PERSONAL DATA PROCESSING POLICY

APPROVED by Order of the Director of LLC "Uyutny Tekstil," Tatyana Valeryevna Chumakova, dated September 22, 2026, No. 1


1. General provisions
1.1. This Personal Data Processing Policy of LLC "Uyutny Tekstil" (interior design studio The Key, hereinafter — the Operator) (hereinafter — the Policy) has been developed to fulfill the requirements of the Law of the Republic of Belarus of May 7, 2021, No. 99-Z "On the Protection of Personal Data" (hereinafter — the Law). It explains to personal data subjects the purposes, legal grounds and procedure for processing their personal data, as well as their rights and the way to exercise them.
1.2. Operator's contacts: Business ID (UNP) 791309614, location address: Republic of Belarus, 212030, Mogilev, Pervomayskaya St., 26, email: anastasia.gvozd.by@gmail.com, information resource: https://thekey.by/ (hereinafter — the Site).
1.3. The Policy applies to the processing of personal data of:

• users of the Site;
• persons who have submitted a request for interior design services through the Site, by phone, email, on social networks or in messengers;
• clients who have concluded (are concluding) a service contract with the Operator;
• persons who have sent an inquiry to the Operator.

1.4. The Policy is published in open access on the Site https://thekey.by/.
1.5. Terms in the Policy are used in the meaning defined by the Law.
2. Procedure and conditions for processing personal data
2.1. The Operator processes only the personal data that is necessary to achieve the stated purposes and does not allow their excessive processing. To make contact regarding a request, the Operator asks only for a name and phone number.
2.2. Personal data is processed on the basis of the data subject's consent, as well as on other legal grounds provided for by the Law:

• upon conclusion and performance of a contract with the data subject;
• when fulfilling obligations provided for by legislative acts;
• when processing personal data previously disseminated by the subject themselves.

2.3. Consent to the processing of personal data when submitting a request through the Site is given by checking the corresponding box in the form. When contacting by phone, email, on social networks or in messengers, processing is carried out for the purpose of responding to the inquiry and preparing for the conclusion of a contract.
2.4. The purposes of processing, categories of subjects, list of processed data, legal grounds, storage periods and persons to whom the data is provided are specified in Appendix 1 to the Policy.
2.5. Upon expiration of the storage periods, personal data is deleted, unless otherwise provided by law.
3. Authorized persons. Provision of personal data to third parties
3.1. To receive and store requests sent through the Site, the Operator entrusts the processing of personal data to an authorized person — LLC "Tilda Publishing Bel" (Republic of Belarus, Minsk Region, Minsk District, Borovlyansky village council, Borovaya village, building 1, room 433, main building), which ensures the operation of the Site and the storage of requests on the Tilda platform.
3.2. The Operator does not provide personal data to third parties, except in cases provided for by legislative acts (including in response to requests from state bodies). The Operator does not carry out advertising or informational mailings.
4. Cross-border transfer of personal data
4.1. When contacting the Operator through social networks and messengers (including Instagram, WhatsApp, Telegram, Viber), personal data is processed by the operators of these services located in foreign states, including states in whose territory an adequate level of protection of the rights of personal data subjects is not ensured. Such transfer is carried out for the purpose of communication with persons who have independently chosen this method of contact.
4.2. The Operator informs data subjects of the risks arising from the absence of an adequate level of personal data protection in such states:

• the absence of special legislation regulating the processing of personal data;
• the absence of an independent authorized body for the protection of the rights of personal data subjects;
• a limited range of rights of personal data subjects;
• the use of improper methods of obtaining personal data;
• the unlawful processing of personal data, as a result of which it may become available to an unlimited number of persons.

4.3. Persons who do not wish to accept these risks may contact the Operator through the form on the Site or by phone.
4.4. The Operator does not carry out any other cross-border transfer of personal data. The personal data of clients residing outside the Republic of Belarus is processed in accordance with this Policy and the legislation of the Republic of Belarus.
5. Measures to protect personal data. Cookies
5.1. The Operator takes legal, organizational and technical measures to protect personal data from unauthorized access, alteration, blocking, deletion and dissemination. Access to personal data is available only to the Operator's employees who need it to work with requests and contracts.
5.2. The Operator does not use web analytics services or advertising counters on the Site. Only technical (necessary) cookies of the Tilda platform may be used on the Site, ensuring the correct operation of the Site and the request form. The user can disable them in the browser settings, but in this case some of the Site's functions may be unavailable.
6. Rights of personal data subjects and the mechanism for exercising them
6.1. The personal data subject has the right to:
6.1.1. demand changes to their personal data if it is incomplete, outdated or inaccurate. The Operator makes changes within 15 calendar days from the receipt of the application;
6.1.2. receive information concerning the processing of their personal data. The Operator provides it within 5 business days after receiving the application, or notifies of the reasons for refusal;
6.1.3. receive information about the provision of their personal data to third parties. Within 15 calendar days, the Operator reports what data and to whom it was provided during the year preceding the date of the application, or notifies of the reasons for refusal;
6.1.4. withdraw consent to the processing of personal data. Within 15 calendar days, the Operator ceases processing and deletes the data if it has no other legal grounds for processing it, and notifies the subject of this;
6.1.5. demand the cessation of the processing of their personal data and (or) its deletion. Within 15 calendar days, the Operator fulfills the demand if it has no other legal grounds for processing, and notifies the subject of this;
6.1.6. appeal the Operator's actions (inaction) and decisions related to the processing of their personal data to the National Center for Personal Data Protection of the Republic of Belarus, in the manner established by the legislation on citizens' and legal entities' appeals.
6.2. To exercise the rights specified in subparagraphs 6.1.1–6.1.5, the subject sends the Operator a written application to the address: Republic of Belarus, [postal code], Mogilev, Pervomayskaya St., 26, or in the form of an electronic document in the manner provided for by the Law.
6.3. The application must contain:

• the surname, first name and patronymic (if any) of the personal data subject;
• date of birth;
• residential address (place of stay);
• the phone number provided when contacting the Operator;
• a statement of the essence of the demands;
• the identification number or the number of the identity document, if this information was provided when giving consent or if processing is carried out without consent;
• a personal signature or electronic digital signature.

6.4. For questions about the processing of personal data, you may also contact us by phone [phone] or email anastasia.gvozd.by@gmail.com for a consultation.
7. Final provisions
7.1. Matters concerning the processing of personal data not regulated by the Policy are governed by the legislation of the Republic of Belarus.
7.2. If any provision of the Policy is found to contradict the law, the remaining provisions retain their force, and the invalid provision is considered amended to the extent necessary for compliance with the law.
7.3. The Operator has the right to unilaterally amend and supplement the Policy. The new version takes effect from the moment it is posted on the Site.

Appendix 1 — Processing table