1. General Provisions 

1.1 This Policy for the processing of personal data (hereinafter referred to as the Policy) has been developed to fulfill the requirements of part 2 of article 4 of the Law of the Kyrgyz Republic "On Personal Data" and defines the legal and organizational grounds for the processing of personal data in CJSC "Central Asia Capital" (hereinafter referred to as the Holder). 

1.2 This Policy is aimed at ensuring the protection of the rights and freedoms of the subject of personal data when processing their personal data and applies to all operations with personal data performed by the Holder, both in automated mode and otherwise. 

2. Basic Rights and Obligations of the Subjects of Personal Data: 

2.1 Subjects of personal data have the right:

● to full information about their personal data processed by the Holder;

● to access their personal data, including the right to receive a copy of any record containing their personal data, except in cases specified by the Law of the Kyrgyz Republic "On Personal Data";

● to clarify their personal data, block or delete it in cases where the personal data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing;

● to take the legal measures to protect their rights, including appealing to the authorized state body for personal data;

● to exercise other rights provided by the legislation of the Kyrgyz Republic.

2.2 Subjects of personal data are obliged to:

● provide the Holder only with truthful data about themselves;

● provide documents containing personal data to the extent necessary for the purpose of processing;

● notify the Holder of any clarifications (updates, changes) to their personal data.

3. Basic Rights and Obligations of the Holder:

3.1 The Holder has the right:

● to receive reliable information and/or documents containing personal data from the subject of personal data;

● to clarify the personal data provided by the subject.

3.2 The Holder is obliged:

● to process personal data in the manner established by the Law of the Kyrgyz Republic "On Personal Data";

● to consider appeals from subjects of personal data regarding the processing of personal data and respond within a period not exceeding 7 days from the date of submission of the application;

● to provide the subject of personal data with the opportunity for free access to his personal data;

● to take measures to update personal data in connection with the appeal of the subject of personal data;

● to organize the protection of personal data in accordance with the requirements of the legislation of the Kyrgyz Republic. 

3.3 The Holder collects, uses, and protects the personal data provided by the subject of personal data in accordance with this Policy and the legislation of the Kyrgyz Republic.

4. Volume and Categories of Processed Personal Data, Categories of Subjects of Personal Data

4.1 The Holder processes personal data of the following categories of subjects of personal data:

- Citizen (applicant);

- Contractor/supplier/counterparty;

- State civil servant;

- Technical service personnel;

- Citizens participating in an open competition for enrollment in a staffing reserve;

- Intern;

- Person directly responsible for working with personal data of other Holders (IS "Register of Holders of Personal Data Arrays").

4.2 Personal data processed by the Holder includes:

● residential address;

● year of birth;

● date of birth;

● personal identification number;

● income;

● place of birth;

● phone number;

● education;

● passport details (series, passport number, issuer, and date of issue);

● military rank;

● profession; 

● marital status; 

● surname; 

● first name; 

● patronymic; 

● email;

● position;

● signature; 

● bank account; 

● salary; 

● wage; 

● length of service; 

● rank; 

● disease codes; 

● amount of accrued insurance premiums; 

● certificate number of professional development; 

● photo-3x4; 

● state and departmental awards. 

4.3 Special categories of personal data processed by the Holder include: 

● national affiliation; 

● political views; 

● medical information. 

4.4 The Holder ensures that the content and volume of the processed personal data correspond to the declared purposes of processing and, if necessary, takes measures to eliminate their excess in relation to the declared processing purposes. 

4.5 The processing of special categories of personal data revealing racial or ethnic origin, national affiliation, political views, religious or philosophical beliefs, as well as concerning health status and intimate life, is carried out by the Holder solely on the basis of the requirements of regulatory legal acts and in strict accordance with article 8 of the Law of the Kyrgyz Republic "On Personal Data". 

4.6 Lists of personal data and categories of subjects of personal data may be reviewed by the Holder with mandatory recording of changes in this Policy and notifying subjects of personal data by any available means (official website, announcement, push notification, email, etc.) 

5. Purposes of Personal Data Collection 

5.1 Personal data is processed by the Holder for the following pre-defined and lawful purposes: 

● informing the User by sending electronic letters; 

● preparing responses within the framework of the implementation of the Law of the Kyrgyz Republic "On the Procedure for Considering Citizens' Appeals"; 

● conducting clerical work in accordance with regulatory legal acts; 

● maintaining personnel records and accounting for employees and interns of the Holder in the manner established by regulatory legal acts; 

● paying employees of the Holder; 

● compensating expenses related to the temporary disability of employees of the Holder; 

● fulfilling contractual rights and obligations within the framework of civil law transactions and effecting payment for services rendered, works performed, and goods delivered; 

● keeping records of visitors to the Holder, as well as subjects receiving consultations from the Holder within the framework of the legislation of the Kyrgyz Republic on personal data orally. 

6. Legal Grounds for Processing Personal Data 

6.1 The legal grounds for processing personal data by the Holder are: 

● Constitution of the Kyrgyz Republic; 

● Labor Code of the Kyrgyz Republic; 

● Civil Code of the Kyrgyz Republic; 

● Budget Code of the Kyrgyz Republic; 

● Tax Code of the Kyrgyz Republic; 

● Law of the Kyrgyz Republic "On State Procurement" 

● Law of the Kyrgyz Republic "On Personal Data"; 

● Law of the Kyrgyz Republic "On the Procedure for Considering Citizens' Appeals"; 

● Law of the Kyrgyz Republic "On the State Civil Service and Municipal Service" 

● consent of subjects of personal data to process personal data (in accordance with the Resolution of the Government of the Kyrgyz Republic No. 759 dated November 21, 2017); 

● Order of the Ministry of Finance of the Kyrgyz Republic "On Approval of the Regulation on the Accounting and Financial Reporting in the Public Administration Sector" dated December 25, 2018, No. 137-P. 

7. Procedure and Conditions for Processing Personal Data 

7.1 The processing of personal data by the Holder is carried out by the following means: 

● automated; 

● without the use of automation tools. 

7.2 The processing of personal data performed by the Holder includes any operations or set of operations carried out regardless of the means, whether automated or not, for the purposes of collection, recording, storage, updating, grouping, blocking, deletion, and destruction of personal data. 

7.3 The processing of personal data is carried out by the Holder with the condition of obtaining consent from the subject of personal data (hereinafter referred to as Consent), except in cases established by legislation when personal data may be processed without such Consent. 

7.4 The subject of personal data decides to provide their personal data and provides it in written form on paper or in the form of an electronic document signed in accordance with the legislation of the Kyrgyz Republic with an electronic signature. 

7.5 The condition for terminating the processing of personal data may be the achievement of the purposes of processing personal data, updating personal data, as well as identifying unlawful processing of personal data, identified based on the appeal of the subject of personal data or a court act. 

7.6 The Holder, for the purposes of processing, with the consent of the subject of personal data, has the right to transfer personal data to third parties provided that the recipient of the data is obligated to maintain the confidentiality of this data. 

7.7 When processing personal data, the Holder takes or provides for the taking of necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access to them, destruction, alteration, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions concerning personal data. 

7.8 Personal data should not be stored longer than is necessary for the purposes of their collection. Storage periods may be extended only in the interests of the subject of personal data or if prescribed by the legislation of the Kyrgyz Republic. 

8. Updating, Correction, Deletion, and Destruction of Personal Data, Responses to Requests from Subjects of Personal Data for Access to Personal Data 

8.1 In case of confirmation of the inaccuracy of personal data or the unlawfulness of their processing, the personal data is subject to updating, blocking, or destruction depending on the legality of their collection, storage, and processing by the Holder, or processing must be terminated accordingly. 

8.2 In cases of inaccuracy of personal data or unlawful processing, the subject of personal data has the right to appeal directly to the Holder or the Authorized State Body for personal data.

8.3 Upon a written request from the subject of personal data, the Holder is obliged to provide information about the processing of personal data carried out by him, reflecting the following information: 

• confirmation of the fact of processing personal data by the holder (owner) of the personal data array; 

• legal grounds and purposes of processing personal data; 

• purposes and methods used by the holder (owner) of the personal data array for processing personal data;

• the name and location of the holder (owner) of the personal data array, information about the individuals (except for employees of the holder (owner) who have access to personal data or to whom personal data may be transferred under a contract with the holder (owner) of the personal data array or under law; 

• the processed personal data related to the respective subject of personal data, the source of their receipt; 

• the duration of the processing of personal data, including storage periods; 

• the procedure for the subject of personal data to exercise their rights as provided by this Law; 

• information about completed or proposed cross-border data transfer; 

• other information provided by this Law and/or other regulatory legal acts. 

8.4 If the subject does not possess the right to access the requested information, a reasoned refusal is sent to them. 

8.5 After the storage period and upon reaching the purposes of personal data collection, they are subject to destruction within two weeks. Destruction is confirmed by an act, a copy of which may be handed over to the subject of personal data upon their written request. 

9. Final Provisions 

9.1 All relationships regarding the processing of personal data not reflected in this Policy are regulated in accordance with the provisions of the Law of the Kyrgyz Republic "On Personal Data". 

9.2 The Holder has the right to make changes to this Policy. When making changes, the date of the last update is indicated in the current edition. The new version of the Policy comes into effect from the moment it is made publicly available with the condition of mandatory prior announcement of planned changes at least 14 working days before the publication date of the new version of the Policy.

9.3 The current version of the Policy is publicly available on the Internet at https://ca.capital/policy.