Documents

1. General Provisions

1.1. This Policy has been developed by HKB Solutions Limited Liability Company (hereinafter — the Organisation, the operator) in accordance with Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" (hereinafter — the Law), including for the purpose of complying with Article 17 of the Law, and sets out the procedure for processing data using cookies on the website https://section228.com/ (hereinafter — the Website).

For the purposes of this document, List No. 140 means the List of Standard Documents with Retention Periods approved by Resolution of the Ministry of Justice of the Republic of Belarus No. 140 of 24 May 2012, as amended.

1.2. Operator: HKB Solutions LLC, UNP 193656658. Registered office: 11 2nd Shestaya Liniya St., office 6a-8-96, Minsk, 220013, Republic of Belarus. Postal address: 53 Novovilenskaya St., apt. 22, Minsk, 220053, Republic of Belarus. Email: intro@section228.com.

1.3. Cookies are small pieces of data stored on the user's device and used when interacting with the Website. Other terms are used as defined in the Law. This Policy applies to all users of the Website.

1.4. Unique identifiers and information about user actions may relate to a directly or indirectly identifiable natural person. Such information constitutes personal data. The absence of a name or the generation of aggregated reports does not in itself mean that the source data has been anonymised.

1.5. This Policy is available before the relevant processing begins. A new version applies no earlier than its approval and publication on the Website. Amendments to the Policy do not extend previously given consent. If the purposes of processing change, new consent is obtained before processing for the new purposes begins, unless there is another legal basis.

2. Purposes and Scope of Data

2.1. Cookies are used to remember user choices, ensure the necessary functionality and security of the Website, analyse traffic and interaction with content, and operate the Calendly meeting booking widget.

2.2. The connected tools may process cookie identifiers, information about the device, browser and operating system, date and time of the visit, session duration, pages viewed and their addresses, number of visits and referral source. The scope of data is determined by the tools actually activated and by the user's choice.

2.3. Analytics settings must not allow the transfer of form contents, contact details or other information not required for the stated purposes. When user action recording features are used, the Organisation carries out a separate review of the data collected and excludes excessive information.

2.4. The name, email address and other information entered when booking a meeting are processed as a separate process. Consent to cookies does not replace the legal basis required for such processing. Information about this process is provided in the general personal data processing policy and in the booking interface. Where consent is relied upon, separate terms are provided before the booking data is submitted: purpose, data, actions, recipients, period and consequences of refusal. Using the widget does not constitute an expression of will.

2.5. Meeting booking: name, email, selected date and time, and time zone, if transmitted; purpose — arranging a meeting upon request. Consent to cookies is not consent to this data. If an applicable basis other than consent exists, it is established separately; otherwise, an independent choice to consent is provided before the data is submitted. Period — until the meeting and related communication are completed, but no longer than three years from the date of consent or, under another legal basis, of receipt of the booking; earlier achievement of the purpose terminates processing unless there is another basis. Recipients and transfers — as set out in Appendix A. If the required consent is refused, online booking is not carried out; the availability of other means of contact depends on the existence of a legal basis.

3. Cookie Categories and Legal Bases for Processing

3.1. Strictly necessary technical cookies are used only to the extent required for the basic functionality of the Website, including remembering the user's choice. Consent is not requested for strictly necessary technical cookies. Optional analytics does not fall into this category.

3.2. Analytics cookies are used for traffic statistics and analysis of interaction with the Website. The legal basis for processing is consent under Article 5 of the Law.

3.3. Optional functional cookies of third-party widgets are used with the user's consent to the relevant category. Refusal may limit the widget's operation but must not prevent viewing the main content of the Website.

3.4. When processing is entrusted to authorised persons, the Organisation complies with Article 7 of the Law. For cross-border transfers, the conditions of Article 9 of the Law are additionally met.

4. List of Cookies and Retention Periods

4.1. The following list applies to the tools listed. The lifetime of a cookie on the device is not the same as the period for which data is stored in the services' information systems. Actual processing is limited to the stated purposes and the legal basis.

4.2. Configuring cookies does not extend consent to processing. If consent has expired, optional tools are not activated until a new choice is made. If the actual set of cookies changes, the Organisation updates the list in advance and, where necessary, obtains new consent.

5. Data Recipients

5.1. When the relevant categories are enabled, Yandex.Metrica, Google Analytics 4 and Calendly are used. Recipients receive only the data necessary for the stated purposes and permitted by the applicable legal basis.

5.2. The list of specific recipients, their roles, data, countries of processing and grounds for cross-border transfer is set out in Appendix A "Unified Register of Recipients and Cross-Border Transfers", which is identical for all three documents in the set. For each purpose, only the row relevant to it applies. Processing that requires informed consent or a special transfer basis does not begin until the relevant information has been completed and disclosed to the data subject and the required basis has been ensured.

5.3. Current information on the terms of third-party services:

• Yandex — https://yandex.ru/legal/confidential/
• Google — https://policies.google.com/privacy
• Calendly — https://calendly.com/legal/privacy-notice
• Cloudflare — https://www.cloudflare.com/privacypolicy/

The terms of these services do not replace the Organisation's obligation to comply with the Law.

6. Cross-Border Transfers

6.1. The use of foreign services may involve the transfer of personal data outside the Republic of Belarus, including to the Russian Federation and the United States of America. The location of the recipient does not mean that processing is limited to the country of its registration.

6.2. The Organisation permits transfers only in compliance with Article 9 of the Law. Whether an adequate level of protection exists is determined by the current list established by the National Personal Data Protection Center. Before connecting a service, the Organisation establishes the recipients, countries of processing and the basis for transfer.

6.3. Transfers to countries without an adequate level of protection are permitted only where a basis provided for in paragraph 1 of Article 9 of the Law exists. If the basis is consent, the user is informed of the destination countries and the risks before consent is obtained. The relevant tools are not activated until such consent is obtained.

6.4. Possible risks include limited rights and remedies, differences in the scope of protected data, access by public authorities, insufficient liability measures and the risk of unauthorised access. This list does not mean that all of these circumstances exist in every country.

6.5. Any change of recipients or countries of processing is preceded by updating the information and ensuring the necessary legal basis. Publication of a new text does not replace consent where consent is required.

7. Obtaining and Withdrawing Consent

7.1. Before optional tools are activated, the user chooses "Accept all", "Reject optional" or "Customise". Analytics and functional categories are selected separately. Inaction, continued browsing and pre-ticked boxes do not constitute consent.

7.2. Before making a choice, the user is provided with information about the operator, purposes, data, actions performed with it, consent period, recipients and cross-border transfers, and is informed of their rights, how to exercise them and the consequences of consenting or refusing. The interface must not encourage consent by making refusal more difficult.

7.3. The user's choice is stored for one year. After this period, the Website asks for consent again. The user may delete stored cookies and restrict their use through browser settings as described in Section 8. Changing browser settings and deleting cookies do not constitute giving new consent.

7.4. The user may withdraw consent as described in clause 9.2. Upon withdrawal, the Organisation fulfils its obligations under Article 10 of the Law: unless there are other legal grounds, it stops processing, deletes the personal data and ensures that authorised persons take the necessary actions, notifying the user within the established period. If deletion is technically impossible, measures to prevent further processing, including blocking, are applied and the user is notified.

7.5. The Organisation ensures that receipt of consent and its content can be confirmed. Refusing analytics does not restrict viewing of the main content. Records of consent are stored separately from the data used for the main purpose for one year after the end of the period for which consent was given, in accordance with the applicable provisions of List No. 140. Storing such records does not permit continuing advertising, analytics or other processing after the basis has ceased. Retention periods and their start for other documents are determined separately according to their type.

8. Browser Settings

8.1. The user can manage cookies through the browser's privacy and security settings: view and delete stored cookies, clear Website data, and restrict or block the storage of cookies, including third-party cookies. Section names and available features depend on the browser and its version. To delete Website data, find section228.com in the list of stored site data and perform the corresponding action. Where necessary, third-party service cookies are deleted separately.

8.2. Deleting and blocking cookies are technical actions on the user's device. They are not equivalent to sending the Organisation a withdrawal of consent, do not automatically delete data already transferred to the Organisation or third-party services, and do not guarantee that all network requests and analytics scripts stop. To exercise the right to withdraw consent, clause 9.2 applies.

8.3. Disabling necessary cookies may impair certain functions of the Website. Private browsing mode does not in itself guarantee that no data is transferred to third parties. Refusing optional analytics must not prevent viewing the main content of the Website.

9. Rights, Requests and Company Details

9.1. In cases provided for by the Law, the user has the right to withdraw consent, obtain information about the processing of their data and its provision to third parties, demand correction of inaccurate data, cessation of processing and deletion of data, and to appeal against the Organisation's actions to the National Personal Data Protection Center and against its decision — to court.

9.2. To withdraw consent and exercise other rights provided for by the Law, the user may send an application in writing to the Organisation's postal address: 53 Novovilenskaya St., apt. 22, Minsk, 220053, Republic of Belarus, or as an electronic document signed with a digital signature to intro@section228.com. The right provided for by Article 10 of the Law to withdraw consent in the form through which it was obtained is also retained. The application must contain the information and signature required by Article 14 of the Law. An ordinary email without a digital signature is not equivalent to an electronic document. For enquiries and assistance in exercising rights, you can write to intro@section228.com. To opt out of advertising messages, an ordinary email or a reply to an advertising message with an unambiguous request to stop the mailing is also accepted; no digital signature is required for such an opt-out.

9.3. The time limits and conditions for consideration are established by Articles 10–13 of the Law. Information under Article 11 is provided within five working days unless another period is established by legislative acts. Other requests are considered within the time limits and subject to the exceptions of the relevant Article. The Organisation does not request excessive information to identify the applicant.

9.4. HKB Solutions Limited Liability Company. UNP 193656658; OKPO 506574105000. Registered office: 11 2nd Shestaya Liniya St., office 6a-8-96, Minsk, 220013, Republic of Belarus. Postal address: 53 Novovilenskaya St., apt. 22, Minsk, 220053, Republic of Belarus. Email: intro@section228.com.

1. GENERAL PROVISIONS

1.1. This Privacy Policy (hereinafter — the Policy) has been developed by HKB Solutions Limited Liability Company in accordance with personal data legislation and is one of the measures to ensure the protection of personal data provided for in Article 17 of Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" (hereinafter — the Law).

1.2. The Policy explains the purposes, legal bases and procedure for the processing of personal data by HKB Solutions Limited Liability Company, and informs you of your rights in connection with such processing and how to exercise them.

1.3. The personal data operator is HKB Solutions Limited Liability Company (hereinafter — the Organisation), UNP 193656658. Registered office: 11 2nd Shestaya Liniya St., office 6a-8-96, Minsk, 220013, Republic of Belarus. Postal address: 53 Novovilenskaya St., apt. 22, Minsk, 220053, Republic of Belarus. Email: intro@section228.com. Website: https://section228.com/ (hereinafter — the Website).

1.4. The Policy applies to the processing of data in connection with requests via the Website, meeting bookings, business correspondence, the conclusion, performance and termination of contracts, the sending of advertising messages and the fulfilment of legal obligations related to these processes. The processing of data of employees and former employees is governed by separate documents. Cookie-specific matters are set out in a separate Cookie Policy; the general principles of this Policy also apply to the relevant personal data.

1.5. The following abbreviations, terms and definitions are used in the Policy:

• Full name — surname, first name and patronymic (if any);
• Individual — a natural person;
• Sole proprietor — an individual entrepreneur;
• Legal entity — a legal person;
• Consent — consent to the processing of personal data.

Other terms and definitions are used as defined in the Law.

1.6. The Policy is available before the processing of personal data begins. A new version applies no earlier than its approval and publication. Amendments to the Policy do not extend previously given consent. If the purposes of processing change, the Organisation obtains new consent before processing for the new purposes begins, unless there is another legal basis.

2. PROCEDURES AND CONDITIONS FOR PROCESSING PERSONAL DATA

2.1. The Organisation processes only the personal data necessary to achieve the stated purposes and does not allow excessive processing.

2.2. The Organisation processes personal data both with and without the use of automation. Depending on the purposes of processing, the following actions may be performed with personal data: collection, storage, use, systematisation, modification, transfer and deletion.

2.3. The Organisation processes personal data as a personal data operator — that is, processing is carried out on behalf of the Organisation and in its interests.

2.4. The Organisation processes personal data solely on the legal bases provided for by the Law. These include:

• consent to the processing of personal data;
• the conclusion and performance of a contract with the data subject;
• the fulfilment of obligations or powers provided for by law.

2.5. In determining personal data retention periods, the Organisation follows the List of Standard Documents Generated in the Activities of State Bodies, Organisations and Individual Entrepreneurs, with Retention Periods, approved by Resolution of the Ministry of Justice of the Republic of Belarus No. 140 of 24 May 2012 (hereinafter — List No. 140). Where a retention period is not provided for by List No. 140, the Organisation determines it independently based on the purposes of processing and the principle of minimisation, so as to avoid excessive retention. Upon expiry of the established retention periods, documents containing personal data are destroyed in accordance with archival and records management legislation, and personal data in the Organisation's information systems is deleted.

2.6. Detailed information on the purposes, scope, legal bases and retention periods of personal data for each category of data subjects is set out in the appendix to this Policy.

3. AUTHORISED PROCESSORS. PROVIDING PERSONAL DATA TO THIRD PARTIES

3.1. The list of specific recipients, their roles, data, countries of processing and grounds for cross-border transfer is set out in Appendix A "Unified Register of Recipients and Cross-Border Transfers", which is identical for all three documents in the set. For each purpose, only the row relevant to it applies. Processing that requires informed consent or a special transfer basis does not begin until the relevant information has been completed and disclosed to the data subject and the required basis has been ensured.

3.2. When processing is entrusted to another party, a contract, legislative act or decision of a state body determines the purposes, the list of actions, confidentiality obligations and protection measures under Articles 7 and 17 of the Law. The role of a recipient is determined by the actual arrangement, not by the name of the service. The conditions for engaging sub-processors are determined by the applicable contract and legislation.

The Organisation monitors compliance by authorised processors with personal data protection measures.

3.3. Within the purposes of processing defined by the Policy, the Organisation may provide personal data to third parties, in particular:

• to recipients for the relevant purpose listed in Appendix A — only to the extent necessary and on an applicable legal basis;
• to other third parties in cases provided for by law — for example, to supervisory authorities upon receipt of relevant requests.

4. CROSS-BORDER TRANSFER OF PERSONAL DATA

4.1. The Organisation transfers personal data across borders in the following cases:

4.1.1. When foreign email infrastructure is used, data may be transferred outside the Republic of Belarus. The transfer may include sender and recipient addresses, message content and attachments, not only the email address. The scope is limited to what is necessary for a lawful purpose.

4.1.2. When foreign messengers are used, user identifiers, contact details and correspondence content may be transferred outside the Republic of Belarus. The fact that the user initiated the correspondence does not in itself replace the legal basis for cross-border transfer.

4.1.3. The use of web analytics and Calendly may involve the transfer of unique identifiers, technical information, booking data and other personal data. The generation of aggregated reports does not in itself mean that the source data has been anonymised. The use of cookies is also governed by a separate policy.

4.2. Before any transfer, the Organisation identifies the recipients and countries of processing, checks the adequacy of protection against the current list of the National Personal Data Protection Center and ensures compliance with Article 9 of the Law. Data is transferred to a country without an adequate level of protection only where one of the grounds in paragraph 1 of Article 9 exists. A contractual basis applies only where the conditions provided for by law are met, not automatically to any message. Where consent is relied upon, the destination countries, recipients and risks are communicated before it is obtained; no transfer takes place until the required consent has been obtained. The specific countries for each service are specified in the register of recipients and communicated to the data subject before the relevant processing.

4.3. When data is transferred to a country without an adequate level of protection, the following risks may arise. This list does not mean that all of these circumstances exist in every country and does not replace the legal basis for transfer required by law:

• absence or fragmentation of personal data protection legislation;
• a limited range of information recognised as personal data;
• a limited range of data subject rights or their complete absence;
• absence of an authorised body responsible for protecting the rights of data subjects;
• an insufficiently developed system of liability for violations of data subject rights;
• risk of broad access by law enforcement authorities to personal data;
• risk of unlawful access to and use of personal data, including by unlawful means of obtaining it.

5. RIGHTS OF PERSONAL DATA SUBJECTS AND HOW TO EXERCISE THEM

5.1. Personal data subjects have the following rights:

5.2. To exercise one or more of the rights listed in clause 5.1 of the Policy, the data subject must send the Organisation an application:

• in writing — by post to: 53 Novovilenskaya St., apt. 22, Minsk, 220053, Republic of Belarus, or by delivering it to the Organisation at its registered office;
• as an electronic document signed with a digital signature in the prescribed manner — to intro@section228.com. An ordinary email without a digital signature is not equivalent to an electronic document under Article 14 of the Law. An ordinary email may be used for enquiries.

The application must contain the surname, first name, patronymic (if any), address of residence (place of stay), date of birth, the substance of the request, and a handwritten or digital signature. The identification number or, if none, the number of the identity document is stated in the cases provided for in paragraph 2 of Article 14 of the Law: if this information was provided when giving consent or if processing is carried out without consent. Excessive information and a copy of the passport are not requested by default.

5.3. The response to the application will be sent in the same form in which it was submitted, unless otherwise specified in the application.

5.4. Consent may also be withdrawn in the form through which it was obtained. For mailings, the unsubscribe link in the message is used; for cookies, the cookie settings. Withdrawal has no retroactive effect. If deletion is technically impossible, measures to prevent further processing, including blocking, are applied and the data subject is notified within the established period. For enquiries: intro@section228.com. To stop advertising, an ordinary email to intro@section228.com or a reply to an advertising message with an unambiguous request to stop the mailing is also accepted; no digital signature is required for such a refusal. This does not replace the established application procedure for exercising other rights.

6. PERSONAL DATA PROTECTION AND ADDITIONAL COMPANY DETAILS

6.1. The Organisation takes legal, organisational and technical measures under Articles 16–17 of the Law: it appoints a person responsible for internal control, establishes access procedures, provides training and briefing for employees, and determines technical and cryptographic protection measures in accordance with applicable requirements. Access is granted only to the extent required for work purposes.

6.2. The Organisation notifies the authorised body of breaches of protection systems immediately, but no later than three working days after becoming aware of them, except in cases determined by the authorised body. Cessation of processing is also ensured by authorised processors.

6.3. Special categories of personal data are not requested for an ordinary request or meeting booking. If such data is received, the Organisation separately assesses the basis and measures under Article 8 of the Law. Please do not include excessive information about yourself or third parties in free-text fields.

6.4. Additional details: OKPO 506574105000; current account BY53 MTBK 3012 0001 0933 0011 7166 with MTBank CJSC; bank address: 10 Tolstogo St., Minsk, 220007. These details do not determine the procedure for exercising data subject rights.

6.5. Before consent is obtained, the rights, how to exercise them, the consequences of consenting and refusing, and the information under paragraph 5 of Article 5 of the Law are communicated separately and in plain language. Reading the Policy, continuing to browse the Website and submitting a request do not in themselves constitute consent to independent marketing purposes. Receipt of consent is confirmed by the Organisation.

Appendix to the Privacy Policy

Key parameters of personal data processing.

BUSINESS OPERATIONS

COMMUNICATION

MARKETING

FULFILMENT OF LEGAL OBLIGATIONS

1. Operator and Scope

1.1. The operator is HKB Solutions Limited Liability Company, UNP 193656658. Registered office: 11 2nd Shestaya Liniya St., office 6a-8-96, Minsk, 220013, Republic of Belarus. Postal address: 53 Novovilenskaya St., apt. 22, Minsk, 220053, Republic of Belarus. Email: intro@section228.com.

For the purposes of this document, List No. 140 means the List of Standard Documents with Retention Periods approved by Resolution of the Ministry of Justice of the Republic of Belarus No. 140 of 24 May 2012, as amended.

1.2. This document has been prepared in accordance with Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" (hereinafter — the Law). The explanation of rights is provided separately from the texts of the consents and is available to the user before making a choice.

1.3. Consents to communication and to advertising are independent of each other. Consent is not obtained through pre-ticked boxes, by merely visiting the Website or by merely reading the policy. Submitting a request does not constitute consent to advertising.

1.4. Consent to request processing applies only to processing for which there is no other legal basis. If the information is necessary for actions under a contract being concluded or concluded with the data subject themselves, the applicability of paragraph fifteen of Article 6 of the Law is assessed separately. For representatives of organisations, the basis is also established separately. The mere fact of contacting us is not a universal contractual basis.

2. Separate Explanation of Rights and Consequences

2.1. Where processing is based on consent, you may withdraw it at any time without giving reasons. Withdrawal has no retroactive effect and does not stop processing for which another legal basis exists.

2.2. You have the right to receive the information about the processing of your data provided for in Article 11 of the Law. A response is provided within five working days of receipt of the application unless another period is established by legislative acts; any refusal must be reasoned.

2.3. You have the right to demand correction of incomplete, outdated or inaccurate data by providing the necessary supporting documents. The request is considered within fifteen days of receipt of the application.

2.4. You have the right, once per calendar year and free of charge, to receive information about the provision of your data to third parties within the limits set out in Article 12 of the Law. The period is fifteen days from receipt of the application unless otherwise provided by law.

2.5. You have the right to demand cessation of processing and deletion of data where there is no legal basis. Within fifteen days, the Organisation takes the actions provided for by the Law and notifies you or informs you of a reasoned refusal. If deletion is technically impossible, measures to prevent further processing, including blocking, are applied and you are notified.

2.6. You have the right to appeal against actions, omissions and decisions that violate your rights to the National Personal Data Protection Center, and against its decision — to court.

2.7. An application is sent in writing to the Organisation's postal address or as an electronic document with a digital signature to intro@section228.com. An ordinary email without a digital signature is not equivalent to an electronic document for exercising all rights under Article 14. To withdraw consent, the form in which it was obtained may also be used; the Organisation also accepts unsubscribe requests by email.

2.8. The application must contain your surname, first name, patronymic (if any), address of residence (place of stay), date of birth, the substance of the request and a signature or digital signature. The identification number or, if none, the number of the identity document is stated in the cases provided for in paragraph 2 of Article 14: if this information was provided when giving consent or if processing is carried out without consent. A copy of your passport is not required by default.

2.9. Consent to request processing allows the information provided to be processed and a response to be given. If you refuse it, no processing based on consent takes place; whether other actions are possible depends on the existence of another legal basis. A request must not be automatically blocked because consent was refused if the necessary data is lawfully processed without it.

2.10. Consent to advertising allows advertising messages to be sent only via the channels you have selected. Refusing or later unsubscribing does not restrict submitting a request, receiving a response or receiving services.

2.11. Before making a choice, the user has access to information about specific recipients and, where necessary, the countries of transfer. A general reference to risk does not replace a basis for cross-border transfer.

3. Independent Consent to Request Processing

3.1. By ticking the separate checkbox for request consent, I freely and knowingly authorise HKB Solutions LLC to process the data listed below for the purposes of considering my request, clarifying the task and preparing a response or a tailored commercial proposal at my request.

3.2. Data: name, company name, email, phone number or identifier of the selected messenger, task description, services of interest, budget — only if I have actually provided this information. Company information is considered personal data to the extent that it relates to an identifiable natural person. Excessive information, special categories of personal data and data of third parties are not requested.

3.3. Actions: collection, systematisation, storage, use for responding, modification on request, provision to the specific recipients listed in Section 5 to the extent necessary, and deletion. Processing is carried out both with and without the use of automation.

3.4. Where processing is based on consent — until the purpose of considering the request and the related communication has been completed, but no longer than three years from the date consent was given or until its earlier withdrawal. Where processing is carried out without consent — until the relevant purpose is achieved, but no longer than three years from receipt of the request, provided an applicable legal basis exists. Information in mandatory documents is stored separately for the periods established by law; this does not permit continued processing of the entire request.

3.5. This consent does not cover advertising mailings, cookies or new independent purposes. For cross-border transfers, the conditions of Article 9 of the Law must be met separately.

3.6. Meeting booking: name, email, selected date and time, and time zone, if transmitted; purpose — arranging a meeting upon request. Consent to cookies is not consent to this data. If an applicable basis other than consent exists, it is established separately; otherwise, an independent choice to consent is provided before the data is submitted. Period — until the meeting and related communication are completed, but no longer than three years from the date of consent or, under another legal basis, of receipt of the booking; earlier achievement of the purpose terminates processing unless there is another basis. Recipients and transfers — as set out in Appendix A. If the required consent is refused, online booking is not carried out; the availability of other means of contact depends on the existence of a legal basis.

4. Independent Consent to Advertising

4.1. I voluntarily authorise HKB Solutions LLC to process my contact details to send advertising of its own services, promotions and special offers only via the channels I have separately selected. Each advertising channel is selected independently and is disabled by default.

4.2. Data: email for the email channel; phone number or identifier of the selected messenger for the corresponding channel; name — if provided with the request. Actions: collection, systematisation, storage, use for sending, necessary transfer to the recipients listed in Section 5, modification and deletion. The company name is not used for an independent marketing purpose.

4.3. Period: three years from the date of consent or until its earlier withdrawal. No selection means no consent for the corresponding channel. The data is not used to advertise other persons or for new purposes without the necessary independent basis.

4.4. By consenting to the selected channel, I agree to receive the corresponding advertising messages in accordance with advertising legislation. The operator records the expression of will and ensures that it can be confirmed. Upon a request to stop advertising, further distribution stops; making such a request does not require signing a separate paper application.

5. Recipients and Cross-Border Transfers

5.1. Access and provision are permitted only to the extent necessary. A service provider is not automatically considered an authorised person: its role and processing conditions are determined by the actual arrangement and the contract. When processing is entrusted, Article 7 of the Law is complied with.

5.2. The list of specific recipients, their roles, data, countries of processing and grounds for cross-border transfer is set out in Appendix A "Unified Register of Recipients and Cross-Border Transfers", which is identical for all three documents in the set. For each purpose, only the row relevant to it applies. Processing that requires informed consent or a special transfer basis does not begin until the relevant information has been completed and disclosed to the data subject and the required basis has been ensured.

5.3. Before transferring data abroad, the Organisation identifies the specific countries and checks the adequacy of protection against the current list of the National Personal Data Protection Center. For a country without adequate protection, a basis under paragraph 1 of Article 9 of the Law is required. General consent to request processing or the choice of a messenger is not deemed to automatically satisfy these conditions.

5.4. If consent is chosen as the basis for such a transfer, before it is obtained the user is informed of the specific recipients, countries, data and purposes, the period and the risks. A separate expression of will is used for an independent purpose. Until the necessary information has been disclosed and consent obtained, the transfer does not take place.

5.5. Possible risks of transfer to countries without adequate protection: limited rights and remedies, differences in the scope of protected data, access by public authorities and unauthorised access. This list does not mean that all of these circumstances exist in every country.

6. Withdrawal and Storage of Records

6.1. To opt out of advertising, use the unsubscribe link in the message, reply to the sender requesting that advertising stop, or write to intro@section228.com. For any other withdrawal, the mechanism in the form in which consent was obtained is available, as well as a written application or electronic document as described in Section 2.

6.2. After withdrawal, within fifteen days the Organisation stops processing, deletes the data, ensures that authorised persons take the necessary actions and notifies the data subject, except for processing on other legal bases. If deletion is technically impossible, the data is blocked and the data subject is notified within the established period. Stopping further advertising is not postponed until the end of this period.

6.3. Records of consent are stored separately from the data used for the main purpose for one year after the end of the period for which consent was given, in accordance with the applicable provisions of List No. 140. Storing such records does not permit continuing advertising, analytics or other processing after the basis has ceased. Retention periods and their start for other documents are determined separately according to their type.

7. Wording of Form Elements

Separate link before the choice: "Your rights, how to exercise them and the consequences of consenting or refusing". It leads directly to Section 2, not only to the general policy.

For the request — only if consent is relied upon: "I consent to HKB Solutions LLC processing the data I have provided to consider my request and prepare a response under the terms of Section 3". If another legal basis exists, a mandatory consent checkbox for this process is not used.

Optional channel 1: "I consent to the processing of my data and to receiving advertising of HKB Solutions LLC services by email under the terms of Section 4".

Optional channel 2: "I consent to the processing of my data and to receiving advertising of HKB Solutions LLC services in the messenger I have selected under the terms of Section 4". The choice of the specific messenger must be recorded.

The following are recorded technically: the data subject / contact, selected purposes and channels, date, time, version of the consent and explanations, method of expressing will and of changing the choice. The time a box was ticked alone is not sufficient to prove informed consent.

1. Authorised Processors

Processing on behalf of the Organisation is carried out under contracts in compliance with Article 7 of Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" (hereinafter — the Law).

2. Cross-Border Transfers

2.1. The website server is located in the Republic of Belarus. When the foreign services listed below are used, personal data may be transferred outside the Republic of Belarus. Transfers are permitted only within the relevant purpose and where a basis established by the Law exists.

2.2. For transfers to countries without an adequate level of protection, or where the countries cannot be precisely determined, the Organisation relies on the data subject's consent with prior information about the risks under paragraph two of clause 1 of Article 9 of the Law. Consent to such a transfer is not presumed from the mere use of the service and must actually be obtained before the transfer.

2.3. Possible risks: absence or limitation of legislation and data subject rights, insufficient legal remedies and oversight, access by public authorities and the risk of unauthorised access to data. Listing these risks does not mean that all of them exist in every country.

2.4. The list of data, the processing and consent period, the procedure for exercising rights and the consequences of refusal are determined by the relevant purpose in the main Policy and in the information provided before consent. This appendix is not a separate consent.