Policy of processing and protection of personal data

Processing and protection of personal data policy (hereinafter - Policy) is applied to information, which "ESM System" LLP (hereinafter - Company) gets about subject of personal data during his/her use of https://q-doc.kz site (hereinafter - Site), Company products or services.

1. General provisions

1. The present Policy determines the legal grounds, order and conditions of personal data processing of the Company’s clients and other persons, whose personal data are processed by the Company (hereinafter - Subjects), in order to ensure protection of rights and freedoms of an individual and a citizen during processing of his/her personal data, including protection of rights for privacy, personal and family secrets.
2. The present Policy is developed according to requirements of the Law of the Republic of Kazakhstan dated May 21, 2013 #94-V "On personal data and its protection", the Law of the Republic of Kazakhstan dated November 24, 2015 #418- V "On informatization", other legislative acts of the Republic of Kazakhstan, the Charter and internal regulatory documents of the Company.

2. Subjects' personal information that is received and processed by the Company

1. Within the framework of the present Policy, the Subject's personal information is as follows:
   1. Personal data provided by the Subject:
      • Subject's surname, first name and patronymic;
      • e-mail address/postal address;
      • phone number;
      • information on the current place of work and position;
      • data on the claims, complaints and other communications from the Subject using the website;
      • other data as stipulated in the consent to the processing of personal data.
   2. Data automatically transmitted to the Company by the Subject, such as IP address, a date and time of the access to Services, URLs of the requested pages, cookies files data.
2. Processing of personal data shall be carried out for the purposes of:
   • establishing (formalizing) a contractual relationship;
   • organization and conduct by the Company (including engagement of third parties on legitimate grounds) of loyalty programs, marketing and/or advertising campaigns, surveys, questionnaires and other activities;
   • fulfilling by the Company its obligations under the contracts for delivery of products, activities and any other services to the Subjects;
   • promoting the services and/or goods of the Company and/or of the Company’s partners in the market through direct contact with the Company’s clients by various means of communication, including but not limited to telephone, email, postal mailing, via the Internet, etc.;
   • feedback to the Subjects, including processing of their requests and appeals, informing them about the operation of the Website;
   • provision of the Company’s services to the Subjects, as well as information on the development of new products and services by the Company, including advertising;
   • preparation of reference materials for internal information support of the Company, its branches and representative offices, as well as the Company’s organizations;
   • exercising the rights and lawful interests of the Company as part of the activities stipulated by the Charter and other local regulatory acts of the Company, as well as of third parties, or accomplishing socially important goals.
   • for such other purposes as may be set out by the consent for processing of personal data, the agreement between the Company and the Subject, and the laws of the Republic of Kazakhstan.
3. The list of actions performed by the Company with personal data: collection, systematization, accumulation, storage, clarification (update, change), use, distribution (including transfer), depersonalization, blocking, destruction, as well as performing any other actions in accordance with applicable laws of the Republic of Kazakhstan.
4. Processing of personal data by the Company is carried out the following ways:
   • non-automated processing of personal data;
   • automated processing of personal data with transfer of received information via information and telecommunication networks or without such a transfer;
   • Mixed processing of personal data.

3. Terms for Processing of Personal Information of Subjects and its Transfer to Third Parties

1. Processing of personal data shall be carried out by the Company on condition of obtaining Subject's consent, except for the cases, established by legislation of the Republic of Kazakhstan, when processing of personal data can be carried out without such consent.
2. Subject of personal data may express his/her consent by taking action, making appropriate marks, filling in forms, posted on the Website, other forms or in writing in accordance with the legislation.
3. All of the Subject's personal information shall be kept confidential and secure.
4. The Company shall be entitled to transfer the Subject's personal information and/or have it processed by third parties in the following cases:
   1. the Subject has given his/her consent to such actions;
   2. the transfer is necessary for performance of the agreement with the Subject;
   3. for the purpose of providing an opportunity to protect the rights and legitimate interests of the Company;
   4. in other cases stipulated by law.
5. Website may contain links to other websites that are not operated by the Company. If the Subject clicks on the link, he or she will be directed to a third-party website. The Company strongly recommends that the Subject reads the privacy policy on each website that he/she visits. The Company has no control over, and assumes no responsibility for the content, privacy policies or practices of third-party websites or services.
6. The time frame for processing the personal data shall be established taking into account:
   • The identified purposes of the processing of personal data.
   • Periods of validity of contracts with subjects of personal data and consents of subjects of personal data for processing of their personal data.
   • Legislation of the Republic of Kazakhstan.
7. Processed personal data is subject to destruction or depersonalization after achievement of processing objectives or in case of no further need in achievement of such objectives, unless otherwise provided by the legislation of the Republic of Kazakhstan.
8. Processed personal data is subject to destruction or depersonalization in case of the following conditions:
9. Achievement of personal data processing objectives or maximum storage periods;
   • No further need to achieve the purposes of personal data processing; 
   • Provision of personal data by Subject or confirmation by his/her legal representative that the personal data is illegally obtained or is not necessary for the stated purpose of processing;
   • Failure to ensure the legitimacy of personal data processing;
   • Withdrawal of personal data subject's consent to the processing of personal data, if preservation of personal data is no longer required for the purposes of personal data processing;
   • Withdrawal of personal data subject's consent to the use of personal data for the purposes of contacting potential consumers during the promotion of goods and services;
   • Expiry of the limitation period for the legal relationship in which the personal data is or was processed;
   • Liquidation (reorganization) of the Company.
10. The Company shall take the necessary legal, organizational and technical measures to ensure the security of personal data to protect it from unauthorized (including accidental) access, destruction, modification, blocking of access and other unauthorized actions. Such measures are as follows:
    • designation of staff responsible for organizing the processing and security of personal data;
    • checking availability of confidentiality clauses in contracts and inclusion of clauses on confidentiality of personal data in contracts, if necessary;
    • issuance of local regulations governing the rules and procedure for processing of personal data in the Company, familiarization of employees with them and training of users;
    • ensuring physical security of premises and means of processing, pass control, security guards, video surveillance;
    • restriction and delimitation of access of employees and other persons to personal data and means of processing, monitoring of operations with personal data;
    • identification of security threats to personal data in the course of data processing, and development of threat models based on such threats;
    • application of security tools (antivirus, firewalls, unauthorized access protection, cryptographic protection of information), including those that have undergone the procedure of compliance assessment in the prescribed manner;
    • backup of information for the possibility of recovery;
    • internal control over compliance with the established procedure, verification of the effectiveness of the measures taken, and response to incidents.
    • other measures stipulated by the legislation of the Republic of Kazakhstan.

4. Rights and obligations of subjects of personal data

1. Company does not verify the accuracy of personal data provided by Subjects.
2. Subject shall notify the Company in writing within 14 calendar days upon change of personal data. The Company has the right to request additional information and documents from the Subject to confirm their accuracy.
3. Subject has the right to receive information relating to the processing of his personal data, including those:
   • confirmation of the fact of processing the personal data by the Company;
   • legal basis, purpose and period of processing of personal data, including the period of its storage;
   • objectives and methods of personal data processing used by the Company;
   • name and location of the Company, information on persons (other than personnel/employees of the Company) who have access to personal data or to whom personal data may be disclosed on the basis of the contract with the Company or by law;
   • processed personal data pertaining to the relevant personal data subject, the source of their receipt, unless another procedure for providing such data is prescribed by law;
   • the procedure for exercising the Subject's rights under the legislation of the Republic of Kazakhstan;
   • information on implemented or supposed trans-border transfer of data;
   • other information specified by the legislation of the Republic of Kazakhstan.
4. The Subject has the right to request the Company to clarify his personal data, block or destroy them if personal data are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as also take statutory measures to protect his rights.
5. If the Subject believes that the Company is processing his/her personal data in contradiction with the legislation of the Republic of Kazakhstan or otherwise violates his/her rights and freedoms, the Subject has the right to appeal against actions or inaction of the Company.
6. The Subject has the right to protect his/her rights and legitimate interests including compensation for losses and (or) compensation for moral damage in court.
7. The Subject has the right to withdraw his/her consent by drawing up a corresponding written document (application), which can be sent to the Company by registered mail with notification of receipt or delivered personally and signed by a representative of the Company.

5. Rights and obligations of the Company

1. The Company has the right to entrust the processing of personal data to another person with the consent of the subject of personal data on the basis of a contract concluded with such a person. This contract shall contain a list of actions (operations) with personal data to be performed by a person engaged in processing of personal data, processing purposes, an obligation of such person to maintain confidentiality of personal data and ensure security of personal data at their processing, as well as requirements to protection of processed personal data in accordance with the laws of the Republic of Kazakhstan.
2. For the purpose of internal information support, the Company may create internal reference materials, which with written consent of the subject of personal data, unless otherwise provided by the legislation of the Republic of Kazakhstan, may include his/her surname, name, patronymic, place of work, position, date of birth, subscriber (mobile) number, e-mail address, other personal data, provided by the subject of personal data. Employees accessing such materials shall be informed of the confidentiality of the information provided to them and shall sign an agreement of non-disclosure.
3. The Company has the right to process personal data obtained by lawful means without the Subject's consent in the cases provided by Art. 9 of the Law of the Republic of Kazakhstan dated May 21, 2013 N 94-V "On Personal Data and Their Protection" or other acts of legislation of the Republic of Kazakhstan.
4. The Company shall have the right to refuse to fulfill a Subject's request for information relating to processing of his/her personal data in the cases stipulated by the Law of the Republic of Kazakhstan dated May 21, 2013 N 94-V "On Personal Data and Their Protection" or other legislative acts of the Republic of Kazakhstan.

6. Additional Terms and Conditions

1. The Policy shall be posted on the Website. The Company has the right to amend the Policy. The Company shall inform the Subject about changes in the Policy by posting the new version on the Website. By continuing to use the Website after the new version has been posted, the Subject agrees to the new version of the Policy.
2. The new Policy comes into effect from the moment it is posted on the Company's website, unless the new version of the Policy stipulates otherwise.
3. If the Subject has any questions about the Policy, he/she can contact the Company using the contact details indicated on the Website.
4. In the event of any questions or complaints from the Subject, he/she may contact the Company by any means available to him/her. All arising disputes will be settled by negotiations, in case of failure to achieve the settlement the dispute will be transferred for consideration to the court in accordance with the current legislation of the Republic of Kazakhstan.

Any further questions?

Please call +7 7172 64-03-21 or e-mail: office@q-doc.kz.