Personal data processing policy
Version dated 2026-07-20
This Privacy Policy (the Policy) describes how personal data is processed and protected when you use raton.by (the Site), in accordance with the laws of the Republic of Belarus, including Law No. 99-Z of 7 May 2021 On Personal Data Protection.
1. General provisions
1.1. This Policy is designed to protect the rights and freedoms of data subjects when their personal data is processed by the Operator. 1.2. The Policy applies to all personal data the Operator receives when you visit the Site, register a client account, submit feedback or job applications, or use other Site services. 1.3. Using the Site means you have read this Policy. Some actions (registration, form submission) may require explicit consent.
2. Terms
2.1. Personal data — any information relating to an identified or identifiable natural person. 2.2. Processing — any action or set of actions with personal data, including collection, storage, use, anonymisation, blocking, distribution, provision, and deletion. 2.3. Operator — the entity that determines the purposes and means of processing personal data. 2.4. Data subject — the natural person to whom the personal data relates. 2.5. Cookies — small text files stored in your browser when you visit the Site.
3. Data controller
Controller: Open Joint Stock Company «Raton» (JSC Raton) UNP 400052263 Registered address: 19 Fedyuninskogo St., Gomel, 246044, Gomel Region, Republic of Belarus E-mail: info@raton.by Phone: +375 (232) 58-42-72 For personal data enquiries, contact us using the details above with the subject line Personal data.
4. Purposes of processing
We process personal data to: • provide access to Site features and the client account; • identify users during registration and sign-in; • handle enquiries, product requests, and job applications; • respond to user requests; • ensure Site security and prevent abuse; • record consent to Site documents; • improve Site quality and usability (with consent to statistical cookies); • comply with obligations under the laws of the Republic of Belarus.
5. Categories of personal data
5.1. Data you provide voluntarily: • account registration: surname, first name, patronymic (individuals), e-mail, phone, password (stored encrypted); for legal entities additionally: UNP, full company name, registered address, contact person name; • feedback and job forms: name, surname, e-mail, phone, message text; • file uploads in the account: file metadata (name, type, size). 5.2. Automatically collected data: • technical visit data (IP address, browser type, user-agent, date and time, interface language, pages viewed); • cookies and browser local storage (see section 9 and the Cookie Policy). 5.3. We do not process special categories of personal data unless you voluntarily include them in a message.
6. Legal bases
Processing is based on: • consent (registration, feedback forms, statistical cookies); • necessity for concluding or performing a contract, or pre-contract steps at the data subject's request (client account, request handling); • legal obligations of the Operator; • legitimate interests in Site security and operation where data subject rights are not overridden. Strictly necessary cookies for authentication and session security are processed without separate consent to the extent required for the Site to function.
7. Processing and retention periods
7.1. Processing uses automated and/or non-automated means. 7.2. Data is retained no longer than necessary for the stated purposes unless law requires otherwise: • account data — until account deletion by the user or Operator, but not less than needed to fulfil obligations and resolve disputes; • enquiries and applications — up to 3 years unless a longer period is required by contract or law; • consent records — at least 3 years from acceptance; • cookies and technical logs — as stated in the Cookie Policy. 7.3. When purposes are achieved or consent is withdrawn (unless law provides otherwise), data is deleted or anonymised within a reasonable time.
8. Third parties and cross-border transfer
8.1. We do not sell personal data or share it with third parties for advertising. 8.2. Data may be shared with: • authorised Operator staff handling enquiries and Site support, subject to confidentiality; • infrastructure and hosting providers (including Vercel Inc.) as needed to host and operate the Site; • public authorities where required by the laws of the Republic of Belarus. 8.3. Hosting and analytics may involve cross-border transfer of technical data on lawful grounds, including cookie consent and compliance with cross-border transfer rules. 8.4. We take measures to protect personal data when it is transferred.
9. Cookies and automatic data
9.1. The Site uses cookies and local storage for operation, personalisation (language, low-vision mode), and, with consent, visit analytics. 9.2. Details on cookie types, retention, and consent management are in the Cookie Policy at /cookies. 9.3. You may change cookie settings via the on-site panel or your browser.
10. Data subject rights
You have the right to: • receive information about processing of your personal data; • request correction, blocking, or deletion of incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary data; • withdraw consent where processing is consent-based, by contacting the Operator; • complain to the National Personal Data Protection Centre of the Republic of Belarus (pd.gov.by) or to a court. To exercise your rights, e-mail info@raton.by with your name, contact details, and request details. We respond within time limits set by Belarusian law. Withdrawal of consent does not affect lawfulness of prior processing and may limit use of some Site features (account, forms).
11. Security measures
We apply legal, organisational, and technical measures to protect personal data from unauthorised or accidental access, destruction, alteration, blocking, copying, provision, distribution, and other unlawful actions, including: • access restrictions; • HTTPS for data in transit; • encrypted password storage; • backups and integrity controls; • appointed persons responsible for processing organisation; • staff training. We notify the National Personal Data Protection Centre of processing as required by the laws of the Republic of Belarus.
12. Final provisions
12.1. We may amend this Policy. The new version takes effect when published on the Site unless stated otherwise. 12.2. The current Policy is published at /privacy and in the Documents section (/docs). The version date is shown at the top. 12.3. Matters not covered here are governed by the laws of the Republic of Belarus.
13. Obtaining and withdrawing consent
13.1. Consent to personal data processing is given by conclusive actions on the Site: checking the relevant box during registration, submitting forms, confirming cookie settings, or other methods explicitly indicated in the form. 13.2. Consent must be specific, informed, and deliberate. Before giving consent, the data subject may read this Policy. 13.3. The data subject may withdraw consent by contacting the Operator using the details in section 3. Withdrawal has no retroactive effect. 13.4. The Operator stops consent-based processing and deletes or anonymises such data within a reasonable time after withdrawal, unless otherwise required by Belarusian law or a contract.
14. Person responsible for organising personal data processing
14.1. The Operator appoints a person responsible for organising personal data processing by internal order. 14.2. For questions about processing organisation and protection, contact info@raton.by with the subject line Personal data or call +375 (232) 58-42-72. 14.3. The Operator notifies the National Personal Data Protection Centre of the Republic of Belarus and submits required information as provided by Belarusian law.