Policy regarding the processing of personal data
Policy regarding the processing of personal data
Policy regarding the processing of personal data
1. General Provisions
1.1 This Personal Data Processing Policy (hereinafter referred to as the Policy) has been developed in compliance with the requirements of Part 2 of Article 4 of the Law of the Kyrgyz Republic "On Personal Information" and defines the legal and organizational grounds for processing personal data in CJSC "Central Asia Capital" (hereinafter referred to as the Holder).
1.2 This Policy is aimed at ensuring the protection of the rights and freedoms of the personal data subject when processing their personal data and applies to all operations with personal data performed by the Holder, both in automated and non-automated modes.
2. Main Rights and Obligations of Personal Data Subjects:
2.1 Personal data subjects have the right:
● to full information about their personal data processed by the Holder;
● to access their personal data, including the right to receive a copy of any record containing their personal data, except in cases provided for by the Law of the Kyrgyz Republic "On Personal Information";
● to clarify their personal data, temporarily block or destroy it in cases where the personal data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing;
● to take measures provided by law to protect their rights, including appealing to the authorized state body for personal data;
● to exercise other rights provided for by the legislation of the Kyrgyz Republic.
2.2 Personal data subjects are obliged:
● to provide the Holder only with reliable data about themselves;
● to provide documents containing personal data in the volume necessary for the purpose of processing;
● to notify the Holder of any clarification (update, change) of their personal data.
3. Main Rights and Obligations of the Holder:
3.1 The Holder has the right:
● to receive reliable information and/or documents containing personal data from the personal data subject;
● to clarify the personal data provided by the subject.
3.2 The Holder is obliged:
● to process personal data in accordance with the procedure established by the Law of the Kyrgyz Republic "On Personal Information";
● to consider appeals from the personal data subject regarding the processing of personal data and provide responses within a period not exceeding 7 days from the date of submission of the application;
● to provide the personal data subject with free access to their personal data;
● to take measures to update personal data in connection with the appeal of the personal data subject;
● to organize the protection of personal data in accordance with the requirements of the legislation of the Kyrgyz Republic.
3.3 The Holder collects, uses, and protects personal data provided by the personal data subject in accordance with this Policy and the legislation of the Kyrgyz Republic.
4. Scope and Categories of Processed Personal Data, Categories of Personal Data Subjects
4.1 The Holder processes personal data of the following categories of personal data subjects:
- Citizen (applicant);
- Contractor/supplier/counterparty;
- State civil servant;
- Technical maintenance staff;
- Citizens participating in an open competition for enrollment in the personnel reserve;
- Intern;
- The person directly responsible for working with personal data of other Holders (IS "Register of Holders (Owners) of Personal Data Arrays").
4.2 Personal data processed by the Holder includes:
● residential address;
● year of birth;
● date of birth;
● personal identification number;
● income;
● place of birth;
● phone number;
● education;
● passport details (series, passport number, by whom and when issued);
● military rank;
● occupation;
● marital status;
● last name;
● first name;
● middle name (patronymic);
● email address;
● job title;
● signature;
● bank account details;
● wage;
● salary;
● seniority (years of service);
● class rank;
● disease code;
● amount of accrued insurance contributions;
● professional development certificate number;
● photo 3x4;
● state and departmental awards.
4.3 Special categories of personal data processed by the Holder include:
● national identity;
● political views;
● medical information.
4.4 The Holder ensures that the content and scope of the processed personal data correspond to the declared purposes of processing and, if necessary, takes measures to eliminate their redundancy in relation to the declared purposes of processing.
4.5 Processing of special categories of personal data revealing racial or ethnic origin, nationality, political views, religious or philosophical beliefs, as well as health and sex life, is carried out by the Holder solely on the basis of the requirements of normative legal acts and in strict accordance with Article 8 of the Law of the Kyrgyz Republic "On Personal Information".
4.6 The lists of personal data and categories of personal data subjects may be reviewed by the Holder, with mandatory recording of the changes in this Policy and notifying the personal data subjects by any accessible means (official website, announcement, push notification, sending a message to email, etc.).
5. Purposes of Personal Data Collection
5.1 Personal data is processed by the Holder for the following predetermined and lawful purposes:
● informing the User by sending emails;
● preparing responses within the framework of the implementation of the Law of the Kyrgyz Republic "On the Procedure for Considering Applications of Citizens";
● maintaining records management in accordance with normative legal acts;
● personnel records management and registration of employees and interns of the Holder in accordance with the procedure established by normative legal acts;
● payment of wages to employees of the Holder;
● compensation for expenses related to temporary disability of the Holder's employees;
● implementation of contractual rights and obligations under civil law transactions and making payment for services rendered, work performed, and goods delivered;
● registration of visitors to the Holder, as well as subjects receiving oral consultations from the Holder within the framework of the legislation of the Kyrgyz Republic on personal information.
6. Legal Grounds for Personal Data Processing
6.1 The legal grounds for the processing of personal data by the Holder are:
● The Constitution of the Kyrgyz Republic;
● Labor Code of the Kyrgyz Republic;
● Civil Code of the Kyrgyz Republic;
● Budget Code of the Kyrgyz Republic;
● Tax Code of the Kyrgyz Republic;
● Law of the Kyrgyz Republic "On Public Procurement";
● Law of the Kyrgyz Republic "On Personal Information";
● Law of the Kyrgyz Republic "On the Procedure for Considering Applications of Citizens";
● Law of the Kyrgyz Republic "On State Civil Service and Municipal Service";
● consent of the personal data subjects to the processing of personal data (in accordance with the Resolution of the Government of the Kyrgyz Republic No. 759 dated November 21, 2017);
● Order of the Ministry of Finance of the Kyrgyz Republic "On Approval of the Regulations on Accounting and Financial Reporting in the Public Administration Sector" dated December 25, 2018 No. 137-P.
7. Procedure and Conditions for Personal Data Processing
7.1 The processing of personal data by the Holder is carried out in the following ways:
● automated;
● non-automated.
7.2 Personal data processing performed by the Holder includes any operations or set of operations performed regardless of the methods, by automatic means or without them, for the purposes of collecting, recording, storing, updating, grouping, blocking, erasing, and destroying personal data.
7.3 Processing of personal data is carried out by the Holder subject to obtaining the consent of the personal data subject (hereinafter referred to as the Consent), except for cases established by law when the processing of personal data may be carried out without such Consent.
7.4 The personal data subject makes a decision to provide their personal data and gives consent in writing on paper, or in the form of an electronic document signed with an electronic signature in accordance with the legislation of the Kyrgyz Republic.
7.5 The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, updating of personal data, as well as detection of unlawful processing of personal data detected on the basis of an appeal from the personal data subject or a court act.
7.6 The Holder, to achieve the processing goals, with the consent of the personal data subject, has the right to transfer personal data to third parties, provided that the recipient of the data is charged with the duty of complying with the confidentiality regime of this data.
7.7 When processing personal data, the Holder takes or ensures the taking of necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution, as well as from other unlawful actions in relation to personal data.
7.8 Personal data shall not be stored longer than necessary to fulfill the purposes of its collection. Storage periods may be extended only in the interests of the personal data subject or if provided for by the legislation of the Kyrgyz Republic.
8. Updating, Correction, Deletion and Destruction of Personal Data, Responses to Requests of Personal Data Subjects for Access to Personal Data
8.1 In case of confirmation of the fact of inaccuracy of personal data or illegality of its processing, the personal data is subject to update, blocking, or destruction depending on the legality of its collection, storage, and processing by the Holder, or its processing must be stopped, respectively.
8.2 Based on the facts of inaccuracy of personal data or illegality of its processing, the personal data subject has the right to appeal directly to the Holder or to the Authorized state body for personal data.
8.3 Upon written request of the personal data subject, the Holder is obliged to provide information about the processing of personal data carried out by them, reflecting the following information:
confirmation of the fact of processing of personal data by the Holder (owner) of the personal data array;
legal grounds and purposes of personal data processing;
purposes and methods of personal data processing applied by the Holder (owner) of the personal data array;
name and location of the Holder (owner) of the personal data array, information about persons (except for the Holder's (owner's) employees) who have access to personal data or to whom personal data can be transferred on the basis of a contract with the Holder (owner) of the personal data array or on the basis of the law;
processed personal data relating to the respective personal data subject, the source of its receipt;
terms of personal data processing, including storage periods;
the procedure for the personal data subject to exercise their rights provided for by this Law;
information on the carried out or potential cross-border transfer of data;
other information provided for by this Law and (or) other normative legal acts.
8.4 If the subject does not have the rights of access to the requested information, a reasoned refusal is sent to them.
8.5 Upon expiration of the storage period and achievement of the purposes of collecting personal data, they are subject to destruction within two weeks. Destruction is confirmed by an act, a copy of which can be handed to the personal data subject upon their written request.
9. Final Provisions
9.1 All relations regarding the processing of personal data not reflected in this Policy are regulated in accordance with the provisions of the Law of the Kyrgyz Republic "On Personal Information".
9.2 The Holder has the right to make changes to this Policy. When making changes, the date of the last update is indicated in the current edition. The new edition of the Policy comes into force from the moment it is placed in the public domain for possibility of review, subject to mandatory preliminary announcement of the planned changes at least 14 working days prior to the date of publication of the new edition of the Policy.
9.3 The current version of the Policy in public access is located on the Internet at https://ca.capital/policy.
1. General Provisions
1.1 This Personal Data Processing Policy (hereinafter referred to as the Policy) has been developed in compliance with the requirements of Part 2 of Article 4 of the Law of the Kyrgyz Republic "On Personal Information" and defines the legal and organizational grounds for processing personal data in CJSC "Central Asia Capital" (hereinafter referred to as the Holder).
1.2 This Policy is aimed at ensuring the protection of the rights and freedoms of the personal data subject when processing their personal data and applies to all operations with personal data performed by the Holder, both in automated and non-automated modes.
2. Main Rights and Obligations of Personal Data Subjects:
2.1 Personal data subjects have the right:
● to full information about their personal data processed by the Holder;
● to access their personal data, including the right to receive a copy of any record containing their personal data, except in cases provided for by the Law of the Kyrgyz Republic "On Personal Information";
● to clarify their personal data, temporarily block or destroy it in cases where the personal data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing;
● to take measures provided by law to protect their rights, including appealing to the authorized state body for personal data;
● to exercise other rights provided for by the legislation of the Kyrgyz Republic.
2.2 Personal data subjects are obliged:
● to provide the Holder only with reliable data about themselves;
● to provide documents containing personal data in the volume necessary for the purpose of processing;
● to notify the Holder of any clarification (update, change) of their personal data.
3. Main Rights and Obligations of the Holder:
3.1 The Holder has the right:
● to receive reliable information and/or documents containing personal data from the personal data subject;
● to clarify the personal data provided by the subject.
3.2 The Holder is obliged:
● to process personal data in accordance with the procedure established by the Law of the Kyrgyz Republic "On Personal Information";
● to consider appeals from the personal data subject regarding the processing of personal data and provide responses within a period not exceeding 7 days from the date of submission of the application;
● to provide the personal data subject with free access to their personal data;
● to take measures to update personal data in connection with the appeal of the personal data subject;
● to organize the protection of personal data in accordance with the requirements of the legislation of the Kyrgyz Republic.
3.3 The Holder collects, uses, and protects personal data provided by the personal data subject in accordance with this Policy and the legislation of the Kyrgyz Republic.
4. Scope and Categories of Processed Personal Data, Categories of Personal Data Subjects
4.1 The Holder processes personal data of the following categories of personal data subjects:
- Citizen (applicant);
- Contractor/supplier/counterparty;
- State civil servant;
- Technical maintenance staff;
- Citizens participating in an open competition for enrollment in the personnel reserve;
- Intern;
- The person directly responsible for working with personal data of other Holders (IS "Register of Holders (Owners) of Personal Data Arrays").
4.2 Personal data processed by the Holder includes:
● residential address;
● year of birth;
● date of birth;
● personal identification number;
● income;
● place of birth;
● phone number;
● education;
● passport details (series, passport number, by whom and when issued);
● military rank;
● occupation;
● marital status;
● last name;
● first name;
● middle name (patronymic);
● email address;
● job title;
● signature;
● bank account details;
● wage;
● salary;
● seniority (years of service);
● class rank;
● disease code;
● amount of accrued insurance contributions;
● professional development certificate number;
● photo 3x4;
● state and departmental awards.
4.3 Special categories of personal data processed by the Holder include:
● national identity;
● political views;
● medical information.
4.4 The Holder ensures that the content and scope of the processed personal data correspond to the declared purposes of processing and, if necessary, takes measures to eliminate their redundancy in relation to the declared purposes of processing.
4.5 Processing of special categories of personal data revealing racial or ethnic origin, nationality, political views, religious or philosophical beliefs, as well as health and sex life, is carried out by the Holder solely on the basis of the requirements of normative legal acts and in strict accordance with Article 8 of the Law of the Kyrgyz Republic "On Personal Information".
4.6 The lists of personal data and categories of personal data subjects may be reviewed by the Holder, with mandatory recording of the changes in this Policy and notifying the personal data subjects by any accessible means (official website, announcement, push notification, sending a message to email, etc.).
5. Purposes of Personal Data Collection
5.1 Personal data is processed by the Holder for the following predetermined and lawful purposes:
● informing the User by sending emails;
● preparing responses within the framework of the implementation of the Law of the Kyrgyz Republic "On the Procedure for Considering Applications of Citizens";
● maintaining records management in accordance with normative legal acts;
● personnel records management and registration of employees and interns of the Holder in accordance with the procedure established by normative legal acts;
● payment of wages to employees of the Holder;
● compensation for expenses related to temporary disability of the Holder's employees;
● implementation of contractual rights and obligations under civil law transactions and making payment for services rendered, work performed, and goods delivered;
● registration of visitors to the Holder, as well as subjects receiving oral consultations from the Holder within the framework of the legislation of the Kyrgyz Republic on personal information.
6. Legal Grounds for Personal Data Processing
6.1 The legal grounds for the processing of personal data by the Holder are:
● The Constitution of the Kyrgyz Republic;
● Labor Code of the Kyrgyz Republic;
● Civil Code of the Kyrgyz Republic;
● Budget Code of the Kyrgyz Republic;
● Tax Code of the Kyrgyz Republic;
● Law of the Kyrgyz Republic "On Public Procurement";
● Law of the Kyrgyz Republic "On Personal Information";
● Law of the Kyrgyz Republic "On the Procedure for Considering Applications of Citizens";
● Law of the Kyrgyz Republic "On State Civil Service and Municipal Service";
● consent of the personal data subjects to the processing of personal data (in accordance with the Resolution of the Government of the Kyrgyz Republic No. 759 dated November 21, 2017);
● Order of the Ministry of Finance of the Kyrgyz Republic "On Approval of the Regulations on Accounting and Financial Reporting in the Public Administration Sector" dated December 25, 2018 No. 137-P.
7. Procedure and Conditions for Personal Data Processing
7.1 The processing of personal data by the Holder is carried out in the following ways:
● automated;
● non-automated.
7.2 Personal data processing performed by the Holder includes any operations or set of operations performed regardless of the methods, by automatic means or without them, for the purposes of collecting, recording, storing, updating, grouping, blocking, erasing, and destroying personal data.
7.3 Processing of personal data is carried out by the Holder subject to obtaining the consent of the personal data subject (hereinafter referred to as the Consent), except for cases established by law when the processing of personal data may be carried out without such Consent.
7.4 The personal data subject makes a decision to provide their personal data and gives consent in writing on paper, or in the form of an electronic document signed with an electronic signature in accordance with the legislation of the Kyrgyz Republic.
7.5 The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, updating of personal data, as well as detection of unlawful processing of personal data detected on the basis of an appeal from the personal data subject or a court act.
7.6 The Holder, to achieve the processing goals, with the consent of the personal data subject, has the right to transfer personal data to third parties, provided that the recipient of the data is charged with the duty of complying with the confidentiality regime of this data.
7.7 When processing personal data, the Holder takes or ensures the taking of necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution, as well as from other unlawful actions in relation to personal data.
7.8 Personal data shall not be stored longer than necessary to fulfill the purposes of its collection. Storage periods may be extended only in the interests of the personal data subject or if provided for by the legislation of the Kyrgyz Republic.
8. Updating, Correction, Deletion and Destruction of Personal Data, Responses to Requests of Personal Data Subjects for Access to Personal Data
8.1 In case of confirmation of the fact of inaccuracy of personal data or illegality of its processing, the personal data is subject to update, blocking, or destruction depending on the legality of its collection, storage, and processing by the Holder, or its processing must be stopped, respectively.
8.2 Based on the facts of inaccuracy of personal data or illegality of its processing, the personal data subject has the right to appeal directly to the Holder or to the Authorized state body for personal data.
8.3 Upon written request of the personal data subject, the Holder is obliged to provide information about the processing of personal data carried out by them, reflecting the following information:
confirmation of the fact of processing of personal data by the Holder (owner) of the personal data array;
legal grounds and purposes of personal data processing;
purposes and methods of personal data processing applied by the Holder (owner) of the personal data array;
name and location of the Holder (owner) of the personal data array, information about persons (except for the Holder's (owner's) employees) who have access to personal data or to whom personal data can be transferred on the basis of a contract with the Holder (owner) of the personal data array or on the basis of the law;
processed personal data relating to the respective personal data subject, the source of its receipt;
terms of personal data processing, including storage periods;
the procedure for the personal data subject to exercise their rights provided for by this Law;
information on the carried out or potential cross-border transfer of data;
other information provided for by this Law and (or) other normative legal acts.
8.4 If the subject does not have the rights of access to the requested information, a reasoned refusal is sent to them.
8.5 Upon expiration of the storage period and achievement of the purposes of collecting personal data, they are subject to destruction within two weeks. Destruction is confirmed by an act, a copy of which can be handed to the personal data subject upon their written request.
9. Final Provisions
9.1 All relations regarding the processing of personal data not reflected in this Policy are regulated in accordance with the provisions of the Law of the Kyrgyz Republic "On Personal Information".
9.2 The Holder has the right to make changes to this Policy. When making changes, the date of the last update is indicated in the current edition. The new edition of the Policy comes into force from the moment it is placed in the public domain for possibility of review, subject to mandatory preliminary announcement of the planned changes at least 14 working days prior to the date of publication of the new edition of the Policy.
9.3 The current version of the Policy in public access is located on the Internet at https://ca.capital/policy.
