Policy on the Processing and Protection of Personal Data

Version dated 31.01.2022

This document defines the policy of LLP “STP-PAK” in the field of processing and protection of personal data (hereinafter referred to as the Policy).

The Policy applies to all personal data that LLP “STP-PAK” may receive from a personal data subject.

1. Terms and Definitions

Agreement — a license agreement on granting the right to use the Service, which is concluded with LLP “STP-PAK”.

Service — the Operator’s internet resource located at: kudos.kz

Operator — LLP “STP-PAK”.

Personal Data — any information relating directly or indirectly to an identified or identifiable User.

User — an individual using the Service.

Consent — consent to the Processing of the User’s Personal Data posted at kudos-media.ru.

Processing of Personal Data (Processing) — any action (operation) or set of actions (operations) with Personal Data performed with or without the use of automation tools. Processing includes, among other things: collection, recording, systematization, accumulation, storage, clarification (updating, amendment), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

2. General Provisions

2.1. The Policy is a local document of the Operator that determines the procedure for the Processing and protection of the Users’ Personal Data.

2.2. The Operator has developed the Policy in accordance with the Constitution of the Republic of Kazakhstan, the Law “On Personal Data”, and other regulatory legal acts that determine the procedure for working with personal data and the requirements for ensuring their security.

2.3. The purpose of the Policy is:

2.3.1. ensuring the protection of human and civil rights and freedoms when processing Personal Data, including the protection of the rights to privacy, personal and family secrecy;

2.3.2. strict and unwavering compliance with the requirements of the legislation of the Republic of Kazakhstan in the field of personal data;

2.3.3. exclusion of unauthorized actions by any third parties in relation to Processing;

2.3.4. prevention of any possible threat to the security of Users.

2.4. The Operator independently organizes and/or carries out the processing of Personal Data, determines their composition and the purposes of Processing, and the actions (operations) performed with Personal Data.

2.5. The Operator has published the policy at: kudos-media.ru. The Operator provides the Policy to any person who personally applies for it.

2.6. The Operator has the right to make changes to the Policy. A new version of the Policy enters into force from the moment of its publication.

3. Purposes of the Processing of Personal Data

3.1. The Operator processes Personal Data for the purposes of concluding and performing the Agreement, including:

Registration and identification of the User in the Service.
Granting access to the Personal Account — for the purpose of using the Service.
Communication with Users — for the purpose of providing the necessary information related to the activity of the Service or the Operator. Including, but not limited to, sending notifications, requests, and information about working with the Service, about the availability of new functionality, notifications about Service updates, and recommendations on functionality settings. For communication, the Operator has the right to use the email address specified by the User.
Processing incoming requests and applications from the User — for the purpose of consulting on issues related to the operation of the Service.
Receiving feedback from the User — for the purpose of improving the quality of the Service, the convenience of its use, and the development of new services.
Conducting statistical and other research based on depersonalized data for the purpose of obtaining information about satisfaction with the operation of the Service and its functionality. Such information is used for analysis aimed at improving the quality of the Service and conducting research of any categories.
Analytics of the User’s actions in the Service and the functioning of the Service.
Conducting advertising and news mailings.
Protecting the confidentiality of Personal Data, the operability and security of the Service, confirming the actions performed by the User, carrying out actions aimed at preventing fraud, cyberattacks, and other abuses, as well as investigating such cases.
4. Principles of the Processing of Personal Data

4.1. The Operator processes Personal Data based on the following principles:

lawful and fair basis for Processing;
processing in accordance with specific, predetermined, and lawful purposes;
prevention of combining databases containing Personal Data the Processing of which is carried out for purposes incompatible with each other;
compliance of the content and volume of Personal Data with the declared purposes of Processing;
accuracy, sufficiency, relevance, and reliability of Personal Data;
legality of technical measures aimed at Processing;
reasonableness and appropriateness of Processing;
storage of Personal Data no longer than required by the purposes of Processing, unless the storage period is established by Law or by an agreement to which the User is a party;
destruction or depersonalization of Personal Data upon achievement of the purposes of Processing or in the event of the loss of the need to achieve them, unless otherwise provided by Law.
5. List of Processed Personal Data

5.1. General Personal Data, including: first name, last name, patronymic, phone number, email address.

5.2. Other data on the use of the Service, including:

5.2.1. data on technical means (devices): IP address, type of operating system, browser type, geographic location, Internet service provider.

5.2.2. information about the User’s behavior in the Service (including the date, time, and number of visits, information about visited pages, transitions from other resources, submitted applications).

5.2.3. information automatically obtained when accessing the Service, including through the use of cookies. Cookies are fragments of text that are automatically stored in the memory of the User’s internet browser. This allows the Service, when necessary, to access the information stored on the User’s computer and extract it. You have the right to change your internet browser settings and refuse the storage of cookies.

5.2.4. general personal data: name, email address, phone number.

5.3. Personal Data uploaded by the User is processed “as is.”

5.4. The Operator does not verify:

the User’s legal capacity;
the accuracy of the Personal Data provided by the User.

5.5. The User guarantees:

the provided Personal Data is accurate, up to date, and does not violate the legislation of the Republic of Kazakhstan;
obtaining the consent of a third party to transfer Personal Data to the Operator and for subsequent Processing if the Personal Data relates to a third party.
6. Processing of Personal Data

6.1. Subjects of Personal Data are Users who have provided data in forms during registration in the Service, feedback forms, and otherwise.

6.2. The Operator collects Personal Data in the following ways:

6.2.1. the User provides data when filling out Service forms, using means of communication, including by phone, email, etc.;

6.2.2. automatic collection of User data using technologies and services: web protocols, “cookie” files, web marks, which are activated only when the User enters their data.

6.3. The Operator stores Personal Data:

6.3.1. exclusively on properly protected electronic media, including digital media;

6.3.2. in the Service using automated processing, except where non-automated Processing is necessary due to the requirements of the legislation of the Republic of Kazakhstan;

6.3.3. using databases located in the territory of the Republic of Kazakhstan;

6.3.4. the periods of storage of Personal Data are determined by the terms of the Consent: the data begins to be stored from the moment the Consent is given.

6.4. The Operator does not distribute or provide Personal Data to third parties without the User’s written consent, except in the following cases:

6.4.1. performance of the terms of the Agreement;

6.4.2. for the purposes of preventing and suppressing unlawful actions of the User and protecting the legitimate interests of the Operator and third parties, as well as in cases established by the legislation of the Republic of Kazakhstan;

6.4.3. upon a reasoned request of judicial authorities, state security authorities, the prosecutor’s office, the police, investigative authorities, and other bodies and organizations in cases established by regulatory legal acts mandatory for execution.

6.5. The Operator warns the receiving persons that the transferred data may be used only for the purposes for which it was communicated.

6.6. In the event of confirmation of the inaccuracy of Personal Data, the Operator shall update it.

6.7. The Operator destroys Personal Data in the following cases:

existence of a threat to the security of the Service;
expiration of the storage period of Personal Data;
violation of the terms of the Agreement;
termination or cancellation of the Agreement;
at the User’s request.

6.8. The Operator deletes all information received from the User upon withdrawal of Consent by the User. The right to use the Service is terminated.

6.9. The Operator has the right to temporarily suspend the processing of Personal Data, i.e., block Processing (except where Processing is necessary to clarify Personal Data).

7. User’s Rights

7.1. The User has the right to send the Operator a request in the manner provided for by the Policy to obtain information about the Processing, including information containing:

7.1.1. confirmation of the fact of Processing;

7.1.2. legal grounds for Processing;

7.1.3. the purposes and methods of Processing used by the Operator;

7.1.4. exactly which Personal Data is being processed and the source of its receipt;

7.1.5. the periods of Processing, including the storage periods of Personal Data;

7.1.6. the procedure for exercising the rights provided for by the legislation of the Republic of Kazakhstan;

7.1.7. information on completed or proposed cross-border transfer of data;

7.1.8. information about persons to whom Personal Data may be disclosed on the basis of an agreement with the Operator or in accordance with the legislation of the Republic of Kazakhstan;

7.1.9. the name or surname, first name, patronymic, and address of the person carrying out Processing on behalf of the Operator, if Processing has been entrusted or will be entrusted to such a person;

7.1.10. other information provided for by the legislation of the Republic of Kazakhstan.

8. Obligations of the Operator

8.1. The Operator is obliged:

8.1.1. upon the User’s request, to provide information about the Processing or a reasoned refusal;

8.1.2. to take measures necessary and sufficient to ensure fulfillment of the obligations provided for by the legislation of the Republic of Kazakhstan;

8.1.3. at the User’s request, to clarify the processed Personal Data, block or delete it if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of Processing;

8.1.4. to ensure the lawfulness of Processing. If it is impossible to ensure the lawfulness of Processing, the Operator shall, within a period not exceeding 10 (ten) business days from the date of detection of the unlawful Processing, destroy the Personal Data or ensure its destruction;

8.1.5. to stop Processing and destroy Personal Data (if its retention is no longer required for the purposes of Processing) within a period not exceeding 30 (thirty) days from the date of receipt from the User of the withdrawal of Consent, except in cases where Processing may be continued in accordance with the legislation of the Republic of Kazakhstan.

9. Measures to Ensure the Protection of Personal Data

9.1. The Operator ensures the implementation of legal, organizational, and technical measures necessary and sufficient to ensure the protection of Personal Data.

9.2. Legal measures include:

9.2.1. development by the Operator of local documents implementing the requirements of the legislation of Kazakhstan, including the Policy, and posting it in the Service;

9.2.2. refusal to use any Processing methods that do not correspond to the purposes predetermined by the Operator.

9.3. Organizational measures include:

9.3.1. appointment of a person responsible for organizing Processing;

9.3.2. restriction of the composition of the Operator’s employees who have access to Personal Data, and organization of a permission-based access system to it;

9.3.3. instruction and familiarization of the Operator’s employees carrying out Processing with the provisions of the legislation of the Republic of Kazakhstan on personal data, including the requirements for the protection of personal data, with the Operator’s local acts regulating the procedure for working with and protecting personal data;

9.3.4. periodic assessment of risks related to the Processing process;

9.3.5. carrying out periodic checks for the purpose of internal control of the compliance of Processing with the requirements of the legislation of the Republic of Kazakhstan.

9.4. Technical measures:

9.4.1. prevention, including through internal investigations, of unauthorized access to systems in which Personal Data is stored;

9.4.2. backup and restoration of Personal Data, operability of technical means and software, and information protection tools in Personal Data information systems;

9.4.3. other necessary security measures.

10. Limitation of the Effect of the Policy

10.1. The Policy applies exclusively to the Service.

10.2. The Operator is not responsible for the actions of third parties who gained access to the User’s Personal Data through the User’s fault.

11. Requests of the Personal Data Subject

11.1. The User or their representative has the right to send the Operator requests/applications, including regarding Processing, and to withdraw consent to Processing:

11.1.1. in writing at the address: 280 Baizakova, Almaty

11.1.2. in the form of an electronic document at the email address: v.gnatova@kudos-media.ru

11.2. The request must contain the following information:

11.2.1. information about the document удостоверяющий личность of the User;
11.2.2. information confirming the User’s participation in relations with the Operator (phone number, email address specified when registering in the Service);
11.2.3. representative’s details and confirmation of their authority (when the representative applies);
11.2.4. signature of the User (representative).

11.3. The Operator undertakes to review and send a response to the received request within 30 (thirty) calendar days from the moment the request is received.

11.4. All correspondence received by the Operator (requests in written or electronic form) is classified as restricted-access information and shall not be disclosed without the User’s written consent.

Details

Limited Liability Partnership “STP-PACK (СТП-ПАК)”
BIN/IIN: 221040033360
Address: 050040, ALMATY CITY, BOSTANDYK DISTRICT, 280 BAIZAKOVA ST., N.P. 16
Bank: Almaty Branch of JSC “ForteBank”
SWIFT code: IRTYKZKA
Bank BIN: 980341000286
Account (IBAN) in KZT: KZ8496502F0015298339