Policy

on the Processing of Personal Data

(Publication date: Feb. 12, 2026. Version: 1.3)

1. GENERAL PROVISIONS
1.1. Individual Entrepreneur Kovtun Denis Yevgenyevich (UNP 291456490) (hereinafter — the Operator) pays due attention to the protection of personal data and to compliance with the rights of personal data subjects when processing such data. The Operator is the personal data operator within the meaning of the Law of the Republic of Belarus “On Personal Data Protection” (hereinafter — the Law).
1.2. This Policy explains what personal data the Operator receives through the website and feedback forms, for what purposes and on what legal grounds such data are processed, and what rights personal data subjects have and how to exercise those rights.
1.3. This Policy applies to the processing of personal data received by the Operator through the website (hereinafter — the Website): https://catnbag.com
1.4. The Website is intended for B2B interaction: showcasing a portfolio and obtaining consent to prepare and send a commercial proposal. The information on the Website is not a public offer; the final terms are set out in a contract.
1.5. Personal data means any information relating to an identified individual or an individual who can be identified. Processing of personal data means any action or set of actions performed with personal data (collection, storage, use, deletion, etc.).
1.6. Important: although the form on the Website is aimed at company details, some information may constitute personal data (for example, a business email in the format name.surname@company.com or data that the user provides in free-text fields). Please do not provide personal data of third parties or excessive personal data (phone numbers, home addresses, passport data, etc.) in free-text fields unless it is required.
1.7. The Website is intended for B2B interaction and is not designed for use by minors. If an enquiry is submitted by a minor, the Operator may request proof of authority of the minor’s legal representative.
1.8. When visiting the Website, the hosting platform may automatically process technical information necessary for operation and security (for example, IP address, browser/device information, technical cookies). The Operator does not use such data for web analytics, advertising targeting, or mailings.

2. OPERATOR’S CONTACT DETAILS
Individual Entrepreneur Kovtun Denis Yevgenyevich
UNP: 291456490
Mailing address: Belarus, Brest Region, Brest, Malaya St., 5, apt. 28
Person responsible for personal data processing: Individual Entrepreneur Kovtun Denis Yevgenyevich
Email for personal data enquiries: owner@catnbag.com
Contact phone: +375 (29) 202 13 10
Country/Time zone: Belarus (UTC+03:00)

3. PURPOSES, SCOPE, LEGAL GROUNDS AND RETENTION PERIODS FOR PERSONAL DATA PROCESSING
3.1. The Operator processes personal data only to the extent necessary for the stated purposes and does not allow excessive processing.
3.2. Processing purpose No. 1: handling the request, contacting the applicant, and preparing/sending a commercial proposal.
Categories of data subjects: representatives of legal entities who submitted a request via the form/contacted the Operator.
List of data (form fields): Country; Business email; Company website; Company social media; Why are you interested?; What result would you like?; Anything you'd like to ask? (questions/message).
Legal ground: the personal data subject’s consent (by ticking the checkbox on the Website). Checkbox text (in English): “I consent to the processing of my personal data, including cross-border transfer to service providers (Tilda and Google), in accordance with the Privacy Policy.”.
Retention period: 1 year from the date of the last interaction regarding the enquiry (sending the commercial proposal and/or completion of communication), or until consent is withdrawn, unless there are other legal grounds for further processing.
3.3. Processing purpose No. 2: correspondence and record-keeping of enquiries (to ensure communication quality, confirm the fact of the enquiry, and prevent duplicate processing of the same request).
Categories of data subjects: individuals who sent a request/message to the Operator.
List of data: business email and the content of correspondence/messages (including free-text responses in open fields).
Legal ground: the personal data subject’s consent (by ticking the checkbox on the Website). Checkbox text (in English): “I consent to the processing of my personal data, including cross-border transfer to service providers (Tilda and Google), in accordance with the Privacy Policy.”.
Retention period: 1 year from the date of the last message/contact, unless a longer period is required by the legislation of the Republic of Belarus and/or for the protection of the Operator’s rights and legitimate interests.
3.4. Processing purpose No. 3: protection of the Operator’s rights and legitimate interests (for example, in the event of a claim/dispute).
Categories of data subjects: individuals who interacted with the Operator.
List of data: correspondence and related information necessary for handling a claim.
Legal ground: processing is carried out where there are grounds provided for by the Law and other legislative acts (including for the protection of the Operator’s rights and legitimate interests and for handling claims/disputes).
Retention period: for the period of handling the claim/dispute and thereafter within the limitation periods and/or other periods necessary to protect the Operator’s rights, unless a longer period is required by the legislation of the Republic of Belarus.
3.5. Processing purpose No. 4: conclusion and performance of a contract (if a contract is concluded as a result of an enquiry via the Website and/or during subsequent communication).
Categories of data subjects: representatives and contact persons of clients (legal entities/individual entrepreneurs), as well as other individuals whose data are included in contractual documents.
List of data: business email, first/last name (if provided), position/title, phone number (if provided), details and signatures in contractual documents, and correspondence related to contract performance.
Legal ground: processing necessary to take steps at the request of the data subject, to conclude and perform a contract, and to fulfil obligations established by the legislation of the Republic of Belarus.
Retention period: for the periods established by the legislation of the Republic of Belarus; as a rule, 3 years after a tax audit, and if no audit is conducted — 10 years (for contracts, acts, invoices and other primary documentation).

4. METHODS OF PROCESSING, AUTHORIZED PERSONS, DISCLOSURE TO THIRD PARTIES
4.1. Personal data may be processed using automation tools and/or without using such tools.
4.2. Personal data submitted through the Website are processed by the Operator and may also be processed by the provider of the platform on which the Website is created and hosted (hosting/website platform — Tilda) to ensure operation of the website and forms, delivery of the submitted data to the Operator, as well as storage of submissions in the “Leads” section of the project’s admin panel.
4.3. Enquiries and messages submitted through the Website forms are delivered to the Operator’s email (Gmail email service) and may be stored in the mailbox and correspondence history. Only the Operator has access to submissions and correspondence.
4.4. The Operator may disclose personal data to third parties only where there are grounds provided for by law.
4.5. Authorized persons (online services engaged by the Operator):
— Tilda (platform/hosting/forms; receiving data from forms and storing submissions in the “Leads” section);
— Gmail/Google (receiving enquiries by email, storing and processing correspondence).
4.6. The Operator may engage contractors to perform work on the project. As a rule, personal data are not transferred to contractors; if a need arises (for example, to agree on details), the Operator transfers to the contractor the minimum necessary amount of personal data on a legal ground and subject to confidentiality.

5. CROSS-BORDER TRANSFER OF PERSONAL DATA
5.1. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state.
5.2. In operating the Website and processing enquiries, the Operator uses the Tilda platform and the Gmail email service. The use of such services may involve cross-border transfer of personal data.
5.3. The Tilda platform may process and store data submitted through the Website forms, including storing submissions in the “Leads” section. According to the platform, its server infrastructure is distributed and its main points of presence include Germany and the USA; hosting/processing in other countries is also possible.
5.4. Enquiries and correspondence are processed using the Gmail (Google) email service, which may involve the processing of personal data in the USA and (depending on the service infrastructure) other countries.
5.5. Legal ground for cross-border transfer: the personal data subject’s consent provided by ticking the checkbox on the Website. The personal data subject is informed that when transferring to countries that may not ensure an adequate level of protection, effective mechanisms for protecting the rights of the personal data subject may be absent in such countries.

6. RIGHTS OF PERSONAL DATA SUBJECTS AND PROCEDURE FOR EXERCISING THEM
6.1. A personal data subject has the rights provided for by the Law, including: to withdraw consent; to obtain information about personal data processing; to obtain information about disclosure of personal data to third parties (in the cases and procedure provided for by the Law); to request rectification, blocking or deletion of personal data; to appeal actions (inaction) and decisions of the Operator that violate the rights of the personal data subject.
6.2. To exercise these rights, the personal data subject may submit an application to the Operator in writing (to the mailing address) or as an electronic document to the email address: owner@catnbag.com. The application must contain the information required by the Law (in particular: full name, residential address (place of stay), date of birth, a description of the request, a signature (for an electronic document — an electronic digital signature, where applicable).
6.3. Consent may be withdrawn by sending an email to the Operator: owner@catnbag.com or by submitting a written application to the mailing address. Recommended email subject: “Withdrawal of consent to personal data processing”. The Operator terminates processing and deletes (or blocks where deletion is technically impossible) within the time limits provided by the Law, unless there are other legal grounds to continue processing.
6.4. The Operator considers applications from personal data subjects and provides a response/takes actions within the time limits established by the Law (as a rule, no later than 15 days from the date of receipt of the application).
6.5. A personal data subject may appeal actions (inaction) and decisions of the Operator to the authorized body for the protection of the rights of personal data subjects (the National Center for Personal Data Protection of the Republic of Belarus), and also to a court in the manner established by law.

7. MEASURES TO ENSURE THE PROTECTION OF PERSONAL DATA
7.1. The Operator takes legal, organizational and technical measures to protect personal data from unauthorized or accidental access, alteration, blocking, copying, distribution, disclosure, deletion, and other unlawful actions.

8. FINAL PROVISIONS
8.1. The Operator may amend this Policy. The current version of the Policy is published on the Website and is publicly available.
8.2. Matters not governed by this Policy are governed by the legislation of the Republic of Belarus.