Privacy policy

Regarding the Processing of Personal Data of Visitors and Users of the Official Website of the “Kyiv Region Regional Development Agency”

APPROVED

By Order of the Director of the “Kyiv Region Regional Development Agency”

dated September “16,” 2026, No. 9

1. GENERAL PROVISIONS

1.1. This Privacy and Personal Data Protection Policy (hereinafter referred to as the “Policy”) sets forth the general foundations, principles, and procedures for the collection, processing, storage, use, and protection of personal data processed by the “Kyiv Region Regional Development Agency” (hereinafter referred to as the “Agency”) in connection with the conduct of its activities in accordance with its authority.

1.2. The Agency is a legal entity under private law, a nonprofit, non-budgetary institution operating on the basis of its Charter with the aim of promoting the socioeconomic and regional development of the Kyiv Region, implementing regional programs and projects, attracting investments and international technical assistance, and developing partnerships among local self-government bodies, businesses, civil society, and international partners.

1.3. This Policy has been developed in accordance with the Constitution of Ukraine, the Law of Ukraine “On the Protection of Personal Data” (hereinafter referred to as the “Law”), other Ukrainian laws and regulations in the field of personal data protection and information security, as well as, to the extent that it does not conflict with Ukrainian law, taking into account the principles of the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR)—in cases where this is provided for by the terms of grant agreements, contracts with international partners, or donor requirements.

1.4. This Policy applies to the personal data of the following categories of individuals:

- members of the Agency’s Supervisory Board;

- members of the Agency’s Expert Council;

- full-time employees of the Agency (including job applicants);

- individuals—experts, consultants, trainers, and other persons engaged by the Agency to perform work (provide services) under civil law contracts (hereinafter “engaged experts”);

- representatives of state bodies, local government bodies, donors, grant providers, volunteers, partner organizations, and international organizations;

- applicants, participants, and beneficiaries of programs, projects, competitions, grant initiatives, educational events, and other activities organized or conducted by the Agency;

- other individuals whose personal data is processed by the Agency in connection with the performance of its statutory activities, including visitors to the official website and subscribers to the Agency’s newsletters.

1.5. The purpose of this Policy is:

- to ensure that the Agency’s activities comply with the requirements of Ukrainian law regarding the protection of personal data;

- to establish principles and rules for handling personal data and confidential information that are clear to employees, engaged experts, members of the Agency’s governing bodies, and other individuals, including the principles of lawfulness, transparency, data minimization, storage limitation, integrity, and confidentiality;

- to ensure respect for the rights of data subjects, as well as the transparency and security of their data processing in all of the Agency’s operations;

- to define the Agency’s procedures for responding to requests from data subjects and for addressing personal data security breaches.

1.6. Detailed organizational and technical measures regarding the protection of personal data, information security, and the management of specific personal data databases are set forth in the Agency’s internal documents (regulations, instructions, standard operating procedures, and orders of the Agency Director), which are approved in accordance with this Policy.

2. KEY TERMS

2.1. In this Policy, the terms listed below have the following meanings:

Personal data - information or a set of information about a natural person who is identified or can be specifically identified.

Personal data database - a named collection of organized personal data in electronic and/or paper form that enables the search for and processing of personal data.

Personal data controller - the Agency that determines the purpose of personal data processing, establishes the scope of such data, and sets the procedures for its processing.

Personal Data Processor - a natural or legal person authorized by the personal data controller or by law to process personal data on behalf of the controller.

Data Subject - a natural person whose personal data is being processed.

Processing of personal data - any action or set of actions performed on personal data, including the collection, recording, accumulation, storage, adaptation, alteration, updating, use, and dissemination (distribution, sale, transfer), anonymization, and destruction of personal data.

Consent of the data subject - a natural person’s voluntary expression of will (provided the person is informed) to grant permission for the processing of their personal data in accordance with the stated purpose of such processing, expressed in writing or in a form that allows for the conclusion that consent has been granted.

Confidential information - information to which access is restricted, including personal data, the Agency’s internal documents, and other information whose disclosure could harm the interests of the Agency, its partners, donors, or data subjects, or violate the lawful rights and interests of third parties.

Anonymization of personal data - the removal of information that allows for the direct or indirect identification of an individual.

A personal data breach - an incident that has resulted in or may result in a breach of the security of personal data, including its accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

2.2. Other terms are used in the meanings set forth in the Law of Ukraine “On the Protection of Personal Data,” other legislative acts of Ukraine, and the Agency’s internal documents.

3. PRINCIPLES OF PERSONAL DATA PROCESSING AND PROTECTION

3.1. In its activities, the Agency is guided by the following principles of personal data processing and protection:

- lawfulness and transparency - personal data is processed exclusively on lawful grounds, openly, and in a manner that is understandable to the data subject;

- purpose limitation - data is collected only for specified, explicit, and legitimate purposes (carrying out statutory activities, human resources and financial administration, interaction with partners and donors, reporting) and is not used for purposes incompatible with those specified;

- Data minimization - the Agency collects only the personal data that is necessary and sufficient to achieve a specific processing purpose;

- Accuracy and timeliness - personal data is kept up to date; the Agency takes measures to correct or update inaccurate information in a timely manner;

- Storage period limitation - personal data is stored only for the period necessary to achieve the purpose of processing, taking into account the requirements of Ukrainian law, the terms of grant/donor agreements, and the Agency’s internal procedures; upon expiration of the storage period, the data is subject to deletion or destruction, unless otherwise provided by law or contractual obligations;

- Integrity and confidentiality - The Agency implements appropriate organizational and technical measures to prevent unauthorized access, loss, alteration, or unlawful processing of personal data;

- Accountability - The Agency is able to demonstrate compliance with these principles and is responsible for their implementation.

4. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

4.1. The Agency processes personal data only if one or more of the following grounds, as provided for by Ukrainian law, are present:

- the consent of the data subject to the processing of their personal data;

- the conclusion and performance of a legal transaction (contract) to which the data subject is a party, or which is concluded for the benefit of the data subject, or for the purpose of taking steps prior to the conclusion of such a transaction at the request of the data subject;

- the need to fulfill the personal data controller’s legal obligations (in particular, in the areas of labor, tax, and accounting relations);

- the need to protect the vital interests of the data subject;

- the need to protect the legitimate interests of the Agency or a third party to whom the personal data is transferred, except where the need to protect the fundamental rights and freedoms of the data subject outweighs such interests;

- authorization to process personal data granted to the Agency in accordance with the law solely for the purpose of exercising its powers.

4.2. The data subject’s consent to the processing of their personal data shall be provided in writing or electronically (in particular, by filling out forms on the Agency’s official website), which allows for the conclusion that consent has been given. Documents (information) confirming the data subject’s consent are retained by the Agency for the entire duration of the processing of the relevant personal data.

4.3. The purpose of processing personal data is determined prior to the collection of such data and is clear and lawful. If the specified purpose of processing personal data is changed to a new purpose that is incompatible with the previous one, the Agency - except in cases provided for by law - shall obtain the consent of the data subject to process their data in accordance with the new purpose.

5. GOVERNING BODIES AND RESPONSIBILITY FOR POLICY IMPLEMENTATION

5.1. This Policy is binding on the Agency’s Director, full-time employees, members of the Supervisory Board, members of the Expert Council, engaged experts, as well as contractors, partners, and other persons who, on a contractual basis, have access to personal data processed by the Agency.

5.2. The Agency’s Supervisory Board:

- approves this Policy and any amendments thereto;

- exercises general oversight over the Agency’s compliance with legal requirements regarding the protection of personal data;

- reviews reports from the Agency’s Director on the status of personal data protection and information security, including reports on significant incidents related to personal data security breaches.

5.3. The Agency Director:

- ensures the implementation and practical application of this Policy in the Agency’s activities;

- approves internal documents (regulations, instructions, procedures) detailing the procedures for processing and protecting personal data;

- organizes training (briefings) for employees and engaged experts on personal data protection issues;

- may appoint a designated person (coordinator) responsible for personal data protection, whose duties include providing methodological guidance, monitoring compliance with this Policy, and interacting with data subjects and authorized government agencies;

- bears personal responsibility for ensuring compliance with personal data protection laws within the Agency.

5.4. In performing its advisory and consultative functions, the Agency’s Expert Council shall comply with the requirements of this Policy regarding personal data that comes to its attention in connection with its members’ participation in the Agency’s work, in particular regarding project materials, competition applications, and other documents that may contain the personal data of third parties.

5.5. Full-time employees and contracted experts who have access to personal data in connection with the performance of their employment, official, or contractual duties are required to comply with the requirements of this Policy, to use personal data solely to the extent necessary to perform their assigned tasks, and must provide a written commitment not to disclose personal data entrusted to them or that has come to their knowledge in connection with the performance of their duties.

6. CATEGORIES OF PERSONAL DATA AND PURPOSES OF THEIR PROCESSING

6.1. Members of the Agency’s Supervisory Board and Expert Council. The Agency processes last name, first name, patronymic, contact information, details regarding position and primary place of employment, a brief professional history (resume/CV), and, in the event of payment of remuneration or reimbursement of expenses, bank account information and the taxpayer identification number. Purpose of processing: forming and organizing the work of the Agency’s governing bodies, maintaining meeting minutes, and paying compensation and reimbursing expenses related to participation in the work of the relevant body.

6.2. Full-time employees of the Agency (including job applicants). The Agency processes identification and contact information, details regarding education, qualifications, and work experience, personnel documents (orders, employment contracts, personnel files), bank account information, health information to the extent required by occupational safety and health legislation, and other information necessary for employment relationships. Purpose of processing: maintaining personnel records, calculating wages and other payments, complying with labor, tax, and pension laws, organizing the Agency’s operations, and ensuring information and physical security.

6.3. Engaged Experts. The Agency processes identification and contact information, details regarding qualifications and professional experience, bank account information, and other data necessary for the conclusion and performance of civil law contracts. Purpose of processing: to engage individuals to perform work (provide services) within the framework of the Agency’s projects and programs, to make payments under contracts, to comply with tax legislation, and to report to donors.

6.4. Partners, donors, grant providers, and representatives of state and local government bodies. The Agency processes contact information for representatives (officials) of relevant bodies and organizations, information regarding their positions, payment details, and other information necessary for identification and the fulfillment of contractual obligations. Purpose of processing: concluding and fulfilling contracts (agreements), implementing joint programs and projects, preparing reports, ensuring transparency in the use of funds, and developing partnerships.

6.5. Applicants, participants, and beneficiaries of the Agency’s programs, projects, competitions, and events. The Agency processes last names, first names, patronymics, contact information, and details contained in applications (application forms) and competition documentation, as well as other data required for participation in the relevant programs, projects, competitions, or events. Purpose of processing: organizing and conducting the selection of participants, implementing regional development programs, preparing reports for donors and government agencies, and informing participants about the results of events.

6.6. Visitors to the Agency’s official website and subscribers to the Agency’s newsletters. When the Agency uses cookies, feedback forms, or newsletters, the corresponding technical data (IP address, device/browser type) and contact information (email address) voluntarily provided by the individual are processed. Purpose of processing: to ensure the website functions properly, to provide feedback to visitors, and to inform them about the Agency’s activities. The procedure for using cookies may be specified in a separate policy (notice) on the Agency’s official website.

6.7. The list of specific personal data databases, the structure of the fields, the procedures for maintaining them, and the technical requirements for them are defined by the Agency’s internal documents (regulations, instructions, standard operating procedures).

7. SOURCES, METHODS OF COLLECTION, STORAGE, AND TRANSFER OF PERSONAL DATA

7.1. Personal data may be collected by the Agency, in particular:

- directly from the data subject when entering into employment or civil law contracts, filling out questionnaires, application and registration forms, or participating in competitions, events, or interviews;

- through the Agency’s official website and official online resources (feedback forms, applications, registration forms);

- via email, messaging apps, and other official communication channels of the Agency;

- from third parties (partners, donors, government agencies) - in cases and to the extent necessary to fulfill contractual obligations and provided there are legal grounds for such a transfer.

7.2. In all cases provided for by Ukrainian law, the Agency obtains the consent of the data subject for the processing of their data in written or electronic form, or acts on other legal grounds specified in Article 11 of the Law.

7.3. The Agency stores personal data in secure information (electronic) systems and/or in paper archives with restricted physical access. Specific technical and organizational security measures are defined in the Agency’s internal documents.

7.4. Personal data may be transferred to third parties only in the following cases:

- when expressly provided for by law;

- with the written (or electronic) consent of the data subject;

- when necessary to fulfill a contract or project involving the Agency, provided that the third party ensures an adequate level of protection for the transferred data.

7.5. Personal data is processed in a form that allows for the identification of an individual for no longer than is necessary to achieve the purpose of its processing, and in any case, no longer than the period prescribed by legislation governing archival matters and record keeping.

8. PROTECTION OF PERSONAL DATA

8.1. The Agency implements organizational and technical measures to ensure the protection of personal data at all stages of its processing in order to prevent its accidental loss or destruction, unlawful processing - including unlawful destruction or access to personal data.

8.2. Organizational measures for the protection of personal data include, in particular:

- the development and approval of internal documents governing the procedures for the processing and protection of personal data (including this Policy);

- maintaining a record by the Agency of employees and engaged experts who have access to personal data, and determining the level of such access in accordance with their employment (official) or contractual duties;

- granting access to personal data only to authorized persons on a “need-to-know” basis (minimum necessary access);

- obtaining a written non-disclosure agreement from employees and engaged experts who have access to personal data;

- regularly reviewing access rights to personal data and the Agency’s information systems.

8.3. The date on which a right of access to personal data is granted is considered to be the date on which the relevant employee (expert) provides a written non-disclosure agreement. The date on which the right of access ceases is the date of the employee’s termination, the termination of the contract with the engaged expert, or the transfer to a position (or performance of duties) not related to the processing of personal data. In such cases, measures are taken to prevent the relevant person from further accessing personal data, and documents and other data storage media are transferred to another authorized employee.

8.4. Technical measures for the protection of personal data include, in particular, the use of access control mechanisms for information systems, data encryption during transmission over communication channels, regular backups, the use of antivirus protection, and other measures aimed at preventing unauthorized access, loss, alteration, or disclosure of personal data. The specific list of technical measures is determined by the Agency’s internal documents, taking into account the requirements of information security legislation.

8.5. Depending on the method of storage (on paper or electronic media), personal data is processed in a manner that prevents access by third parties (unauthorized persons).

8.6. The Agency maintains records of operations related to the processing of and access to the data subject’s personal data, including information on the date, time, and source of collection of personal data, as well as any changes, views, or transfers (copying) thereof, and the date and time of deletion or destruction of personal data, along with the employee (expert) who performed the relevant operation. This information is retained for one year from the end of the year in which the specified operations were performed, unless otherwise provided by Ukrainian law.

8.7. Any violations of the personal data processing and protection procedures are documented and reviewed by the Agency’s Director, who takes the necessary corrective measures.

9. PROCEDURE IN THE EVENT OF A PERSONAL DATA BREACH

9.1. If an incident is detected that has resulted in or may result in unauthorized access to, loss, alteration, or disclosure of personal data, the employee (or engaged expert) who detected such an incident shall immediately notify the Director of the Agency (or the person responsible for personal data protection, if any).

9.2. The Agency shall take the necessary measures to promptly mitigate the consequences of the incident, assess its scope, and evaluate the risks to the rights and freedoms of data subjects.

9.3. In cases provided for by Ukrainian law, the Agency shall inform the relevant data subjects and authorized government agencies of the personal data breach in accordance with the procedures and timeframes established by law and the Agency’s internal documents.

9.4. Based on the results of the review of each incident, measures are taken to prevent the recurrence of similar breaches in the future, in particular by revising the relevant organizational and technical safeguards.

10. RIGHTS OF DATA SUBJECTS

10.1. A data subject whose personal data is processed by the Agency has the right to:

- to know the sources of collection, the location of their personal data, the purpose of its processing, the location of the Agency, or whether the processing has been outsourced to another controller;

- to receive information about the conditions for granting access to personal data, including information about third parties to whom their personal data is transferred;

- to access their personal data processed by the Agency;

- submit a reasoned request to have their personal data corrected or deleted if such data is being processed unlawfully or is inaccurate;

- submit a reasoned request to object to the processing of their personal data;

- protect their personal data from unlawful processing and accidental loss, destruction, or damage;

- to withdraw consent to the processing of personal data without providing a reason if such consent is the sole basis for processing;

- to file complaints regarding the processing of their personal data with the Ukrainian Parliament Commissioner for Human Rights or with a court;

- to seek legal remedies in the event of a violation of personal data protection laws.

10.2. The data subject exercises their rights by submitting a written or electronic request to the Agency at the official mailing address and/or email address designated for inquiries regarding the processing of personal data: [email protected]

10.3. The Agency shall review a request from a data subject within 10 (ten) business days of receiving it, unless a different time limit is established by Ukrainian law. If, as a result of reviewing the request, it is determined that the personal data is being processed unlawfully or is inaccurate, the Agency shall immediately cease such processing and/or make the necessary corrections, and shall also inform the data subject thereof.

10.4. If there are no grounds for granting the request, the data subject shall be provided with a reasoned response within the timeframe established by Ukrainian law.

10.5. The Agency’s interaction with the Ukrainian Parliament Commissioner for Human Rights is carried out in accordance with the procedure established by law and by the Law of Ukraine “On the Ukrainian Parliament Commissioner for Human Rights.”

11. RETENTION PERIODS AND DISPOSAL OF PERSONAL DATA

11.1. The Agency retains personal data only for the period necessary to achieve the purpose of its processing, taking into account the requirements of Ukrainian law (in particular regarding archiving, accounting, and labor relations), the terms of grant (donor) agreements, and the Agency’s internal procedures.

11.2. The specific retention periods for individual categories of personal data (personnel data, data on event participants, partner data, etc.) are determined by the Agency’s file classification system and other internal documents.

11.3. Upon expiration of the established retention period, personal data shall be deleted or destroyed in a manner that precludes any possibility of subsequent recovery, unless otherwise provided by law or the Agency’s contractual obligations.

12. LIABILITY FOR VIOLATIONS OF THIS POLICY

12.1. Persons found to have violated Ukrainian legislation on the protection of personal data and/or the requirements of this Policy shall be subject to disciplinary, civil, administrative, or criminal liability in accordance with Ukrainian law.

12.2. Full-time employees and engaged experts who have been granted access to personal data are liable for the disclosure of personal data entrusted to them or that has come to their knowledge in connection with the performance of their employment, official, or contractual duties, including after the termination of their respective relationships with the Agency.

12.3. Partners, contractors, and other third parties who are granted access on a contractual basis to personal data processed by the Agency are required to ensure the same level of protection for such data as provided for by this Policy and the laws of Ukraine, and are liable for any failure to comply in accordance with the terms of the relevant contracts and applicable law.

13. FINAL PROVISIONS

13.1. This Policy shall take effect on the date of its approval by the Agency’s Supervisory Board and shall remain in effect until it is repealed or replaced by a new version.

13.2. Amendments and additions to this Policy shall be approved by a resolution of the Agency’s Supervisory Board upon the recommendation of the Agency’s Director.

13.3. In the event that any provisions of this Policy conflict with Ukrainian legislation that has entered into force after the Policy’s approval, the provisions of such legislation shall apply until the Policy is brought into compliance with it.

13.4. Full-time employees, members of the Supervisory Board, members of the Expert Council, and engaged experts shall be made aware of this Policy by signing a document or by any other means that allows for confirmation of such acknowledgment.

13.5. The text of this Policy (or a summary thereof) shall be posted on the Agency’s official website for general review.