This Privacy Policy (the "Policy") has been developed in accordance with the regulatory rules of the Astana International Financial Centre (the "AIFC"), the applicable laws of the Republic of Kazakhstan and international standards. It sets out how UD Capital Astana Ltd. (the "Company") processes and protects personal data and other information that the Company obtains about a User when the User uses the Company's Services.
1. Definitions
The following terms are used in this Policy:
- "AFSA" means the Astana Financial Services Authority.
- "AIFC Rules" means the rules contained in the Handbook of Rules and Guidance produced by the AFSA, as in force from time to time.
- "Company's Services" means the Company's corporate website and the enquiry and application forms placed on it, which allow the User to interact with the Company, whether or not a services agreement has been concluded with the Company.
- "User" means a person who accesses the Company's Services via the Internet and uses the Company's Services.
- "Personal data" means information relating to a data subject who is identified or identifiable on the basis of such information, recorded in electronic, paper and/or any other tangible form.
- "Collection of personal data" means actions aimed at obtaining personal data.
- "Processing of personal data" means any action (operation) or set of actions (operations) performed on personal data with or without the use of automated means, including collection, recording, systematisation, accumulation, storage, updating (amendment, alteration), retrieval, use, transfer (distribution, provision, access), anonymisation, blocking, erasure and destruction of personal data.
- "Confidentiality of personal data" means the requirement, mandatory for the Company or any other person who has obtained access to personal data, not to allow their dissemination without the consent of the data subject or another lawful ground.
- "User Information" means the personal information that the User provides to the Company when using the Company's Services, as well as data transmitted automatically in the course of such use.
2. Purpose of the Policy
The purpose of this Policy is to ensure the proper protection of information about Users, including their personal data, against unauthorised access and disclosure, and to comply with the AIFC Rules, including the AIFC Data Protection Rules dated 22 January 2018, and with the applicable data protection laws of the Republic of Kazakhstan.
3. Personal data processed
The personal data permitted to be processed under this Policy is provided by the User by completing an enquiry or application form on the Company's corporate website and comprises:
- the User's surname, first name and patronymic (if any);
- the User's contact telephone number;
- the User's e-mail address;
- any other personal information that the User provides to the Company at the User's own discretion.
Where a services agreement is concluded with the User, the Company additionally processes the personal data required to identify the client and to comply with the AIFC Rules on anti-money laundering and countering the financing of terrorism, including the individual identification number (IIN) or another identification number and identity document details.
4. Consent and purposes of processing
Use of the Company's Services constitutes the User's unconditional consent to this Policy and to the conditions set out in it for the processing of information received from the User's device. The Company does not control and is not liable for information (or the consequences of its transfer) transferred by the User to a third party where such transfer was made on a third-party resource that the User may have reached through links from the Company's Services.
The Company processes the User's personal data for the purposes of:
- providing the User with access to the Company's Services;
- handling the User's enquiries and applications submitted through the Company's Services;
- verifying the accuracy and completeness of the personal data provided by the User;
- providing the User with information about the services offered by the Company and other information on behalf of the Company;
- conducting marketing and other research, including with the assistance of external experts (third parties).
5. Statistical information
The Company may use additional software tools to collect and process anonymised statistical information about the User's use of the Company's Services in order to improve the Company's Services.
6. Applicable requirements
When using User Information, the Company is guided by this Policy, the AIFC Rules, including the AIFC Data Protection Rules, the applicable laws of the Republic of Kazakhstan and the international treaties ratified by the Republic of Kazakhstan.
7. Security measures
The Company takes all organisational and technical measures within its control to protect User Information against unlawful access by third parties, and against unlawful use, copying and dissemination.
8. Transfer and retention of data
For the purposes set out in this Policy, the Company may engage partners with whom it has entered into the relevant confidentiality agreements in the processing of anonymised statistical User Information. The transfer of anonymised data on the use of the Company's Services to partners for the purpose of improving the Company's Services is carried out on the basis of agreements with those partners.
Any transfer of personal data outside the AIFC, including to jurisdictions that are not recognised as providing an adequate level of protection under the AIFC Data Protection Rules dated 22 January 2018, is carried out only with the consent of the data subject or on another lawful ground.
User Information is retained for the term of the contractual relationship between the Company and the User and for five years after the termination of such contracts. User Information may be provided to the AFSA, to the competent state authorities of the Republic of Kazakhstan and to other competent authorities in accordance with the requirements of applicable law.
9. User representations
The User confirms that the User:
- provides accurate information about themselves; all other information is provided by the User at their own discretion and with their full approval and consent;
- has read the terms of this Policy and agrees with them;
- by continuing to use the Company's corporate website, consents to the collection and processing of their personal data;
- by signing documents using an electronic digital signature and/or by means of biometric and/or dynamic identification, consents to the collection and processing of their personal data.
10. Rights of the data subject and contact details
The User has the right to obtain access to their personal data, to have it updated, blocked or erased, and to withdraw their consent to its processing. Requests relating to the processing of personal data may be sent to the Company at:
UD Capital Astana Ltd.
Republic of Kazakhstan, Z05T8M2, Astana, Yesil District, Mangilik El Avenue, Building 30
E-mail: info@udc-astana.kz
11. Amendments to the Policy
The Company has the right to amend this Policy by publishing a new version of the Policy on the Company's corporate website. The User is responsible for reviewing the current version of the Policy. A new version of the Policy takes effect from the moment of its publication.
12. Disagreement with the Policy
If the User does not agree with this Policy, the User must refrain from using the Company's Services. This Policy applies only to the Company's Services.
