Rules for the processing of personal data

The following rules of personal data collection and processing explain what data is collected and processed by our company. 

We do collect information that you have provided voluntarily: name and surname, email, phone number, name of your company, your position and your message to us. This information is usually required whenever you are going to interact with us on https://kz.kursiv.media: give us feedback or get a subscription, for example.

The information might be collected and processed when you send us a message.

The collection and processing of the information are also possible when you provide us with personal information needed for signing an employment agreement or making a deal.

Data collection and processing might be conducted automatically by operational systems and computers (please, see the Confidentiality Policy section).

All gathered and processed information is kept in our server or electronic mail of our employees. 

There is no expiration date for the personal data we collect, but we can delete it once that information is no longer relevant. 

In the process of data processing and storage, we rely on Our Confidentiality Policy and Rules for Collection, Processing and Protection of Personal Data that was approved by the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan on October 21, 2020.

Approved by order
Minister of Digital Development,
innovation and aerospace
Republic of Kazakhstan
dated October 21, 2020 No. 395 / НҚ

Regulations for the collection, processing of personal data

Chapter 1. General provisions

1. These Rules for the collection, processing of personal data (hereinafter referred to as the Rules) are developed in accordance with subparagraph 7) of paragraph 1 of Article 27-1 of the Law of the Republic of Kazakhstan dated May 21, 2013 “On personal data and their protection” (hereinafter referred to as the Law) and determine the procedure for collecting and processing personal data.

2. The following basic concepts are used in these Rules:

  1. Personal data — information related to a subject of personal data determined or determined on their basis, recorded on an electronic, paper and (or) other material medium;
  2. Blocking of personal data — actions to temporarily stop the collection, accumulation, change, addition, use, distribution, depersonalization and destruction of personal data;
  3. Accumulation of personal data — actions to systematize personal data by entering them into a database containing personal data;
  4. Collection of personal data — actions aimed at obtaining personal data;
  5. Destruction of personal data — actions, as a result of which it is impossible to restore personal data;
  6. Depersonalization of personal data — actions, as a result of which the determination of the ownership of personal data by the subject of personal data is impossible;
  7. The base containing personal data (hereinafter referred to as the base) is a set of ordered personal data;
  8. The owner of the database containing personal data (hereinafter referred to as the owner) is a state body, an individual and (or) legal entity exercising, in accordance with the laws of the Republic of Kazakhstan, the right to own, use and dispose of the database containing personal data;
  9. Operator of the database containing personal data (hereinafter referred to as the operator) — a state body, an individual and (or) legal entity that collects, processes and protects personal data;
  10. The authorized body in the field of personal data protection (hereinafter referred to as the authorized body) — the central executive body in charge of the protection of personal data;
  11. Service for ensuring the security of personal data — a service that ensures information interaction of owners and (or) operators with the subject, including obtaining consent from the subject to collect, process personal data or transfer it to third parties, including through the implementation of this interaction by the owners and/or by operators independently;
  12. Processing of personal data — actions aimed at the accumulation, storage, modification, addition, use, distribution, depersonalization, blocking and destruction of personal data;
  13. Use of personal data — actions with personal data aimed at realizing the goals of the owner, operator and third party;
  14. Storage of personal data — actions to ensure the integrity, confidentiality and availability of personal data;
  15. Dissemination of personal data — actions as a result of which the transfer of personal data occurs, including through the media or providing access to personal data in any other way;
  16. The subject of personal data (hereinafter — the subject) — an individual to whom the personal data relates;
  17. Third party — a person who is not a subject, owner and (or) operator, but associated with them (him) by circumstances or legal relations for the collection, processing and protection of personal data;
  18. The web portal of “electronic government” is an information system that is a single window of access to all consolidated government information, including the regulatory legal framework, and to public services, services for issuing technical specifications for connecting natural monopoly entities to networks and services of quasi-public entities. sector rendered electronically.

3. These Rules apply to the relations arising between owners, operators, subjects, as well as third parties in the process of collecting and processing personal data.

4. The collection, processing of personal data is carried out by the owner and (or) operator, as well as by a third party with the consent of the subject or his legal representative in the manner determined by these Rules, with the exception of cases provided for in Article 9 of the Law.

Collection, processing of personal data of the deceased (recognized as missing by the court or declared deceased) of the subject is carried out in accordance with the legislation of the Republic of Kazakhstan.

5. Collection and processing of personal data by the owner and (or) operator of personal data is allowed in the amount determined by the List of personal data, necessary and sufficient to perform the tasks being performed (hereinafter referred to as the List of personal data).

The list of personal data is determined and approved in accordance with the Rules, determination by the owner and (or) operator of the list of personal data necessary and sufficient to perform the tasks they carry out, approved by the Government of the Republic of Kazakhstan dated November 12, 2013 No. 1214.

6. The subject or his legal representative gives (withdraws) consent to the collection, processing of personal data in writing, in the form of an electronic document or through a service for ensuring the security of personal data or in another way using elements of protective actions that do not contradict the legislation of the Republic of Kazakhstan.

7. The collection and processing of personal data is carried out subject to the provision of measures to protect personal data in accordance with the Rules for the implementation by the owner and (or) operator, as well as a third party, of measures to protect personal data, approved by the Government of the Republic of Kazakhstan dated September 3, 2013 No. 909.

Chapter 2. Collection of personal data

8. To collect personal data, the owner and (or) operator, as well as a third party, ask the subject for consent to the collection, processing of personal data assigned to him in the manner determined by these Rules.

In accordance with paragraph 3 of Article 8 of the Law, the subject has the right to consent to the collection of personal data through the user’s account on the web portal of the “electronic government”, the service for ensuring the security of personal data, as well as through the subscriber number registered on the web portal of the “electronic government” subject by transmitting a one-time password or by sending a short text message as a response to the notification of the e-government web portal.

When requesting personal data from a subject, it is necessary to match their names, the purposes of their collection and processing, the names, the purposes of collection and processing specified in the List of personal data.

9. The subject, in accordance with paragraph 2 of Article 24 of the Law, is obliged to submit his personal data in cases established by the laws of the Republic of Kazakhstan.

Chapter 3. Personal data processing

Paragraph 1. Accumulation and storage of personal data

10. The accumulation of personal data is carried out in accordance with Chapter 2 of these Rules, necessary and sufficient for the performance of tasks carried out by the owner and (or) operator, as well as a third party.

11. The storage of personal data is carried out by the owner and (or) operator, as well as by a third party in the database, which is stored on the territory of the Republic of Kazakhstan.

12. The storage period for personal data is determined by the date of achievement of the goals of their collection and processing, unless otherwise provided by the legislation of the Republic of Kazakhstan.

Paragraph 2. Change and addition of personal data

13. The subject has the right to demand from the owner and (or) operator to change and supplement his personal data if there are grounds confirmed by the relevant documents.

14. The owner and (or) operator within one working day changes and (or) supplements the personal data on the basis of the relevant documents confirming their accuracy.

15. The subject has the right to know about the presence of the owner and (or) operator, as well as a third party, of his personal data, as well as to receive information containing:

  • confirmation of the fact, purpose, sources, methods of collecting and processing personal data;
  • list of personal data;
  • terms of processing personal data, including the terms of their storage.

At the same time, in order to obtain information, the subject or his legal representative sends an appeal (request) to the owner and (or) operator or a third party in writing or in the form of an electronic document or in another way using elements of protective actions that do not contradict the legislation of the Republic of Kazakhstan.

16. The owner and (or) operator shall provide information related to the entity within 3 (three) business days from the date of receipt of the application from the entity or its legal representative, unless other terms are provided for by the laws of the Republic of Kazakhstan.

In case of refusal to provide information to the subject or his legal representative, the owner and (or) operator, within a period not exceeding 3 (three) working days from the date of receipt of the request, shall submit a reasoned response, unless other terms are provided for by the laws of the Republic of Kazakhstan.

Paragraph 3. Use, distribution and anonymization of personal data

17. The use of personal data is carried out by the owner, operator and a third party for the previously stated purposes of their collection, determined by the List of Personal Data.

18. Dissemination of personal data in cases that go beyond the previously stated purposes of their collection, is carried out with the consent of the subject or his legal representative.

19. Personal data is depersonalized for statistical, sociological, scientific, marketing research.

20. Depersonalization is carried out by the owner and (or) operator or a third party prior to their distribution, by any method of depersonalization that does not contradict the legislation of the Republic of Kazakhstan, allowing to solve the tasks of processing personal data.

21. The procedure for anonymizing personal data excludes the possibility of reverse recovery of the original personal data.

Reimbursement of the expenses of the owner and (or) operator or third party for the depersonalization of personal data is carried out at the expense of the person who requested the depersonalized personal data, unless otherwise determined by an agreement with the owner and (or) operator or a third party.

22. The description of the anonymization procedure provides an unambiguous interpretation of the actions taken to anonymize personal data and includes anonymization algorithms and the characteristics of the procedure related to the quality of anonymized data, its laboriousness, and resistance to various attacks.

23. Personal data and anonymized data are stored separately when the owner and (or) operator, as well as a third party, use the anonymization procedure.

Paragraph 4. Blocking and destruction of personal data

24. The subject or his legal representative applies to the authorized body in order to verify the owner and (or) operator, as well as a third party for compliance with the requirements for the collection and processing of personal data.

The authorized body considers the appeal of the subject or his legal representative, with the involvement of the owner and (or) operator, as well as a third party, within the time limits established by the Law of the Republic of Kazakhstan dated January 12, 2007 “On the procedure for considering appeals of individuals and legal entities.”

In case of revealing facts of violation of the conditions for the collection, processing of personal data, as well as confirmation of the fact of their collection, processing in violation of the legislation of the Republic of Kazakhstan, the authorized body requires the owner and (or) operator, as well as a third party to clarify, block or destroy inaccurate, or received by illegal means of personal data, as well as bringing the procedures for collecting and processing personal data in line with legislation.

25. If there is information about a violation of the conditions for the collection, processing of personal data, the subject requires the owner and (or) operator, as well as a third party, to block his personal data.

Personal data collected and processed by the owner and (or) operator, as well as by a third party in violation of the legislation of the Republic of Kazakhstan, as well as in other cases established by the Law and other regulatory legal acts of the Republic of Kazakhstan, are subject to destruction at the request of the subject.

26. The owner and (or) operator, within one working day, block the personal data related to the subject, if there is information about a violation of the conditions for their collection and processing.

The owner and (or) operator, within one working day, destroy personal data in case of confirmation of the fact of their collection, processing in violation of the legislation of the Republic of Kazakhstan, as well as in other cases established by the Law and other regulatory legal acts of the Republic of Kazakhstan.

27. Personal data are subject to destruction by the owner and (or) operator, as well as by a third party:

  1. Upon expiration of the storage period in accordance with paragraph 2 of Article 12 of the Law;
  2. Upon termination of legal relations between the subject, the owner and (or) the operator, as well as a third party;
  3. Upon entry into legal force of a court decision;
  4. In other cases established by the Law and other regulatory legal acts of the Republic of Kazakhstan.

28. The destruction of personal data is carried out by deleting information or destroying material carriers of personal data.

Paragraph 5. Processing of personal data in the activities of courts

29. Texts of judicial acts of the Supreme Court of the Republic of Kazakhstan, local and other courts of the Republic of Kazakhstan, with the exception of the texts of judicial acts providing for provisions that contain information constituting state or other secrets protected by law, as well as judicial acts on cases considered in closed court proceedings , are placed on the services “Judicial Cabinet”, “Bank of Judicial Acts” of the Internet resource of the Supreme Court of the Republic of Kazakhstan in full.

30. In order to ensure the safety of participants in the trial and protect secrets protected by law when collecting and using or distributing by third parties judicial acts of the Supreme Court of the Republic of Kazakhstan, local and other courts of the Republic of Kazakhstan, personal data are excluded (depersonalized) from them. In this case, third parties assume obligations to ensure compliance with the requirements of the Law.

Personal data in relation to judicial acts are:

  • surnames, first names and patronymics, date and place of birth, place of residence or stay, telephone numbers, details of a passport or other identity document, individual identification number — an individual, taxpayer identification number — an individual registered as an individual entrepreneur of the participants in the trial;
  • information about the location of the land plot, building, structure, residential building, apartment, vehicle, other information about the property and about the funds of the participants in the trial held in banks or other credit institutions, if this information relates to the merits of the case.

31. In some cases, in order to protect the personal rights and legitimate interests of participants in the proceedings, the general access of the Internet resource of the Supreme Court of the Republic of Kazakhstan to personal data contained in judicial acts and minutes of court sessions on specific cases considered in open proceedings is limited by a participant in legal proceedings, as well as by the decision of the Chairman and chairmen of the chambers of the Supreme Court of the Republic of Kazakhstan, chairmen of regional and equivalent courts.