Personal Data Processing Policy — Sattilik Invest Holding JSC

1. General provisions

This Personal Data Processing Policy (hereinafter — the “Policy”) has been developed by Sattilik Invest Holding JSC (BIN 170140031155, registered office: 050043, Republic of Kazakhstan, Almaty, Bostandyk district, Svezhest-1 gardening association, building 145; hereinafter — the “Company”, the “Operator”) for the purpose of fulfilling the requirements of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” of 21 May 2013 No. 94-V (as amended), the Law of the Republic of Kazakhstan “On Informatisation” of 24 November 2015 No. 418-V (as amended) and other regulatory legal acts of the Republic of Kazakhstan in the field of personal data protection.

The Policy establishes the procedure for the collection, processing, storage, use, transfer, protection, depersonalisation and destruction of personal data of natural persons accessing the official website of the Company at https://sattilik.com (hereinafter — the “Website”), and also defines the rights of personal data subjects and the obligations of the Company as the operator.

2. Personal data operator

The operator of personal data processed in connection with the use of the Website is:

Full name: Sattilik Invest Holding JSC;
Business identification number (BIN): 170 140 031 155;
Registered office: 050043, Republic of Kazakhstan, Almaty, Bostandyk district, Svezhest-1 gardening association, building 145;
Email address for personal data enquiries: bilalov@sattilik.com;
Telephone: +7 707 733 6998.

The person responsible for the organisation of personal data processing in the Company in accordance with paragraph 4 of Article 25 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” is the General Director of the Company Murat O. Bilalov.

3. Composition of personal data processed

3.1. Data voluntarily provided by the subject when completing the Website’s forms

full name (last name, first name and patronymic if any);
name of the organisation, position of the contact person;
email address;
telephone number;
content of the message (text of the enquiry) sent through the Website;
other data voluntarily provided by the subject in free fields of the forms.

3.2. Data collected automatically when visiting the Website

device IP address;
type, version of the browser and operating system;
information about the access device (device type, screen resolution);
visited pages and time of their visit;
source of transition (referrer);
cookie identifiers established in accordance with the Cookie Policy.

The Company does not collect special categories of personal data (racial and ethnic origin, political views, religious and other beliefs, biometric data, information about health and intimate life) through the Website.

4. Purposes of personal data processing

The Company processes personal data exclusively for the following purposes directly conditioned by the tasks of the Website:

processing institutional and qualified private enquiries received through the Website’s contact forms, formation of responses and conduct of correspondence with the enquiring person;
identification of the enquiring organisation or individual and the contact person for subsequent business communication;
ensuring the functioning of the Website, including protection from unauthorised actions and analysis of operability;
analysis of statistics of visits to the Website in depersonalised form to improve the structure and content;
fulfilment of the Company’s obligations directly provided for by the legislation of the Republic of Kazakhstan;
protection of the rights and legitimate interests of the Company in case of disputes.

5. Legal grounds for processing

The processing of personal data by the Company is carried out on the following legal grounds: consent of the data subject, formalised in the manner provided for by Article 8 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”; laws of the Republic of Kazakhstan that directly provide for cases of processing personal data without the consent of the subject (Article 9 of the indicated Law); the necessity of carrying out and performing the functions assigned to the Company by the legislation of the Republic of Kazakhstan; the necessity of protecting the rights and legitimate interests of the Company and third parties, provided that the rights and freedoms of the personal data subject are not thereby violated.

6. Consent of the data subject

Consent of the subject to the collection and processing of personal data is formalised in writing or in the form of an electronic document in accordance with paragraph 1 of Article 8 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”.

Within the framework of the use of the Website, consent is formalised by an active action of the subject — placing a mark in a special field of the feedback form with simultaneous familiarisation of the subject with this Policy and accompanying documents. The use of “pre-set” marks is not permitted.

The fact of receiving consent is recorded by the technical means of the Company indicating the time of receipt, IP address of the subject, version of the Policy in effect at the time of receiving consent. The indicated recording is carried out for the purposes of possible confirmation of receipt of consent in case of an enquiry from the subject or supervisory bodies.

7. Methods and terms of processing

The Company processes personal data in the following ways: collection of personal data through the Website’s forms and other communication channels; recording of personal data in the Company’s electronic databases; systematisation, accumulation, storage, clarification, use of personal data; transfer of personal data in cases and in the manner provided for by legislation; depersonalisation and blocking of personal data; destruction of personal data upon achievement of the purposes of processing or upon expiry of established storage periods.

The term of personal data processing is determined by the purposes of their processing. As a general rule, personal data is stored until the moment of achievement of the purposes of processing and during the period established by the legislation of the Republic of Kazakhstan, after which it is subject to destruction or depersonalisation.

8. Storage of personal data on the territory of the Republic of Kazakhstan

In accordance with paragraph 2 of Article 12 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, the Company ensures the storage of collected and processed personal data of citizens of the Republic of Kazakhstan on the territory of the Republic of Kazakhstan.

The Website is hosted on the infrastructure of the Kazakhstani hosting provider Hoster.kz, the servers of which are located in data centres on the territory of the Republic of Kazakhstan. This ensures compliance with the requirements of legislation on the localisation of personal data.

9. Transfer of personal data to third parties

The Company does not transfer personal data to third parties, except for cases directly provided for by the legislation of the Republic of Kazakhstan or with the direct consent of the personal data subject.

Possible categories of recipients in case of transfer with the consent of the subject or on the basis of law: state bodies and their officials in cases directly provided for by the legislation of the Republic of Kazakhstan; persons providing the Company with professional services (legal, accounting, audit) — to the extent necessary for the provision of the relevant services and subject to the assumption by such persons of obligations to protect confidentiality; the hosting provider — to the extent necessary for the technical functioning of the Website; law enforcement agencies and courts in cases directly provided for by the procedural legislation of the Republic of Kazakhstan.

10. Cross-border transfer of data

Cross-border transfer of personal data to foreign states is carried out in accordance with Article 16 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” and is permitted under the conditions of: ensuring by foreign states of personal data protection; the presence of consent of the personal data subject for the cross-border transfer of their data; in cases directly provided for by international treaties of the Republic of Kazakhstan and laws of the Republic of Kazakhstan.

11. Personal data protection measures

In accordance with Article 22 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, the Company takes the necessary legal, organisational and technical measures to protect personal data from unauthorised or accidental access to it, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions.

The applied measures include: appointment of a person responsible for the organisation of personal data processing; development and approval of local acts of the Company on personal data processing issues; application of encryption (TLS/SSL) when transmitting data through the Website; restriction of access to personal data within the Company on the principle of official necessity; regular creation of backup copies of data with ensuring their preservation; control over the fulfilment of personal data protection requirements and response to information security incidents in the manner provided for by the legislation of the Republic of Kazakhstan on informatisation.

12. Rights of the data subject

In accordance with Article 24 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, the personal data subject has the right to:

know about the existence of their personal data with the Company, as well as receive information containing data about the collection and processing of such data;
require the Company to amend and supplement their personal data if there are grounds confirmed by relevant documents;
require the Company to block their personal data if there are grounds to believe that the data is unreliable or has been collected and processed in violation of legislation;
require the Company to destroy personal data, the collection and processing of which has been carried out in violation of legislation, as well as in other cases provided for by law and the consent of the subject;
withdraw consent to the collection and processing of personal data in the manner provided for by section 13 of this Policy;
appeal the actions (inaction) of the Company as the operator to the authorised body in the field of personal data protection or to court;
protect their rights and legitimate interests, including require compensation for moral and (or) property damage in court;
exercise other rights provided for by the legislation of the Republic of Kazakhstan.

To exercise their rights, the subject may contact the Company at the email address bilalov@sattilik.com or at the postal address of the Company indicating their identification data and the substance of the enquiry.

13. Procedure for withdrawal of consent

The personal data subject has the right at any time to withdraw their consent to the collection and processing of personal data by sending a corresponding enquiry to the email address bilalov@sattilik.com or to the postal address of the Company.

The Company within ten working days from the date of receipt of the enquiry ceases the processing of personal data and destroys it in the manner provided for by the legislation of the Republic of Kazakhstan, except for cases where the continuation of processing is required by direct requirements of law (for example, for the purposes of tax, accounting, execution of court decisions, protection of the Company’s rights in disputes).

14. Final provisions

This Policy is drawn up in Russian, Kazakh and English. In case of discrepancies between the language versions, the Russian and Kazakh versions shall prevail in accordance with paragraph 2 of Article 21 of the Law of the Republic of Kazakhstan “On Languages in the Republic of Kazakhstan” of 11 July 1997 No. 151-I. The English version is provided for informational purposes only.

For matters of personal data processing in the Company, subjects may contact the General Director of the Company Murat O. Bilalov as the person responsible for the organisation of personal data processing at bilalov@sattilik.com.