PRIVACY POLICY

This Privacy and Personal Data Processing Policy (hereinafter - the Policy) defines the procedure for the collection, processing, storage, use and protection of personal data of users of the website https://ecash.kz, the web application and the mobile application (hereinafter jointly - the Services), carried out by Ecash Limited Liability Partnership, BIN 221240028699 (hereinafter - the Company), acting as the owner of the database containing personal data, and Quiq Limited Liability Partnership, BIN 230140017242 (hereinafter - the Operator), which processes personal data on the instructions of the Company for the purposes of automating user registration processes and providing access to the functionality of the Services.

The Policy has been developed in accordance with the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 “On Personal Data and Their Protection” (hereinafter - the Law), the Law of the Republic of Kazakhstan No. 418-V dated 24 November 2015 “On Informatization”, as well as other regulatory legal acts of the Republic of Kazakhstan governing relations in the field of collection, processing and protection of personal data.

Use of the Services means that the user has read this Policy. A separate and independent consent to the collection and processing of personal data is given by the user in the manner provided for in Section 5 of this Policy and is executed as a separate document - the Consent to the Collection and Processing of Personal Data.

1. TERMS AND DEFINITIONS

This Policy uses terms in the meanings defined in Article 1 of the Law, including:

• Personal data - information relating to a specific subject of personal data, or a subject identifiable on the basis of such information, recorded on electronic, paper and (or) other tangible media.
• Subject of personal data (User) - an individual to whom the personal data relate and who uses the Services.
• Owner of the database containing personal data (Owner) - the Company, which exercises the right to own, use and dispose of the database containing personal data.
• Operator of the database containing personal data (Operator) - Quiq, which collects, processes and protects personal data on the instructions of the Owner.
• Third party - a person who is not the subject, the Owner and (or) the Operator, but is connected with them by circumstances or legal relations concerning the collection, processing and protection of personal data.
• Processing of personal data - actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalization, blocking and destruction of personal data.
• Cross-border transfer of personal data - the transfer of personal data to the territory of foreign states.
• Consent - the consent of the subject of personal data to the collection and processing of personal data, given in the manner provided for in Article 8 of the Law.

2. PERSONAL DATA SUBJECT TO COLLECTION AND PROCESSING

When the User registers for and uses the Services, the Owner and the Operator collect and process the following personal data of the User:

• surname, first name, patronymic (if indicated in the identity document);
• mobile phone number and (or) email address;
• information on the fact, date and time of giving the Consent, the version of its text, as well as other technical information (account or session identifier) recorded for the purpose of confirming receipt of the Consent.

The Owner and the Operator do not collect personal data that are not necessary for the purposes specified in Section 3 of this Policy.

3. PURPOSES OF COLLECTION AND PROCESSING OF PERSONAL DATA

Personal data are collected and processed for the following purposes:

• registration of the User in the Services and creation of an account;
• identification and authentication of the User, including by means of a one-time password (OTP code);
• providing the User with access to the functionality and services of the Services;
• enabling the User to log in to the account and to recover it;
• sending the User service messages necessary for registration, authentication and use of the Services;
• ensuring the security of the Services and preventing unlawful access to the account.

The use of personal data for purposes incompatible with those specified above is not permitted without an appropriate legal basis, including, where necessary, a separate consent of the subject.

4. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

The legal basis for the collection and processing of personal data is the Consent of the subject, given in electronic form upon registration in the Services by ticking a box in the interface (checkbox) that is not ticked by default. Registration cannot be completed without giving the Consent.

The Consent is given in a manner that makes it possible to confirm the fact of its receipt, which complies with paragraph 1 of Article 8 of the Law. The fact that the Consent was given, the date and time it was given, the account (session) identifier and the version of the text of the Consent are recorded and stored by the Owner throughout the entire period of personal data processing and, after its expiry, for the period necessary to confirm the lawfulness of the processing.

The cases of collection and processing of personal data without the consent of the subject are exhaustively defined in Article 9 of the Law; none of these cases applies to the activities of the Owner and the Operator within the Services, and therefore obtaining the Consent is a mandatory condition for the processing of personal data.

5. ROLES OF THE OWNER AND THE OPERATOR

The Company acts as the Owner of the database containing personal data and independently determines the purposes and methods of personal data processing.

Quiq acts as the Operator and processes personal data solely on the instructions and in the interests of the Company for the purposes of automating user registration processes, maintaining accounts and integrating with the functionality of the Services. The Operator may not use the personal data received for purposes not agreed with the Company and is obliged to maintain the confidentiality of personal data and take measures to protect them in accordance with the requirements of the legislation of the Republic of Kazakhstan.

6. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

In addition to the Operator, the personal data of the User may be transferred to the following persons engaged by the Owner and (or) the Operator for the purposes specified in Section 3 of this Policy:

• providers of SMS and (or) OTP messaging services - for the purpose of confirming registration and login to the account;
• email service providers - for the purpose of sending service notifications;
• the hosting (data centre) service provider - for the purpose of storing personal data.

These persons are engaged on a contractual basis and are obliged to maintain the confidentiality of personal data and take measures to protect them in accordance with the requirements of the legislation of the Republic of Kazakhstan. No other transfer of personal data to third parties is carried out, except in cases expressly provided for by the legislation of the Republic of Kazakhstan, including upon a lawful request of state bodies.

7. CROSS-BORDER TRANSFER OF PERSONAL DATA

As at the date of approval of this Policy, the Owner and the Operator do not carry out cross-border transfer of personal data, that is, the transfer of personal data to the territory of foreign states, since the Operator and all persons specified in Section 6 of this Policy are registered and operate in the territory of the Republic of Kazakhstan, and the information systems and databases they use are physically located in the territory of the Republic of Kazakhstan.

Should these circumstances change so that cross-border transfer of personal data becomes necessary, the Owner undertakes, before such transfer begins, to bring this Policy and the Consent into compliance with the requirements of Article 16 of the Law, including verifying that the legislation of the receiving state ensures the protection of personal data, and to notify the Users thereof in the manner provided for in Section 13 of this Policy.

8. PLACE OF STORAGE OF PERSONAL DATA

Personal data are stored in a database physically located in the territory of the Republic of Kazakhstan, which complies with paragraph 2 of Article 12 of the Law. The Owner ensures compliance with this requirement in respect of the infrastructure used by the Operator and the other engaged persons specified in Section 6 of this Policy.

9. STORAGE PERIOD AND DESTRUCTION OF PERSONAL DATA

Personal data are stored for the period necessary to achieve the purposes of their collection and processing specified in Section 3 of this Policy, as well as for the period during which the User account is valid.

Personal data are subject to destruction in the cases provided for in Article 18 of the Law, including upon expiry of the storage period, upon termination of legal relations between the User, the Owner and (or) the Operator, as well as in other cases established by the legislation of the Republic of Kazakhstan.

10. PERSONAL DATA PROTECTION MEASURES

The Owner and the Operator apply organizational and technical measures to protect personal data aimed at preventing unauthorized access to, modification, copying, dissemination or destruction of personal data, in accordance with the requirements of Articles 20-23 of the Law. The personal data of the User are classified as confidential restricted-access information and are neither disclosed nor disseminated without the consent of the User, except in cases established by the legislation of the Republic of Kazakhstan.

11. RIGHTS OF THE SUBJECT OF PERSONAL DATA

In accordance with Article 24 of the Law, the User has the right to:

• receive information concerning the processing of their personal data, except in cases provided for by the legislation of the Republic of Kazakhstan;
• demand the clarification, modification or supplementation of their personal data if they are incomplete, outdated or inaccurate;
• withdraw the Consent in the manner provided for in Section 12 of this Policy;
• appeal against the actions (inaction) and decisions of the Owner and (or) the Operator related to the processing of their personal data, in the manner established by the legislation of the Republic of Kazakhstan.

Requests concerning the exercise of these rights are to be sent using the contact details specified in Section 15 of this Policy.

12. PROCEDURE FOR WITHDRAWAL OF CONSENT

The User has the right to withdraw the Consent by sending a corresponding request to the Owner using the contact details specified in Section 15 of this Policy. Withdrawal of the Consent makes further use of the Services that require registration impossible.

In accordance with paragraph 2 of Article 8 of the Law, withdrawal of the Consent is not permitted if it contradicts the legislation of the Republic of Kazakhstan or if the User has an unfulfilled obligation to the Owner and (or) the Operator.

13. AMENDMENTS TO THE POLICY

The Owner has the right to amend this Policy unilaterally and without prior notice to the Users. The current version of the Policy is posted at https://ecash.kz, as well as in the web application and the mobile application, and applies from the moment of its publication. The User is obliged to keep track of the current version of the Policy independently.

If the amendments expand the list of purposes of personal data processing, the scope of personal data collected or the range of persons to whom personal data are transferred, as compared with the Consent previously given, such amendments may be applied to personal data collected before their entry into force only on condition that a new consent is obtained from the User in the manner provided for in Article 8 of the Law.

14. LIMITATION OF LIABILITY OF THE COMPANY

The Company is not liable for:

• the reliability, accuracy and completeness of personal data provided by the User independently upon registration for and use of the Services;
• the impossibility of identifying or authenticating the User and other consequences arising from the User providing incomplete, inaccurate or outdated data;
• delay, non-delivery or other failures in the sending of SMS and (or) OTP messages or email messages that occur through the fault of telecommunications operators, email service providers or other third parties not under the control of the Company;
• unauthorized access by third parties to the User account resulting from the User losing control over the phone number, email address or other means of access to the account;
• losses arising from force majeure circumstances, as well as from lawful actions (inaction) of state bodies of the Republic of Kazakhstan.

Liability for violation of the requirements of the legislation of the Republic of Kazakhstan on personal data arises in the manner provided for in Article 29 of the Law and may not be excluded or limited by this Policy.

15. FINAL PROVISIONS AND CONTACTS

This Policy is governed by the legislation of the Republic of Kazakhstan. The invalidity of any individual provision of the Policy does not entail the invalidity of its remaining provisions.

On matters related to the processing of personal data, the exercise of the rights of the subject of personal data and withdrawal of the Consent, the User may send a request by email to info@ecash.kz or call +7 701 666 4398.