Personal data processing and protection policy

1. The policy of BUS VOKZALY.UA LLC (hereinafter referred to as the E-station Policy) determines the procedure for processing and protecting the personal data of Passengers.

2. This Policy has been developed in accordance with the Constitution of Ukraine, the Law “On Personal Data”, “On Informatization, Information Technologies and Information Protection”, Decrees of the Government of Ukraine “On Approval of the Regulations on Ensuring the Security of Personal Data during their Processing in Personal Data Information Systems”, Government Decree “On approval of the Regulations on the features of the processing of personal data carried out without the use of automation tools” and other regulatory acts in force on the territory of Ukraine in the field of personal data.

3. This document applies to all information that the E-station can receive about the user and / or about a third party on behalf of and in whose interests the user acts – while using the e-vokzal.com website, applications for Android (Buses) and iOS ( Buses) and its other services, programs and products.

4. Настоящий документ является общедоступным и подлежит размещению на сайте e-vokzal.com

The following terms are used in this document:

• User of services E-station – a passenger using the services provided by LLC BUS STATION.UA;
• LLC “BUS STATION.UA” – a legal entity that sells itinerary receipts for bus flights of Carriers on their behalf and for this purpose collects, stores, accumulates, clarifies, blocks, deletes and transfers personal data of Passengers;
• Operator – a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data;
• Passenger – an individual whose transportation by a vehicle is carried out on the basis of a passenger transportation agreement, who buys an itinerary receipt for this transportation and provides his personal data for this;
• Personal data of the Passenger – information relating to a particular Passenger, necessary for the fulfillment of contractual obligations for the carriage of a passenger;
• Protection of the Passenger’s personal data – the activities of AVTOVOKZALY.UA LLC to ensure the security of personal data through local regulation of the procedure for processing personal data and organizational and technical measures of information confidentiality;
• Confidentiality of personal data – a mandatory requirement for a person who has gained access to personal data to prevent their distribution without the consent of the subject of personal data or other legal grounds;
• Information system – a set of information contained in databases and information technologies and technical means that ensure its processing;
• Processing of personal data – any action (operation) or a set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction of personal data;
• Destruction of personal data – actions, as a result of which it becomes impossible to restore the content of personal data to the information system of personal data and (or) as a result of which material carriers of personal data are destroyed.

The processing of personal data of users of the services of LLC “AVTOVOKZALY.UA” is carried out in order to fulfill transportation contracts and ensure transport security.

The processing of personal data at AVTOVOKZALY.UA LLC is carried out in compliance with the principles and rules provided for by the Law of Ukraine “On Personal Data”, and takes into account the need to ensure the protection of the rights and freedoms of personal data subjects, including the protection of the right to privacy, personal and family secrets, namely:

• processing is carried out on a lawful and fair basis;
• the processing is limited to the achievement of specific, predetermined and legitimate purposes; processing of personal data that is incompatible with the purposes of their collection is not allowed;
• it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other;
  only those personal data that meet the purposes of processing are subject to processing;
• the content and scope of the processed personal data must correspond to the stated purposes of processing, processing of data that is excessive in relation to the stated purposes is not allowed;
• during processing, the accuracy and sufficiency of personal data and, if necessary, relevance in relation to the purposes of processing are ensured; OOO AVTOVOKZALY.UA takes measures to remove or clarify incomplete or inaccurate data or ensures the adoption of such measures;
• storage of personal data is carried out in a form that allows to determine the subject of personal data, if the period of storage of personal data is not established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor;
• processed personal data is destroyed or depersonalized upon reaching the goals of processing or in case of loss of the need to achieve these goals, unless otherwise provided by federal law.

The processing of personal data in AVTOVOKZALY.UA LLC is carried out with the consent of the subject of personal data, unless otherwise provided by the legislation of Ukraine. When processing personal data, AVTOVOKZALY.UA LLC is obliged to ensure their confidentiality.

LLC AVTOVOKZALY.UA processes personal data of the following categories of personal data subjects: users of the services of LLC AVTOVOKZALY.UA, individuals who are in contractual and other civil law relations with LLC AVTOVOKZALY.UA, employees of LLC AVTOVOKZALY.UA. SA” and other subjects of personal data (to ensure the implementation of the processing purposes specified in Section III of this document).

LLC “AVTOVOKZALY.UA” processes the following personal data of service users:

• Full Name;
• date, month, year of birth;
• citizenship;
• the name, series and number of the identity document by which the travel document is purchased (for minors – a birth certificate);
• point of departure, point of destination, type of route (direct, transit);
• date and time of the trip;
• floor;
• contact number;
• E-mail address.

LLC “AVTOVOKZALY.UA” may also process other personal data of users of the services of LLC “AVTOVOKZALY.UA”, necessary for the implementation of the processing purposes specified in Section III of this document.

1. The processing of personal data can be carried out using computer technology (automated processing) or with the direct participation of a person without the use of computer technology (manual processing).

2. Only those employees of BUS VOKZALY.UA LLC, whose job duties include the processing of personal data, are allowed to process personal data. These employees have the right to receive only those personal data that they need to perform their job duties.

3. In order to ensure the rights and freedoms of a person and a citizen, BUS VOKZALY.UA LLC and its representatives, when processing the Passenger’s personal data, must comply with the following general requirements:

• the processing of the Passenger’s personal data is carried out solely for the purpose of ensuring compliance with laws and other regulatory legal acts, facilitating the fulfillment of contractual obligations in accordance with the legislation of Ukraine;
• when determining the volume and content of the processed personal data of the Passenger, BUS VOKZALY.UA LLC must be guided by the legislation of Ukraine in the field of personal data;
• the receipt and use of personal data is carried out only after familiarization and consent of the subject of personal data with this provision.

4. Consent to the processing of personal data may be withdrawn by the subject of personal data.

5. All personal data of the Passenger should be obtained from him, except in cases where the ticket is purchased by a third party for the Passenger, provided that the third party provides the original documents necessary for the purchase of the ticket.

6. LLC “AVTOVOKZALY.UA” has the right to entrust the processing of personal data to another legal entity or individual entrepreneur with the consent of the subjects of personal data on the basis of a contract. A legal entity or an individual entrepreneur that processes personal data on behalf of BUS VOKZALY.UAi LLC is required to comply with the principles and rules for the processing of personal data provided for by the legislation of Ukraine in the field of personal data.

7. In the event that AUTOVOKZALY.UA LLC, on the basis of an agreement, transfers or entrusts the processing of personal data to another legal entity or individual entrepreneur, an essential condition of the agreement should be the obligation to ensure the specified person confidentiality conditions and ensure the security of personal data during their transfer or processing.

The subject of personal data has the right:

• receive full information regarding the processing of his personal data by AVTOVOKZALY.UA LLC, with the exception of cases provided for by the legislation of Ukraine;
• demand the correction of incorrect or incomplete personal data, as well as data processed in violation of the requirements of the legislation of Ukraine;
• require the blocking or destruction of their personal data if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
• require notification of all persons who were previously informed of their incorrect or incomplete personal data of all changes made to them;
• withdraw consent to the processing of their personal data;
• appeal against the actions or inaction of the operator when processing their personal data in accordance with the legislation of Ukraine;
• exercise other rights provided for by the legislation of Ukraine.

1. LLC “AVTOVOKZALY.UA” when processing personal data is obliged to:

• take the necessary measures to fulfill the obligations of the operator, provided for by the legislation of Ukraine in the field of processing and protection of personal data;
• explain to the subject of personal data the legal consequences of refusal to provide personal data, if this is mandatory in accordance with the legislation of Ukraine;
• block illegally processed personal data;
• terminate the processing of personal data in accordance with the legislation of Ukraine;
• notify the subject of personal data about the elimination of violations or the destruction of his personal data;
• provide, at the request of the subject of personal data or his representative, information relating to the processing of his personal data, in the manner prescribed by the legislation of Ukraine and the regulations of LLC “AUTOVOKZALY.UA”.

2. In order to take the measures necessary to fulfill the obligations stipulated by the legislation of Ukraine and the regulations of AUTOVOKZALY.UA LLC, the director of AUTOVOKZALY.UA LLC shall appoint a person responsible for organizing the processing and protection of personal data at AUTOVOKZALY.UA LLC.

3. The person responsible for organizing the processing and protection of personal data in AVTOVOKZALY.UA LLC is obliged to:

• organize the adoption of legal, organizational and technical measures to ensure the protection of personal data processed by AVTOVOKZALY.UA LLC from unauthorized or accidental access to them, destruction, modification, blocking, copying, distribution of personal data, as well as from other illegal actions in regarding personal data;
• ensure internal control over compliance in LLC “AVTOVOKZALY.UA” with the requirements of the legislation of Ukraine and regulations of LLC “AVTOVOKZALY.UA” in the field of personal data, including requirements for the protection of personal data;
• organize bringing to the attention of the employees of LLC “AVTOVOKZALY.UA” the provisions of the legislation of Ukraine in the field of personal data, regulations of LLC “AVTOVOKZALY.UA” on the processing of personal data, as well as requirements for the protection of personal data;
• to organize the reception and processing of appeals and requests from personal data subjects or their representatives, as well as to monitor the acceptance and processing of such appeals at AVTOVOKZALY.UA LLC.

1. Ensuring the security of personal data during their processing at AVTOVOKZALY.UA LLC is carried out in accordance with the legislation of Ukraine and the requirements of the authorized state authority for the protection of the rights of personal data subjects, the executive authority authorized in the field of security, and the executive authority authorized in areas of counteraction to technical intelligence and technical protection of information.

2. LLC “AVTOVOKZALY.UA” takes the necessary organizational and technical measures to protect personal data from accidental or unauthorized access, destruction, modification, blocking access and other unauthorized actions.

3. The protection measures implemented by AVTOVOKZALY.UA LLC when processing personal data include:

• adoption of local regulations and other documents in the field of processing and protection of personal data;
• appointment of officials responsible for ensuring the security of personal data in the divisions and the information system of BUS VOKZALY.UA LLC;
• organizing training and carrying out methodological work with employees who process personal data at AUTOVOKZALY.UA LLC;
• creation of the necessary conditions for working with material media and the information system in which personal data is processed;
• organization of accounting of material carriers of personal data and information systems in which personal data are processed;
• storage of material carriers of personal data in compliance with the conditions that ensure the safety of personal data and exclude unauthorized access to them;
• separation of personal data processed without the use of automation tools from other information;
• ensuring separate storage of physical media of personal data, which contain personal data of different categories or contain personal data, the processing of which is carried out for different purposes;
• establishment of a ban on the transfer of personal data through open communication channels, computer networks and the Internet without the application of measures established by AVTOVOKZALY.UA LLC to ensure the security of personal data;
• implementation of internal control over compliance in LLC “AVTOVOKZALY.UA” with the legislation of Ukraine and regulations of LLC “AVTOVOKZALY.UA” when processing personal data.

4. Responsibility for violation of the requirements of the legislation of Ukraine and the regulations of AUTOVOKZALY.UA LLC in the field of processing and protecting personal data is determined in accordance with the legislation of Ukraine.