Personal Data Processing Policy

This is a translation. The Russian version prevails.

Version dated 27 October 2026. Effective from the date of publication on the website.

1. General provisions

1.1. This Policy sets out how the limited liability company BelkrajTurizm LLC (UNP 193771430, registered office: Republic of Belarus, Minsk, Sofyi Kovalevskoy lane 60, office 508, the "Operator") processes personal data in the operation of the leksta.by website and the Leksta speech analytics service (the "Service").

1.2. The Policy has been prepared in accordance with the Constitution of the Republic of Belarus, the Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection" (the "Law") and other legislation of the Republic of Belarus.

1.3. The Policy applies to all personal data that the Operator processes with and without the use of automation tools, including data received through the website, the Service personal account, email, telephone and messengers.

1.4. The Policy does not apply to personal data that Customers of the Service upload to the Service or transmit to it through integrations (call recordings, transcripts, telephone numbers and the names of their employees and clients). For such data, the Customer is the operator, and BelkrajTurizm LLC is the processor that processes it on the Customer's instructions (section 8 of the Policy and Appendix 1 to the Public Offer).

1.5. More about cookies — see section 9.

1.6. The Policy is freely available on the Internet at leksta.by/legal/privacy. The Operator may amend the Policy. A new version takes effect from the date of its publication, unless it states otherwise. The Operator retains previous versions and provides them on request.

2. Terms

2.1. Personal data means any information relating to an identified individual or an individual who can be identified.

2.2. Data subject (the "data subject") means the individual to whom personal data relates.

2.3. Processing of personal data means any action or set of actions with personal data: collection, systematisation, storage, modification, use, anonymisation, blocking, dissemination, disclosure, deletion.

2.4. Processor means a person who processes personal data on behalf of or in the interests of an operator under a contract with the operator.

2.5. Cross-border transfer means the transfer of personal data to the territory of a foreign state.

2.6. Other terms are used in the meanings defined by the Law.

3. Principles of processing

3.1. The Operator processes personal data:

• lawfully, fairly and proportionately to the stated purposes;
• with the consent of the data subject or on another basis provided for by the Law;
• only for specific, previously stated lawful purposes;
• in a volume that does not exceed those purposes;
• transparently: the data subject receives information about the processing in accordance with the Law;
• ensuring that the data is accurate and, where necessary, kept up to date;
• storing data in a form that permits identification of the data subject for no longer than the purposes of processing require.

3.2. The Operator does not process special categories of personal data (health, beliefs, biometric and genetic data, etc.) for its own purposes. The Service does not use voice to identify individuals (voiceprints are not created).

3.3. The Operator does not make decisions that produce legal consequences for a data subject solely on the basis of automated processing of the data subject's personal data.

4. Purposes, categories of data subjects, scope of data, legal bases and retention periods

Purpose	Data subjects	Personal data	Legal basis	Retention period
Responding to a request from the website, demonstrating the Service, preparing a commercial proposal	Persons who submitted a request (including representatives of organisations)	Name, company name, telephone number or email address, selected method of contact, product of interest, number of operators, PBX and CRM systems used, call volume, comment, page address and date of the request	Consent of the data subject (Article 5 of the Law)	3 years from the date of the last contact or until consent is withdrawn
Registering and maintaining an account in the Service, concluding and performing a contract (the public offer)	Users of the Service, representatives and employees of Customers	First name, last name, email address, company name, password (stored only as a hash), role in the Service, login records (date, time, IP address), record of acceptance of the offer and the Policy	Contract with the data subject (indent fifteen of Article 6 of the Law); for representatives and employees of Customers and for the trial period, the consent given at registration (Consent, section B)	The term of the account and 3 years after its deletion (for the resolution of disputes)
Settlements, accounting and tax records, primary accounting documents	Representatives of Customers, payers	Full name, position, contact details, organisation details, payment information (the Operator does not process bank card numbers; they are processed by the payment service)	Performance of obligations provided for by legislation (indent twenty of Article 6 of the Law)	The periods established by legislation for the retention of accounting and tax documents
Technical support and responses to enquiries	Users and other persons who contacted the Operator	Name, contact details, content of the enquiry, correspondence	Contract (for users); consent (for other persons); handling of enquiries is carried out in accordance with the legislation on enquiries from citizens and legal entities	3 years from the date of the last contact; enquiries from citizens, for the periods established by legislation
Ensuring the operation and security of the website and the Service	Website visitors, users	IP address, browser and device information, date and time of requests, page addresses, event logs	Performance of the obligation to protect personal data (indent twenty of Article 6, Article 17 of the Law)	Up to 12 months
Analysing traffic and improving the website	Website visitors	Analytics cookie data: browser identifier, information on pages visited, referral source, approximate location based on IP address	Consent of the data subject, expressed in the cookie banner	The periods stated in the Cookie Policy
Informational and promotional mailings about the Service	Persons who gave separate consent	Name, email address or telephone number	Separate consent of the data subject (Article 5 of the Law, Article 18 of the Law "On Advertising")	Until consent is withdrawn

4.1. The Operator does not require you to provide a personal identification number, passport details or date of birth unless this is necessary for the stated purposes.

4.2. If personal data is necessary for concluding a contract and the data subject does not provide it, the Operator will not be able to conclude the contract, provide access to the Service or respond to the request.

4.3. Upon expiry of the retention period or achievement of the purpose, personal data is deleted or anonymised, unless otherwise provided by legislation.

5. Procedure for processing

5.1. The Operator collects personal data directly from data subjects (through forms on the website, at registration, in correspondence) and from the organisations that the data subjects represent.

5.2. The Operator performs the following actions with personal data: collection, systematisation, storage, modification, use, anonymisation, blocking, disclosure, deletion. The processing is mixed (with and without the use of automation tools).

5.3. Personal data is stored on servers located in the Republic of Belarus (a data centre in Minsk).

5.4. The Operator may entrust processing to processors. The contract with a processor defines the purposes of processing, the list of actions, the obligations to maintain confidentiality and the measures for protecting personal data (Article 7 of the Law). The list of processors and third parties to whom data is transferred:

• the server hosting provider (a data centre in Minsk, Republic of Belarus);
• the email delivery service smtp.bz (Russian Federation), for service emails: address confirmation, password recovery, notifications about requests;
• the payment service bePaid (Republic of Belarus), for payment by bank card; card details are entered on the payment service's page and are not transferred to the Operator;
• the web analytics services Yandex Metrica and Google Analytics via Google Tag Manager, only with consent to analytics cookies (Cookie Policy);
• the Telegram messenger, for internal notifications to the Operator's employees about a new request (name, company, contact, text of the request);
• the authorities and organisations to which the Operator is obliged to provide data in cases provided for by legislation.

5.5. Cross-border transfer. The smtp.bz service and Yandex Metrica process data in the Russian Federation. Google services (Google Analytics, Google Tag Manager) and Telegram may process data on servers outside the Republic of Belarus, including in states that do not ensure an adequate level of protection of the rights of data subjects. The list of states with an adequate level of protection is defined by Order No. 14 of the Director of the National Personal Data Protection Centre of 15 November 2021. A transfer to states that are not on this list is carried out only with the consent of the data subject after the data subject has been informed of the risks (Article 9 of the Law), or on another basis provided for by the Law. The risks: in such states there may be no authority for personal data protection, and the rights of the data subject may be restricted; it may be more difficult for the data subject to exercise their rights and to defend them in court.

5.6. The Operator does not disseminate personal data (does not make it available to an indefinite number of persons) and does not sell it.

5.7. Processing is terminated when the purposes are achieved, the retention period expires, consent is withdrawn (if there is no other basis), unlawful processing is identified, or the Operator ceases its activities.

6. Rights of the data subject and how to exercise them

6.1. The data subject has the right to:

• withdraw consent to processing at any time without giving reasons (Article 10 of the Law);
• obtain information about the processing of their personal data: the Operator's location, confirmation of the fact of processing, the data and the source from which it was obtained, the legal bases and purposes, the term of consent, the processors, and other information under the Law (Article 11 of the Law);
• demand that changes be made to personal data if it is incomplete, outdated or inaccurate (Article 11 of the Law);
• once per calendar year, receive free of charge information about the disclosure of their personal data to third parties (Article 12 of the Law);
• demand that the processing and/or deletion of personal data be stopped (Article 13 of the Law);
• appeal against the actions (inaction) and decisions of the Operator to the National Personal Data Protection Centre of the Republic of Belarus and then to a court (Article 15 of the Law).

6.2. To exercise their rights, the data subject submits an application to the Operator in writing or as an electronic document (and, for withdrawal of consent, also in the form in which the consent was given). The application must contain: surname, first name, patronymic (if any), residential address (place of stay), date of birth, personal identification number (if it was provided when consent was given or if processing is carried out without consent), a statement of the substance of the demands, and a personal signature or electronic digital signature (Article 14 of the Law).

6.3. The application is sent to the postal address: BelkrajTurizm LLC, Republic of Belarus, Minsk, Sofyi Kovalevskoy lane 60, office 508, or as an electronic document to the email address client@belkraj.by. Consent given on the website or at registration can also be withdrawn in the same form in which it was given: by an email to client@belkraj.by from the email address (or stating the telephone number) that you gave in your request or at registration. Consent to analytics cookies is withdrawn via the "Cookie settings" link at the bottom of every page. Questions about the processing of personal data can be asked by telephone at +375 33 623-53-69 (Mon-Fri, 9:00-17:30).

6.4. The Operator's response times:

• to an application for information about the processing: within 5 working days;
• to an application for information about disclosure to third parties, for changes to be made, for processing to be stopped and data deleted, or for consent to be withdrawn: within 15 days.

6.5. Withdrawal of consent is not retroactive. After consent is withdrawn, the Operator may continue processing if there is another basis for it provided for by the Law (for example, performance of a contract or a requirement of legislation). If the data cannot technically be deleted, the Operator blocks it and notifies the data subject.

7. Obligations of the Operator and protective measures

7.1. The Operator:

• explains to the data subject their rights relating to processing and the consequences of giving or refusing consent;
• obtains consent where there is no other basis;
• ensures the protection of personal data;
• provides the data subject with information about their personal data, makes changes, stops processing and deletes data in the cases and within the time limits established by the Law;
• notifies the National Personal Data Protection Centre of breaches of personal data protection systems immediately, but no later than three working days after becoming aware of them;
• complies with the requirements of the authority for the protection of the rights of data subjects.

7.2. The Operator applies legal, organisational and technical measures (Article 17 of the Law):

• appoints a person responsible for internal control over the processing of personal data;
• issues local legal acts on the processing of personal data, familiarises employees with them and trains them;
• only employees who need access to perform their job duties have access to personal data, and they are obliged to maintain confidentiality;
• connections to the website and the Service are protected by the HTTPS protocol; passwords are stored only as a hash; access to servers is restricted and logged; the data of the Service's Customers is isolated from one another;
• backups are made and security events are monitored;
• technical and cryptographic protection tools are applied in accordance with legislation.

8. Data that the Service processes on behalf of Customers

8.1. A Customer of the Service (an organisation or sole proprietor) uploads recordings of telephone conversations and chats to the Service or connects its PBX, CRM or other system to the Service. This data may contain voice, speech, telephone numbers, names and other information about the Customer's employees and their interlocutors.

8.2. The operator of such data is the Customer. The Customer determines the purposes of processing, ensures the legal basis (including by warning interlocutors about the recording and analysis of conversations) and is responsible to data subjects. BelkrajTurizm LLC processes this data as a processor, solely on the Customer's instructions and to the extent necessary to provide the services: transcribing speech into text, analysing conversations using artificial intelligence algorithms, scoring against the Customer's criteria, generating reports, passing results to the Customer's systems, and technical support.

8.3. BelkrajTurizm LLC does not use Customer data for its own purposes, does not sell it and does not use it to train models outside the Customer's environment without the Customer's written consent.

8.4. The terms of the instruction, retention periods, the deletion procedure, the list of sub-processors engaged and the actions to be taken in the event of incidents are set out in the Personal Data Processing Agreement (Appendix 1 to the Public Offer).

8.5. If you are an interlocutor of a Customer of the Service (for example, you called a company that uses Leksta) and wish to exercise your rights, contact that company as the operator. BelkrajTurizm LLC will pass the application received from you to that company and will help it to respond.

9. Cookies

9.1. What cookies are

9.1.1. Cookies are small files that a website stores in a visitor's browser. They help the website work, remember the visitor's choices and understand how pages are used.

9.1.2. The leksta.by website belongs to BelkrajTurizm LLC (UNP 193771430, Minsk, Sofyi Kovalevskoy lane 60, office 508). Where cookie data makes it possible to identify a visitor, the Operator processes it in accordance with the Law of the Republic of Belarus "On Personal Data Protection" and this Policy.

9.2. Which cookies we use

Strictly necessary cookies are required for the website to work. They are set without consent and are not used for analytics or advertising.

Cookie	Set by	Purpose	Duration
tv_cookie_consent	leksta.by	Remembers your choice in the cookie banner	180 days
payload-token	leksta.by	Login to the website editing panel (staff only)	until logout, no more than 2 hours

Analytics cookies are set only after you click "Accept" in the banner. They help us understand which pages are useful and improve the website.

Cookie	Set by	Purpose	Duration
_ym_uid, _ym_d, _ym_isad, _ym_visorc	Yandex Metrica (Yandex LLC, Russia)	Counting visits, analysing behaviour on the website	from 30 minutes to 1 year
_ga, _ga_*	Google Analytics (Google LLC, USA)	Counting visits and traffic sources	up to 2 years
Google Tag Manager service cookies	Google LLC, USA	Loading analytics tags after consent	session

Advertising cookies are not used on the website. The online chat on the website is not currently connected; if it is connected, its cookies will be added to this section before it is enabled.

9.3. How we obtain consent

9.3.1. On your first visit, the website shows a banner with the buttons "Accept" and "Decline". Analytics scripts are not loaded until you make a choice.

9.3.2. Consent is given for 180 days. After that, the banner is shown again.

9.3.3. If you click "Decline", the website will continue to work in full and analytics cookies will not be set.

9.4. How to change your choice

9.4.1. A "Cookie settings" link is located at the bottom of every page. You can use it to withdraw your consent: the banner will be shown again and analytics scripts will stop loading.

9.4.2. Cookies can be deleted or blocked in your browser settings. If you block strictly necessary cookies, the website may not be able to remember your choice.

9.4.3. Cookies previously set by third-party services are deleted in your browser settings. Yandex and Google also provide their own tools for opting out of analytics.

9.5. Data transfer

9.5.1. Analytics cookie data is processed by Yandex LLC (Russian Federation) and Google LLC (USA). Google may process data in states that do not ensure an adequate level of protection of the rights of data subjects. By clicking "Accept", you consent to such a transfer and confirm that you are aware of the risks: in those states, the rights of a data subject may be protected to a lesser extent, and exercising them may be difficult.

9.5.2. We receive only aggregated reports from the analytics services and do not link them to data from the forms on the website.

9.6. Changes

The current version is always published on this page. For questions, use the Operator contact details in section 10 of this Policy.

10. Final provisions

10.1. Matters not regulated by the Policy are governed by the legislation of the Republic of Belarus.

10.2. Compliance with the Policy is monitored by the person responsible for internal control over the processing of personal data at the Operator.

10.3. Operator's contact details: BelkrajTurizm LLC, UNP 193771430, Republic of Belarus, Minsk, Sofyi Kovalevskoy lane 60, office 508, telephone +375 33 623-53-69, email client@belkraj.by.