Consent to Personal Data Processing

This is a translation. The Russian version prevails.

Version dated 27 October 2026

Before giving your consent, please read the information below. Section A applies to forms on the website, section B to registration in the Leksta Service. It is provided in accordance with Article 5(5) of the Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" (the "Law").

1. Who processes the data

The Operator is BelkrajTurizm LLC, UNP 193771430, Republic of Belarus, Minsk, Sofyi Kovalevskoy lane 60, office 508, telephone +375 33 623-53-69, email client@belkraj.by.

A. Consent when submitting forms on the website

2. When consent is given

You give your consent when you tick the box "I consent to the processing of personal data" and submit a request form, a callback form, a demo request form or any other form on the leksta.by website. The box is not ticked in advance. The form cannot be submitted without consent.

3. Purposes of processing

• to respond to your request and contact you by the method you selected;
• to run a demonstration of the Leksta Service and provide demo access;
• to prepare and send a commercial proposal;
• to record your request and the history of communication with you.

4. List of personal data

Name; company name; telephone number and/or email address; the selected method of contact; the product of interest; the number of operators, the PBX and CRM systems used, the call volume (if you provided them); comment; the address of the page from which the request was submitted; the date and time of the request.

Do not include in the comment any information that is not needed to respond to the request, including special categories of personal data.

5. Actions with data and methods of processing

Collection, systematisation, storage, modification, use, blocking, disclosure to authorised persons, deletion. The processing is mixed: with the use of automation tools (the request-tracking information system) and without them (a call or letter by an employee).

6. Term of consent

The consent is valid for 3 years from the date of your last contact with the Operator or until it is withdrawn.

7. Authorised persons and data transfer

• the server hosting provider (a data centre in Minsk), to store the request;
• the email delivery service smtp.bz (Russian Federation), to notify the Operator's employees of the request;
• the Telegram messenger (Telegram Messenger Inc.), for internal notification of the Operator's employees about a new request.

Telegram may process data on servers outside the Republic of Belarus, including in states that do not ensure an adequate level of protection of the rights of data subjects. The risks of such a transfer are as follows: in those states there may be no personal data protection authority, the rights of a data subject may be protected to a lesser extent, and exercising them and obtaining judicial protection may be difficult. By giving your consent, you agree to such a transfer (Article 9 of the Law).

The Operator does not disseminate your data and does not transfer it to any other third parties, except as provided by law.

8. Your rights

You have the right to:

• withdraw your consent at any time without giving reasons;
• obtain information about the processing of your personal data;
• demand that changes be made to your personal data if it is incomplete, outdated or inaccurate;
• obtain information about the disclosure of your personal data to third parties;
• demand that the processing and/or deletion of your personal data be stopped;
• appeal against the actions (inaction) and decisions of the Operator to the National Personal Data Protection Centre of the Republic of Belarus.

How to do this: submit an application to the Operator's postal address (section 1) or as an electronic document to client@belkraj.by in accordance with Article 14 of the Law. You can also withdraw consent in the same form in which it was given: by an email to client@belkraj.by from the email address (or stating the telephone number) given in your request. The application must contain your surname, first name and patronymic (if any), your residential address (place of stay), date of birth, the substance of your request and your signature. The procedure and time limits are described in section 6 of the Personal Data Processing Policy.

9. Consequences of giving and refusing consent

If you give your consent, the Operator will process the data for the purposes set out in section 3 and will contact you.

If you do not give your consent, the form will not be submitted. You can contact us by the telephone number given in section 1. Refusing consent has no other consequences for you.

After consent is withdrawn, the Operator will, within 15 days, stop the processing and delete the data, unless there is another basis for processing (for example, a contract concluded with you), and will notify you accordingly. Withdrawal of consent is not retroactive.

10. Other

For more details on how the Operator processes personal data, see the Personal Data Processing Policy. Separate consent to advertising mailings is requested separately and is not a condition for submitting a request.

B. Consent when registering in the Leksta Service

You give this consent when, at registration on app.leksta.by, you tick the box "I accept the Public Offer and give my consent to personal data processing" and click "Create account". The box is not ticked in advance.

Operator: BelkrajTurizm LLC (section 1).

Purposes: creating and maintaining an account; providing the trial period; concluding and performing the contract (Public Offer) with the organisation you represent; service notifications (address confirmation, password recovery, messages about the operation of the Service); technical support; ensuring the security of the Service.

Personal data: first name, last name, email address, company name, password (stored only as a hash), role in the Service, record of acceptance of the offer and the date of consent, login records (date, time, IP address, browser).

Actions and methods: collection, systematisation, storage, modification, use, blocking, provision to authorised persons, deletion; processing with the use of automation tools.

Term of consent: the term of the account and 3 years after its deletion (for the resolution of disputes), or until consent is withdrawn.

Authorised persons: the server hosting provider (a data centre in Minsk, Republic of Belarus); the email delivery service smtp.bz (Russian Federation).

Rights, how to exercise them and time limits: as in section 8. Withdrawal of consent leads to deletion of the account; if the contract with the organisation remains in force, it may appoint another user. Processing that is necessary to perform obligations under legislation (for example, accounting) continues without consent.

Consequences of refusal: registration is not possible without consent. You can contact us and get a demonstration through the request form on the website or by telephone.