Policy

on the Processing of Personal Data

Version: 1.4
Publication and effective date: August 13, 2026
Operator: Individual Entrepreneur Kovtun Denis Yevgenyevich, UNP 291456490

1. General provisions
1.1. This Policy sets out how Individual Entrepreneur Kovtun Denis Yevgenyevich (the “IE” or the “Operator”), doing business under the CatnBag designation, processes and protects personal data. CatnBag is not a separate person, contracting party, operator or rights holder.
1.2. The Policy applies to data received through catnbag.com, website forms, email, contractual documents and project communications. Where a customer instructs the IE to process an employee’s data solely to create a deliverable, the customer remains the operator and the IE acts as its authorized person within the contract and the separate legal basis.
1.3. The Website is intended for B2B interaction with legal entities and is not designed for minors.
1.4. The IE processes only data necessary for specific lawful purposes, does not retain it longer than necessary and does not use it for incompatible purposes.
1.5. The Website uses only essential cookies. Website providers may process technical data required for operation and security, such as IP address and browser/device information.

2. Operator contact details
Operator: Individual Entrepreneur Kovtun Denis Yevgenyevich
UNP: 291456490
Mailing address: 224013, Republic of Belarus, Brest, Malaya St. 5, apt. 28
Personal data email: owner@catnbag.com
Phone: +375 (29) 202-13-10
Responsible person: Individual Entrepreneur Kovtun Denis Yevgenyevich

3. Website forms: exact names, data, grounds and retention
3.1. The English “Request Form” contains the fields: “Company country”; “Business email”; “Company website”; “Company social media”; “Why are you interested?”; “What result would you like?”; “Anything you'd like to ask?”. The “Ask Us” form contains: “Business email” and “Anything you'd like to ask?”.
3.2. Checkbox helper text: “* by checking this box, you confirm you’ve read the Privacy Policy”. Checkbox text: “I consent to the processing of my personal data, including cross-border transfer to service providers (Tilda and Google), in accordance with the Privacy Policy.”
3.3. Immediately before each checkbox, separately from this Policy, the Website displays a visible or expandable block accessible before the box is ticked, titled “Information before consent.”, containing the following text:
“Information before consent
Operator: Individual Entrepreneur Kovtun Denis Yevgenyevich, UNP 291456490, 224013, Republic of Belarus, Brest, Malaya St. 5, apt. 28; owner@catnbag.com.
Purposes: receiving and handling an enquiry, contacting the applicant, preparing and sending a commercial proposal, keeping correspondence and proving that an enquiry was submitted.
Data: only the completed fields of the relevant form: “Company country”, “Business email”, “Company website”, “Company social media”, “Why are you interested?”, “What result would you like?”, “Anything you'd like to ask?”.
Actions, methods and authorized persons: automated collection, recording, organization, storage, retrieval, use, necessary disclosure, blocking and deletion; Tilda Publishing Bel LLC (Belarus, Tilda Leads), its providers Tilda Publishing JSC, Selectel JSC and Yandex.Cloud LLC (Russian Federation), Support Chain LLC (Belarus: Tilda infrastructure and CatnBag hosting and email), and Google LLC (USA and other countries, Gmail notifications).
Retention: no longer than one year after the last interaction relating to the enquiry, or until earlier withdrawal if no other legal ground applies.
Cross-border transfer: Tilda uses Tilda Publishing JSC, Selectel JSC and Yandex.Cloud LLC in the Russian Federation, which provides an adequate level of protection, for server processing and technical operations; Google may process data in the USA and other countries where that level may be unavailable. Risks include limited data-subject rights and remedies, potentially broader government access, and the absence of equivalent security and liability requirements.
Rights and procedure: consent may be withdrawn; information about processing may be requested; rectification, termination, deletion or blocking may be requested where legally available; and a complaint may be made to the National Personal Data Protection Centre of the Republic of Belarus or a court. Requests are sent to owner@catnbag.com. Withdrawal operates prospectively.
Consequences: consent enables submission of the form; if consent is refused, the form is not submitted, but another contact channel may be used.”.
3.4. Data subjects are representatives of legal entities and other individuals who submit a message. The legal ground is consent given by ticking the checkbox. The retention period and consequences of refusal are stated in clause 3.3; data may be deleted earlier when it is no longer needed.

4. Other purposes and categories of data
4.1. Contract and payments: name, position, place of work, business contact details, signature, correspondence, document details and payment information of customer representatives. Purposes are contract conclusion/performance, accounting and tax records, claims and defence of rights. Grounds include consent, data stated in a document addressed to the IE and signed by the data subject, and statutory obligations. Documents are retained for mandatory periods.
4.2. Employee project reference: name, position or role, photograph or exact URL, visible features, the created character and related project materials. Where the customer is the operator, the IE processes this data only on its instructions to create, review, correct and deliver the result. Consent of the depicted person does not replace permission from the photographer or other owner.
4.3. If a source photograph is not downloaded to the IE’s computer but its URL, copy or image is submitted to ChatGPT, personal data is still transferred to OpenAI. A recognizable sprite or character remains personal data after stylization.
4.4. Portfolio: the final result, recognizable character, selected name/position and other permitted features are published by the IE as an independent operator only under a separate basis specifically covering the portfolio. Refusal does not prevent participation in the project. The source photograph is not published separately.
4.5. Working project copies may be deleted earlier and are deleted during the annual clean-up no later than one year after project completion or termination unless law or a lawful instruction requires earlier deletion. This is a maximum period, not a duty to retain data for a full year. The final result, lawful portfolio and mandatory documents have their own separate grounds.
4.6. Claims and defence of rights: necessary correspondence and evidence may be retained within applicable claim/limitation or mandatory periods. Such copies have restricted access and are not reused for AI, development or portfolio purposes.

5. Processing actions, sources and service providers
5.1. The IE may receive, collect, record, organize, store, rectify, retrieve, use, copy, artistically adapt and stylize, provide necessary access to an authorized service, disseminate under a separate legal basis, block and delete data, with or without automated means.
5.2. Sources are the data subject; their employer/customer; contractual documents and correspondence; and an exact official public resource identified by the customer. Public availability does not by itself permit every subsequent use.
Tilda Publishing Bel LLC (Belarus, UNP 291748628): Website pages and forms; submitted data enters Tilda Leads. Project storage is provided by Support Chain LLC on servers in Belarus. For server processing of personal data and related technical operations, Tilda also uses Tilda Publishing JSC, Selectel JSC and Yandex.Cloud LLC in the Russian Federation, which provides an adequate level of protection.
HostFly / Support Chain LLC (Belarus): Hosting of the exported website and portfolio, and the owner@catnbag.com mailbox. Website form notifications are delivered to this address.
Gmail / Google (USA and other countries): An additional mailbox receives form notifications; customer correspondence and submitted materials may be retained in Gmail.
ChatGPT Plus / OpenAI OpCo, LLC (USA and other countries): Only under a separate project basis: a photograph or URL and visible features are submitted for stylization and character creation. Model training is disabled in the account used for processing; data is retained until the relevant project/chat is deleted.
5.3. Actual website form flow: form → Tilda Leads → notification to owner@catnbag.com (HostFly mail) and an additional Gmail mailbox. Only the IE has access. OpenAI does not automatically receive website form data.
5.4. Before engaging employees or contractors with access to personal data, their role, scope of access, confidentiality obligations and data protection measures shall be documented separately.

6. Cross-border transfer
6.1. Use of Tilda for website forms involves transfer to Tilda Publishing JSC, Selectel JSC and Yandex.Cloud LLC in the Russian Federation, which provides an adequate level of protection, while use of Google may involve transfer to the USA and other countries where that level may be unavailable. Before the checkbox is ticked, the information in clause 3.3 is provided separately from this Policy, and consent is expressed through the checkbox in clause 3.2.
6.2. Submission of a photograph or its URL to OpenAI is not covered by the website checkbox and requires a separate project basis. Before consent, the person is informed that the USA and some other processing countries may not provide an adequate level of protection or effective rights enforcement mechanisms.

7. Data subject rights and requests
7.1. A data subject may withdraw consent, obtain information about processing and disclosure to third parties, request rectification, termination, deletion or blocking where the legal conditions are met, and complain to the National Personal Data Protection Centre of the Republic of Belarus and to a court.
7.2. Consent may be withdrawn by the same electronic means used to give it, including by email to owner@catnbag.com. Other applications under Articles 10–13 of Law No. 99-Z must be submitted in writing or as an electronic document and contain the information required by Article 14.
7.3. Processing information is supplied within five working days. Withdrawal, termination, deletion or blocking is completed within fifteen days unless another lawful ground applies. Withdrawal operates prospectively and does not invalidate prior lawful processing.
7.4. Where the IE acts as the customer’s authorized person, the request is promptly forwarded to the relevant operator and the IE assists with its fulfilment.

8. Data protection and incidents
8.1. The IE applies legal, organizational and technical measures appropriate to the data and risk, including restricted access, password protection, an up-to-date operating system and security software, separated project folders and deletion of unnecessary working copies.
8.2. For data processed on a customer’s instructions, the IE notifies the customer of an incident without undue delay and, where possible, within 24 hours after discovery. Where the IE is the operator, it assesses whether the National Centre must be notified and, if required, notifies it without delay and no later than three working days after becoming aware of the protection-system breach.

9. Final provisions

9.1. The current Policy is published at catnbag.com before processing begins. A change in services, purposes or data flows requires a prior Policy update and, where necessary, new consent.