Privacy Policy - Whosecar

1. General Provisions

1.1. This Policy defines the procedure for processing personal data of users of the web service Whosecar (hereinafter — the Service), available at https://whosecar.by/.
1.2. The Operator of personal data is Yegor Usik, a natural person applying a special taxation regime (self-employed), registered in the Republic of Belarus (hereinafter — the Operator).
1.3. The Policy is developed in accordance with the Law of the Republic of Belarus dated May 7, 2021 No. 99-Z «On Personal Data Protection» (hereinafter — Law No. 99-Z).
1.4. The Policy applies to all personal data that the Operator receives from Users in connection with the use of the Service.

2. Basic Terms

2.1. Personal Data — any information relating to an identified natural person or a natural person who can be identified.
2.2. Personal Data Processing — any action or set of actions performed with personal data (collection, recording, storage, modification, use, provision, deletion, etc.).
2.3. Data Subject — a User of the Service.
2.4. Consent — a free, specific, informed and conscious expression of will by the User by which they permit the processing of their personal data.

3. Purposes and Legal Grounds for Processing

The Operator processes personal data for the following purposes:

Purpose 1: Registration and identification via Telegram.

Data: Telegram ID, username, profile name (profile photo — if available).
Legal basis: the User's consent (acceptance of the User Agreement).
Storage period: until the User's account is deleted.

Purpose 2: Functioning of the search by state registration plate.

Data: state registration plate of the vehicle, binding to the Owner's Telegram ID.
Legal basis: the User's consent (the User adds the vehicle independently).
Storage period: until the vehicle is deleted by the User or the account is deleted.

Purpose 3: Ensuring communication via the Telegram bot.

Data: sender's Telegram ID, recipient's Telegram ID, state plate, text of the selected message template, date and time of sending.
Legal basis: the User's consent.
Storage period: [specify period, e.g., 6 months from the moment of sending] (for the purposes of preventing abuse and resolving disputes).

Important: The Operator does not transfer personal data of the sender and recipient to each other (Telegram ID, name, phone). Communication is carried out anonymously within the bot interface.

Purpose 4: Displaying additional information on the User Page (optional).

Data: profile photo (from Telegram), name, phone number, Instagram link.
Legal basis: separate consent of the User, expressed by filling in the relevant fields and configuring their visibility. The fields are optional; by default they are hidden or not filled in.
Storage period: until the User deletes the relevant field or withdraws consent (by hiding/deleting the field in the settings).

Purpose 5: Technical functioning of the Service (cookie).

Data: technical cookie session to determine the fact of the User's first visit.
Legal basis: the Operator's legitimate interest in ensuring the correct operation of the Service. Analytical and advertising cookies are not used.
Storage period: during the session / up to [specify period, e.g., 30 days].

4. Cross-Border Transfer

4.1. Users' personal data is stored on servers located in the Federal Republic of Germany (Frankfurt am Main).
4.2. The transfer of personal data to Germany is carried out to ensure the functioning of the Service (hosting). Germany is a country ensuring an adequate level of protection of the rights of personal data subjects in accordance with the legislation of the European Union.
4.3. The Operator does not carry out any other cross-border transfers of personal data, except for the transfer of data to Telegram (to the extent necessary for authorization and message delivery), which occurs at the initiative of the User themselves when using the Telegram widget.

5. Rights of the Personal Data Subject

The User has the right to:

5.1. Receive information about the processing of their personal data (list of data, purposes, grounds, periods, recipients). The request is submitted in accordance with Art. 14 of Law No. 99-Z. The Operator responds within 5 working days.
5.2. Request modification of their personal data if it is incomplete, outdated or inaccurate. The Operator makes changes within 15 days.
5.3. Withdraw consent to the processing of personal data. Withdrawal has no retroactive effect. After withdrawal, the Operator stops processing and deletes the data, unless there are other lawful grounds for their processing.
5.4. Request deletion of personal data if the grounds for their processing have ceased.
5.5. Appeal the Operator's actions to the National Center for Personal Data Protection or in court.
5.6. To exercise their rights, the User sends an application to email: [email] or via the Service functionality (if provided). The application must contain: full name (if available), identification number (if available), substance of the request, personal signature or electronic signature.

6. Security Measures

6.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data from unauthorized access, modification, blocking, copying, distribution, deletion.
6.2. Such measures include: restricting access to the database, using secure data transmission channels (HTTPS), backup, regular security monitoring.
6.3. In the event of a breach of the personal data protection system, the Operator notifies the National Center for Personal Data Protection immediately, but no later than 3 working days from the moment of detection.

7. Cookie

7.1. The Service uses exclusively technical cookies necessary to determine the fact of the User's first visit to the website. Analytical, advertising and tracking cookies are not used.
7.2. By continuing to use the Service, the User agrees to the use of technical cookies. The User may disable cookies in their browser settings, however this may affect the correct operation of the Service.

8. Final Provisions

8.1. The Operator has the right to amend this Policy. The new version is published on the Website and comes into force from the moment of publication.
8.2. The Policy is valid indefinitely until replaced by a new version.

9. Operator Contacts

Yegor Usik

self-employed (no sole proprietorship registration)

Minsk

Telegram: [@username]