PRIVACY POLICY

1. General Provisions

1.1. This Privacy Policy (the “Policy”) has been developed by the Operator in accordance with the Constitution of the Republic of Kazakhstan and the Law of the Republic of Kazakhstan No. 94-V “On Personal Data and Its Protection” dated 21 May 2013 (the “Law”) and sets out the procedure for processing personal data and the measures taken to ensure its security.

1.2. The Policy applies to all personal data of data subjects that the Operator receives through its website, feedback form, email, telephone and other communication channels.

1.3. By using the website and/or sending an enquiry to the Operator, the data subject confirms that they have read this Policy.

2. Key Definitions

2.1. Personal data means information relating to a data subject who is identified or identifiable on the basis of such information, recorded on an electronic, paper and/or other tangible medium.

2.2. Processing of personal data means actions aimed at the collection, accumulation, storage, alteration, supplementation, use, dissemination, depersonalisation, blocking and destruction of personal data.

2.3. Data subject means the natural person to whom the personal data relate. Consent means the data subject’s expression of will, given in any form that allows the fact of its receipt to be confirmed. Cross-border transfer means the transfer of personal data to the territory of foreign states.

3. Categories of Subjects and Composition of Data Processed

3.1. The Operator processes the personal data of persons who send enquiries and business proposals through the website and other communication channels.

3.2. Composition of data: surname, first name (and patronymic, if any); email address; telephone number; name of organisation and/or position; subject and content of the enquiry; as well as technical data automatically collected when using the website (IP address, cookies, browser and device information).

4. Purposes of Processing

4.1. Reviewing and processing enquiries, requests and business proposals; providing feedback to the data subject; conducting business communications; complying with the requirements of the legislation of the Republic of Kazakhstan; and ensuring the operation and improvement of the website.

5. Legal Grounds for Processing

5.1. The legal ground for processing is the consent of the data subject given in accordance with Articles 7 and 8 of the Law, as well as the cases provided for in Article 9 of the Law where consent is not required, and other requirements of the legislation of the Republic of Kazakhstan.

6. Procedure and Conditions of Processing

6.1. Processing is carried out with the consent of the data subject, save for the cases provided for by the Law, using automated and/or non-automated means.

6.2. The collection, processing and storage of the personal data of citizens of the Republic of Kazakhstan are carried out using databases located within the territory of the Republic of Kazakhstan.

6.3. Personal data are processed until the purposes of processing are achieved or until the data subject withdraws consent. Upon withdrawal of consent, the Operator ceases processing and destroys the personal data within the time limits established by the legislation of the Republic of Kazakhstan.

7. Transfer to Third Parties and Cross-Border Transfer

7.1. The Operator does not disclose or transfer personal data to third parties, except where this is necessary to achieve the purposes of processing, is carried out with the consent of the data subject, or is provided for by law. Cross-border transfer is carried out provided that the receiving party ensures the protection of personal data.

8. Cookies

8.1. The website may use cookies and similar technologies to ensure the functioning of the website and to analyse its use. The data subject may disable cookies in their browser settings; certain features of the website may then become unavailable.

9. Personal Data Protection Measures

9.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful access, alteration, dissemination or destruction in accordance with Article 25 of the Law, and appoints a person responsible for organising the processing of personal data.

10. Rights of the Data Subject

10.1. The data subject has the right to: obtain information concerning the processing of their personal data; demand the alteration and supplementation of the data; demand the blocking or destruction of the data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the purposes of processing; withdraw consent; and appeal against the actions (inaction) of the Operator to the authorised body for the protection of personal data and/or in court.

11. Procedure for Withdrawing Consent and Submitting Enquiries

11.1. Withdrawal of consent, as well as enquiries on matters of personal data processing, shall be sent to the Operator at the email address info@uga.kz or to the postal address indicated in the requisites. The enquiry is considered within the time limits established by the legislation of the Republic of Kazakhstan.

12. Final Provisions

12.1. The Operator has the right to amend this Policy. The current version is posted on the Operator’s website and takes effect from the moment of its posting.