Privacy Policy for the Processing of Personal Data

“e-Lab Factor Factoring Company” LLP

This is a translation for convenience. In case of any discrepancy, the Russian version prevails.

1. General provisions

1. 1.1. This Privacy Policy for the processing of personal data has been drawn up in accordance with, and for the purpose of complying with, Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection” and sets out the procedure for the processing of personal data by the operator, “e-Lab Factor Factoring Company” LLP, BIN 230540027026 (hereinafter, the Operator), and the measures to ensure the security and protection of personal data.
2. 1.2. The Operator’s most important goal and condition for carrying out its activities is the observance of human and civil rights and freedoms in the collection, processing and protection of personal data, including the protection of the rights to privacy and personal and family secrets.
3. 1.3. This Operator’s Privacy Policy for the processing of personal data (hereinafter, the Privacy Policy) applies to all information and data relating to an identified or identifiable data subject that the Operator may obtain about visitors to the website https://elabfactor.com (hereinafter, the Website).
4. 1.4. By confirming that they have read and agree to this Policy, the User (visitor) consents to the collection and processing of their personal data in order to review their enquiry or application, contact them and provide the requested services.

   For these purposes, the Operator may engage providers of technical services that support the operation of the Website, the processing of applications, data storage and message delivery, including hosting, cloud infrastructure, email and SMS services.

   The Operator may send the User messages related to their enquiry, application or the provision of services using the contact details they have provided, including through engaged providers of communication and message delivery services; the User (visitor) consents to receiving such messages.

2. Basic terms used in the Policy

1. 2.1. The following basic terms are used in this Privacy Policy:
2. 2.2. Automated processing of personal data — processing of personal data using computer equipment;
3. 2.3. Accumulation of personal data — actions to systematise personal data by entering them into a database containing personal data;
4. 2.4. Blocking of personal data — actions to temporarily stop the collection, accumulation, modification, supplementation, use, dissemination, depersonalisation and destruction of personal data;
5. 2.5. Website — a set of graphic and information materials, as well as computer programs and databases, ensuring their availability on the internet at the network address: https://elabfactor.com;
6. 2.6. Personal data information system — a set of ordered personal data contained in a database, together with the information technologies and technical means that ensure their processing;
7. 2.7. Depersonalisation of personal data — actions as a result of which it becomes impossible to determine whether personal data belong to a data subject;
8. 2.8. Processing of personal data — actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalisation, blocking and destruction of personal data;
9. 2.9. Operator — a legal entity that collects, processes and protects personal data;
10. 2.10. Transfer of personal information — transfer of data received from a Website user for processing in order to carry out a business process, including to provide a service to the user. Personal data (other than depersonalised data) are not transferred to third parties for any other purposes, except in response to duly executed requests of authorised bodies in accordance with the legislation of the Republic of Kazakhstan;
11. 2.11. User — any visitor to the Website;
12. 2.12. Personal data — information relating to an identified or identifiable data subject, recorded on an electronic, paper and (or) other tangible medium, in particular relating to an identified or identifiable User of the Website;
13. 2.13. Provision of personal data — actions aimed at disclosing Personal data to a specific person or a specific group of persons;
14. 2.14. Storage of personal data — actions to ensure the integrity, confidentiality and availability of Personal data;
15. 2.15. Dissemination of personal data — actions as a result of which Personal data are transferred, including via the Website, or access to Personal data is provided in any other way;
16. 2.16. Cross-border transfer of personal data — transfer of Personal data to the territory of foreign states;
17. 2.17. Destruction of personal data — actions as a result of which Personal data cannot be restored.

3. Personal data of the User that the Operator may process

1. 3.1. Approved list of Personal data:
   • the User’s surname, first name and patronymic (if indicated, including in an identity document provided);
   • the User’s phone number, with consent to receive SMS messages and information;
   • the User’s email address, with consent to receive electronic messages and information;
   • the website also collects and processes depersonalised data about visitors, including by means of web analytics services.

   The above data are hereinafter collectively referred to in this Policy as Personal data.

2. 3.2. The User gives (withdraws) consent to the collection and processing of Personal data through the service or in any other way that makes it possible to confirm that consent has been obtained.
3. 3.3. Consent to the collection and processing of Personal data includes:
   • the name and business identification number of the Operator;
   • the surname, first name and patronymic (if indicated in an identity document) of the User;
   • the term or period during which consent to the collection and processing of Personal data is valid;
   • information on whether the Operator may transfer Personal data to third parties;
   • information on the presence or absence of cross-border transfer of Personal data during their processing;
   • information on the dissemination of Personal data in publicly available sources;
   • consent to receive SMS messages and other information;
   • the list of collected data relating to the User.

4. Purposes of collecting and processing Personal data

1. 4.1. The purpose of collecting and processing the User’s Personal data is to provide the User with access to the services, information and/or materials contained on the Website. The Operator uses Personal data only for the purposes of collection stated in this clause, namely: reviewing applications, providing feedback and providing services.
2. 4.2. The Operator also has the right to send the User notifications about new products and services, special offers and various events, and other information. The User may at any time opt out of receiving informational messages by sending the Operator an email to help@elabfactor.com marked “Unsubscribe from notifications about new products, services and special offers”.
3. 4.3. Depersonalised User data collected by means of web analytics services are used to gather information about Users’ actions on the website and to improve the quality of the website and its content.
4. 4.4. In the cases and in the manner established by the legislation of the Republic of Kazakhstan, the Operator depersonalises and destroys the User’s Personal data.

5. Legal grounds for processing Personal data

1. 5.1. The Operator processes the User’s Personal data if there is consent to the collection and processing of Personal data, and only if they are filled in and/or submitted by the User independently through special forms on the Website. By filling in the relevant forms and/or sending their Personal data to the Operator, the User expresses their agreement with this Privacy Policy.
2. 5.2. The Operator processes depersonalised data about the User if this is permitted in the User’s browser settings.

6. Procedure for collecting, storing, transferring and otherwise processing Personal data

1. 6.1. The security of Personal data processed by the Operator is ensured through the implementation of legal, organisational and technical measures necessary to fully comply with the requirements of current legislation on the protection of Personal data.
2. 6.2. The Operator ensures the safety of Personal data and takes all possible measures to prevent access to Personal data by unauthorised persons.
3. 6.3. The User’s Personal data will never, under any circumstances, be transferred to third parties, except in cases related to the provision of the service specified in clause 1.4 of this Policy and to the requirements of the legislation of the Republic of Kazakhstan.
4. 6.4. Personal data are amended and supplemented by the Operator on the basis of the User’s request sent to the Operator’s email address marked “Update of personal data”.
5. 6.5. The period of processing Personal data is determined in the consent to the collection and processing of Personal data and, with the User’s consent, may be unlimited. The User may at any time withdraw their consent to the processing of Personal data by sending the Operator a notice by email to the Operator’s email address marked “Withdrawal of consent to the processing of Personal data”.
6. 6.6. The Operator undertakes to take the necessary measures to protect Personal data in accordance with the legislation of the Republic of Kazakhstan. The Operator’s obligations to protect Personal data arise from the moment Personal data are collected and remain in effect until they are destroyed or depersonalised.

7. Cross-border transfer of Personal data

1. 7.1. Before carrying out a cross-border transfer of Personal data, the Operator must make sure that the foreign state to whose territory the Personal data are to be transferred provides reliable protection of Personal data.
2. 7.2. Cross-border transfer of Personal data to the territory of foreign states that do not meet the above requirements may be carried out only with the written consent of the data subject to the cross-border transfer of their Personal data.

8. Final provisions

1. 8.1. The User may obtain any clarification on matters of interest regarding the processing of their Personal data by contacting the Operator at the Operator’s email address.
2. 8.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Privacy Policy is valid indefinitely until it is replaced by a new version.

The User (visitor) agrees that by continuing, leaving and submitting their contact and other personal data, they consent to the collection, storage and processing of Personal data and agree to this Privacy Policy for the processing of personal data.