Privacy Policy

NOTICE ON THE PROCESSING OF PERSONAL DATA

 

This Notice on the processing of Personal Data (Data Processing Notice) defines the procedure and conditions for the processing of Personal Data of Data Subjects by CFG TRADING LIMITED LIABILITY COMPANY (Company), as well as the procedure for the exercise of rights by Personal Data Subjects in accordance with the legislation of Ukraine governing the processing of Personal Data, in particular, but not exclusively, the Law of Ukraine On the Protection of Personal Data dated 01.06.2010 No. 2297-VI (Legislation of Ukraine).

 

 

DEFINITIONS

 

Company / we - CFG TRADING LLC, duly registered in accordance with the legislation of Ukraine at the legal address: 47602, Ukraine, Ternopil region, Ternopil district, Kozova village, Bohuna I. Street, building 8a.

 

You - a natural person whose Personal Data may be processed by the Company.

 

Owner - a natural or legal person, regardless of the form of ownership, who independently or jointly with others determines the purposes and means of processing Personal Data, as well as other natural or legal persons for whom the purposes and means of processing are determined by the Legislation of Ukraine.

 

Personal Data Subject - a natural person in relation to whom the processing of their Personal Data is carried out.

 

Personal Data - any information relating to a natural person, with the help of which such a natural person is identified or can be identified.

 

Processor - a natural or legal person, regardless of the form of ownership, who processes Personal Data on behalf of the Owner and is authorized to do so by the Owner or the Legislation of Ukraine.

 

Sensitive Personal Data - Personal data about racial or ethnic origin, political, religious, or philosophical beliefs, membership in political parties and trade unions, criminal convictions, as well as data concerning health, sex life, biometric, or genetic data.

 

Supervisory Authority - The Ukrainian Parliament Commissioner for Human Rights.

 

Website - The Company's website, available at: https://cfg.com.ua/

 

Recipients of Personal Data - individuals or legal entities to whom Personal Data is provided, including Third Parties.

 

Third Parties - any persons, except for the Subject of Personal Data, the Company or Administrators engaged by the Company, and the Human Rights Commissioner of the Verkhovna Rada of Ukraine, to whom the Company or the relevant Administrator transfers Personal Data

 

Other terms not defined in this Data Processing Notice are defined in accordance with the Ukrainian Legislation.

 

 

GENERAL PROVISIONS

 

The Company respects your privacy and takes security measures regarding your Personal Data. We process your Personal Data fairly and transparently in accordance with the requirements of the current Ukrainian Legislation and international standards, and we implement appropriate technical and organizational measures to ensure a high level of security.

 

This Data Processing Notice has been developed to explain how the Company processes Personal Data in the course of its economic, civil, social, and educational activities, as well as within the framework of labour relations.

 

By using the Website or interacting with the Company in any other way, you confirm that you have read this Data Processing Notice and agree to the application of its terms and conditions regarding the processing of your Personal Data by the Company as described in this Data Processing Notice.

 

 

ROLE OF THE COMPANY

 

This Data Processing Notice sets out the main terms and conditions for the processing of Personal Data by the Company in its role as an Owner, for its own purposes, and in its role as a Processor, when the Company processes Personal Data on behalf of other Owners. 

 

When processing Personal Data on behalf of Owners, the Company processes Personal Data solely on the basis of the instructions of such Owners, on the grounds and for the purposes specified by such Owners. In such cases, the Company takes all necessary steps to obtain confirmation from third parties – Owners – that the Personal Data has been collected and transferred by the relevant Owner to the Company in accordance with the Legislation of Ukraine.

 

 

HOW YOUR DATA IS COLLECTED AND PROCESSED

 

The Company, as the Owner, may collect and process various types of Personal Data that you provide directly, that we automatically receive as a result of your interaction with the Company's Website, as well as from third parties for purposes determined by the Company. 

 

When processing Personal Data, the Company ensures compliance with the processing principles, which stipulate that Personal Data must be relevant, adequate, and not excessive in relation to the purposes of processing determined by the Company.

 

Data obtained from the Data Subject

 

Commercial cooperation. When you communicate with the Company on matters of commercial cooperation, we may ask you to provide Personal Data such as your surname, first name, patronymic, contact information (phone number and email address), your position in the organization you represent, as well as other information recognized as Personal Data in accordance with the Ukrainian Legislation, which may be necessary for the purposes of implementing the relevant commercial cooperation between the Company and you personally or with the organization whose interests you represent. Please note that when you visit the Website, we automatically consider you a potential counterparty or a person representing the interests of a potential counterparty who wishes to have a commercial relationship with the Company, unless you prove by your actions that you have other intentions (for example, regarding employment, anti-corruption appeals, or participation in the Company's projects).

 

Employment, internships, and labour relations. If you communicate with the Company regarding employment or internships, or if you are an employee of the Company, we may ask you to provide Personal Data such as your surname, first name, patronymic, contact information (phone number and email address), information from your resume, as well as other information recognized as Personal Data in accordance with the Legislation of Ukraine, which may be necessary to evaluate you as a candidate or intern for a relevant position in the Company or to implement labour relations or relations related to internships.

 

Company Projects. The Company may implement a number of social, public, and image projects that you can join as a participant. In this case, we may ask you to provide Personal Data such as your surname, first name, patronymic, contact information (phone number and email address) to enable your participation in such projects and to communicate with you regarding the implementation of relevant social, public, and image-building projects.

 

Other communication. When you contact the Company via the feedback form, not regarding commercial cooperation, employment, internships, or labour relations, or via the hotline available on the Website, we may ask you to provide Personal Data such as your surname, first name, patronymic, contact information (phone number and email address), as well as other information related to your inquiry, in order to communicate with you effectively and resolve any issues arising in connection with your inquiry. 

 

Data obtained from third parties

 

The Company may receive your Personal Data from third parties, in particular when you publicly post such data on the Internet (for example, on social networks) or when you act as an official representative of a business entity with which the Company plans or implements commercial relations, or in other cases when the Company does not act as an Administrator. In such cases, the Company takes all necessary steps to obtain confirmation from third parties that the Personal Data has been collected and transferred to the Company in accordance with the laws of Ukraine. 

 

Data collected automatically

 

Cookies are small text files stored by your web browser on your device when you visit the Website. When you use the Website, the Company may automatically use certain information about your interaction with the Website through cookies and other similar technologies. We use these technologies to understand how Website users navigate the Website, improve its performance, and conduct statistical and analytical assessments of Website user behaviour. In cases where cookies enable the direct or indirect identification of a natural person, they are considered Personal Data and are processed in accordance with the requirements of applicable Personal Data Protection Legislation for the purpose of protecting the Company's own interests.

 

You can customize the use of cookies by configuring your devices or through the settings in the web browsers you use to access the Website. 

 

This includes, but is not limited to, the settings at the following links:

 

 

LEGAL BASIS AND PURPOSE OF DATA PROCESSING

 

The Company ensures the processing of Personal Data solely on the grounds specified by the Legislation of Ukraine and for the purposes determined by the Company independently or by the Ukrainian Legislation, namely:

 

Conclusion and performance of legal transactions

 

In the vast majority of cases, the Company processes Personal Data based on the need to conclude and perform legal transactions to which you are a party, or which are concluded in your favour, or to carry out activities preceding the conclusion of a legal transaction, in particular, when it is necessary for the purposes of commercial relations, potential employment, internships, regulation of labour relations, implementation of relevant social, public, and image projects, and other communication between you and the Company, if it precedes the conclusion of a transaction.

 

Protection of legitimate interests

 

The Company may also process the Personal Data you provide to protect its legitimate interests, in particular in the areas of information security and risk management, protection of rights and interests in court or during disputes, verification of violations of internal policies and fraud, ensuring the security of property, personnel and access control, control of the use of Company resources, ensuring the continuity of the Company's business, searching for and recruiting personnel, as well as when your personal data is processed for the purposes of commercial relations between the Company and business entities whose interests you represent.

 

Compliance with legal obligations

 

The Company may process the Personal Data you provide to the extent necessary to comply with legal obligations imposed on the Company by Ukrainian law, in particular with regard to the fulfilment of tax and accounting obligations, social and pension insurance, military registration, statistical reporting, occupational safety, financial monitoring, anti-corruption, and other special obligations in accordance with the requirements of Ukrainian law.

 

Consent to the processing of Personal Data

 

In cases where there are no other legal grounds for processing Personal Data or where it is expressly required by Ukrainian law, the Company may ask you to consent to the processing of Personal Data, which must be freely given, unambiguous, and informed. This may, for example, apply to the processing of Personal Data for direct marketing purposes, your participation in corporate surveys, or communication with you on matters that are not included in the scope of the previously defined processing purposes.

 

You have the right to withdraw your consent to data processing at any time by contacting the Company in the manner specified in this Data Processing Notice.

 

Processing of sensitive data

 

The company makes every effort to avoid processing Sensitive Personal Data, however, the need to process your Sensitive Personal Data, in particular data about your health, may arise in cases where it is necessary for the purposes specified by the legislation of Ukraine (e.g., fulfilling obligations under labour law, ensuring compliance with occupational health and safety requirements at production facilities, fulfilling obligations under military service law, military registration, protecting the vital interests of employees, visitors, or contractors).

 

If the Country's legislation does not provide for exceptions to the processing of Sensitive Personal Data on other legal grounds, the Company may ask you to consent to the processing of such data. 

 

If any Sensitive Data that is not required by the Company for the purposes of processing is accidentally collected or obtained by the Company directly from you or from a third party, the Company will take immediate steps to ensure its secure and prompt deletion.

 

Processing of data of minors or young children

 

The Company does not intentionally collect and process the Personal Data of minors or young children, except for the purposes specified in this document and exclusively within the framework of the requirements of Ukrainian law.

 

If you are a minor and wish to participate in relevant social, public, and image projects, consent to the processing of your Personal Data may only be given by your legal representative, who is determined in accordance with the legislation of Ukraine and acts on your behalf. In this case, it should be assumed that your Personal Data will be processed by the Company solely for the purpose of implementing social, public, and image projects and only for the period specified in the relevant consent. At the same time, the Personal Data of legal representatives of minors/underage persons is not processed on the basis of consent to data processing, as such processing is provided for and required by the Legislation of Ukraine.

 

If any Personal Data of minors is accidentally collected or received by the Company directly from you or from other persons that is not necessary for the Company to achieve the established processing purposes, the Company will take immediate measures to ensure its safe and urgent deletion.

 

 

STORAGE OF PERSONAL DATA

 

The Company stores Personal Data for the time necessary to achieve the purposes of its processing, unless another period is provided for by the legislation of Ukraine or follows from contractual obligations between the Company and the Subject of Personal Data. Once the purposes of processing have been achieved or the storage period has expired, Personal Data shall be destroyed or anonymized, unless otherwise provided by law.

 

The storage periods for Personal Data are determined by the Company on the basis of legal requirements for the performance of obligations imposed on the Company by the current legislation of Ukraine, contractual obligations, legitimate interests of the Company, as well as the Consent to data processing provided by the Subject of Personal Data or his/her legal representative.

 

If the Company uses cookie files that allow you to be identified, such files are stored for no longer than is necessary to achieve the purposes set by the Company and no longer than the term of operation of the relevant cookie file, depending on its type.

 

The Company regularly monitors and reviews Personal Data to ensure that it is not stored longer than is reasonably necessary for its processing.

 

 

DISSEMINATION OF PERSONAL DATA

 

The Company may transfer Persnal Data to Recipients or provide them with access to Personal Data solely within the limits specified by the legislation of Ukraine.

 

Involvement of other Administratoors

 

In order to ensure the continuity of business activities, development, administration, and technical support of the Website and internal information systems, fulfilment of contractual obligations, support of the proper functioning of the Website, and fulfilment of other legitimate purposes, the Company may engage persons who are external service providers acting as Administrators. In cases where the involvement of Processors requires access to or processing of Personal Data, the Processors act solely on behalf of and under the written instructions of the Company.

 

The Company takes all necessary legal, organizational, and technical measures to adequately protect Personal Data during its processing by Processors, in particular, it enters into written agreements for the processing of Personal Data or other legally binding documents, verifies that the Administrators have adequate technical and organizational security measures in place that meet the Company's standards, and exercises appropriate supervision and control over the Administrators' compliance with the requirements of Ukrainian legislation on the protection of Personal Data.

 

Access by authorized personnel

 

Access to Personal Data is granted exclusively to authorized personnel of the Company within the scope of their official duties and competence and only to the extent necessary to achieve the legitimate and specified purposes of Personal Data processing.

 

When involving personnel in the processing of Personal Data, the Company ensures that access to Personal Data is restricted on the basis of the “minimum necessary” principle, that employees who have access to Personal Data comply with confidentiality requirements in accordance with the provisions of labour legislation, employment contracts, job descriptions, and the Company's internal policies, and that personnel receive regular training on Personal Data protection and information security.

 

Legal requirements for data transfer to third parties

 

The Company may transfer Personal Data to state authorities, local authorities, law enforcement agencies, judicial or other competent authorities in cases where such transfer is mandatory under Ukrainian law or necessary to comply with the requirements of laws and other regulations, court decisions or lawful requests, to protect its lawful rights, interests, property or security, as well as the rights, interests and security of third parties, and for the purposes of preventing fraud, intellectual property rights violations, security violations and other unlawful activities.

 

In such cases, the amount of Personal Data transferred is limited to the minimum necessary to achieve the relevant purpose, and the transfer is carried out in a manner that ensures an adequate level of protection.

 

Cross-border transfer of Personal Data

 

The Company may transfer Personal Data outside Ukraine, including, but not limited to, countries of the European Union, the European Economic Area, and the United States of America, only in cases and in the manner specified by the laws of Ukraine.

 

The transfer of Personal Data to Recipients outside Ukraine is carried out only if the relevant state to which the Personal Data is transferred ensures adequate protection of Personal Data in cases established by law or international treaty of Ukraine.

 

The Company takes all necessary legal, organizational, and technical measures to ensure the proper protection of Personal Data during its transfer outside Ukraine, including, but not limited to, verifying the level of protection of Personal Data in the country to which the data is transferred, as well as concluding relevant agreements with Recipients that provide for obligations to comply with data protection requirements. In the event of the transfer of Personal Data to countries that do not provide an adequate level of protection, the Company ensures that additional legal, organizational, and technical protection measures are in place.

 

Links to third-party websites

 

The website may contain links to external websites or services provided by third-party organizations. The privacy terms of these websites may differ from the Company's privacy policy. If you choose to provide Personal Data to any third-party websites, such data will be processed in accordance with their respective privacy terms, not this Data Processing Notice. We encourage you to carefully review the privacy documentation provided by these third-party organizations before sharing any Personal Data.

 

 

PERSONAL DATA SECURITY

 

The Company pays special attention to the protection of Personal Data and applies appropriate technical and organizational measures to ensure its confidentiality, integrity, and availability. These measures are implemented in accordance with the current legislation of Ukraine and are based on recognized industry security standards. The Company has developed appropriate information security and personal data protection policies and has implemented a robust information security management system and privacy program.

 

To prevent unauthorized access, loss, or misuse of data, the Company uses modern protection methods, including encryption, access control, and secure infrastructure, and implements training and awareness programs for its personnel in the field of data protection. In addition, the Company carefully selects the Processors to whom access to Personal Data may be granted and monitors their activities to ensure that they comply with security requirements and provide an adequate level of protection.

 

When assessing the level of security measures taken by the Company, it should be noted that no system can guarantee absolute security, but at the same time, the Company constantly evaluates the effectiveness of its measures, improves processes, and implements new solutions to protect Personal Data from modern risks and threats.

 

 

RIGHTS OF PERSONAL DATA SUBJECTS

 

The Company respects the rights of each Personal Data Subject to protect their Personal Data and ensures the possibility of exercising such rights in accordance with the procedure established by the Legislation of Ukraine.

 

These rights include:

  1. The right to receive information about who processes their Personal Data and for what purposes.
  2. The right to access their Personal Data, which includes the right to obtain confirmation as to whether their data is being processed, as well as to obtain a copy of their data processed by the Company.
  3. The right to correct inaccurate, outdated, or incomplete Personal Data.
  4. The right to make a reasoned request to the Company to object to the processing of your Personal Data.
  5. The right to make a reasoned request for the Company to destroy your Personal Data if it is being processed unlawfully or is inaccurate.
  6. The right to know the mechanisms of automatic processing of Personal Data, including the right to protection from automated decisions that have legal consequences for the Subject of Personal Data.
  7. The right to make a reservation regarding the restriction of the right to process Personal Data when giving consent to data processing.

 

If you wish to exercise one of your rights to protect your Personal Data as defined by Ukrainian law or withdraw your consent to the processing of your data, you (or your legal representative) must send your request in electronic form to the Company's email address specified in this Data Processing Notice or in writing to the Company's postal address, which is also specified in this Data Processing Notice.

 

Please note that the subject line of each request you submit must clearly state the right you wish to exercise, and in the case of withdrawal of consent to data processing, a clear statement of your desire to withdraw your consent to data processing. In addition, you must provide information that will help us identify the person making the request.

 

If the subject of your request is unclear or the Company has difficulty identifying the person making the request, we may ask you to fill out a request form and provide additional information to clarify the subject of your request or identify you so that we can process your request correctly. Requests are free of charge, and we make every effort to respond to them as quickly as possible, but in any case no longer than required by Ukrainian law.

 

When the Company processes your Personal Data as a Controller, the Company reserves the right not to respond to your requests regarding the exercise of your rights. We ask you to send all requests related to your Personal Data to the Owner on whose behalf the Company acts and to whom you have provided your Personal Data, through the communication channels specified by the relevant Controllers.

 

 

AUTOMATED DECISION-MAKING

 

The Company does not process Personal Data using solely automated decision-making, including profiling, which may have legal consequences for the Data Subject or otherwise significantly affect their rights, freedoms, or legitimate interests.

 

If the use of such processes is envisaged in the future, the Company undertakes to inform the Subjects of Personal Data in advance about the use of automated decision-making, explain the logic of such processes, the possible consequences for the Subjects of Data, and provide the opportunity to appeal the decision or obtain human intervention in its adoption.

 

The right to complain about the processing of their Personal Data to the competent Supervisory Authority or to a court and to apply legal remedies in case of violation of the Legislation of Ukraine on the protection of Personal Data.

 

 

OBLIGATIONS OF PERSONAL DATA SUBJECTS

 

When providing their Personal Data to the Company, Personal Data Subjects are obliged to act in good faith and comply with the requirements of Ukrainian law, in particular, to provide accurate and up-to-date Personal Data relating to themselves and to notify the Company of any changes to their Personal Data in order to maintain its accuracy and relevance.

 

The Personal Data Subject undertakes to refrain from providing Personal Data of other persons (e.g., relatives) without proper legal grounds or consent of such persons and to comply with other obligations provided for by the Legislation of Ukraine.

 

 

CONTACT US

 

If you have any questions, comments, or complaints regarding this Data Processing Notice, the processing of your Personal Data, or the exercise of your rights as a Personal Data Subject, you may contact the Company through the following channels:

 

Company mailing address: 46015, Ternopil, V. Vynnychenko St., 8

 

Company email: cfg_trading@cfg.com.ua

 

 

CHANGES TO THE DATA PROCESSING NOTICE

 

This version of the Data Processing Notice is current as of the date of its publication. The Company reserves the right to periodically review and update the provisions of this Data Processing Notice in connection with the requirements of the current Ukrainian Legislation, changes in its business activities, or if it considers such changes to be reasonable and necessary.

 

In the event of changes, the updated version of the Data Processing Notice will be published on this web page with the date of the last update. We recommend that users regularly review the Data Processing Notice when visiting the Website or interacting with the Company in order to be informed about current practices for the protection of Personal Data and the possibilities for exercising their rights.

 

If you do not agree with the changes made to the Data Processing Notice, you must stop using the Website and notify the Company by contacting us through the contact channels specified in this Privacy Policy.