CMS
Grace Label

Legal documents

Personal Data Processing Policy

Last updated: 12.10.2026

Grace Label LLC · revision of 12 October 2026

1. General provisions

1.1. The personal data operator is Limited Liability Company «GRACE LABEL» (ООО «ГРЕЙС ЛЕЙБЛ», Grace Label LLC, UNP 592025437, the Operator), registered by the Grodno Regional Executive Committee in the Unified State Register of Legal Entities and Individual Entrepreneurs on 18 January 2024; registering authority — Inspectorate of the Ministry of Taxes and Duties of the Republic of Belarus for Oktyabrsky District of Grodno. Registered address: 230011, Republic of Belarus, Grodno Region, Grodno, Gerasimovicha str., 1-2. Contacts: phone +375 44 556-63-97, e-mail [email protected], website https://grace-label.org (the Site).

1.2. This Policy is issued in fulfilment of paragraph 3 of Article 17 of the Law of the Republic of Belarus of 7 May 2021 No. 99-Z «On Personal Data Protection» (the Law) and is published in open access in accordance with paragraph 4 of Article 17 of the Law.

1.3. The Policy covers the processing of personal data of the following categories of data subjects: Site visitors; persons who have submitted a request through the Site forms; persons who contacted the Operator by e-mail, phone or WhatsApp messenger; representatives of the Operator's counterparties.

1.4. Terms are used in the meanings defined in Article 1 of the Law. Familiarisation with the Policy is a right, not an obligation of the data subject.

2. Procedure and conditions of personal data processing

2.1. The following actions are performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction. Processing is carried out by automated means in the Operator's information system and, for paper-based requests, partially without automation tools.

2.2. Sources of personal data: the request form on the Site; e-mail [email protected]; phone and WhatsApp +375 44 556-63-97; postal correspondence; technical means of the Site (cookies, web analytics, spam protection for forms).

2.3. Purposes of processing, categories of data subjects, data, legal grounds and retention periods:

Acceptance and processing of requests for the Operator's services (product marking, label printing, DataMatrix code generation, warehouse services, consultations and cost estimation).

Subjects: Site visitors who submitted a request.

Data: name, phone number, information about the product batch (product name, quantity), selected service, message content.

Legal basis: consent of the data subject (Article 5 of the Law), expressed by completing and submitting the request form.

Retention: until consent is withdrawn, but no more than 5 years from the date of the request.

Consideration of requests and responses to inquiries received by e-mail, phone, WhatsApp or postal correspondence.

Subjects: persons who contacted the Operator.

Data: surname, first name, patronymic (if provided), contact details, content of the request.

Legal basis: a document addressed to the Operator and signed by the subject (paragraph sixteen of Article 6 of the Law); legislation on appeals of citizens and legal entities (Law of the Republic of Belarus of 18 July 2011 No. 300-Z).

Retention: 5 years from the date the request is processed.

Conclusion and performance of contracts with counterparties.

Subjects: representatives and employees of counterparties.

Data: surname, first name, patronymic, position, work phone and e-mail address, signature specimen in the contract.

Legal basis: receipt of personal data on the basis of a contract concluded (being concluded) with the data subject for the performance of actions established by that contract (paragraph fifteen of Article 6 of the Law).

Retention: the term of the contract plus 5 years after its expiry.

Exercise by data subjects of the rights provided for in Articles 10-13 of the Law.

Subjects: persons who have submitted applications to the Operator.

Data: information specified in the application (surname, first name, patronymic, residential address, date of birth, identification number or identity document number — where applicable).

Legal basis: a document addressed to the Operator and signed by the subject (paragraph sixteen of Article 6 of the Law), and the Operator's duties under Article 16 of the Law.

Retention: 5 years from the date the application is processed.

Protection of the request form against automated submission (spam) via the Cloudflare Turnstile service.

Subjects: Site visitors interacting with the request form.

Data: IP address, technical information about the browser and device, behavioural characteristics of interaction with the form.

Legal basis: consent of the subject (Article 5 of the Law), expressed by using the request form.

Retention: data is not stored on the Operator's side; processing periods are determined by the Cloudflare, Inc. policy.

Site attendance statistics via Google Tag Manager.

Subjects: Site visitors.

Data: cookie identifiers, IP address, device and browser information, pages viewed and actions on the Site.

Legal basis: consent of the subject (Article 5 of the Law), expressed by continued use of the Site.

Retention: the Operator stores only aggregated depersonalised statistics; processing periods for identifying data are determined by Google's policy.

2.4. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, health, etc.). Please do not include such information in the «Message» field of the request form or in inquiries; if received, such data is deleted.

2.5. To protect personal data the Operator applies, among other things, the following measures: role-based access — only authorised employees can access requests; administrator authentication in the information system; data transfer over secure HTTPS/TLS protocol; database storage on a dedicated server; protection of forms against automated submission; appointment of a person responsible for internal control of personal data processing (contact: [email protected]).

2.6. The Site uses technical cookies necessary for its functioning and analytics cookies of the Google Tag Manager service. You can restrict or disable cookies in your browser settings; disabling technical cookies may cause some Site functions to work incorrectly.

3. Authorised persons

3.1. To achieve the purposes set out in section 2, the Operator entrusts the processing of personal data to the following authorised persons (Article 7 of the Law):

  • Contabo GmbH (Germany) — hosting of the Site's server infrastructure and storage of its database (requests, inquiries);
  • Cloudflare, Inc. (USA) — delivery of Site content (CDN) and verification of request form senders for automated submission (Turnstile service);
  • Google Ireland Limited (Ireland) and Google LLC (USA) — collection of Site attendance statistics (Google Tag Manager);
  • Telegram FZ-LLC (United Arab Emirates) — delivery of notifications about incoming requests to the Operator's employees' work chat.

3.2. Authorised persons may engage their own contractors (sub-authorised persons) for processing in accordance with their privacy policies.

4. Cross-border transfer of personal data

4.1. Personal data is transferred to the following foreign states:

  • Germany, Ireland — states included in the list of foreign states ensuring an adequate level of protection of the rights of personal data subjects (Order of the Director of the National Centre for Personal Data Protection of 15 November 2021 No. 14). Transfer is carried out on the grounds provided for in Articles 5, 6 and paragraph 2 of Article 8 of the Law.
  • United States of America (Cloudflare, Google LLC), United Arab Emirates (Telegram) — states not included in the list. Transfer is carried out on the basis of the consent of the data subject (paragraph two of part 1 of Article 9 of the Law), given subject to being informed of the risks associated with the absence of an adequate level of protection: these states apply a different legal regime for personal data protection, and data may be accessed by the authorised bodies of those states in accordance with their national legislation.

4.2. Data transferred: to Cloudflare and Google services — technical data (IP address, cookie identifiers, device and browser information); to the Telegram service — request content (name, phone number, product batch details, message text) to the extent necessary to notify the Operator's employees.

5. Rights of data subjects and procedure for exercising them

5.1. You have the right to:

  • withdraw consent to the processing of personal data at any time without explanation (Article 10 of the Law) — the Operator will stop processing and delete the data within fifteen days of receiving the application and notify you;
  • obtain information about the processing of your personal data: purposes, legal basis, time limits, name of the Operator and list of actions with the data (Article 11 of the Law);
  • require changes to personal data if it is incomplete, outdated or inaccurate (Article 12 of the Law);
  • obtain information about the provision of your personal data to third parties (Article 13 of the Law).

5.2. To exercise these rights, send an application to the Operator (Article 14 of the Law):

  • in written form — to: Republic of Belarus, Grodno, Gerasimovicha str., 1;
  • as an electronic document — to [email protected].

The application must contain: surname, first name, patronymic (if any); residential (temporary residence) address; date of birth; identification number or identity document number (if this information was provided when giving consent or if data is processed without consent); statement of the essence of the demands; personal signature or electronic digital signature.

5.3. The response is sent in the form corresponding to the form of the application, within 15 calendar days of its receipt; applications requiring additional verification are considered within up to one month in accordance with the legislation on appeals of citizens and legal entities.

5.4. If you believe that the actions (inaction) or decisions of the Operator violate your rights in the processing of personal data, you may appeal them (Article 15 of the Law) to the authorised body for the protection of the rights of personal data subjects — the National Centre for Personal Data Protection of the Republic of Belarus (website: https://cpd.by), and the decision of the authorised body — to a court.

5.5. Contact of the person responsible for internal control of personal data processing: [email protected], +375 44 556-63-97 (Monday–Friday, 08:30–17:30).

6. Final provisions

6.1. The Policy is kept up to date. In case of significant changes (purposes of processing, retention periods, procedure for exercising rights, conditions of cross-border transfer), a new revision is published on the Site in advance of such changes taking effect.

6.2. The current revision of the Policy is available at https://grace-label.org/policies/politika-obrabotki-personalnyh-dannyh.