1. Main
    2. > 
  2. Personal data privacy policy
    3. > 
  3. Personal data processing guide

Personal data processing guide

General Provisions

This Personal Data Processing Guide (hereinafter referred to as the "Guide") defines the general rules and guiding principles of conduct to be followed by employees directly involved in the processing of personal data, and by employees maintaining information systems that process personal data at Belavia - Belarusian Airlines (hereinafter referred to as the " Belavia"). It also explains to personal data subjects the purposes, legal grounds, and procedures for processing their personal data, as well as the rights of personal data subjects and the mechanisms for exercising such rights.

The Guide has been developed in compliance with the requirements of the Law of the Republic of Belarus dated May 7, 2021, No. 99-Z "On Personal Data Protection" (hereinafter referred to as the "Law"), and the General Data Protection Regulation (GDPR) 2016/679 (hereinafter referred to as the "Regulation").

Belavia contact details:

  • Postal address: Republic of Belarus, 220004, Minsk, 14A Nemiga Street.
  • Phone numbers (24/7):
    • 106 (within Belarus only)
    • +375 17 220 25 55 (from outside Belarus)
  • Email: info@belavia.by (for general information); support@belavia.by (booking support)
  • Website: belavia.by

Terms and their definitions used in this Guide are applied in the meanings established by the Law.

Purposes and Legal Grounds for Personal Data Processing

Belavia processes only those personal data that are necessary to achieve the stated purposes and does not allow excessive processing thereof.
Belavia processes personal data for the following purposes:

  • Providing air transportation services and related services, as well as informing about the progress of service provision and possible changes;
  • Providing access to the website and self-service features;
  • Enabling participation in the "Belavia Leader" loyalty programme;
  • Providing marketing information, including newsletters with news about promotions and special offers conducted by the Belavia;
  • Reviewing and responding to requests received from personal data subjects, including those recorded in the complaints and suggestions book;
  • Providing information in response to requests from government authorities (organizations);
  • Maintaining HR records and personnel documentation;
  • Complying with the legislation of the Republic of Belarus or any other country to which the Belavia carries passengers;
  • Protecting Belavia facilities from acts of unlawful interference in its operations;
  • Prevention of offences and crimes;
  • Ensuring the safety of Belavia employees and visitors, and the preservation of Belavia property (valuables);
  • Prevention and elimination of emergency situations;
  • Maintaining labour discipline.

Belavia processes personal data on the basis of the consent of personal data subjects, as well as on other legal grounds provided for by the Law.
Belavia processes personal data of a subject with their consent for the purposes of:

  • Sending newsletters with regular offers and promotions of the Belavia;
  • Enabling participation in the "Belavia Leader" loyalty programme;
  • Analytics for the purpose of optimizing offers for Belavia customers;
  • Reviewing CVs (questionnaires) of candidates for open vacancies on the Website.

Belavia processes personal data for the purpose of fulfilling contractual obligations for:

  • Issuing tickets;
  • Sending booking confirmations;
  • Providing additional services during air transportation;
  • Providing passengers with additional information about their flights;
  • Providing passengers with relevant information about their booked flight and destination;
  • Managing the flight check-in process;
  • Carrying out cargo transportation;
  • Organizing the transportation of passenger baggage;
  • Implementing access control and on-site security measures.

Belavia processes personal data of a subject for purposes arising from duties (powers) provided for by legislative acts, as well as to achieve its own objectives within the framework established by law, for:

  • Fulfilling obligations to store personal data in accordance with tax legislation;
  • Complying with the requirements of the legislation of the countries to which Belavia operates flights;
  • Complying with the requirements of labour, employment, social protection, and pension legislation;
  • Transmitting API (Advance Passenger Information) / PNR (Passenger Name Record) data to border authorities of respective countries;
  • Implementing the norms of legislation in the field of national security, anti-corruption, prevention of money laundering, financing of terrorist activities, and financing of the proliferation of weapons of mass destruction;
  • Ensuring the fulfilment of legal obligations, including debt collection and protection in the event of legal disputes;
  • Conducting inspections and audits;
  • Ensuring the functioning of the international aviation security system;
  • Advertising its services and products, provided that the subject has given consent to such actions;
  • Creating anonymous statistics for the purpose of improving the quality of Belavia services and products, as well as collecting statistics on flights and routes;
  • Implementing the norms of legislation in the field of security activities;
  • Interacting with customers and employees of the Belavia (or job applicants).

Categories of Personal Data Subjects

Belavia processes personal data of the following categories of subjects:

  • Visitors (users) of the Belavia website;
  • Visitors arriving at the Belavia premises (facilities);
  • Persons who have provided the Belavia with their personal data by subscribing to newsletters, submitting reviews, requests, filling out questionnaires, surveys during advertising and other events conducted by the Belavia;
  • Current and former employees of the Belavia;
  • Relatives (family members) of Belavia employees;
  • Candidates for employment with the Belavia;
  • Partners (counterparties) and customers of the Belavia who are natural persons;
  • Representatives and/or employees of partners (counterparties) of the Belavia who are legal entities;
  • Other subjects whose interaction with the Belavia create the need to process personal data.

Categories of Personal Data Processed

When fulfilling contractual obligations and providing additional services, Belavia processes the following categories of customer personal data:

  • Last name, first name, patronymic (if applicable), identity document details (series, number, date of issue, name of the issuing authority, document validity period, identification number), gender, age, citizenship;
  • Contact details (address, phone number, email address), including workplace contact details (when booking air travel under a corporate agreement);
  • Information about bookings, orders and purchases, including detailed information about routes, booking and flight dates, class, cost, payment details, baggage and other additional services related to the flight, boarding passes, special requests and preferences;
  • Information about participation in the "Belavia Leader" loyalty programme, including member number, points, balance, rewards and privileges, type and level of participation in the programme, and other information related to programme participation;
  • Information about interaction between the customer and the Belavia, including messages received via email, the website feedback form, chats, messengers and social networks;
  • Information in the form of audio recordings of telephone conversations received during contact with the Belavia structural divisions with complaints and suggestions;
  • Information processed during the use of the website and other digital media, including IP address, browser type, operating system, referring website, as well as information contained in cookies and similar files when visiting the website;
  • Information related to customers' social media: depending on the social network settings, access may be obtained to certain customer information from their social media profile, including contact details, interests and contacts;
  • Additional information that customers provide to the Belavia or that is contained in open sources, including interests and preferences, social media comments, information obtained from completed questionnaires, applications and survey forms;
  • Other information not specified in this Guide; for processing such data, the Belavia may request additional consent from the customer.

When considering a subject as a candidate for a position at the Belavia or when hiring a subject, the following data may be collected:

  • Last name, first name, patronymic (if applicable);
  • Date of birth, citizenship, identity document number and validity period, identification number;
  • Contact details (phone number, email address);
  • Photograph of the subject;
  • Place of residence/place of stay;
  • Information about the subject's education;
  • Information about the subject's professional development/advanced training;
  • Information about previous places of employment;
  • Marital status;
  • Information about children;
  • Information about parents;
  • Brief biography;
  • Health information;
  • Primary military registration data.

Rights of Personal Data Subjects and the Mechanism for Their Exercise

Consent of a personal data subject is a free, unambiguous, and informed expression of their will, by which they authorize the processing of their personal data.
Consent of the subject or their representative (if duly authorized) may be obtained by the Belavia in written form or in another electronic form.
Prior to obtaining consent, the Belavia also provides the personal data subject with information about their rights related to the processing of personal data and the mechanism for exercising such rights.

Personal data subjects have the right:

  • To receive information regarding the processing of their personal data, including:
    • The name and location of the Belavia;
    • Confirmation of the fact that the Belavia is processing personal data of the requesting person;
    • Their personal data and the source from which they were obtained;
    • The legal grounds and purposes for processing personal data;
    • The period for which consent to the processing of personal data has been given;
    • Other information provided for by legislation.
  • To amend their personal data if it is incomplete, outdated, or inaccurate. To do so, the subject must provide relevant documents and/or duly certified copies thereof confirming the need for such amendments, or independently make the relevant changes in their personal account on the Website.
  • To receive information about the transfer of personal data to third parties once per calendar year, free of charge, unless otherwise provided for by the Law and other legislative acts.
  • To withdraw consent to the processing of personal data at any time, without explanation, if the Belavia obtained the subject's consent as the basis for processing. The right to withdraw consent cannot be exercised if processing is carried out on other legal grounds.
  • To demand free-of-charge cessation of the processing of their personal data, including their deletion, in the absence of legal grounds for processing personal data as provided for by the legislation of the Republic of Belarus.
  • To appeal against actions (inactions) and decisions of the Belavia that violate their rights in the processing of personal data — to the authorized body for the protection of the rights of personal data subjects or through judicial proceedings.

To exercise one or more of the above-listed rights, except for the right to appeal against actions or inactions of the Belavia, the personal data subject may submit a corresponding application to the Belavia in one of the following ways:

  • In writing — by hand delivery (courier), by post, in person, or by making entries in the complaints and suggestions book;
  • In electronic form via the state unified (integrated) republican information system for recording and processing appeals of citizens and legal entities on the Internet at: https://обращения.бел.

An application to exercise one or more of the aforementioned rights must contain:

  • Last name, first name, patronymic (if applicable) of the personal data subject and their residential address (place of stay);
  • Date of birth of the personal data subject;
  • Identification number of the personal data subject, or, if no such number exists — the number of the identity document of the personal data subject, in cases where this information was indicated by the personal data subject when giving consent to the Belavia, or where processing is carried out without the consent of the personal data subject;
  • Statement of the substance of the personal data subject's requirements;
  • Personal signature or electronic digital signature of the personal data subject.

In the event that the subject withdraws consent to the processing of data that was collected on the basis of previously obtained consent, the Belavia must cease further processing of the data; however, all data processing carried out prior to the withdrawal of consent remains lawful. In the absence of other lawful grounds justifying further processing (e.g., continued storage of data), the data must be deleted.

A personal data subject may seek assistance in exercising their rights by contacting the Information Protection Department by sending an email to dpo@belavia.by.

Storage and Destruction of Personal Data

When determining the retention periods for personal data, the Belavia is guided by the periods established by the List of Standard Documents Generated in the Course of Activities of State Bodies, Other Organizations and Individual Entrepreneurs, with Indicated Retention Periods, approved by Resolution of the Ministry of Justice of the Republic of Belarus dated May 24, 2012, No. 140 "On the List of Standard Documents" (hereinafter referred to as the "List").

If the retention period for personal data is not determined by the List, the Belavia independently determines such a period based on the purposes of personal data processing and the specifics of the Belavia activities, while excluding excessive processing of personal data.

The retention period for information may be changed in connection with an investigation conducted by a supervisory authority, in cases where the data is needed as evidence of the compliance with applicable legislation requirements, as well as when the Belavia exercise its legal rights during judicial proceedings under the legislation of the Republic of Belarus or other applicable legislation.

Upon expiration of the established retention periods, documents containing personal data are destroyed in accordance with the procedure established by the legislation on archiving and records management; personal data contained in Belavia information systems is deleted; and where there is no technical capability to delete personal data, Belavia applies measures to prevent further processing of personal data, including their blocking.

Ensuring the Security of Personal Data Processing at Belavia

When processing personal data in the Belavia information systems, data must be protected against unauthorized or accidental access, modification, blocking, copying, distribution, provision, deletion of personal data, and other unlawful actions in relation to personal data. Security measures are applied regardless of whether data is processed electronically or in paper form. The method of information storage must be taken into account.

Cross-Border Transfer of Personal Data

Belavia carefully selects authorized persons and engages only those who provide sufficient guarantees of implementing appropriate legal, organizational, and technical measures to ensure the processing of personal data in accordance with the requirements of paragraph 3 of Article 17 of the Law.

Authorized persons process personal data on the basis of an agreement concluded with Belavia (it is permissible to include a relevant section in the contract or an annex to the contract) on the processing of personal data, and undertake to comply with the principles and rules for processing and protecting personal data as provided for by the Law or the legislation of the foreign state in whose territory the authorized person is located.

To the extent that the operator and the authorized person process any personal data, the parties are obliged to take appropriate legal, organizational, and technical measures to ensure a level of security commensurate with the risk associated with the processing of personal data, and any security measures specified in the provisions of the personal data processing agreement.

Belavia regularly monitors the compliance of authorized persons with measures to ensure the protection of personal data processed on behalf of Belavia. If the legislation changes, the terms of the agreement are reviewed and updated.

Cross-border transfer of personal data in the course of Belavia core activities is carried out in accordance with the list of foreign states that ensure an adequate level of protection of the rights of personal data subjects, which includes foreign states that are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, adopted in Strasbourg on January 28, 1981, as well as foreign states that are members of the Eurasian Economic Union.

Cross-border transfer of personal data of customers to the territory of a foreign country of planned visit that does not ensure an adequate level of personal data protection, for the purpose of processing all necessary documents and providing services, is carried out in cases and in the manner established by Article 9 of the Law.

When carrying out such cross-border transfers of personal data, the following risks may arise, of which Belavia informs customers:

  • Absence of specific legislation regulating the processing of personal data;
  • Absence of an independent authorized state body for the protection of the rights of personal data subjects;
  • Risk of broad access to personal data by law enforcement authorities of various countries.

In accordance with the legislation of the Republic of Belarus and other countries that are countries of departure, destination, or transit, Belavia ensures the transfer of API (Advance Passenger Information) / PNR (Passenger Name Record) passenger data to the authorized bodies of those countries. Compliance with these requirements is necessary to ensure aviation security and immigration control.

COOKIE PROCESSING POLICY OF BELAVIA - BELARUSIAN AIRLINES

1. General Provisions

1.1. This Cookie Processing Policy of Belavia (hereinafter referred to as the "Policy") has been developed in compliance with the requirements of the Law of the Republic of Belarus dated May 7, 2021, No. 99-Z "On Personal Data Protection" for the purpose of protecting the personal data of users of the website belavia.by (hereinafter referred to as the "Website"), who are personal data subjects.

1.2. The Policy explains to Website users for what purposes and how Belavia - Belarusian Airlines  (hereinafter referred to as the " Belavia"), as the owner of the Website, processes cookies, as well as how users can control such processing.

1.3. Cookies are small strings of data that are transmitted to the browser of a user's device when visiting the Website, through which the Website remembers certain information about the user and their device, such as personal preferences and user settings.

1.4. Belavia processes cookies for the purposes of:

  • Ensuring the security of Website users;
  • Ensuring the proper functioning of the Website and improving ease of use;
  • Creating and providing personalized advertising;
  • Collecting analytical information in aggregated form to evaluate and further improve the performance of the Website.

2. Classification of Cookies Used

2.1. Belavia uses the following types of cookies: technical/functional (mandatory), analytical, advertising.

2.2. Technical/functional (mandatory) cookies are required to ensure the proper functioning of the Website, including the correct use of the features and services offered on it. This type of cookie does not store information about the user that could be used for advertising (marketing) purposes or for analyzing user behavior on the Website. Such data is not transferred to third-party analytical systems.

2.3. Analytical cookies are necessary for statistical purposes; they allow counting the number and duration of Website visits and analyzing how users use the Website, including which pages they visit, which helps improve the Website's performance and make it more user-friendly.

2.4. Advertising cookies are used for marketing purposes and to improve the quality of advertising, to provide the user with more relevant and suitable content, and personalized advertising material based on the user's interests.

2.5. Depending on the retention period in the user's device browser, Belavia uses session and persistent cookies. Session cookies are stored only during the use of the Website, while persistent cookies are stored for the time specified in the cookie parameters, or until they are deleted by the user.

2.6. Depending on who has set (generated) the cookies, they are divided into:

  • Own cookies, set (generated) by Belavia;
  • Third-party cookies, which are generated by third parties and used by Belavia a tool for analyzing user interaction with the Website, as well as for configuring marketing and advertising materials based on user preferences and interests.

3. Ways of Obtaining User Consent for Cookie Processing

3.1. When a user first visits the Website, Belavia offers the user the option to consent to the use of cookies or to refuse their use by clicking the "Accept" or "Reject" buttons on the pop-up information banner.

  • By clicking "Accept", the user consents to the use of all types of cookies listed in clause 2.1 of this Policy.
  • By clicking "Reject", the user refuses the processing of any cookies except technical/functional (mandatory) ones.
  • By clicking "Settings", the user is directed to the settings page where they can authorize the processing of specific cookies.

3.2. To ensure the full and proper functioning of the Website and its safe use, Belavia - Belarusian Airlines processes technical/functional (mandatory) cookies regardless of whether the user has provided consent. Such cookies cannot be disabled using the Website's functionality.

3.3. The user may manually clear their device and/or refuse the use of cookies by accessing browser configuration settings and selecting the following options:

  • Blocking cookies on the user's device;
  • Receiving a browser notification requesting consent to install a new cookie on the user's device;
  • Accepting or rejecting cookies depending on the sender.

3.4. The Website saves the user's choice regarding cookie settings for 1 (one) year. After this period, the Website will again request the user's consent by displaying a pop-up information banner.

3.5. More information about cookie management settings can be found on the respective pages of the main browser websites:

  • Chrome
  • Safari
  • Opera
  • Microsoft Edge
  • Internet Explorer
  • Firefox

When visiting the Website in "incognito" mode, some types of cookies are not saved.

4. Cross-Border Transfer of Cookies

4.1. Through the processing of the cookies used, the following information may be obtained:

  • Device information (device type, browser type and settings, operating system, source request URL, etc.);
  • Content preferences (visited web pages, date and time of Website visit, etc.);
  • Information about advertising display (viewability and interaction of the user with advertising content).

Belavia collects the aforementioned information in accordance with the purposes specified in clause 1.4 of this Policy.

4.2. Belavia uses analytics tools and the corresponding cookies of the following service providers:

Yandex.Metrica — Yandex Privacy Policy. Yandex.Metrica is used to improve user interaction with the Website; it uses cookies to collect information about user behavior on the Website without identifying them.

4.4. In connection with the above, Belavia additionally informs personal data subjects of the existence of risks arising from the absence of an adequate level of personal data protection in the following foreign countries:

  • Absence of specific legislation regulating the processing of personal data, including requirements for compliance with such norms;
  • Absence of an independent authorized state body for the protection of the rights of personal data subjects;
  • Limited scope of personal data subjects' rights;
  • Use of improper methods for obtaining personal data, unlawful processing of personal data, as a result of which personal data may become accessible to an unlimited number of persons.

5. Assistance in Exercising Rights Related to Cookie Processing

5.1. A user who is a personal data subject may contact Belavia for assistance in exercising their rights on matters related to the processing of cookies in one of the following ways:

  • By sending an email to: dpo@belavia.by;
  • By submitting a written application to: Republic of Belarus, 220004, Minsk, 14A Nemiga Street;
  • By submitting an application in the form of an electronic document containing the electronic digital signature of the personal data subject, to the email address: support@belavia.by.

6. Final Provisions

6.1. This Policy is published in the public domain on the Website in the information and telecommunications network Internet and takes effect from the moment of its approval.

6.2. Belavia has the right at its own discretion to unilaterally amend and/or supplement the terms of this Policy without prior notification of personal data subjects, by posting a new version of the Policy on the Website.

tk.by