The privacy policy

THE PRIVACY POLICY

The privacy policy of Aktiv Project LLP based on the Law of the Republic of Kazakhstan effected May 21, 2013 N 94-V “On Personal Data and Its Protection” and regulates public relations between Aktiv Project LLP(“Active Project”), its Partners, Customers, potential Customers and visitors of this site.

 

Chapter 1. GENERAL PROVISIONS

Article 1. Basic concepts used in this Law

The following basic concepts are used:

1) personal data – information relating to a certain or determined on their basis to the subject of personal data, recorded on electronic, paper and (or) other material media;

2) blocking of personal data – actions to temporarily stop the collection, accumulation, modification, addition, use, distribution, depersonalization and destruction of personal data;

3) accumulation of personal data – actions to systematize personal data by entering them into the database containing personal data;

4) collection of personal data – actions aimed at obtaining personal data;

5) destruction of personal data – actions, as a result of which it is impossible to restore personal data;

6) depersonalization of personal data – actions as a result of which it is impossible to determine the ownership of personal data to the subject of personal data;

7) the database containing personal data (hereinafter – the database) – a set of ordered personal data;

8) the owner of the base containing personal data (hereinafter – the owner) – a state body, an individual and (or) a legal entity exercising in accordance with the laws of the Republic of Kazakhstan the right to own, use and dispose of the database containing personal data;

9) the operator of the database containing personal data (hereinafter referred to as the operator) – a state body, an individual and (or) a legal entity collecting, processing and protecting personal data;

10) protection of personal data – a set of measures, including legal, organizational and technical, carried out for the purposes established by this Law;

11) processing of personal data – actions aimed at accumulation, storage, modification, addition, use, distribution, depersonalization, blocking and destruction of personal data;

12) use of personal data – actions with personal data aimed at implementing the objectives of the owner, operator and third party;

13) storage of personal data – actions to ensure the integrity, confidentiality and availability of personal data;

14) dissemination of personal data – actions, as a result of which personal data is transferred, including through the media or providing access to personal data in any other way;

15) the subject of personal data (hereinafter – the subject) – an individual to whom the personal data relates;

16) a third party – a person who is not a subject, owner and (or) operator, but is related to them (him) by circumstances or legal relations for the collection, processing and protection of personal data.

 

Article 2. Purpose of this Policy

The purpose of this Policy is to improve and improve quality of relations of Aktiv Project LLP with Partners, “Customers”, potential “Customers” and visitors of this site

 

Article 3. Effect of this Policy

1. This Policy regulates relations related to the collection, processing and protection of personal data of Partners of Aktiv Project LLP, “Customers”, potential Customers” and visitors to this site.
2. Features of collection, processing and protection of personal data are also regulated by the laws and acts of the Republic of Kazakhstan.

 

Article 4. Principles of collection, processing and protection of personal data

Collection, processing and protection of personal data are carried out in accordance with the principles of:

1) observance of constitutional rights and freedoms of man and citizen;

2) legality;

3) confidentiality of personal data of limited access;

4) equality of rights of subjects, owners and operators;

5) ensuring the security of the individual, society and the state.

 

Chapter 2. COLLECTION AND PROCESSING OF PERSONAL DATA

Article 5. Availability of personal data

Personal data on accessibility is divided into public and restricted access.

Publicly available personal data are personal data or information that, in accordance with the legislation of the Republic of Kazakhstan, is not subject to the requirements of confidentiality, access to which is free with the consent of the subject.

For the purpose of information support, publicly available sources of personal data are used (including biographical directories, telephone, address books, publicly available electronic information resources, mass media).

Information about the subject, the collection and processing of which is carried out in violation of the legislation of the Republic of Kazakhstan, shall be excluded from publicly available sources of personal data at any time at the request of the subject or his legal representative or by a court decision or other authorized state bodies.

At the same time, the costs arising from the destruction of personal data from publicly available sources of personal data are borne by the owner and (or) the operator, a third party.

The amount of expenses arising from the withdrawal of the consent of the subject or his legal representative to the dissemination of his personal data in publicly available sources of personal data related to the destruction of personal data from publicly available sources of personal data, as well as the persons to which these costs are imposed, if necessary, are determined in court.

Персональными данными ограниченного доступа являются персональные данные, доступ к которым ограничен законодательством Республики Казахстан.

 

Article 6. Conditions of collection, processing of personal data

1. Collection, processing of personal data shall be carried out by the owner and (or) operator, as well as by a third party with the consent of the subject or his legal representative in the manner determined by the authorized body, except for the cases provided for in Article 7 of this Policy.
2. Features of collection, processing of personal data in electronic information resources containing personal data shall be established in accordance with the legislation of the Republic of Kazakhstan on informatization, taking into account the provisions of this Law.
3. The processing of personal data should be limited to the achievement of specific, predetermined and legitimate purposes. It is not allowed to process personal data that is incompatible with the purposes of collecting personal data.
4. Personal data, the content and volume of which are excessive in relation to the purposes of their processing, are not subject to processing.

 

Article 7. The procedure for giving (withdrawing) the consent of the subject to the collection, processing of personal data

1. The subject or his legal representative gives (withdraws) consent to the collection, processing of personal data in writing, in the form of an electronic document or through the service of ensuring the security of personal data or in another way with the use of elements of protective actions that do not contradict the legislation of the Republic of Kazakhstan.
2. The subject or his legal representative may not withdraw consent to the collection, processing of personal data in cases where it contradicts the laws of the Republic of Kazakhstan, or in the presence of an unfulfilled obligation.
3. The subject has the right to consent to the collection, processing of personal data by filling in the “Place an order” website or in the “Partners” section by leaving a “Review”.

 

Article 8. Collection, processing of personal data without the consent of the subject

Collection, processing of personal data are carried out without the consent of the subject or his legal representative in the following cases:

1) carrying out the activities of law enforcement agencies and courts, enforcement proceedings;

2) carrying out of the state statistical activity;

3) use of personal data by state bodies for statistical purposes with a mandatory condition for their depersonalization;

4) implementation of international treaties ratified by the Republic of Kazakhstan; 5) protection of constitutional rights and freedoms of man and citizen, if obtaining the consent of the subject or his legal representative is impossible;

5) protection of constitutional rights and freedoms of man and citizen, if obtaining the consent of the subject or his legal representative is impossible;

6) carrying out of legal professional activity of a journalist and (or) activity of mass media or scientific, literary or other creative activity on condition of observance of requirements of the legislation of the Republic of Kazakhstan on ensuring of rights and freedoms of the person and the citizen;

7) publication of personal data in accordance with the Laws of the Republic of Kazakhstan;

8) non-fulfillment by the subject of its obligations on submission of personal data in accordance with the Laws of the Republic of Kazakhstan;

9) receipt by the state body carrying out regulation, control and supervision of the financial market and financial organizations, information from individuals and legal entities in accordance with the legislation of the Republic of Kazakhstan;

10) receipt by the state revenue bodies for the implementation of tax administration and (or) control of information from individuals and legal entities in accordance with the Laws of the Republic of Kazakhstan;

11) in other cases established by the laws of the Republics of Kazakhstan.

 

Article 9. Access to personal data

1. Access to personal data shall be determined by the terms of consent of the subject or his legal representative, provided to the owner and (or) the operator for their collection and processing, unless otherwise provided by the legislation of the Republic of Kazakhstan.

Access to personal data should be prohibited if the owner and (or) the operator, and (or) a third party refuse to assume obligations to ensure compliance with the requirements of this Policy or cannot provide them.

1. The appeal (request) of the subject or its legal representative regarding access to its personal data shall be submitted to the owner and (or) the operator in writing or in the form of an electronic document or in another way with the use of elements of protective actions that do not contradict the legislation of the Republic of Kazakhstan.

 

Article 10. Confidentiality of personal data

1. Owners and (or) operators, as well as third parties gaining access to personal data of limited access, ensure their confidentiality by complying with the requirements to prevent their distribution without the consent of the subject or his legal representative or the presence of other legal grounds.
2. Persons who have become aware of personal data of limited access in connection with professional, official necessity, as well as labor relations, are obliged to ensure their confidentiality.

 

Article 11. Accumulation and storage of personal data

1. The accumulation of personal data is made by collecting personal data necessary and sufficient to perform the tasks carried out by the owner and (or) the operator, as well as a third party.
2. Storage of personal data shall be carried out by the owner and (or) the operator, as well as by a third party in the database, which is stored in the territory of the Republic of Kazakhstan.

The period of storage of personal data shall be determined by the date of achievement of the purposes of their collection and processing, unless otherwise provided by the legislation of the Republic of Kazakhstan.

 

Article 12. Modification and addition of personal data

Change and addition of personal data shall be carried out by the owner and (or) operator on the basis of an appeal (request) of the subject or its legal representative or in other cases, provided by the Laws of the Republic of Kazakhstan.

 

Article 13. Use of personal data

The use of personal data should be carried out by the owner, operator and third party only for the previously stated purposes of their collection.

 

Article 14. Dissemination of personal data

1. The dissemination of personal data is allowed if the rights and freedoms of the subject are not violated, as well as the legitimate interests of other individuals and (or) legal entities are not affected.
2. The dissemination of personal data in cases that go beyond the previously stated purposes of their collection is carried out with the consent of the subject or his legal representative.

 

Article 15. Depersonalization of personal data

1. When collecting, processing personal data for statistical, sociological, scientific, marketing research, the owner and (or) the operator, as well as a third party transmitting personal data, are obliged to depersonalize them in accordance with the rules for collecting, processing personal data.

 

Article 16. Destruction of personal data

Personal data shall be subject to destruction by the owner and (or) operator, as well as by a third party:

1) after the expiration of the storage period;

2) upon entry into force of the court decision;

3) in other cases, established by the legislation and other regulatory legal acts of the Republic of Kazakhstan.

 

Article 17. Notification of actions with personal data

1. In the presence of a condition on notification of the subject on transfer of his (her) personal data to a third party, the owner and (or) the operator within ten working days shall notify the subject or his legal representative about it, unless otherwise provided by the laws of the Republic of Kazakhstan.
2. The requirements of paragraph 1 of this Article shall not apply to the cases:

1) performance by state bodies of their functions, provided by the legislation of the Republic of Kazakhstan, as well as carrying out activities by private notaries, private enforcement agents and advocates;

2) collection and processing of personal data for statistical, sociological or scientific purposes.

 

Chapter 3. RIGHTS AND OBLIGATIONS OF THE SUBJECT, OWNER AND (OR) OPERATOR

Article 18. Rights and obligations of the subject

1. The subject has the right to:

1) to know about the presence of the owner and (or) operator, as well as a third party of their personal data, as well as receive information containing:

– confirmation of the fact, purpose, sources, methods of collecting and processing personal data;

– list of personal data; terms of processing personal data, including the terms of their storage;

2) to require the owner and (or) the operator to change and supplement their personal data in the presence of grounds confirmed by the relevant documents;

3) to require the owner and (or) the operator, as well as a third party to block their personal data in the event of information about a violation of the conditions for the collection, processing of personal data;

4) to require from the owner and (or) operator, as well as a third party the destruction of their personal data, the collection and processing of which are carried out in violation of the legislation of the Republic of Kazakhstan, as well as in other cases established by this Law and other regulatory legal acts of the Republic of Kazakhstan;

5) withdraw consent to the collection, processing of personal data, except for the cases provided for in this Policy;

6) to give consent (refuse) to the owner and (or) operator to distribute their personal data in publicly available sources of personal data;

7) to protect their rights and legitimate interests;

8) to exercise other rights provided by the legislation.

 

Article 19. Rights and obligations of the owner and (or) operator, person responsible for organizing the processing of personal data

1. The owner and (or) the operator shall have the right to collect, process personal data in the manner established by this Law and other regulatory legal acts of the Republic of Kazakhstan.
2. The owner and (or) the operator shall be obliged to:

1) approve the list of personal data, necessary and sufficient for performance of tasks carried out by them, unless otherwise provided by the Laws of the Republic of Kazakhstan;

2) take and comply with the necessary measures, including legal, organizational and technical, to protect personal data in accordance with the legislation of the Republic of Kazakhstan;

3) comply with the legislation of the Republic of Kazakhstan on personal data and their protection;

4) take measures to destroy personal data in case of achieving the purpose of their collection and processing, as well as in other cases established by this Law and other regulatory legal acts of the Republic of Kazakhstan;

5) provide evidence on obtaining the consent of the subject to the collection and processing of his (her) personal data in the cases provided for by the legislation of the Republic of Kazakhstan;

6) report information related to the subject within three working days from the date of receipt of the application of the subject or its legal representative, unless other terms are provided by the Laws of the Republic of Kazakhstan;

7) in case of refusal to provide information to the subject or its legal representative within a period not exceeding three working days from the date of receipt of the appeal, to submit a reasoned response, unless other terms are provided by the Laws of the Republic of Kazakhstan;

8) within one working day: change and (or) supplement personal data on the basis of relevant documents confirming their reliability, or destroy personal data if it is impossible to change and (or) supplement them; block personal data relating to the subject, in case of information about violation of the conditions for their collection, processing; destroy personal data in case of confirmation of the fact of their collection, processing in violation of the legislation of the Republic of Kazakhstan, as well as in other cases established by this Law and other regulatory legal acts of the Republic of Kazakhstan;

9) provide free of charge to the subject or his (her) legal representative the opportunity to familiarize himself with personal data relating to this subject;

10) appoint a person responsible for organizing the processing of personal data in the event that the owner and (or) the operator are legal entities.

The effect of subparagraph 10) of the first part of this paragraph does not apply to the processing of personal data in the activities of the courts.

1. The person responsible for organizing the processing of personal data is obliged to:

1) carry out internal control over compliance by the owner and (or) the operator and its employees with the legislation of the Republic of Kazakhstan on personal data and their protection, including the requirements for the protection of personal data;

2) bring to the attention of the employees of the owner and (or) the operator the provisions of the legislation of the Republic of Kazakhstan on personal data and their protection on the processing of personal data, the requirements for the protection of personal data;

3) exercise control over the reception and processing of appeals of subjects or their legal representatives.