Policy Regarding the Processing of Personal Data

CHAPTER 1. GENERAL PROVISIONS
1.1. This Personal Data Processing Policy (hereinafter referred to as the "Policy") of TUV Thuringen Kazakhstan LLP (hereinafter referred to as the "Company") establishes the fundamental principles, purposes, terms, and methods of personal data processing, lists of data subjects and processed personal data, the Company's functions in processing personal data, the rights of personal data subjects, and the personal data protection requirements implemented by the Company.
1.2. This Policy has been prepared in accordance with the requirements of the Constitution of the Republic of Kazakhstan, Law of the Republic of Kazakhstan No. 94-V "On Personal Data and their Protection" dated May 21, 2013 (hereinafter referred to as the "Law"), and other regulatory legal acts. It applies to all personal data processed by the Company that may be obtained from:

a personal data subject or their representative who is a party to a civil law contract with the Company;
a legal entity that has entered into a civil law contract with the Company;
a personal data subject in an employment relationship with the Company;
visitors to the Company's office;
visitors to the Company's websites and any other personal data subjects.

This Policy complies with the applicable legislation of the Republic of Kazakhstan and is based on the following regulatory legal acts:

The Constitution of the Republic of Kazakhstan;
The Labor Code of the Republic of Kazakhstan;
Laws of the Republic of Kazakhstan "On Personal Data and their Protection" dated May 21, 2013, and "On Informatization" dated November 24, 2015;
Order of the Minister of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan No. 395 dated October 21, 2020 "On Approval of the Rules for Collection and Processing of Personal Data";
Other regulatory legal acts of the Republic of Kazakhstan.

1.3. This Policy also applies to all information that the Company may obtain about visitors to the Company's website tuv-thuringen.kz.
1.4. Key terms and definitions used in this Policy and other local legal acts and documents of the Company governing personal data processing matters:

Biometric data — personal data that characterize the physiological and biological characteristics of a personal data subject, on the basis of which their identity can be established;
Blocking of personal data — actions to temporarily suspend the collection, accumulation, modification, addition, use, dissemination, de-identification (depersonalization), and destruction of personal data;
Use of personal data — actions involving personal data aimed at achieving the business purposes of the owner, operator, and third party;
Candidate — an individual applying for a vacant position;
Accumulation of personal data — actions to systematize personal data by entering them into a database containing personal data;
De-identification (depersonalization) of personal data — actions resulting in the impossibility of determining the ownership of personal data by a specific personal data subject;
Processing of personal data — actions aimed at the accumulation, storage, modification, addition, use, dissemination, de-identification, blocking, and destruction of personal data;
Publicly available personal data — personal data or information to which confidentiality requirements do not apply pursuant to the legislation of the Republic of Kazakhstan, access to which is unrestricted with the consent of the subject;
Operator of a database containing personal data (hereinafter referred to as the "Operator") — a state body, an individual, and/or a legal entity performing the collection, processing, and protection of personal data;
Personal data — information relating to a personal data subject who is identified or identifiable on the basis of such information, recorded on electronic, paper, and/or other material media;
Dissemination of personal data — actions resulting in the transfer of personal data, including through the mass media or granting access to personal data by any other means;
Collection of personal data — actions aimed at obtaining personal data;
Personal data subject — an individual to whom the personal data relates;
Cross-border transfer of personal data — transfer of personal data to the territory of foreign states;
Destruction of personal data — actions as a result of which it is impossible to restore personal data;
Storage of personal data — actions to ensure the integrity, confidentiality, and availability of personal data.

CHAPTER 2. PRINCIPLES AND PURPOSES OF PERSONAL DATA PROCESSING
2.1. The Company, acting as the Personal Data Operator, processes personal data of the Company's employees and other personal data subjects who are not in an employment relationship with the Company.
2.2. Personal data processing in the Company is carried out taking into account the need to protect the rights and freedoms of employees and other personal data subjects, including the right to privacy, personal and family confidentiality, based on the following principles:

personal data processing is carried out on a lawful and fair basis;
personal data processing is commensurate with the stated purposes of processing and ensures, at all stages, a fair balance of interests of all parties concerned;
personal data processing is carried out with the consent of the personal data subject, except in cases stipulated by legislative acts;
personal data processing is transparent; a personal data subject may be provided with relevant information regarding the processing of their personal data exclusively;
the Operator takes measures to ensure the accuracy of the processed personal data and updates them when necessary;
personal data storage is carried out in a form permitting identification of the personal data subject for no longer than required by the stated purposes of processing;
personal data processing is carried out based on the confidentiality of restricted-access personal data;
processing of incoming requests, quote inquiries for calculating the cost of logistics services, and feedback from users of the website tuv-thuringen.kz;
ensuring stable operation, analytics, and security of the website tuv-thuringen.kz.

2.3. Personal data are processed by the Company for the following purposes:

exercising functions, powers, and duties imposed on the Company by the legislation of the Republic of Kazakhstan, including the provision of personal data to tax authorities, the Unified Accumulative Pension Fund of the Republic of Kazakhstan (UAPF), the State Social Insurance Fund of the Republic of Kazakhstan, the Social Health Insurance Fund, and other authorized bodies;
regulating employment relationships with the Company's employees;
preparing, concluding, performing, and terminating contracts and other relations with counterparties;
exercising the rights and legitimate interests of the Company within its scope of activities;
recruiting and selecting job candidates;
providing information and conducting corporate events, marketing campaigns, surveys, and research;
for other legitimate purposes where necessary to ensure compliance with applicable law.

CHAPTER 3. CATEGORIES OF SUBJECTS WHOSE PERSONAL DATA ARE PROCESSED BY THE COMPANY
3.1. The Company processes personal data of the following categories of subjects:

employees of the Company;
relatives of the Company's employees;
candidates for job vacancies;
individuals in civil law relations with the Company;
individuals who are counterparties (clients) of the Company;
employees and authorized representatives of corporate counterparties (legal entities);
other subjects whose interaction with the Company necessitates personal data processing;
users (visitors) of the website tuv-thuringen.kz who submit an inquiry or use the site's services.

CHAPTER 4. LIST OF PERSONAL DATA PROCESSED BY THE COMPANY
4.1. The scope of personal data processed by the Company is determined in accordance with the legislation of the Republic of Kazakhstan and internal local legal acts of the Company, taking into account the purposes of processing specified in this Policy.
4.2. Personal data of employees' relatives include:

full name (surname, first name, patronymic);
date of birth;
Individual Identification Number (IIN);
citizenship;
passport details or data of other identity documents;
registered residential address;
actual residential address;
medical information (in cases stipulated by law);
information on social benefits and statutory payments;
contact details.

4.3. Personal data of job candidates include:

full name (surname, first name, patronymic, as well as all previous surnames);
date and place of birth;
Individual Identification Number (IIN);
citizenship;
passport details or data of other identity documents;
gender;
marital status and family composition (indicating names, dates of birth, places of work and/or study of family members);
registered residential address;
actual residential address;
details regarding education, professional development, vocational retraining, academic degrees, and titles;
employment history (including length of service, previous employment records indicating position, department, employer information, etc.);
specialty, profession, and qualifications;
military registration data;
medical information (in cases stipulated by law);
biometric personal data (including photographs, CCTV surveillance recordings, and voice recordings);
information on social benefits and statutory allowances;
contact details;
awards, recognitions, and commendations;
information provided by the candidate during personality questionnaires; other data that may be specified in the candidate's CV/resume or application form.

4.4. Personal data of employees and representatives of corporate counterparties include:

full name (surname, first name, patronymic);
passport details or data of other identity documents;
Individual Identification Number (IIN);
registered residential address;
contact details;
job position / title;
other data required for the performance of mutual rights and obligations between the Company and the counterparty.

4.5. Personal data of individual counterparties include:

full name (surname, first name, patronymic);
citizenship;
Individual Identification Number (IIN);
passport details or data of other identity documents;
registered residential address;
bank account details;
contact details;
title/property ownership registration certificate details;
other data required for the performance of mutual rights and obligations between the Company and the counterparty.

4.6. Personal data of individuals in civil law relations with the Company include:

full name (surname, first name, patronymic, and previous surnames);
date of birth;
citizenship;
passport details or data of other identity documents;
gender;
place of temporary stay / residence;
education, vocational development, training, academic degrees, and titles;
bank account details;
specialty, profession, and qualifications;
medical information (in cases stipulated by law);
biometric personal data (including photographs, CCTV surveillance recordings, voice recordings);
information on social benefits and allowances;
contact details;
other data required for the performance of mutual rights and obligations.

4.7. The Company does not process special categories of personal data concerning racial or ethnic origin, political views, trade union membership, religious or philosophical beliefs, health status, sex life, administrative or criminal liability records, or genetic personal data.
4.8. Personal data of tuv-thuringen.kz website users include:

full name (surname, first name, patronymic, if applicable);
contact telephone number;
email address;
name of the represented organization and job position;
route details and cargo specifications submitted in inquiry forms;
technical data automatically transmitted by the user's device: IP address, cookie data, browser type, operating system, and referral source.

CHAPTER 5. FUNCTIONS OF THE COMPANY IN PERSONAL DATA PROCESSING
5.1. When carrying out personal data processing, the Company:

adopts measures necessary and sufficient to ensure compliance with the requirements of the legislation of the Republic of Kazakhstan and internal local legal acts governing personal data;
takes legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as against other unauthorized actions;
appoints a designated officer responsible for internal control over personal data processing;
issues internal regulations and local acts governing personal data processing and protection;
familiarizes employees directly engaged in processing with the provisions of applicable data protection legislation and internal policies, and provides regular training;
publishes or otherwise ensures unrestricted public access to this Policy;
provides information upon request to data subjects or their legal representatives concerning the existence and status of their personal data and grants access to such data, unless otherwise provided by law;
ceases processing and destroys personal data in cases provided for by the legislation of the Republic of Kazakhstan;
performs other actions provided for by the legislation of the Republic of Kazakhstan in the field of personal data.

CHAPTER 6. TERMS AND CONDITIONS OF PERSONAL DATA PROCESSING
6.1. Personal data processing is conducted with the consent of the personal data subject, unless otherwise provided by the legislation of the Republic of Kazakhstan.
6.2. The Company shall not disclose personal data to third parties or disseminate personal data without the subject's consent, unless otherwise required by the laws of the Republic of Kazakhstan.
6.3. The data subject or their legal representative grants (or revokes) consent to the collection and processing of personal data in writing, in electronic format, via a personal data access control service, or by any other means allowing verification of receipt of consent, including by ticking the designated acceptance box in web forms on tuv-thuringen.kz.
6.4. Access to processed personal data is restricted solely to authorized employees of the Company whose job responsibilities directly involve processing personal data.

CHAPTER 7. ACTIONS PERFORMED ON PERSONAL DATA AND PROCESSING METHODS
7.1. Processing performed by the Company includes collection, systematization, storage, modification, use, de-identification, blocking, dissemination, provision, and deletion of personal data.
7.2. Personal data processing is performed using the following methods:

automated processing (utilizing computing systems);
non-automated processing (without automation tools), provided that structured search and/or access based on specific criteria (lists, databases, physical records, registers) is ensured.

7.3. Cross-border transfer of personal data is prohibited if the receiving foreign jurisdiction fails to ensure an adequate level of protection of the rights of personal data subjects, with the exception of:

cases where the subject or their legal representative has granted explicit consent to such cross-border transfer;
cases provided for by international treaties ratified by the Republic of Kazakhstan;
cases provided for by the laws of the Republic of Kazakhstan where necessary to protect the constitutional order, safeguard public order, human and civil rights and freedoms, and protect public health and morals;
cases concerning the defense of constitutional human and civil rights and freedoms where obtaining consent is impossible.

7.4. Accumulation and storage of personal data of citizens of the Republic of Kazakhstan are performed by the Company in databases situated on servers and physical storage media physically located within the territory of the Republic of Kazakhstan.

CHAPTER 8. RIGHTS AND OBLIGATIONS OF PERSONAL DATA SUBJECTS
8.1. Personal data subjects have the right to: know about the existence of their personal data held by the Operator and third parties, and obtain information regarding:

confirmation of the fact, purpose, sources, and methods of collection and processing;
the scope and list of personal data;
retention periods and processing timelines;
demand that the Operator modify or supplement their personal data upon providing supporting documentary evidence;
demand that the Operator or a third party block their personal data if there is reason to believe that collection or processing terms have been violated;
demand that the Operator or a third party destroy their personal data if they were collected or processed in violation of the legislation of the Republic of Kazakhstan, or in other statutory cases;
revoke consent to the collection and processing of personal data, except in cases stipulated by legislative acts of the Republic of Kazakhstan;
grant consent to (or refuse) the Operator regarding the distribution of their data in publicly available sources;
protect their rights and legitimate interests, including claims for moral and material damages;
exercise other rights provided for by the Law and other legislative acts of the Republic of Kazakhstan.

8.2. A personal data subject is obligated to:

provide the Operator with accurate and up-to-date personal data;
promptly notify the Operator of any modifications or updates to their personal data;
fulfill other duties provided for by the legislation of the Republic of Kazakhstan.

CHAPTER 9. MEASURES TAKEN BY THE COMPANY TO FULFILL OPERATOR OBLIGATIONS
9.1. Necessary and sufficient measures taken by the Company to ensure compliance with its statutory obligations as an Operator include:

providing data subjects with necessary statutory notices prior to obtaining their consent;
explaining to data subjects their legal rights regarding data processing;
obtaining written or legally equivalent consent, except where statutory exemptions apply;
appointing an internal officer responsible for data processing oversight;
issuing internal regulatory documents and policies governing data processing and protection;
familiarizing and training employees on data protection legislation;
establishing role-based access controls to personal data, including data processed in information systems;
implementing technical and cryptographic protection safeguards;
ensuring open public access to this Policy via the Internet prior to commencing processing activities;
ceasing processing upon expiration or loss of legal grounds;
amending, blocking, or deleting inaccurate or unlawfully obtained data;
strictly limiting processing activities to predetermined, legitimate purposes;
storing data in an identifiable form for no longer than required by the stated processing purposes.

9.2. Security measures for processing within personal data information systems are governed by the internal local legal acts of the Company regulating data security protocols.

CHAPTER 10. COMPLIANCE OVERSIGHT AND INTERNAL CONTROL
11.1. Oversight of compliance with the legislation of the Republic of Kazakhstan and internal local acts of the Company, including security requirements, is exercised to verify adherence to statutory rules, evaluate preventative safeguards, detect potential data leak channels and unauthorized access attempts, and remediate the consequences of any identified incidents.
11.2. Internal control over compliance with the legislation of the Republic of Kazakhstan and internal local acts of the Company is exercised by the designated officer responsible for organizing personal data processing within the Company.

CHAPTER 11. OPERATOR DETAILS AND CONTACT INFORMATION

Company Name: TUV Thuringen Kazakhstan LLP (ТОО TUV Thuringen Kazakhstan)
Business Identification Number (BIN): 230540020504
Registered Address: 20 Dostyk Street, Yesil District, Astana, Republic of Kazakhstan
Email for inquiries and withdrawal of consent: info@tuv-thuringen.kz
Telephone: +7 700 434 98 88