TELECONTACT ALMATY LLP

PERSONAL DATA PROCESSING POLICY


1. GENERAL PROVISIONS

1.1. The purpose of this Policy is to ensure the protection of human and civil rights and freedoms when processing their personal data, including the protection of rights to privacy, personal and family secret, with TELECONTACT ALMATY LLP.

1.2. This Policy has been elaborated in accordance with the Personal Data and Personal Data Protection Law of the Republic of Kazakhstan No.94-V dated 21 May 2013 (within the context may be used as "the Law") and shall apply to the Personal Data processed with TELECONTACT ALMATY LLP.

1.3. The Personal Data are the confidential information and subject to all requirements to the confidential information protection set by TELECONTACT ALMATY LLP's bylaws.

1.4. The Personal Data may be processed independently or as a part of other confidential information, which processing procedure is determined by the sectoral laws.

1.5. This Policy shall apply to all processes within TELECONTACT ALMATY LLP related to the processing of the Personal Data of the Subjects and shall be binding upon all the employees processing the Personal Data in the pursuance of their duties.

1.6. This Policy shall be effective from the date of its approval by the CEO and shall remain in force without limit of time until replaced with the new Policy. The unrestricted access to the Policy shall be provided by means of its posting at www.telecontact.kz, or otherwise.

1.7. All matters not covered in this Policy shall be governed by the applicable law of the Republic of Kazakhstan.

2. DEFINITION AND SCOPE OF THE PERSONAL DATA
2.1. TELECONTACT ALMATY LLP shall generate a List of Personal Data Subject to Protection in accordance with the Personal Data and Personal Data Protection Law of the Republic of Kazakhstan No.94-V dated 21 May 2013.

2.2. TELECONTACT ALMATY LLP shall regard any information relating to the directly or indirectly identified or being identified natural person (Personal Data Subject) as the Personal Data.

2.3. Depending on the Personal Data Subject, TELECONTACT ALMATY LLP shall process the Personal Data of the following categories of the Personal Data Subjects:



natural persons: employees of TELECONTACT ALMATY LLP, seekers, employees of the counterparties; persons being in the civil law relationships with legal entities – counterparties of TELECONTACT ALMATY LLP; persons provided their consent to processing to the client (potential client, partner, counterparty) of TELECONTACT ALMATY LLP, or other guarantor, at the instruction of which TELECONTACT ALMATY LLP processes the Personal Data; other natural persons consented to the personal data processing by TELECONTACT ALMATY LLP.

3. OBJECTIVES OF THE PERSONAL DATA PROCESSING

3.1. TELECONTACT ALMATY LLP shall process the Personal Data for the purpose of execution, performance and termination of the agreement with the natural persons, legal entities and other persons to the extent provided for by the applicable law and TELECONTACT ALMATY LLP's Charter; ensuring the labor and production processes and compliance with the law of the Republic of Kazakhstan related to the labor relations; keeping of accounting and tax treatment, payroll calculation and accounting and HR records keeping; execution by TELECONTACT ALMATY LLP of the instructions for the personal data processing given by the client (potential client, partner, counterparty) of TELECONTACT ALMATY LLP, or other guarantor, at the instruction of which TELECONTACT ALMATY LLP processes the Personal Data; recruiting for open vacancies; execution of voluntary health insurance for the employees of TELECONTACT ALMATY LLP; provision of the employees with the access to IT infrastructure; control of access to TELECONTACT ALMATY LLP's facilities.

4. TERMS OF THE PERSONAL DATA COLLECTION, PROCESSING

4.1. The Personal Data shall be collected and processed by TELECONTACT ALMATY LLP's operator with the consent of the subject or his/her legal representative, unless otherwise provided for by Article 9 of the Law.

4.2. The Personal Data of the deceased (adjudged missing or declared deceased) subject shall be collected and processed in accordance with the law of the Republic of Kazakhstan.

4.3. The specifics of collection, processing of the Personal Data in the electronic information resources shall be set forth in accordance with the information technology law of the Republic of Kazakhstan, subject to the provisions of the Law.

5. RIGHTS AND OBLIGATIONS
5.1. TELECONTACT ALMATY LLP shall be entitled to:

5.1.1. collect, process the Personal Data in accordance with the procedure established by this Law and other legal enactments of the Republic of Kazakhstan.

5.2. TELECONTACT ALMATY LLP shall:

5.2.1. approve the List of Personal Data necessary and sufficient for the performance of the tasks being discharged, unless otherwise provided for by the laws of the Republic of Kazakhstan;

5.2.2. take and comply with the necessary measures, including legal, organizational and technical ones, for the protection of the Personal Data in accordance with the law of the Republic of Kazakhstan;

5.2.3. comply with the personal data and personal data protection law of the Republic of Kazakhstan;

5.2.4. take measures for the destruction of the Personal Data, if the objectives of their collection and processing are attained, as well as in other cases provided for by this Law and other legal enactments of the Republic of Kazakhstan;

5.2.5. furnish evidence of obtaining the subject's consent to collection and processing of his/her Personal Data to the extent provided for by the law of the Republic of Kazakhstan;

5.2.6. provide the information related to the subject within three business days from the date of receipt of the subject or his/her legal representative's request, unless otherwise provided for by the laws of the Republic of Kazakhstan;

5.2.7. in case of refusal to provide the subject or his/her legal representative with the information within three business days from the date of request, submit a substantiated response, unless otherwise provided for by the laws of the Republic of Kazakhstan;

5.2.8. within one business day:

5.2.8.1. change and (or) supplement the Personal Data based on the respective documents supporting their integrity, or destroy the Personal Data, when it is not possible to change and (or) supplement;

5.2.8.2. block the Personal Data related to the subject, when there is an information on the breach of terms of their collection, processing;

5.2.8.3. destroy the Personal Data, if it is proved that they are collected, processed in breach of the law of the Republic of Kazakhstan, as well as in other cases provided for by this Law and other legal enactments of the Republic of Kazakhstan;

5.2.8.4. unblock the Personal Data, when the fact of breach of the terms of the Personal Data collection, processing is not confirmed.

5.3. The Personal Data Subject shall be entitled to:

5.3.1. know about the availability of his/her Personal Data with TELECONTACT ALMATY LLP, as well as the third party, as well as obtain the information containing:

5.3.1.1. confirmation of the fact, objectives, sources, means of collection and processing of the Personal Data;

5.3.1.2. List of Personal Data;

5.3.1.3. periods of processing of the Personal Data, including the periods of their storage.

5.3.2. require from TELECONTACT ALMATY LLP to change and supplement his/her Personal Data, where justified by the respective documents;

5.3.3. require from TELECONTACT ALMATY LLP, as well as the third party to block his/her Personal Data, if there is an information on the breach of the terms of collection, processing of the Personal Data;

5.3.4. require from TELECONTACT ALMATY LLP, as well as the third party to destroy his/her Personal Data, which have been collected and processed in breach of the law of the Republic of Kazakhstan, as well as otherwise provided for by this Law and other legal enactments of the Republic of Kazakhstan;

5.3.5. withdraw the consent to collection, processing of the Personal Data, except as otherwise provided for by Clause 2 Article 8 of the Law;

5.3.6. give consent (refuse) to TELECONTACT ALMATY LLP to distribute his/her Personal Data in the publicly available sources of personal data;

5.3.7. protect his/her rights and legal interests, including redress for the non-pecuniary damage and material damage;

5.3.8. exercise other rights provided for by this Law and other laws of the Republic of Kazakhstan.

5.4. The Personal Data Subject shall:

5.4.1 provide his/her Personal Data to the extent permitted by the laws of the Republic of Kazakhstan.

6. PRINCIPLES OF COLLECTION, PROCESSING AND PROTECTION OF THE PERSONAL DATA
6.1. The Personal Data shall be collected, processed and protected in accordance with the principles of:

6.1.1. respect for the constitutional human and civil rights and freedoms;

6.1.2. legality;

6.1.3. confidentiality of the Personal Data with restricted access;

6.1.4. equality of the rights of the subjects, owners and operators;

6.1.5. safety of person, society and state.

7. PERSONAL DATA SECURITY
7.1. TELECONTACT ALMATY LLP shall undertake the necessary organizational and technical measures in order to ensure the security of the Personal Data against the accidental or unauthorized access, destruction, change, blocking of access and other unauthorized actions.

7.2. The person in charge of security of the Personal Data shall be appointed for the coordination of activities on security of the Personal Data with TELECONTACT ALMATY LLP.

8. PERSONAL DATA ACCUMULATION AND STORAGE
8.1. The Personal Data shall be accumulated by means of collection of the Personal Data necessary and sufficient for the performance of the tasks being discharged by TELECONTACT ALMATY LLP, as well as the third party.

8.2. The Personal Data shall be stored by TELECONTACT ALMATY LLP, as well as the third party in the database, which is kept within the Republic of Kazakhstan.

8.3. The period of storage of the Personal Data shall be determined by the date of achievement of the objectives of their collection and processing, unless otherwise provided for by the law of the Republic of Kazakhstan.

9. FINAL PROVISIONS
9.1. This Policy is a bylaw of TELECONTACT ALMATY LLP, publicly available and subject to posting at the official website of TELECONTACT ALMATY LLP.

9.2. This Policy shall be amended and supplemented in case of adoption of new legal enactments and special regulatory documents for the personal data processing and protection, but at least once every three years.

9.3. The compliance with the requirements of this Policy shall be supervised by the person in charge of the security of TELECONTACT ALMATY LLP's Personal Data.

9.4. The liability of TELECONTACT ALMATY LLP's officials having access to the Personal Data for failure to comply with the regulation governing the personal data processing and protection shall be determined in accordance with the law of the Republic of Kazakhstan and TELECONTACT ALMATY LLP's bylaws.