Privacy policy on collection and processing of personal data of the Limited Liability University "De Montfort University Kazakhstan"

1. Purpose and Scope

1.1. This Regulation of the Limited Liability University "De Montfort University Kazakhstan" (BIN 210340016753) (hereinafter also referred to as "the University") about the collection, processing of personal data (hereinafter also referred to as the "Policy") defines the position and intentions of the University in the field of collection, processing and protection of personal data to respect and protect the rights and freedoms of each individual and, in particular, the right to privacy, personal and family secrecy, protection of one's honour and good name.

1.2 The managers and employees of the University shall strictly enforce the policy.

1.3 The Policy applies to all subjects' personal data collected and processed in the University with or without automation tools.

1.4 This Policy is accessible to any subject of personal data, including through the global computer network Internet.

1.5 In all other matters not provided for by this Policy, the University shall be guided by the provisions of the current legislation of the Republic of Kazakhstan.

1.6. The Policy has legal force in Russian. Translations into other languages do not prevail and are used for information purposes only.

2. Terms

2.1 Personal data - information relating to a certain or determined on their basis subject of personal data, recorded on electronic, paper and (or) other material medium. I.e. such information may include, in particular, Full name, year, month, date and place of birth, address, information on family, social, property status, information on education, profession, income, information on health status, position, mobile phone numbers, e-mail address (personal), type of activity (student, specialist, graduate), name of the university/company, interests, dates of visits, as well as other information that allows determining, identify the subject of personal data in the aggregate.

2.2 Processing personal data means actions aimed at accumulating, storing, modifying, amending, adding, using, distributing, depersonalising, blocking, and destroying personal data.

2.3 The subject of personal data is a natural person to whom the personal data relates.

2.4 Operator—a person who, independently or jointly with other persons, organises and (or) carries out the collection, processing, and protection of personal data.

2.5 Other terms are used in this Policy in accordance with the meanings defined by the current legislation of the Republic of Kazakhstan, unless otherwise expressly stated in the Policy.

3. Personal Data Subjects

The University processes the personal data of the following individuals:

• employees;
• former employees;
• personal data subjects with whom civil law contracts have been concluded;
• candidates to fill vacant positions;
• clients;
• representatives and employees of counterparties;
• students, applicants, their parents, other third parties;
• other subjects of personal data to ensure the realisation of the purposes of collection and processing established by this Policy and the presence of appropriate legal grounds for collection and processing.

4. Principles, Conditions and Purposes of Personal Data Collection and Processing

4.1 By the security of personal data, the University understands the protection of personal data from unlawful or accidental access to them, destruction, modification, blocking, copying, provision, and dissemination, as well as from other unlawful actions in relation to personal data, and it takes the necessary legal, organisational, and technical measures to protect personal data.

4.2 Collection, processing and security of personal data at the University shall be carried out in accordance with the requirements of the Constitution of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan No. 94-V "On Personal Data and their Protection", by-laws, other laws of the Republic of Kazakhstan defining cases and specifics of collection, processing of personal data, guiding and methodological documents of the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan, as well as its authorised committees.

4.3 When collecting and processing personal data, the University shall adhere to the following principles:

• justice;
• limiting the collection, processing of personal data to the achievement of specific, predetermined and legitimate purposes;
• prevention of collection, processing of personal data incompatible with the purposes of personal data collection;
• preventing the merging of databases containing personal data collected and processed for incompatible purposes;
• content relevance;
• collection, processing of personal data is carried out with the consent of the subject of personal data or his/her legal representative, except for cases stipulated by the legislation of the Republic of Kazakhstan;
• collection, processing of personal data is transparent. The personal data subject may be provided with relevant information regarding the collection, processing of his/her personal data;
• storage of personal data is carried out in a form that allows to identify the subject of personal data, not longer than required by the stated purposes of collection, processing of personal data;
• The operator takes measures to ensure the reliability of the personal data collected and processed by it and updates them if necessary.

4.4 The University collects, processes personal data only if at least one of the following conditions exists:

• collection, processing of personal data is carried out with the consent of the personal data subject or his/her representative;
• for the protection of life, health or other vital interests, constitutional rights and freedoms of a person and citizen, if it is impossible to obtain the consent of the personal data subject or his/her legal representative;
• in case of failure of the subject of personal data to fulfil his/her obligations to provide personal data in accordance with the legislation of the Republic of Kazakhstan;
• in cases where mandatory publication of personal data is required in accordance with the laws of the Republic of Kazakhstan;
• in other cases when the legislation of the Republic of Kazakhstan provides for the collection and processing of personal data without the consent of the subject of personal data.

4.5 Where not expressly prohibited by the laws of the Republic of Kazakhstan, the University may transfer personal data to third parties it identifies on the basis of contracts entered into with such third parties, subject to the conditions specified in this paragraph. Such parties include, in particular, service providers who assist the University in its operations: delivery service providers, customer contact centre providers, billing and refund service providers, banks, payment systems, payment card processors, etc.

Third parties receiving personal data from the University undertake to comply with the principles and rules of collection, processing and protection of personal data provided for by the Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection" and other regulatory legal acts of the Republic of Kazakhstan. For each third party receiving personal data, the contract will define the purposes of personal data processing, the list of actions to be performed with personal data by such third party, obligations to maintain confidentiality of personal data, and measures to ensure protection of personal data.

4.6 In cases established by the legislation of the Republic of Kazakhstan, the University has the right to carry out cross-border transfer of personal data.

4.7 The University shall destroy or depersonalise personal data upon achieving the purposes of collection or processing or in case of loss of necessity to achieve the purposes of collection or processing.

4.8 Personal data are collected, processed by the University for the following purposes:

• ensuring compliance with the laws of the Republic of Kazakhstan and other regulatory legal acts, including consumer protection;
• exercising the functions, powers and duties imposed by the legislation of the Republic of Kazakhstan on the THE UNIVERSITY, including the provision of personal data to public authorities, including the Ministry of Labour and Social Protection of Population of the Republic of Kazakhstan, the Ministry of Finance of the Republic of Kazakhstan and their territorial subdivisions, as well as to other state bodies and their authorised committees;
• processing of information (CV) of a candidate for employment;
• regulating labour relations with the University employees (assistance in employment, training and promotion, ensuring personal safety, controlling the quantity and quality of work performed, ensuring the safety of property);
• maintaining personal files and filling out work record books, providing guarantees and compensations in accordance with the legislation of the Republic of Kazakhstan, taxation, keeping records in the personnel management system and other databases maintained by the University, receiving and paying insurance premiums, compensations, processing transactions with banks in accordance with the requirements of the legislation of the Republic of Kazakhstan;