Privacy and Personal Data Processing Policy

This Privacy and Personal Data Processing Policy (hereinafter referred to as the "Policy") regulates the procedure for processing and using personal and other data on the website of the Tayyab Central Asia Ltd Private Company (BIN 200640900169, registered on 17.06.2020 with the Companies Registrar of the Astana International Financial Centre) (hereinafter referred to as the "Company"). Personal data of users of the tayyab.kz service are processed by the Company. The Company is the owner and operator of the Database of personal data of users of tayyab.kz. Database of personal data of users of tayyab.kz is located at the place of registration of the Company.

This Policy describes the procedure established by the Company for processing personal data collected from the Internet resource tayyab.kz (hereinafter referred to as the "Website"), the mobile application tayyab.kz (hereinafter referred to as the "mobile application") and the related services and tools on the Website and in the mobile application. To the full extent, the Company processes users' personal data exclusively in accordance with the requirements of the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and their Protection", as well as international treaties ratified by the Republic of Kazakhstan. The Policy follows the requirements of such Law and international treaties. Users should be aware that when they click on certain links placed on the Website or in the mobile application), they may be redirected to the websites (applications, etc.) of other companies outside the Company's hosting space ("google+"), where the Users' data is collected beyond the direct control of the Company. In this case, the Privacy Policies of third-party websites and / or applications will regulate the processing of information received from users by these third parties.

By transmitting personal and other data to the Company through the Website or mobile application, the User confirms his/her consent to the use of this data under the conditions set out in this Policy.

If the User does not agree with the terms of this Policy, he/she is obliged to stop using the Website and the mobile application.

The start of using the Website and / or mobile application by the User is considered to be the User's unconditional acceptance of this Privacy Policy.


1.TERMS

1.1. Website - a website placed on the Internet at the address tayyab.kz. All exclusive rights to the Website and its individual elements (including software, design) are fully owned by the Company. The transfer of exclusive rights to the User is not the subject of this Policy.

1.2. User - a person who uses the Website and / or mobile application.

1.3. Legislation - the applicable legislation of the Republic of Kazakhstan.
1.4. Personal data - the User's personal data that the User provides by himself/herself upon registration in the mobile application or in the process of using the Website's functionality.

1.5. Data – other User data (other than that described in the term of Personal Data).


2. PERSONAL DATA COLLECTION AND PROCESSING

2.1. The Company collects and stores only those Personal Data that are necessary for the provision of Services by the Company and communication with the User. The Company undertakes to use personal data in accordance with the Law "On Personal Data" of the Republic of Kazakhstan and internal documents of the Company.

The privacy of the User's personal data and other data is kept, except where such data is publicly available.2.2. Personal data may be used for the following purposes:

2.2.1. to provide Services to the User;

2.2.2. to communicate with the User;

2.2.3. to send advertising materials, information and requests to the User;

2.2.4. to conduct statistical and other research;

2.2.5. to provide services to the User, including opening and management of the User accounts, solve technical difficulties and issues of access to various functions of the Website and / or mobile application;

2.2.6. to take control of Users' general and individual activities, as well as for traffic management on the Website;

2.2.7. to communicate with the Users, including on matters related to the service, customer service or permitted marketing communications through any available communication channels;

2.2.8. to ensure compliance with the User Agreement;

2.2.9. to review the option of entering into transactions with second-tier banks of the Republic of Kazakhstan;

2.2.10. in order to make money transfers, the User's personal data may be provided by the Company to the Company's counterparty (the counterparty of the Company's representative) and to all banks/processing organizations/IPS (international payment systems), which are involved in the transfer/routing/processing of the User's order(s) (order(s) of the User's representative);

2.2.11. for internal control and accounting;

2.2.12. to perform User identification in order to minimize the risks of unauthorized transactions in accordance with the legislation of the Republic of Kazakhstan;

2.2.13. for judicial and non-judicial protection of the Company's rights: (i) in case of violation of obligations under the relevant contracts (agreements); (ii) in case of disputes, including disputes with third parties;

2.2.14. to publish public (disclosed) data and information in the mass media in compliance with the requirements of the legislation of the Republic of Kazakhstan;

2.2.15. for the Company's interaction with third parties that are and (or) may be related to the execution and (or) performance of any transactions / operations that have been executed (may be executed in the future) between Users and second-tier banks of the Republic of Kazakhstan;

2.2.16. to provide reports and (or) information to the authorized bodies, audit, evaluation and other competent organizations to the extent established by the legislation of the Republic of Kazakhstan;

2.2.17. for identification and providing access to the Company's information systems, to the mobile application, subject to the restrictions stipulated in the Company's internal documents to ensure the safety procedures;

for the exchange of information, including for the consideration and / or provision of responses to requests, complaints, suggestions, recommendations, claims, instructions, etc. of Users (and / or third parties), the transmission (receipt) of correspondence (mail) to the address of Users for sending (delivery)/receipt through the services of a courier, courier service, express mail, etc.;

2.2.18. for marketing purposes, delivery (mailing) to Users of any advertisements, including on the products and (or) services, and other notifications by phone, fax and other forms of communication, and via open channels of communication (including SMS, e-mail, fax, etc.);

2.2.19. for the development of marketing and promotion offers, future maintenance, subject to the historical relationship between the User and the Company;

for other purposes that are prescribed (may be prescribed) by the legislation of the Republic of Kazakhstan.

The Company may retain the information it collects and receives on its Website and / or mobile application for as long as it is required to reach the above business purposes. The Company has the right to retain an archived copy of personal data. The Company has the right to store personal data and data on servers outside the territory of the Republic of Kazakhstan.

2.3. The Company also processes the following data:

2.3.1. information necessary to fill out the forms, statements and proper identification: surname, name, patronymic; citizenship; data, photo/video of the document proving the identity; personal identification number; date and data of birth; gender; photo; signature; video with Users, etc.;

2.3.2. information required for communication: place of residence, place of actual location (stay/residence), place of work and position; telephone number (home, work, cell), e-mail address; the information contained in the address statement, etc.;

2.3.3. information on family / social status: data of the marriage certificate, surname, name, patronymic of the spouse, data from the identity document of the spouse; presence/absence of dependents and (or) other family members; kinship, surnames, names, patronymics and dates of birth of other family members, dependents; list of persons whose official representative and (or) guardian is the User; other information;

2.3.4. Information on the purpose and nature of business relationship;

2.3.5. information on education, professional activity, official position, business reputation: education, profession, qualification (including advanced training), position, academic degree, academic title, membership in professional chambers/organizations, knowledge of foreign languages and other information; data of the certificate of state registration of an individual entrepreneur, data of the license to carry out licensed activities, awards, patents, diplomas, certificates; information of criminal records, criminal / administrative sanctions;

2.3.6. information on bank deposits (account numbers, special card accounts, deposit type, tenor, amount, terms and other information); information on loans, bank accounts (including special card accounts), funds and securities, including those in trust management and in trust custody (contract data, including account numbers, special card accounts, bank card numbers, bank card codes, credit history codes, addresses of purchased real estate items, the amount and currency of the loan, the loan purpose and conditions, information on collateral, balances and amounts of movement on accounts, type of bank cards, limits and other information;

2.3.7. other information required by the Company in accordance with the requirements of the legislation of the Republic of Kazakhstan and internal documents of the Company;

2.3.8. Information on changes and (or) additions to the above data.

2.4. The Users hereby confirm that:

1. they are notified of the personal data protection in a manner similar to the protection of information constituting a secret;
2. consent to the collection and processing of personal data is not subject to revocation to the extent contrary to the legislation of the Republic of Kazakhstan, or if there is an unfulfilled obligation to the Company;

1. The Company has the right to collect and process personal data without the consent of Users in cases established by the legislation of the Republic of Kazakhstan, including in banks and (or) organizations for the purposes of conducting any events not prohibited by the legislation of the Republic of Kazakhstan;
2. The Company has the right to collect (receive) personal data of Users from the Users themselves and any third parties, as well as to transfer the Customer's personal data to third parties/distribute in publicly available sources of personal data, subject to the requirements of the legislation of the Republic of Kazakhstan and the requirements of international law (requirements of international treaties);
3. if the relevant contract (s) /agreement (s) entered into by the Company provide / will provide the transfer of personal data of Users through open communication channels, the Users are aware of and take the risk of unauthorized receipt of such data by third parties;
4. this consent grants the Company the right, in accordance with the procedure established by the legislation of the Republic of Kazakhstan, to perform any action (operation) or a number of such actions (operations) with the personal data of Users, including those performed with or without the automation tools, including, but not limited to, collection, processing, recording, copying, backup, protection, screening, systematization, accumulation, storage inside and outside the Company's databases (in compliance with security and confidentiality requirements), clarification (modification, updating), extraction, use, transfer (distribution, provision of access, including transfer to third parties with the right to process Users' personal data), depersonalization, blocking, deletion, destruction;
5. no Customer's notification of the Company's receipt from third parties and / or the Company's transfer of Users' personal data to third parties is required, such personal data may be collected (transferred) and processed by the Company without giving notices to the Users;
6. this consent may be submitted to third parties as proof that the consent to the collection and processing of Users' personal data was provided to the Company by the Users.

2.5. The Company has the right to transfer personal data and the User data without the User's consent to the following persons:

- state bodies, including bodies of inquiry and investigation, and local self-government bodies at their reasoned request;

- otherwise as expressly provided in the applicable legislation of the Republic of Kazakhstan.

2.6. The Company has the right to transfer personal data and data to third parties not specified in Article 2 of this Policy in the following cases:

- the User has expressed his/her own consent to such actions;

- the transfer is necessary as part of the User's use of the Website, mobile application or the provision of Services to the User.

2.7. The Company performs automated processing of Personal Data and Data.


3. PERSONAL DATA PROTECTION

3.1. The Company provides proper protection of personal and other data in accordance with the legislation of the Republic of Kazakhstan and takes relevant and sufficient organizational and technical security measures to protect personal data.

3.2. The applicable security measures also allow to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other illegal actions of third parties.

3.3. All data that the Company collects is reasonably protected by technical means and security procedures in order to prevent data unauthorized access or use.


4. INFORMATION EXCHANGE

4.1. The Company may share the information it collects with its affiliates. At the same time, the transmitted data remains the subject of the Policy.

4.2. The Company may transfer certain depersonalized information (data that does not allow identify individual User) third party service providers, trusted partners, or authorized researchers in order to better understand what advertising or services may be of interest to Users, to improve the overall quality and effectiveness of the services on the Website or a Service, or to make its contribution to scientific research that, in the Company's opinion, can bring great social benefits.

4.3. Service: When Users contact the Company, the Company may - as part of the operations of its Website and/or mobile application - collect personal information necessary to fulfill the User's request and receive feedback, if any. The Company may also contact the User using the User's existing contact information provided for this purpose. The Company may also collect other information about communication with Users, such as help desk requests or feedback submitted by Users.

4.4. Website and mobile data: The Company may automatically receive and register on its servers any information from the User's browser or any device, including the IP address, software and hardware attributes, pages requested by the User, mobile identifiers, information about the use of the application, and/or information about other devices used or system-level information. This may occur on the Website, or the mobile app, or the third party services.

4.5. Added information: The Company may also add information legally obtained from business partners or third parties to the Company's existing data of its Users.


5.MISCELLANEOUS

5.1. This Policy and the relations between the User and the Company arising from the application of the Policy are subject to the law of the Republic of Kazakhstan.

5.2. All possible disputes arising from this Policy are subject to resolution in accordance with the applicable legislation at the place of registration of the Company.

Before applying to the court, the User must comply with the mandatory pre-trial procedure and send the Company a corresponding claim in writing. The response time to the claim is 30 (thirty) business days.

5.3. If, for any reason, one or more provisions of the Policy are declared invalid or unenforceable, the validity or enforceability of the remaining provisions of the Policy shall not be affected.
5.4. The Company has the right at any time to change the Policy (in whole or in part) at its own discretion without prior agreement with the User. All changes shall be valid upon placement on the Website.

5.5. The User agrees to monitor changes to the Policy on its own by reviewing the current version.

5.6. All suggestions and questions regarding this Policy should be submitted by e-mail: [email protected] or by phone:+7 707 114 99 33.