Personal Data Processing Policy
1.General provisions
This policy explains what personal data the Bonolama service processes, why, for how long, to whom it is disclosed, and what rights you have. It has been prepared in accordance with Law of the Republic of Belarus No. 99-Z of 7 May 2021 “On Personal Data Protection” (hereinafter — Law No. 99-Z).
The policy applies to the bonolama.com website, the Bonolama Business dashboard and the Bonolama apps for Android and iOS. Reading the policy is your right; we do not require you to “accept” it as a condition of using the service.
2.Who processes whose data
Users and partner representatives — we are the operator. These are people who sign in to Bonolama with a phone number: they receive promo codes, take part in loyalty programs, contact support, as well as owners and employees of companies in Bonolama Business.
Partners are independent operators. When you show a promo code or your personal QR code at the checkout, the Partner’s employee receives your name, your phone number with hidden digits (+375 29 5••-••-03), the promo code, your purchases, points and tier — only with that Partner. The Partner must process this data solely to serve you (section 11 of the Terms of Service).
3.Purposes, data, legal bases and retention periods
Each purpose is described separately below. We do not process more data than the purpose requires and do not use it for anything else.
| Purpose | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Registration and sign-in Users and partner representatives | Phone number, time and result of number verification, IP address | Contract (Terms of Service), paragraph 15 of Article 6 of Law No. 99-Z | While the account exists; sign-in log — 6 months |
| Promo codes, orders and payment Users | Promo codes received, orders, redemption status, payment amount and method, card type and last 4 digits, balance transactions | Contract; accounting legislation | While the account exists; payment documents — for the periods set by archival legislation (after account deletion — without name and phone number) |
| Partner loyalty programs Users | Personal QR code, purchases from partners (amount, date, partner), points, tier, free items | Contract | While you are a program member; deleted upon account deletion |
| Profile and deal recommendations Users | Name, gender, date of birth, city, interests from the questionnaire (categories, benefit type, preferred time), favorites | Consent (paragraph 1 of clause 1 of Article 5 of Law No. 99-Z) — the questionnaire can be skipped, and the data can be corrected or deleted in the “Account” section | While the account exists or until consent is withdrawn |
| View statistics and personalized feed Users and visitors who are not signed in | Which deals and banners were shown and opened, how long they were viewed, on which screen and device; an anonymous browser identifier or account | Contract (the personalized feed is part of the service); for visitors who are not signed in — the operator’s legitimate interest in operating the service | Up to 2 years, then only aggregated statistics not linked to an individual |
| Notifications Users | Device token, notification settings | Consent — permission for notifications in the app, which can be withdrawn in the phone settings | Until consent is withdrawn or the account is deleted |
| Geolocation Users | Approximate coordinates — only to determine your city or show nearby deals | Consent — browser or app permission | Not stored: used at the time of the request |
| Support Users and partner representatives | Text of requests, correspondence, related order | Contract | 3 years from closing the request; deleted upon account deletion |
| Partners: companies and promotion Partner representatives | Name, taxpayer ID (UNP) and address of the organization, company details, phone numbers of employees with scanner access, campaigns, advertising balance transactions | Contract; accounting legislation | While the company exists; documents — for the periods required by law |
| Security and abuse prevention All visitors | IP address, browser and device data, log of requests and actions | Contract; the operator’s information protection obligations | Request log — 30 days; log of operations involving money and data — 1 year |
4.Deal recommendations and advertising
- The order of deals in the feed is selected automatically — based on interests, age group, city and views. This has no legal consequences for you: only the display order changes
- Partners promoting deals and banners receive only aggregated statistics — impressions, clicks, visits. Your personal data is not disclosed or sold to advertisers
- If you do not want a personalized feed, write to info@bonolama.com and we will turn it off: the feed will become the same for everyone in your city
6.Cross-border transfer
Data is stored on servers in the Republic of Belarus. Only the device token and push notification text are transferred abroad — via Google and Apple, without which notifications on a phone are impossible, and only if you have allowed notifications. The list of countries with an adequate level of protection is set by Order of the National Personal Data Protection Center No. 14 of 15.11.2021; transfers to other countries are based on your consent (Article 9 of Law No. 99-Z), and there may be risks due to the lack of an adequate level of protection there.
7.How we protect data
- Connections to the website, apps and dashboard use HTTPS only
- Only employees who need access for their work can access data, and such access is logged
- Partners see phone numbers only with hidden digits
- There are no passwords: sign-in is by phone number verification via a call
- A person responsible for internal control over personal data processing has been appointed
- We report breaches of data protection systems to the National Personal Data Protection Center immediately, and no later than 3 business days after becoming aware of the breach
8.Your rights and how to exercise them
Under Law No. 99-Z, you have the right to:
- Withdraw consent if processing was based on it — we will stop processing and delete the data within 15 days (Article 10)
- Obtain information about what data of yours we process, why and on what basis — we will reply within 5 business days, free of charge (Article 11)
- Rectify incomplete, outdated or inaccurate data — within 15 days (Article 11). You can change your name, gender, date of birth and interests yourself in the “Account” section
- Find out to whom your data has been disclosed — once per calendar year free of charge, with a reply within 15 days (Article 12)
- Demand that processing stop and the data be deleted if there is no legal basis for processing — within 15 days (Article 13). The fastest way is to delete your account yourself: “Account” → “Settings” (learn more)
- Appeal our actions to the National Personal Data Protection Center (cpd.by) (Article 15)
How to submit a request
Send a written request to the operator’s address (220004, Республика Беларусь, г. Минск, пр. Победителей, д. 7А, офис 28) or as an electronic document to info@bonolama.com. In the request, state your surname, first name, patronymic (if any), residential address, date of birth, the account phone number, the substance of your request and your personal signature (or electronic digital signature), as required by Article 14 of Law No. 99-Z. We will reply in the same way.
10.Changes to the policy
If we materially change the policy — purposes, retention periods, the scope of data or the procedure for exercising rights — we will notify you in advance in the app. The current version is always available on this page.