Approved by order of the General Director
of Sky Pay Limited Liability Company

Personal Data Processing Policy of Sky Pay Limited Liability Company

1. General provisions

1.1. The Personal Data Processing Policy of Sky Pay Limited Liability Company (hereinafter — the Policy) has been developed in accordance with the Constitution of the Kyrgyz Republic, Law of the Kyrgyz Republic No. 58 of 14 April 2008 “On Personal Information”, Law of the Kyrgyz Republic No. 21 of 21 January 2015 “On the Payment System of the Kyrgyz Republic”, and other regulatory legal acts of the Kyrgyz Republic in the field of personal data processing and protection, including processing in personal data information systems (hereinafter — PDIS), and sets out the principles and conditions for processing personal data (hereinafter — PD), as well as measures for their protection.

1.2. The Policy has been developed to implement the requirements of legislation on the processing and security of personal data and is aimed at protecting human and civil rights and freedoms when personal data are processed by Sky Pay Limited Liability Company (registered address: 7a, 7-Liniya St., Bishkek, Kyrgyz Republic; licenses No. 2035270723 dated 27.07.2023 and No. 3037270723 dated 27.07.2023) (hereinafter — the Company).

1.3. The Policy establishes:

• the purposes of personal data processing;
• the list of personal data processed by the Company;
• the categories of subjects whose personal data are processed by the Company;
• the procedure and conditions for personal data processing;
• the procedure for updating, correcting, deleting and destroying personal data;
• the procedure for reviewing and responding to requests from personal data subjects;
• the participants of the personal data processing management system at the Company;
• the main approaches to the personal data processing management system.

1.4. The provisions of this Policy are mandatory for all Employees of the Company who have access to personal data.

1.5. The Policy is a publicly available document and is published on the Company’s website.

1.6. This Policy applies to all processes of collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of personal data carried out with or without the use of automation tools.

1.7. The Company is the holder (owner) of a personal data array (personal data operator) and processes personal data in connection with providing services for accepting payments and making payouts, as well as in connection with other activities provided for by the Company’s charter and the licenses issued to it.

2. Terms and definitions

Administrative and business activities

processes aimed at the day-to-day supply of the Company with goods and materials (purchase of stationery, office equipment, consumables, household goods, communication services, etc.), and at organizing document flow, premises operation and the work process.

Close relatives

spouses, children and other persons whose contact details are indicated in the questionnaire of a Candidate or Employee.

Holder (owner) of a personal data array (Operator)

a state body, local self-government body, legal entity or individual that, independently or jointly with others, organizes and (or) carries out the processing of personal data and determines the purposes of processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.

Other individuals

individuals whose information, including personal data, has been obtained by the Company in order to fulfil obligations under contracts with Counterparties, Payers and Users.

Personal data information system (PDIS)

a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

Candidate

an individual applying for a vacant position at the Company whose personal data have been accepted by the Company.

Counterparty

a legal entity, individual entrepreneur, or individual engaged in private practice in accordance with the legislation of the Kyrgyz Republic who has concluded or intends to conclude a civil law contract with the Company.

Confidentiality of personal data

a requirement, binding on the Company or any other person who has gained access to personal data, not to allow their dissemination without the consent of the personal data subject or another legal basis.

Personal data processing

any action (operation) or set of actions (operations) performed by the Company with personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion and destruction of personal data.

Personal data (personal information)

any information relating directly or indirectly to an identified or identifiable individual (personal data subject).

Payer

an individual who pays for a Counterparty’s goods, works or services using the Payment Service, or an individual in whose favour a Counterparty makes a payout.

Payment Service (SkyPay)

an automated system consisting of a set of information and communication technologies (software modules, applications, personal account, application programming interfaces (API) and other remote service channels) used to accept orders for non-cash payment for goods, works and services, as well as for payouts to individuals.

User

an individual using the Payment Service, including on behalf of a Counterparty, who has accepted the terms of use of the Payment Service and whose personal data have been transferred to the Company.

Counterparty Representative

an individual whose personal data have been transferred to the Company and who is a member of the Counterparty’s management bodies, or an owner/founder/shareholder/participant of the Counterparty, or who acts on behalf of the Counterparty under a power of attorney.

Employee

an individual who has concluded an employment contract with the Company.

Dissemination of personal data

actions aimed at disclosing personal data to an indefinite range of persons.

Personal data subject

an individual who can be directly or indirectly identified by means of personal data.

Authorized body

the state body of the Kyrgyz Republic that protects the rights of personal data subjects — the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic.

Cookies

a small piece of data sent by a web server and stored on the user’s device, which the web client or web browser sends back to the web server in an HTTP request each time it attempts to open a page of the corresponding website.

IP address

a unique network address of a node in a computer network built on the IP protocol.

3. Principles of personal data processing

3.1. Personal data processing at the Company is carried out in accordance with the following principles:

• personal data are processed on a lawful and fair basis;
• personal data processing is limited to achieving specific, predetermined and legitimate purposes; processing incompatible with the purposes of collection is not permitted;
• combining databases containing personal data processed for mutually incompatible purposes is not permitted;
• only personal data that meet the purposes of their processing are subject to processing;
• the content and volume of the personal data processed and the methods of processing correspond to the declared purposes;
• the personal data processed are not excessive in relation to the declared purposes of processing;
• when processing personal data, their accuracy, sufficiency and, where necessary, relevance to the declared purposes are ensured; the Company takes (or ensures that others take) the necessary measures to delete or clarify incomplete or inaccurate data;
• personal data are stored in a form that allows the personal data subject to be identified for no longer than the purposes of processing require, unless the storage period is established by the legislation of the Kyrgyz Republic or by a contract to which the personal data subject is a party, beneficiary or guarantor; processed personal data are to be destroyed or depersonalized once the purposes of processing have been achieved or when there is no longer a need to achieve them, unless otherwise provided by law.

4. Legal grounds and conditions of personal data processing

4.1. Personal data are processed in compliance with the principles and rules established by the legislation of the Kyrgyz Republic on personal data. Personal data processing at the Company is permitted in the following cases:

• personal data are processed with the consent of the personal data subject;
• processing is necessary for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, or for the conclusion of a contract at the initiative of the personal data subject;
• processing is necessary to achieve the purposes provided for by an international treaty to which the Kyrgyz Republic is a party, or by law, or to exercise and perform the functions, powers and duties imposed on the Company by law, including in the areas of payment services, accounting and tax records, and countering the financing of terrorism and the legalization (laundering) of criminal proceeds;
• processing is carried out in connection with a person’s participation in civil, administrative or criminal proceedings, or is necessary for the enforcement of a judicial act or an act of another body or official subject to enforcement under the legislation on enforcement proceedings;
• processing is necessary to protect the life, health or other vital interests of the personal data subject where obtaining the subject’s consent is impossible;
• processing is necessary to exercise the rights and legitimate interests of the Company or third parties, including to prevent fraud and other unlawful actions when using the Payment Service, provided that the rights and freedoms of the personal data subject are not violated;
• processing is carried out for statistical or other research purposes, subject to mandatory depersonalization of personal data; the exception is processing for the purpose of promoting goods, works and services on the market through direct contact with a potential consumer by means of communication;
• personal data subject to publication or mandatory disclosure in accordance with the legislation of the Kyrgyz Republic are processed.

4.2. The written consent of the subject to the processing of their personal data is required in cases expressly established by the legislation of the Kyrgyz Republic, including:

• inclusion of the subject’s personal data in publicly available sources of personal data;
• processing of special categories of personal data relating to racial or ethnic origin, political views, religious or philosophical beliefs, health, intimate life, or criminal record;
• processing of biometric personal data — information characterizing the physiological and biological features of a person on the basis of which their identity can be established and which is used by the Company to identify the personal data subject;
• making decisions based solely on automated processing of personal data that produce legal consequences for the personal data subject or otherwise affect their rights and legitimate interests.

4.3. Where written consent is not required, consent may be given by the personal data subject or their representative in any form that allows confirmation of its receipt, including electronically (by ticking the corresponding box on the website or in the Payment Service).

4.4. The Company may entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by law, on the basis of a contract concluded with that person (hereinafter — the operator’s instruction). A person processing personal data on behalf of the Company is obliged to comply with the principles and rules of personal data processing provided for by this Policy and the legislation of the Kyrgyz Republic.

4.5. Where the Company entrusts personal data processing to another person, the Company is liable to the personal data subject for the actions of that person. The person processing personal data on behalf of the Company is liable to the Company.

4.6. The Company and other persons who have gained access to personal data are obliged not to disclose personal data to third parties or disseminate them without the consent of the personal data subject, unless otherwise provided by the legislation of the Kyrgyz Republic.

4.7. Dissemination of personal data is carried out on the basis of a separate consent of the personal data subject, executed separately from other consents. Transfer (dissemination, provision, access) of such personal data must be stopped at any time at the request of the personal data subject.

4.8. Where the Company processes personal data that the subject has disclosed to an indefinite range of persons, and the subject has not given the Company consent to process them, the burden of proving the lawfulness of subsequent dissemination or other processing of such personal data lies with the Company.

5. Rights of the personal data subject

5.1. The personal data subject has the right to demand that the Company clarify, block or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the declared purpose of processing, and to take measures provided for by law to protect their rights.

5.2. The personal data subject has the right to demand the termination of the transfer (dissemination, provision, access) of personal data that they previously permitted for dissemination.

5.3. The personal data subject has the right to withdraw previously given consent to personal data processing.

5.4. The personal data subject has the right to receive information concerning the processing of their personal data, including:

• confirmation of the fact of personal data processing by the Company;
• the legal grounds and purposes of personal data processing;
• the purposes and methods of personal data processing applied by the Company;
• the name and location of the Company, and information about persons (other than the Company’s employees) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Company or on the basis of law;
• the processed personal data relating to the respective personal data subject and the source of their receipt, unless a different procedure for providing such data is established by law;
• the periods of personal data processing, including storage periods;
• the procedure for the personal data subject to exercise the rights provided for by the legislation of the Kyrgyz Republic;
• information on completed or intended cross-border data transfer;
• the name or full name and address of the person processing personal data on behalf of the Company, if processing has been or will be entrusted to such a person;
• other information provided for by the legislation of the Kyrgyz Republic.

5.5. The personal data subject has the right to appeal against the actions or inaction of the Company to the authorized body or in court.

6. Obligations of the Company

6.1. In accordance with the requirements of the legislation of the Kyrgyz Republic on personal data, the Company is obliged to:

• provide the personal data subject, upon request, with information concerning the processing of their personal data, or provide a reasoned refusal on legal grounds;
• at the request of the personal data subject, clarify, block or delete the processed personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the declared purpose of processing, and ensure blocking or deletion where personal data are processed by another person acting on the Company’s behalf;
• notify the personal data subject of the processing of their personal data if the personal data were not obtained from the subject, except where the subject has already been notified of such processing;
• once the purpose of personal data processing has been achieved, immediately stop processing and destroy or depersonalize the respective personal data within a period not exceeding 30 (thirty) days from the date the purpose was achieved, unless otherwise provided by law, or ensure destruction or depersonalization where personal data are processed by another person acting on the Company’s behalf, and notify the personal data subject or their legal representative thereof and, where the appeal or request was sent by the authorized body, also notify that body;
• if the personal data subject withdraws consent to the processing of their personal data, stop processing and destroy the personal data within a period not exceeding 30 (thirty) days from the date the withdrawal was received, unless otherwise provided by an agreement between the Company and the personal data subject or by law, and notify the personal data subject of the destruction of their personal data;
• upon receipt of a demand from the personal data subject to stop processing personal data for the purpose of promoting goods, works and services on the market, immediately stop such processing or ensure that it is stopped where personal data are processed by another person acting on the Company’s behalf;
• upon receipt of a demand from the personal data subject to stop the transfer (dissemination, provision, access) of personal data previously permitted by the subject for dissemination, stop such transfer within 3 (three) business days from receipt of the demand;
• take the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions.

7. Purposes of personal data processing

7.1. Personal data processing by the Company is limited to achieving specific, predetermined and legitimate purposes. The Company does not process personal data in a manner incompatible with the purposes of their collection.

7.2. The Company processes personal data for the following purposes:

7.2.1. With respect to Counterparty Representatives, Users, Payers and website visitors

• concluding, performing and terminating contracts with the Company, signing paper contracts, registering in personal accounts and recording the history of interaction in databases;
• providing services for accepting payments and making payouts, organizing settlements, and accepting and transmitting orders and claims;
• carrying out mutual settlements, issuing invoices, acts and other accounting documents;
• exchanging information with the Company, sending information required by law, and processing appeals, requests, applications, orders and questionnaires of Users and Counterparties;
• communicating with the User to provide information on the performance of the Payment Service usage agreement, including sending postal mailings, short text messages (SMS), email and messenger messages, including transaction statements, as well as transmitting informational messages about the services of the Company and its Counterparties;
• providing services by the Company for creating and storing electronic documents and their copies;
• conducting promotions, surveys and research by the Company;
• providing the personal data subject with information about the services rendered by the Company and the development of new products and services.

7.2.2. With respect to employees (including former employees) and candidates for vacant positions

• ensuring compliance with the Constitution of the Kyrgyz Republic, laws and other regulatory legal acts of the Kyrgyz Republic;
• concluding, performing and terminating employment contracts and regulating employment and other directly related relations;
• maintaining HR records, including records of working time, vacations, business trips, incentives and penalties of the Company’s Employees;
• calculating and paying salaries, compensation and benefits, as well as making tax deductions and other mandatory payments in accordance with the law;
• ensuring occupational safety and the security of Employees, monitoring compliance with internal labour regulations, and controlling access to the Company’s premises;
• attracting and selecting Candidates for employment at the Company;
• generating statistical reports;
• ensuring compliance with labour legislation.

7.2.3. For all categories of subjects

• complying with the requirements of legislation and legal proceedings, identifying Users, Counterparties, their representatives, beneficial owners and beneficiaries, providing payment information to state information systems, and submitting all types of reporting provided for by law, including in the area of countering the financing of terrorism and the legalization (laundering) of criminal proceeds;
• ensuring the security and operation of the Company’s information systems and infrastructure;
• detecting unlawful and (or) prohibited actions when using the Payment Service, cases of fraud, theft of funds and other unlawful actions, preventing such actions in the future and mitigating their consequences, assessing cooperation risks, and verifying the accuracy of information provided;
• carrying out administrative and business activities of the Company.

8. Personal data processed, categories of subjects and purposes of processing

8.1. The Company processes personal data of the following categories of personal data subjects.

8.1.1. Candidates

Personal data processed: surname, first name, patronymic; gender; citizenship; date and place of birth; residential address; contact details (phone, email address); information on education; information on work experience and qualifications; identity document details; existence (absence) of a criminal record and (or) criminal prosecution; other personal data provided by the candidate.

Purposes of processing: compliance with labour legislation within employment and other directly related relations, and access control.

8.1.2. Employees and former Employees

Personal data processed: surname, first name, patronymic; gender; citizenship; date and place of birth; identity document details; personal identification number (PIN); registered residential address; actual residential address; contact details (phone, email address); taxpayer identification number (TIN); information on state social insurance; information on education, qualifications, professional training and advanced training; marital status, children, family ties, information on dependants; information on work history, including incentives, awards and (or) disciplinary penalties; marriage registration data; military registration information; disability information; information on alimony deductions; information on income from the previous place of work; registration number of a personal vehicle; other personal data provided by employees in accordance with labour legislation.

Purposes of processing: compliance with labour legislation within employment and other directly related relations, and access control.

8.1.3. Close relatives of Employees

Personal data processed: surname, first name, patronymic; degree of kinship; year of birth; other personal data provided by employees in accordance with labour legislation.

Purposes of processing: compliance with labour legislation within employment and other directly related relations.

8.1.4. Individuals performing works (rendering services) under civil law contracts

Personal data processed: surname, first name, patronymic; date and place of birth; identity document details; personal identification number (PIN); registered residential address; contact details (phone, email address); taxpayer identification number (TIN); settlement (current) account number; other personal data necessary for concluding and performing contracts.

Purposes of processing: carrying out activities in accordance with the Company’s charter, concluding and performing contracts, and access control.

8.1.5. Individuals who are members of the Company’s management bodies, other than Employees

Personal data processed: surname, first name, patronymic; date and place of birth; identity document details; registered residential address; actual residential address; contact details (phone, email address).

Purposes of processing: carrying out activities in accordance with the Company’s charter, exercising rights and obligations in the field of corporate governance, and access control.

8.1.6. Individuals representing the interests of Counterparties (potential Counterparties)

Personal data processed: surname, first name, patronymic; identity document details; contact details (phone, email address); registration data and bank details (for individual entrepreneurs); registered address; login; position held; name of the counterparty organization; information about actions performed on the Company’s website and in the personal account; statistical, technical and functional data types (type of action performed, date and time of its performance, page URL, type of user device, IP address, etc.); information automatically transmitted by the device as a result of technological interaction with the website, including cookies; other information provided by the person while communicating with the Company, as well as other personal data necessary for concluding and performing contracts.

Purposes of processing: carrying out activities in accordance with the Company’s charter, concluding and performing contracts, and access control.

8.1.7. Users, Payers, their representatives, beneficial owners and beneficiaries, and Other individuals

Personal data processed: surname, first name, patronymic; registered residential address; actual residential address; contact details (phone, email address); identity document details; taxpayer identification number (TIN) — in cases provided for by law; electronic means of payment number; transaction details (amount, currency, date and time, payment purpose); information about the User’s actions in the Payment Service; information about recipients and senders who are not Users; information on participation in loyalty programmes of the Company and (or) its Counterparties; User identifiers in the databases of the Company’s partners; information about actions performed on the Company’s website; statistical, technical and functional data types (type of action performed, date and time of its performance, page URL, type of user device, IP address, etc.); information automatically transmitted by the device as a result of technological interaction with the Company’s website, including cookies; other information provided by the person while communicating with the Company.

Purposes of processing: carrying out activities in accordance with the Company’s charter, concluding and performing contracts, providing payment services, and complying with legislation on countering the financing of terrorism and the legalization (laundering) of criminal proceeds.

8.1.8. Visitors to the Company’s website

Personal data processed: IP address; information from cookies; information about the browser (or other program accessing the website); access time; page address; referrer (address of the previous page).

Purposes of processing: ensuring the operability and security of the website, collecting depersonalized visit statistics, and detecting and eliminating technical faults.

8.2. The Company does not process special categories of personal data relating to racial or ethnic origin, political views, religious or philosophical beliefs, intimate life, or criminal record of individuals, unless otherwise established by the legislation of the Kyrgyz Republic.

8.3. Biometric personal data — information characterizing the physiological and biological features of a person on the basis of which their identity can be established — may be processed by the Company only with the written consent of the personal data subject or in cases expressly provided for by law.

8.4. Disabling cookies may make it impossible to access parts of the website and the Payment Service that require authorization.

8.5. The Company collects statistics on the IP addresses of website visitors. This information is used to identify and resolve technical problems and to monitor the lawfulness of payments made.

8.6. Any other personal information not specified above (payment history, information about operating systems, etc.) is subject to secure storage and non-disclosure, except in cases provided for by applicable law and this Policy.

9. Main participants of the personal data processing management system

9.1. To ensure effective management of the personal data processing process, its main participants have been defined.

9.1.1. General Director of the Company

• determines and approves the Company’s policy on personal data processing.

9.1.2. Person responsible for organizing the processing and protection of personal data

Appointed by order of the General Director of the Company and performs the following functions:

• develops, organizes and monitors the personal data processing process (carried out with or without the use of automation tools, including on paper) in accordance with personal data legislation, this Policy and the Company’s internal regulations;
• develops and submits for approval to the General Director of the Company internal regulations on personal data processing and protection requirements;
• organizes communication and (or) communicates to the Company’s Employees the provisions of personal data legislation, this Policy and the Company’s internal regulations;
• analyses, assesses and forecasts risks associated with personal data processing at the Company and develops risk mitigation measures;
• assesses the impact of processes on the rights and freedoms of personal data subjects;
• analyses automated systems and personal data processing processes for compliance with mandatory requirements;
• keeps records of personal data processing procedures and tools;
• identifies threats to the security of personal data during processing;
• organizes and monitors the level of security of personal data information systems;
• assesses the effectiveness of measures taken to ensure the security of personal data;
• develops internal procedures aimed at ensuring the security and protection of personal data;
• organizes and monitors compliance by the Company and its Employees with personal data legislation, this Policy and the Company’s internal regulations;
• interacts with the authorized body and other state authorities on personal data protection matters;
• performs other functions provided for by personal data legislation.

9.1.3. Person responsible for receiving and processing appeals and requests

• organizes the receipt and processing of appeals and requests from personal data subjects or their representatives and (or) monitors the receipt and processing of such appeals and requests.

9.1.4. Person responsible for organizing and conducting HR work

• organizes the recording and storage of documents containing personal data of Candidates, Employees and their close relatives, and former Employees of the Company.

10. Organization of the personal data processing management system

10.1. Personal data of a personal data subject are processed with their consent, or without it if processing is necessary for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, for the conclusion of a contract at the initiative of the personal data subject, or in other cases provided for by personal data legislation.

10.2. A special category of personal data relating to the health of the personal data subject is processed with their written consent, or without it if the personal data have been made publicly available by the personal data subject.

10.3. The Company may entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by law. Such processing is carried out only on the basis of a contract concluded between the Company and the third party, which must define:

• the list of actions (operations) with personal data to be performed by the third party;
• the purposes of personal data processing;
• the obligations of the third party to maintain the confidentiality of personal data and ensure their security during processing, as well as requirements for the protection of the personal data processed.

10.4. The Company transfers personal data to state bodies within their powers in accordance with the legislation of the Kyrgyz Republic, as well as to banks, payment institutions and other settlement participants — to the extent necessary to execute the order of the personal data subject and carry out the payment transaction.

10.5. The Company is liable to the personal data subject for the actions of persons to whom it entrusts the processing of the subject’s personal data.

10.6. Access to the personal data processed is granted only to those Employees of the Company who need it to perform their job duties, in compliance with the principles of personal responsibility.

10.7. Personal data processing is terminated when the purposes of processing are achieved, as well as upon expiry of the period provided for by law, contract or the consent of the personal data subject. If the personal data subject withdraws consent to the processing of their personal data, the Company may continue processing without the subject’s consent if such processing is provided for by a contract to which the personal data subject is a party, beneficiary or guarantor, by another agreement between the Company and the personal data subject, or if the Company is entitled to process personal data without the subject’s consent on the grounds provided for by the applicable legislation of the Kyrgyz Republic.

10.8. Personal data are processed in compliance with confidentiality, meaning the obligation not to disclose personal data to third parties or disseminate them without the consent of the personal data subject, unless otherwise provided by the legislation of the Kyrgyz Republic.

10.9. The Company ensures the confidentiality of the personal data subject’s personal data on its own part and on the part of its Employees who have access to personal data, and ensures that such persons use personal data solely for purposes consistent with the law, contract or other agreement concluded with the personal data subject.

10.10. The security of the personal data processed is ensured by the Company within a single comprehensive system of organizational, technical and legal information protection measures, taking into account the requirements of applicable personal data legislation and the requirements of the National Bank of the Kyrgyz Republic for payment system participants.

11. Updating, correction, deletion and destruction of personal data, responses to subject requests

11.1. Confirmation of the fact of personal data processing by the Company, the legal grounds and purposes of processing, and other information in accordance with applicable law are provided by the Company to the personal data subject or their representative within the periods established by the legislation of the Kyrgyz Republic.

11.2. The information provided does not include personal data relating to other personal data subjects, except where there are legal grounds for disclosing such personal data.

11.3. A request from a personal data subject must contain:

• the number of the main identity document of the personal data subject or their representative, the date of issue of that document and the issuing authority;
• information confirming the personal data subject’s participation in relations with the Company (contract number, contract date, code word and (or) other information), or information otherwise confirming the fact of personal data processing by the Company;
• the signature of the personal data subject or their representative.

The request may be sent as an electronic document signed with an electronic signature in accordance with applicable law. The Company provides information to the personal data subject or their representative in the form in which the respective appeal or request was sent, unless otherwise specified in the appeal or request. If the appeal (request) does not comply with the requirements of applicable law, the Company sends the personal data subject or their representative a reasoned refusal to provide information. The personal data subject’s right of access to their personal data may be limited in accordance with applicable law, including where such access violates the rights and legitimate interests of third parties.

11.4. If inaccurate personal data are identified upon an appeal from the personal data subject or their representative, at their request or at the request of the authorized state body, the Company blocks the personal data relating to that personal data subject from the moment of such appeal or receipt of such request for the period of verification, provided that blocking does not violate the rights and legitimate interests of the personal data subject or third parties. If the inaccuracy of the personal data is confirmed, the Company clarifies the personal data on the basis of the information provided within 7 (seven) business days from the date such information is provided and lifts the blocking.

11.5. If unlawful processing of personal data is identified upon an appeal (request) from the personal data subject, their representative or the authorized state body, the Company blocks the unlawfully processed personal data relating to that personal data subject from the moment of such appeal or receipt of the request.

11.6. If the Company, the authorized state body or another interested person identifies an unlawful or accidental transfer (provision, dissemination) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Company immediately takes measures to eliminate the consequences of the incident, conducts an internal investigation and notifies the authorized state body in the manner and within the periods established by the legislation of the Kyrgyz Republic, indicating the presumed causes of the incident, the presumed harm to the rights of personal data subjects and the measures taken.

11.7. Procedure for the destruction of personal data by the Company.

11.7.1. Conditions and periods for the destruction of personal data by the Company:

• achievement of the purpose of personal data processing or loss of the need to achieve that purpose — within 30 days;
• expiry of the maximum storage periods for documents containing personal data — within 30 days;
• provision by the personal data subject (their representative) of confirmation that the personal data were obtained unlawfully or are not necessary for the declared purpose of processing — within 7 business days;
• withdrawal by the personal data subject of consent to the processing of their personal data, if their retention is no longer required for the purpose of processing — within 30 days.

11.7.2. Once the purpose of personal data processing has been achieved, or if the personal data subject withdraws consent to their processing, the personal data are to be destroyed, provided that:

• a contract to which the personal data subject is a party, beneficiary or guarantor does not provide otherwise;
• the Company is not entitled to process the data without the consent of the personal data subject on the grounds provided for by applicable law;
• another agreement between the Company and the personal data subject does not provide otherwise.

11.7.3. Personal data are destroyed by a commission established by order of the General Director of the Company.

11.7.4. Methods of personal data destruction are established in the Company’s internal regulatory and (or) administrative acts.

12. Measures to ensure the security of personal data during processing

12.1. When processing personal data, the Company takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision and dissemination, as well as against other unlawful actions in relation to personal data.

12.2. The Company appoints an employee responsible for organizing personal data processing.

12.3. The security of personal data is ensured, in particular, by:

• identifying threats to the security of personal data during their processing in personal data information systems;
• applying organizational and technical measures to ensure the security of personal data during their processing in personal data information systems, necessary to meet the personal data protection requirements established by the legislation of the Kyrgyz Republic and the regulations of the National Bank of the Kyrgyz Republic;
• using cryptographic information protection and encryption when transmitting and storing payment transaction data;
• assessing the effectiveness of personal data security measures before a personal data information system is put into operation;
• keeping records of machine-readable personal data media;
• detecting cases of unauthorized access to personal data and taking appropriate measures;
• restoring personal data modified or destroyed as a result of unauthorized access;
• establishing rules for access to personal data processed in the personal data information system, and ensuring registration and recording of actions performed with personal data;
• familiarizing the Company’s employees who directly process personal data with the provisions of personal data legislation, personal data protection requirements and internal acts on personal data processing;
• controlling access to premises where personal data are processed;
• monitoring the effectiveness of the measures and means applied to ensure the security of personal data, as well as monitoring the level of security of personal data information systems.

13. Cross-border transfer of personal data and specifics of processing data of residents of other states

13.1. The Company operates in the territory of the Kyrgyz Republic. The Company carries out cross-border transfer of personal data only where necessary for the performance of a contract to which the personal data subject is a party, for carrying out a payment transaction involving foreign banks, payment systems and other settlement participants, or on the basis of the consent of the personal data subject, and provided that the receiving party ensures adequate protection of the rights of personal data subjects.

13.3. The requirements of this section do not limit the rights of personal data subjects provided for by the legislation of the Kyrgyz Republic.

14. Final provisions

14.1. The Company, its officials and Employees bear civil, administrative and other liability for non-compliance with the principles and conditions of processing personal data of individuals, as well as for disclosure or unlawful use of personal data, in accordance with the legislation of the Kyrgyz Republic.

14.2. This Policy is subject to review as necessary, including when the legislation of the Kyrgyz Republic or the Company’s business processes change. The current edition of the Policy is always published on the Company’s website.

14.3. For all matters related to personal data processing, including withdrawal of consent and sending requests and appeals, the personal data subject may contact the Company.