Privacy Policy for the “Palace Ukraine” Mobile Application

Effective Date: September 1, 2023

PREAMBLE

THE PRIVACY POLICY OF THE MOBILE APPLICATION “PALAC UKRAINE” (HEREIN – THE PRIVACY POLICY) IS DEVELOPED TO COMPLY WITH THE PRINCIPLE OF “ACCOUNTABILITY” IN ACCORDANCE WITH ARTICLE 5(2) GDPR.

BY USING THE “PALAC UKRAINE” APPLICATION, YOU CONFIRM THAT YOU ARE AWARE OF THE PURPOSES AND METHODS OF OBTAINING AND PROCESSING PERSONAL DATA, AND YOU GIVE YOUR CONSENT TO THE PROCESSING OF PERSONAL DATA AND THE PROVISION OF THEM TO THIRD PARTIES IN ACCORDANCE WITH THE PROVISIONS OF THIS PRIVACY POLICY.

ALL DATA YOU PROVIDE IS A NECESSARY CONDITION FOR ACCEPTANCE OF THE RULES OF USE OF THE “PALAC UKRAINE” MOBILE APPLICATION.

This Privacy Policy was published on 01.09.2023 in accordance with the current legislation of Ukraine, including, but not limited to, the Law of Ukraine “On Protection of Personal Data” dated June 01, 2010 No. 2297-VI, which applies to Users of the “Palac Ukraine” Mobile Application and establishes the procedure for receiving, collecting, accumulating, storing, processing, using, ensuring the protection and disclosure of Personal Data of Users of the “Palac Ukraine” Mobile Application.

References to the words “we”, “our” or “us” (or similar words) mean the owner of the “Palace Ukraine” Mobile Application – State Enterprise “National Palace of Arts “Ukraine””, EDRPOU 02221461, Ukraine, 03150, Kyiv, Velyka Vasylkivska Street, Building 103, or the “Palace Ukraine” Mobile Application, depending on the context.

References to the words “you” or “your” (or similar words) mean our User – Specialist or Client, depending on the context of the Privacy Policy.

This Privacy Policy sets out how we work with certain Personal Data of Users.

We may change this Privacy Policy, so please check this page periodically to ensure that you are satisfied with the changes.

We do our best to comply with all regulations regarding the processing, storage and collection of Personal Data, both GDPR and Ukrainian legislation related to Personal Data.

The provisions of this Privacy Policy are drawn up in accordance with the legislation of Ukraine, European legislation in the field of Personal Data protection (Regulation (EU) 2016/679 General Data Protection Regulation (“GDPR”)), and are also brought into line with, comply with and do not contradict the requirements of US legislation in the field of Personal Data protection, in particular the California Consumer Privacy Act (CCPA).

TERMS AND DEFINITIONS

Data – any information that directly or indirectly relates to a specific User. Data includes: name, surname, e-mail address, telephone number, other information used for communication, which is provided to the User at their request through the registration form and/or when filling out their own profile in the “Palace Ukraine” Mobile Application, when writing a message or review, or information obtained in another way.

Processing – any operation with your Personal Data, whether automated or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or destruction. Processing of Personal Data means any actions with Personal Data, including, but not limited to: providing access, distribution, collection, systematization, storage, accumulation, recording, transfer, blocking, deletion, clarification, updating and/or modification, depersonalization and other methods of using personal data by the “Palace Ukraine” Mobile Application.

Personal data — information relating to you, separately or in combination with other pieces of information, which allows the person collecting and processing the information to identify you as an individual.

Services of the “Palace Ukraine” Mobile Application — services specified in clause 2.1. of the Rules for using the “Palace Ukraine” mobile application.

Data subject — an individual or an identifiable person whose personal data are processed by us; refers to you as a User of the “Palace Ukraine” Mobile Application.

Consent is a freely given, specific, informed and unambiguous indication of the wishes of the Data Subject by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of his or her Personal Data.

All other terms used in this Privacy Policy are defined in the Terms of Use of the Palace Ukraine mobile application.

GENERAL PROVISIONS

1. The “Palace Ukraine” mobile application does not process Data related to racial or ethnic origin, political opinions, religious or other beliefs, membership in public organizations. Information characterizing the physiological characteristics of users, on the basis of which their identity can be established, is also not processed.

WHAT DATA DO WE COLLECT AND PROCESS?

1. We may collect various types of data, both directly obtained from you upon registration (Article 13 GDPR) and automatically obtained through your device (e.g. mobile phone) when you use the “Palace Ukraine” Mobile Application Service (Article 13-14 GDPR). In accordance with the principle of “data minimization” (Article 5(1)(c) GDPR), we collect and process only those Personal Data that are strictly necessary to provide you with the “Palace Ukraine” Mobile Application Services.
2. We may collect the Data listed below:

Customer Account. We collect and process Personal Data provided by you during registration and subsequent editing of your Account. For registration purposes, you specify registration data: username and password, first name, last name and email address, you can also edit your Account and supplement it by providing information at your own discretion.

Information posted by Users based on the results of their service. We collect and process information such as reviews, comments, requests to the Support Service, complaints, claims and other requests.

Information about transactions made using the “Palace Ukraine” Mobile Application. We do not directly process your credit/debit card information, instead, we use a third-party payment service on the Agent side to bill you for online payment. We do not store your payment information on our servers, such as the identifier, date and time of the transaction.

FOR WHAT PURPOSES DO WE COLLECT AND PROCESS YOUR DATA?

1. We collect and process Personal Data for the following purposes:
   We process your personal data to provide access to the selection of events and payment for Electronic Tickets. We use your personal data upon registration to help purchase tickets for events and to personalize you. Please note that without the information provided by you in accordance with our Terms of Use, you will not be able to use the functionalities of the “Palace Ukraine” Mobile Application, contact and communicate with other Users, or provide/use the User Services.
   We may also use your payment card transaction data provided by our Agent to confirm that a specific transaction has occurred, for example: the date and amount of your transaction and the last 4 digits of your card number so that we can verify your payment for the Order.
   We process certain payment information to comply with applicable financial and accounting legislation. We may also process data collected in the “Palace Ukraine” Mobile Application in connection with legal requests that we receive from you or any other competent person and/or authority, and we may use this information to exercise, protect our legitimate interests.
   We may use the data in the event of disputes and other issues related to the Services (including communications) to resolve such issues, monitor the behavior of Users in the “Palace Ukraine” Mobile Application and respond to any complaints or requests.
   We use Users’ contact details and payment information to establish, maintain and maintain relationships with Users necessary to provide the “Palace Ukraine” Mobile Application Services. If the User fails to provide the necessary personal data, we may be unable to fulfill our obligations under the Terms of Use. We contact Users only to obtain information related to the functioning of the “Palace Ukraine” Mobile Application.
   Certain information, such as your payment information and your behavior on the “Palace Ukraine” Mobile Application, is subject to monitoring by us in order to prevent fraudulent activity on the “Palace Ukraine” Mobile Application and to help you manage your Account.
   Certain sections of the “Palace Ukraine” Mobile Application require access to components of your device, in particular to the functionality for displaying push notifications. When accessing these Services, a pop-up window appears asking you to allow the “Palace Ukraine” Mobile Application to access the relevant components of your device. You can configure the permissions available in the device settings. If you prohibit such access, this functionality of the “Palace Ukraine” Mobile Application may not work as intended.
2. We may change the purposes of data processing specified above, in which case we will notify you of changes in the use and processing of your personal data within the framework of the new purposes. Notification of such changes will be sent to your email address. We will ask you to provide your consent if the additional purpose of processing is not compatible with those listed above.
3. If you do not wish to provide the Personal Data requested by us for the purposes specified above, you may not be able to access the Services of the “Palace Ukraine” Mobile Application.
4. We do not collect or process your personal data unless you give your explicit consent to this.

WITH WHOM WE MAY SHARE YOUR PERSONAL DATA?

1. To provide high-quality services, “DP Palace “Ukraine”” employs employees, enters into agreements with independent contractors, and also cooperates with other service providers, companies and organizations that adhere to strict data processing agreements (DPAs). For this reason, some of your personal data may be transferred to these persons.
2. We do not sell, transfer or disclose Personal Data of Users, except as provided for in this Privacy Policy. We never collect and process your personal data without explanation and warning, as well as without your consent, unless we have informed you about it and you have given us your consent to such use.
3. In cases where there is no decision of the European Commission confirming an adequate level of data protection in accordance with Art. 45(1) GDPR, “DP Palace “Ukraine”” uses the standard data protection provisions adopted by the European Commission in accordance with Art. 46(2)(c) GDPR to ensure appropriate safeguards for your rights and Personal Data in the event of third party access or other data transfer.
4. The “Palace Ukraine” Mobile Application may contain links to third-party websites, plug-ins and applications. Clicking on these links or enabling these connections may allow third parties to collect or send data about you. When you leave the “Palace Ukraine” Mobile Application, we recommend that you read the privacy policy of each website/application you visit.
5. You agree that any information provided through the “Palace Ukraine” Mobile Application may be accessible to the “Palace Ukraine” SE and certain employees of the “Palace Ukraine” SE: employees of the ticket desk department (regarding purchased Electronic Tickets, accounting and finance department.)

WHERE IS PERSONAL DATA STORED AND HOW LONG IS IT PROCESSED?

1. In accordance with Article 5 (1)(b)(c)(e) of the GDPR, We adhere to the principles of “purpose limitation”, “data minimization”, “storage limitation” and therefore We collect, store and otherwise process only such information as is necessary for the purposes of our legitimate interests and for compliance with a legal obligation for the period necessary to satisfy our legitimate interests.
2. To determine the appropriate retention period for personal data, we take into account the volume, nature and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process the personal data and whether we can achieve those purposes through other means. and applicable legal requirements.
3. If we no longer need to process your data for the purposes set out in this Privacy Policy, we will delete your personal data from our systems. However, we may retain your Personal Data for longer if we are unable to delete it for legal or technical reasons, in which case we will ensure that your privacy is protected and your Personal Data is used only for these purposes.
4. The period for which we retain your personal information necessary to comply with requirements and legal regulations varies and depends on the nature of the legal obligations and claims in each case.
5. You have the right to delete your Account upon such request, it will be permanently deleted from our active systems, servers and backups within 30 (thirty) days. When deleting your Account, all your personal data will also be deleted from the “Palace Ukraine” Mobile Application, within 180 (one hundred eighty) days.

OUR SECURITY MEASURES

1. In accordance with Article 5(1)(d)(e)(f) of the GDPR, We adhere to the principles of “accuracy”, “storage limitation”, and “integrity and confidentiality”.
2. All personal data is stored by our third-party processors on secure servers in accordance with modern information security requirements. We use recommended industry practices to ensure the security of access to such data.
3. We use an appropriate level of technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data in the “Palace Ukraine” Mobile Application.
4. In the event of a data breach (e.g., a leak), we undertake to conduct an investigation, promptly notify the competent data protection authority, assess the damage and communicate the results of the investigation to all Users whose Personal Data have been breached.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

1. In accordance with Article 5(1)(a)(d) of the GDPR, “DP Palace “Ukraine”” undertakes to adhere to the principles of “lawfulness, fairness and transparency”, as well as “accuracy”.
2. In accordance with the provisions of the Law of Ukraine “On Personal Data Protection”, GDPR and CCPA, We undertake to respect your rights. Among them, you have the right to:
   access to Personal Data under Art. 15 GDPR – this allows you to access or obtain a copy of your personal data that we store and check whether we are lawfully processing them;
   rectification of Personal Data under Art. 16 GDPR – if you believe that any information we hold about you is inaccurate or incomplete, you have the right to request that we correct inaccurate personal information about you;
   erasure of personal data under Art. 17 GDPR; CCPA – you may request that we delete your personal data if you believe that:
   we no longer need to process your personal data for the purposes for which they were provided;
   we have requested your consent to process your personal data and you wish to withdraw your Consent.
   restriction of Processing of Personal Data in accordance with Art. 18 GDPR – you have the right to request restriction of processing of your personal data. This allows you to ask us to restrict the processing of your personal data if:
   the data is incorrect;
   The account has been used unlawfully, but you do not want us to delete it;
   The account is no longer relevant, but you want us to keep it for use in possible legal claims.
   Please note that if you ask us to restrict the Processing of Personal Data, “DP Palace “Ukraine”” will have to suspend the provision of the “Palace Ukraine” Mobile Application Services.
   Personal data portability in accordance with Art. 20 GDPR; CCPA – you have the right to receive the Personal Data you have provided to us in text format. You can also ask us to provide it to a third party, if technically feasible. We are not responsible for such third party’s use of your Account information, which will be governed by their agreement with you and any privacy statement they have provided to you;
   object to the Processing of Personal Data in accordance with Art. 21 GDPR;
   object to automated processing (where applicable) of Personal Data in accordance with Art. 22 GDPR;
   withdraw your Consent to the Processing of Personal Data, where applicable pursuant to Art. 7(3) GDPR – you may withdraw your consent to the processing and use of your personal data at any time. Please note that if you withdraw your Consent, you will no longer be able to use the Services of “DP Palats “Ukraine””;
   lodge a complaint with your national supervisory authority in accordance with Art. 13(2)(d), 14(2)(e), 15(1)(f) GDPR, if you believe that your privacy rights have been violated;
   To receive information about the Personal Data under CCPA that we have collected about you in the past 12 months. You may make such a request no more than 2 times in a 12-month period.
3. If you ask us to correct, erase your personal data or to restrict, stop processing or withdraw your consent to the processing of your personal data, we will inform you as soon as your request has been satisfied, in accordance with Art. 13(2)(c), 14(2)(d) and 19 GDPR.
4. If your request is not resolved or is not resolved satisfactorily, you have the right to complain to your local data protection authority in accordance with Art. 13(2)(d), 14(2)(e), 15(1)(f) GDPR.
5. You have the right to access your Account and change information about yourself to the extent permitted by the system. You can also submit a request to change your information by email: palaceukraina@ukr.net
6. If you wish to submit a request to delete your personal data in accordance with the requirements of the GDPR, please send a message to palaceukraina@ukr.netWhen submitting a request by email, you will be asked to provide information for identification and verification.

COOKIES AND SIMILAR TECHNOLOGIES

1. We do not use aggregated, non-identifying electronic data collected as a result of using our “Palace Ukraine” Mobile Application.

CHILDREN’S PRIVACY (Article 8 GDPR)

1. We take the privacy of children very seriously. The Palace Ukraine Mobile Application Services are not intended for use by children under the age of 18 without the express permission of a parent or guardian.
2. If you are under the age of 18, you must obtain the consent of a parent/guardian before submitting any personal data to “DP Palace “Ukraine”. We may process Personal Data of children under the age of 18 provided that the Personal Data is provided by parents/legal guardians with the explicit consent of the parent/legal guardian for the express purpose of using the Services.
3. “DP Palace “Ukraine”” operates in accordance with the Children’s Online Privacy Protection Act (COPPA). This law requires us to inform parents and legal guardians about how we collect, use and disclose personal information of children under the age of 13.
4. We never knowingly collect, process or solicit any information from individuals under the age of 18.

OTHER OBLIGATIONS RELATED TO CONFIDENTIALITY

1. We will only collect and use your Data where we have a legitimate reason to do so.
2. We will always be transparent and tell you how we use your information. We will respect and uphold your rights by ensuring that requests relating to privacy are dealt with promptly and transparently.
3. We will not request more data than is necessary to provide our services.
4. If any of your rights in relation to your personal data are infringed, we will immediately notify you and the relevant data protection authorities of such cases, if there is a high risk of your rights as a Data Subject being infringed. We will also do our utmost to minimise such risks.
5. We will also ensure that all our data processors have appropriate security measures in place, as well as contractual clauses requiring them to comply with our obligations.

LEGAL MATTERS

1. “DP Palace “Ukraine”” considers your use of the “Palace Ukraine” Mobile Application Services to be your personal and conscious choice. However, we may disclose your personal data stored in our databases in order to:
   comply with the law or a court order served on us;
   enforce and investigate possible violations of this Privacy Policy;
   investigate potential fraudulent activities;
   protect the rights, property or safety of “DP Palace “Ukraine””, its employees, Users or the public.

WARRANTIES AND LIABILITY

1. We do not guarantee the error-free operation of the “Palace Ukraine” Mobile Application in accordance with this Privacy Policy. “DP Palace “Ukraine”” will make reasonable efforts to comply with the Privacy Policy and will take immediate corrective action in case of violation or non-compliance with our Privacy Policy.
2. We are not liable for any incidental, indirect damages or penalties related to this Privacy Policy.
3. We do not control third-party websites and are not responsible for their privacy statements. We expressly disclaim responsibility for their content, privacy policies and terms of use and make no representations as to their accuracy, content or thoroughness.
4. In cases of changes or updates to the Privacy Policy, “DP Palace “Ukraine”” will always notify you on the “Palace Ukraine” Mobile Application page.