Personal data processing policy

This policy describes which personal data BelDiscovery LLC processes when you use beldiscovery.by or write to the company’s Telegram account, for what purpose, on what legal basis, who receives it and how a data subject exercises their rights.

It is written to comply with the Law of the Republic of Belarus of 7 May 2021 No. 99-Z “On personal data protection”.

1. The operator

• Name — BelDiscovery LLC.
• Registration number (UNP) — 193900948.
• Address — Republic of Belarus, 220100, Minsk, Vera Khoruzhey Street 6A, premises 117 (office 4V).
• E-mail — beldiscovery@bk.ru.
• Telephone — +375 33 620-67-26.

Please send anything concerning personal data to the e-mail address above, marked “Personal data”.

2. What is processed

The site has no accounts and no sign-up. On the site, personal data reaches us only when a visitor fills in and submits the enquiry form; we also receive what people write to the company’s Telegram account.

From the enquiry form:

• name;
• e-mail address;
• telephone number, if given;
• country of residence, if given;
• citizenship, travel dates, route and point of entry — on the visa consultation form;
• the number of adults and children travelling — counts only, no names and no ages;
• organisation, registration details, profession, group size, preferred dates, experience, languages, countries, website address — whichever of these belong to the chosen enquiry direction;
• the text of the enquiry;
• interface language, the page the enquiry was sent from, and the referring address;
• campaign tags (utm_source, utm_medium, utm_campaign) if the visit came from an advertisement;
• the consent tick, and a separate tick for news and offers.

The form accepts no files, so no copy of a passport or of any other document is sent through it.

Technical data:

• the sender’s IP address — used only to limit how often the form can be submitted from one address, and kept in that form for no more than 30 minutes;
• the ordinary web server and security logs kept by our hosting provider.

From messages to the company’s Telegram account (+375 33 605-21-17), where a chatbot answers first:

• the name, username and numeric ID in Telegram;
• the text of the messages — no more than the last eight, each up to 500 characters;
• a note that a file was sent; the chatbot does not open, store or forward files;
• the topic and status of the enquiry and the time of the messages.

The chatbot only identifies the topic, replies with pre-approved texts and passes the enquiry to a member of staff; it makes no decisions about the person.

The site runs no analytics and no advertising trackers, builds no visitor profiles and makes no automated decisions.

3. Purposes and legal grounds

• Answering an enquiry, preparing a quote, agreeing the terms of a trip — consent of the data subject (article 5 of Law No. 99-Z).
• Considering an application for a vacancy — consent of the data subject.
• Replying to a message sent to the company’s Telegram account and passing it to the responsible member of staff — consent of the data subject.
• Concluding and performing a contract for tourism services — processing necessary to conclude and perform a contract.
• Protecting the form from automated submissions — the operator’s legitimate interest in keeping the site working.
• Sending news and special offers — a separate consent, given voluntarily, which does not affect the answer to an enquiry.

Providing data is voluntary. An enquiry cannot be answered without a name and an e-mail address, so those fields are required on every form. Some forms also ask for the details an enquiry cannot be considered without: the organisation from an employer or a partner, the occupation from an employer or a candidate, citizenship for a visa consultation. Every other field is filled in at the visitor’s discretion.

4. Who receives the data

We do not sell personal data and do not pass it to third parties for their own purposes. Running the site and replying to enquiries involves these service providers:

• Cloudflare, Inc. — hosting of the site and the chatbot, protection against attacks and storage of received enquiries. Its infrastructure is distributed worldwide, so processing includes a cross-border transfer.
• Telegram Messenger — correspondence with the company’s Telegram account, including the chatbot’s replies, and notifying a member of staff about a new enquiry from the site. The notification carries the details from the form.
• Sendinblue SAS (Brevo) — delivering the same notification by e-mail. The channel is connected as needed.

Data may be disclosed to state authorities of the Republic of Belarus in the cases and manner provided for by law.

5. Retention

An enquiry is kept until the purpose of processing has been met — that is, until the correspondence and any contractual relationship arising from it are complete — or until consent is withdrawn, whichever comes first. After that the data is deleted.

What the chatbot stores is deleted 90 days after the enquiry is closed or, if it was never passed to a member of staff, 90 days after the last message. The conversation itself stays in the company’s Telegram account and is kept until the purpose of processing has been met.

A data subject may demand deletion at any time; such a demand is handled in the manner set out in section 7.

6. Safeguards

The site is served over HTTPS only. The enquiry store is reachable by the members of staff who need it for their work, under individual credentials. The number of submissions from a single IP address is capped, and the form itself is protected against automated submissions.

7. Rights of the data subject

A data subject has the right to:

• be told who the operator is and whether their data is being processed;
• receive the list of their data and information about its disclosure to third parties;
• demand that incomplete, outdated or inaccurate data be corrected;
• withdraw consent to processing;
• demand that processing stop and the data be deleted;
• appeal against the operator’s actions to the National Personal Data Protection Center of the Republic of Belarus.

Send the request to the e-mail address in section 1. It must state the surname, given name and patronymic (where one exists), an address for the reply, and what is being asked for. We answer within fifteen calendar days of receiving it. Where a request cannot be met, the answer says why.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and does not end retention that the law requires of us.

8. Cookies

The site sets no advertising or analytics cookies and needs no consent banner. Technical cookies that the hosting provider’s protective infrastructure may set are required for the site to work and are not used to watch the visitor.

9. Changes to this policy

The current version lives on this page; the date it was last changed is shown at the top. Material changes take effect when published.