5.2. sex;
5.3. citizenship (nationality);
5.4. date and place of birth;
5.5. image (photo);
5.6. passport data (identification number, passport number, information about the date and authority of passport issuance);
5.7. address of registration at the place of residence;
5.8. address of actual residence;
5.9. contact details;
5.10. individual taxpayer number;
5.11. information about education, qualifications, professional training and advanced training, academic degree, academic title;
5.12. marital status, presence of children, family ties;
5.13. information about employment, including the availability of rewards, awards and (or) disciplinary penalties;
5.14. marriage registration data;
5.15. information about military registration;
5.16. information about disability;
5.17. information about the state of health indicated in the temporary disability certificate, military ID card provided to the joint company for the purpose of assigning benefits, maintaining military records and other purposes in accordance with the requirements of the legislation;
5.18. information about the retention of alimony;
5.19. other personal data provided by personal data subjects (their representatives) in accordance with the requirements of the legislation or reported by them in documents sent to the joint company (applications, questionnaires, resumes, cover letters, draft contracts and others).

6. The following technical information may be processed by the joint company:
IP-address;
browser information;
data from cookies;
address of the requested page;
access time;
history of requests and website views.

7. The joint company ensures that the content and volume of personal data processed by it correspond to the stated processing goals, takes measures to prevent and, if necessary, eliminate the redundancy of the volume of personal data processed to the stated processing goals.

8. The personal data specified in sub-clause 5.17 of clause 5 of this Policy relate to legally protected information constituting a medical secret (hereinafter referred to as the "protected information"). Disclosure of protected information by persons authorized to process it, as well as illegal processing of personal data, entails bringing the perpetrators to responsibility (disciplinary, civil, administrative, criminal) in accordance with the legislation.

9. Processing of special personal data is carried out in accordance with the requirements of the legislation of the Republic of Belarus with the consent of the subject of personal data, and in cases provided for by legislative acts, without such consent. The joint company, with the exception of cases provided for by the legislation of the Republic of Belarus, does not process special personal data concerning race, political views, religious or philosophical beliefs, sexual life, as well as genetic personal data.

10. The joint company, if necessary, in order to achieve the purposes of processing, has the right to transfer personal data to third parties in compliance with the requirements of the legislation of the Republic of Belarus.

CHAPTER 3

PURPOSES OF PERSONAL DATA PROCESSING

11. The joint company processes personal data for the following purposes:
making various types of transactions with personal data subjects, their subsequent execution, if necessary, making changes (additions) to the terms of the transaction and ending (terminating) agreements (obligations under the transaction);
carrying out communications with personal data subjects, sending appeals, notifications, messages, including of advertising and informational nature; keeping records of affiliated persons;
conducting personnel work and organizing accounting of the joint company's employees;
attracting and selecting candidates to work in the joint company, including inclusion in the personnel reserve;
maintaining individual (personalized) records of insured persons, military records;
accounting and tax accounting, performing the functions of a tax agent;
calculations and transfer of wages, assignment and payment of benefits;
pension assignments;
organizing the provision of medical services, voluntary medical insurance services to employees of the joint company, their family members, as well as providing them with other types of services, material benefits and guarantees;
filling in and submitting the required reporting forms to state bodies and other authorized organizations;
processing of various kinds of appeals, requests and other documents received from personal data subjects;
conducting various kinds of contests, surveys, interviews, testing, procurement procedures organized by the joint company;
sending notifications, invitations, commercial and other offers, informational and advertising messages to the subject of personal data;
presentation of awards, gifts, congratulations to personal data subjects;
exercising other duties and powers provided for by the legislation.

CHAPTER 4

BASIC RIGHTS AND OBLIGATIONS OF THE JOINT COMPANY AS AN OPERATOR AND A SUBJECT OF PERSONAL DATA

12. When organizing and processing personal data, the joint company has the right:
12.1. to receive reliable information and (or) documents containing personal data from the subject of personal data;
12.2. to request from the subject of personal data information about the relevance and reliability of the personal data provided;
12.3. to refuse the personal data subject to satisfy the requirements for termination of its personal data processing and (or) their deletion if there are grounds for processing provided for by legislative acts, including if they are necessary for the stated purposes of their processing. If there are grounds provided for by legislative acts, the joint company has the right to continue processing personal data without the consent of the personal data subject;
12.4. if necessary, in order to achieve the purposes of processing personal data, to transfer them to third parties in compliance with the requirements of the legislation.

13. When organizing and processing personal data, the joint company is obliged: 13.1. to process personal data in accordance with the procedure provided for by the legislation of the Republic of Belarus;
13.2. to explain to the subject of personal data its rights related to the processing of personal data;
13.3. to obtain the consent of the personal data subject to the processing of personal data, except in cases provided for by legislative acts, when consent is not required for the processing of personal data;
13.4. to ensure the protection of personal data during their processing;
13.5. to provide the subject of personal data with information about its personal data, as well as about the provision of its personal data to third parties, except in cases provided for by Law and other legislative acts;
13.6. to make changes to personal data that are incomplete, outdated or inaccurate, except in cases where a different procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not imply subsequent changes to such data;
13.7. to terminate the processing of personal data, delete or block them in the absence of grounds for processing personal data provided for by law, as well as at the request of the subject of personal data, unless otherwise provided by legislative acts;
13.8. to perform other duties stipulated by the legislation of the Republic of Belarus.

14. The subject of personal data has the right:
14.1. to receive information concerning the processing of its personal data, including information about the provision of its personal data to third parties;
14.2. to revoke consent to the processing of personal data;
14.3. to request changes to its personal data if the personal data is incomplete, inaccurate or outdated;
14.4. to request the termination of the processing of its personal data, including their deletion or blocking, in the absence of grounds for the processing of personal data provided for by the legislation of the Republic of Belarus;
14.5. to receive clarifications on issues related to the processing of its personal data;
14.6. to appeal actions (inaction), decisions of the joint company that violate the rights of the subject when processing its personal data to the authorized body for the protection of the rights of personal data subjects in accordance with the procedure established by the legislation;
14.7. to exercise other rights provided for by the legislation of the Republic of Belarus.

15. The subject of personal data is obliged:
15.1. to provide the joint company with reliable data about itself;
15.2. to inform the joint company about changes (updates, clarifications) of its personal data;
15.3. if necessary, to provide the joint company with documents containing personal data to the extent necessary for the purposes of their processing.

16. Persons who have transferred to the joint company unreliable (incomplete, outdated) information about themselves or information about another personal data subject without the consent of the latter, when such consent is necessary due to the requirements of legislation, are liable in accordance with legislative acts.

CHAPTER 5

PROCEDURE AND CONDITIONS OF PERSONAL DATA PROCESSING

17. The consent of the personal data subject is required for the processing of personal data, except in cases established by legislative acts when the processing of personal data is carried out without obtaining such consent.

18. Prior to obtaining consent, the joint company is obliged to provide the personal data subject with information containing:
information about the name and location of the joint company;
purposes of personal data processing;
list of personal data to be processed by the consent of the personal data subject, and the period for which consent is given;
information about authorized persons, in cases where the processing of personal data will be carried out by such persons on behalf of the joint company or in its interests in accordance with the legislation or on the basis of an agreement concluded between the joint company and the authorized person;
list of actions with personal data for which the consent of the personal data subject is given, a general description of the methods of personal data processing used by the joint company; other information necessary to ensure transparency of the personal data processing procedure. Prior to obtaining the consent of the personal data subject, the joint company is obliged to explain to the personal data subject its rights related to the processing of personal data, the mechanism for exercising such rights, as well as the consequences of giving the consent of the personal data subject or refusing to give such consent. The information and explanations specified in parts one and two of this clause are provided to the subject of personal data in written or electronic form corresponding to the form of consent expression of the personal data subject, separately from other information provided to it.

19. The consent of the subject of personal data is a free, unambiguous, informed expression of its will, through which it authorizes the processing of its personal data. The consent of the personal data subject may be obtained in writing, in the form of an electronic document or in any other electronic form provided for by Law. Refusal to consent to the processing of personal data gives the right of the joint company to refuse to provide the personal data subject with services or perform other actions for the purpose of which consent to the processing of personal data is requested.

20. The processing of personal data by the joint company includes, collectively or separately, the following actions with personal data: collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision, deletion and other actions performed with personal data.

21. Methods of processing personal data by the joint company: non-automated processing of personal data; automated processing of personal data using automation tools used by the joint company in the course of carrying out activities, with the transmission of the information received via information and telecommunications networks or without such transmission; mixed processing of personal data.

22. The storage of personal data is carried out in a form that allows to determine the subject of personal data for a period not longer than the purposes of personal data processing require, except in cases when the storage period of personal data is established by the legislation of the Republic of Belarus, an agreement concluded (in the process of conclusion) with the subject of personal data for the purpose of performing actions established by this agreement.

23. The condition for the termination of personal data processing may be the achievement of the purposes of personal data processing, the expiration of the personal data processing period, the withdrawal of the personal data subject's consent to the processing of its personal data, as well as the identification of unlawful processing of personal data.

24. When processing personal data, the joint company takes the necessary legal, organizational and technical measures to ensure the protection of personal data from unauthorized or accidental access to them, modification, blocking, copying, distribution, provision, deletion of personal data, as well as from other illegal actions with respect to personal data.

CHAPTER 6

MECHANISM OF THE PERSONAL DATA SUBJECT'S RIGHTS REALIZATION

25. The subject of personal data, in order to exercise its rights provided for in sub-clauses 14.1 -14.4 of clause 14 of this Policy, sends to the joint company a corresponding application in writing or in the form of an electronic document signed with an electronic digital signature, and in cases established by the legislation - in writing, subject to the personal presence of the personal data subject and the presentation of an ID document. The application should contain:
surname, first name, patronymic (if any) of the subject of personal data, address of its place of residence (place of stay); date of birth;
identification number of the subject of personal data, and in its absence - the number of the ID document, if this information was indicated when giving consent to the processing of personal data or the processing of personal data is carried out without the consent of the subject of personal data;
statement of the requirement's essence;
personal signature or electronic digital signature of the subject of personal data.

26. In accordance with the clause 25 of this Policy, the joint company, within 15 days after receiving from the subject of personal data an application for withdrawal of its consent to the processing of personal data, terminates the processing of personal data, if there are no other grounds provided for by legislative acts for their processing, deletes them, and in the absence of a technical possibility of deletion, takes measures to prevent further processing of personal data, including their blocking, and notifies the subject of personal data about this.

27. In accordance with the procedure provided for in the clause 25 of this Policy, the joint company, within 5 working days after receiving from the subject of personal data an application demanding the provision of information concerning the processing of its personal data, provides the subject of personal data with relevant information or notifies its of the reasons for refusing to provide such information.

28. In accordance with the procedure provided for in the clause 25 of this Policy, the joint company, within 15 days after receiving from the subject of personal data an application requesting changes to its personal data if they are incomplete, outdated or inaccurate, makes appropriate changes to its personal data and notifies the subject of personal data or notifies it of the reasons for refusing to make such changes. At the same time, the application by the subject of personal data should be accompanied by relevant documents and (or) certified copies thereof confirming the need to make such changes.

29. In accordance with the clause 25 of this Policy, the joint company, within 15 days after receiving from the subject of personal data an application on receiving information on the provision of its personal data to third parties, sends to the subject of personal data information about which personal data of this subject and to whom were provided during the year preceding the date of submission of the application, or notifies it of the reasons for refusal to provide such information. In accordance with the Law, the subject of personal data has the right to receive information about the provision of its personal data to third parties once a year for free, unless otherwise established by legislative acts.

30. In accordance with the procedure provided for in the clause 25 of this Policy, the joint company, within 15 days after receiving from the subject of personal data an application to terminate the processing of its personal data, including their deletion, stops processing its personal data, deletes them, and in the absence of a technical possibility of deletion, takes measures to prevent further processing of personal data, including their blocking, and notifies the subject of personal data about it. The joint company has the right to refuse to satisfy the personal data subject's requests to terminate the processing of its personal data and (or) delete them if there are grounds for processing personal data provided for by legislative acts, including if they are necessary for the stated purposes of their processing, with notification of the personal data subject within the same period.

CHAPTER 7

FINAL PROVISIONS

31. Issues related to the processing of personal data that are not fixed in this Policy are regulated by the legislation of the Republic of Belarus.

32. The joint company has the right to make changes and (or) additions to this Policy without prior and (or) subsequent agreement with the subjects of personal data. At the same time, the current version of this Policy is posted on the joint company websites, as well as in other places that are available for review by employees of the joint company.

33. If, by virtue of a change in the current legislation, any provision of this Policy is found to be contrary to the legislation, the provisions of the legislation shall apply. The remaining provisions of this Policy that comply with the legislation remain in force and are valid, and any provision that does not comply with the legislation will be considered deleted or changed to the extent necessary to ensure its compliance with the legislation.