Go back

Personal data processing policy

This Personal Data Protection Policy (the Policy) of UK Orlovskie Bani LLP (the Company/Operator) has been developed to comply with the legislation of the Republic of Kazakhstan and establishes the procedure for collecting, processing and protecting the personal data of the Company’s clients.

The Company may process personal data only to ensure compliance with laws or other legal acts of the authorised body (the NB RK).

The Policy defines the rights and obligations of clients and the Company concerning the giving or withdrawal of consent to collect and process personal data, and their interactions concerning the collection, documentation, storage, protection and destruction of clients’ personal data.

1. Key terms and definitions used in this Policy

biometric data – personal data describing a client’s physiological and biological characteristics that can be used to establish their identity;

personal data – information relating to an identified or identifiable client, recorded on electronic, paper and/or other tangible media;

blocking of personal data – actions temporarily suspending the collection, accumulation, modification, supplementation, use, dissemination, anonymisation and destruction of personal data;

accumulation of personal data – actions to organise personal data by entering them into a database containing personal data;

collection of personal data – actions aimed at obtaining personal data;

destruction of personal data – actions that make it impossible to restore personal data;

anonymisation of personal data – actions that make it impossible to determine which client the personal data belong to;

database containing personal data – a collection of organised personal data;

owner of a database containing personal data – a state body, individual and/or legal entity exercising ownership of a database containing personal data under the laws of the Republic of Kazakhstan;

operator of a database containing personal data – a state body, individual and/or legal entity that collects, processes and protects personal data;

protection of personal data – a set of measures, including legal, organisational and technical measures, implemented for the purposes established by this Policy;

processing of personal data – actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, anonymisation, blocking and destruction of personal data;

use of personal data – actions involving personal data aimed at achieving the objectives of the Company and a third party;

storage of personal data – actions ensuring the integrity, confidentiality and availability of personal data;

dissemination of personal data – actions resulting in the transfer of personal data, including through the media or by providing access to personal data in any other way;

personal data subject – the Company’s Client to whom the personal data relate;

third party – a person who is not the subject, owner and/or operator but is connected with them by circumstances or legal relationships concerning the collection, processing and protection of personal data.

2. Composition of the Client’s personal data

The Client’s personal data comprise:

information about facts, events and circumstances of the Client’s private life that allow them to be identified, except information required to be disseminated through the media in cases established by the legislation of the Republic of Kazakhstan;

Documents containing personal data include:

identity card or other identity document, individual identification number (IIN);
other documents containing information intended for the purposes provided for in this Policy in accordance with the legislative acts of the Republic of Kazakhstan.

3. Collection, processing and storage of Clients’ personal data

The Client’s personal data are collected by obtaining documents containing them and creating a database of the Company’s Client’s personal data. The Company collects and processes these data with the consent of the subject or their legal representative. The Company may collect Clients’ personal data by:

obtaining complete information about the Client’s personal data and their processing, including automated processing, and means of contacting the Client, such as telephone numbers and email addresses;
copying original identity documents;
entering information in the Client’s file on paper and electronic media;
obtaining originals of necessary documents provided for by the legislative acts of the Republic of Kazakhstan and containing information intended for use in carrying out the activities specified in the Company’s Charter;
obtaining personal data to update or correct incorrect, outdated, inaccurate or incomplete personal data, or data processed in breach of the legislation of the Republic of Kazakhstan.

Processing Clients’ personal data includes obtaining, storing, combining, transferring or otherwise using them within the limits and scope of the Client’s consent.

When processing the Client’s personal data to protect them and safeguard human and civil rights and freedoms, and when determining the scope and content of the data processed, the Constitution and legislative acts of the Republic of Kazakhstan must be strictly taken into account.

The Company’s Client’s personal data are processed exclusively for:

ensuring the Company’s compliance with the legislation of the Republic of Kazakhstan;
ensuring the confidentiality of personal data and restricted access;
ensuring equal rights of Clients and the Company;
ensuring the security of individuals, society and the state.

The Company’s Client and/or their legal representative may review the Company’s documents establishing the personal data processing procedure.

Storage of personal data:

the data of each Client of the Company are held on paper and/or electronic media;
access to Clients’ personal data is restricted to the persons specified in paragraph 13 of this Policy.

4. Access to Clients’ personal data

Within the Company, access to Clients’ personal data is granted to officers, employees who directly use them for official purposes, the Company’s shareholders and the audit firm auditing the Company.

External access by outside organisations and/or third parties: disclosure of Clients’ personal data is permitted with the Client’s written consent and a written request signed by the head of the requesting organisation or the requesting third party and endorsed by the Company’s chief executive.

The Company may grant authorised state bodies access to Clients’ personal data in accordance with the procedure and requirements of the applicable legislation of the Republic of Kazakhstan.

5. Protection of Clients’ personal data

When transferring Clients’ personal data under the conditions in section 4 of this Policy, the Company must warn users of those data of liability for breaching the legislation of the Republic of Kazakhstan on personal data and their protection.

The Company protects Clients’ personal data by:

storing Clients’ personal data in metal cabinets in accordance with applicable legislation of the Republic of Kazakhstan;
restricting employees’ and third parties’ access to Clients’ personal data;
complying within the Company with legislation on personal data and their protection.

Protection of Clients’ personal data against unlawful use or loss is funded by the Company in accordance with the legislation of the Republic of Kazakhstan.

The Company’s responsible unit arranges for Clients to sign written consent to the collection, processing and storage of personal data using the form in Appendix 1 to this Policy.

6. Liability for disclosure of confidential information concerning Clients’ personal data

If the Company or other persons with access to Clients’ personal data breach rules governing their acquisition, processing, storage, transfer or protection, they bear disciplinary, administrative, civil or criminal liability under the applicable legislation of the Republic of Kazakhstan.

7. Final provisions

Matters not covered by this Policy are governed by the applicable legislation of the Republic of Kazakhstan. All amendments or additions to this Policy are approved by the Company’s Management Board.

If amendments to the legislation of the Republic of Kazakhstan cause individual provisions of this Policy to conflict with applicable law, those provisions cease to apply and applicable law must be followed until the Policy is amended.

In all other matters not provided for by this Policy, officers and other employees of the Company’s divisions follow the legislation of the Republic of Kazakhstan and the Company’s other internal documents.

This Policy is reviewed and updated as necessary.

All appendices form an integral part of this Policy and must be followed and used in the Company’s operations.

This Policy on the Protection of Personal Data of Clients of Banno-Restoranny Kompleks LLP enters into force on 4 March 2022.

Consent to the collection, processing and storage of personal data

By purchasing or paying for the services of UK Orlovskie Bani LLP or visiting the website of the ORLOV BANYA SELECT bath complex, the User https://orlovbanya-select.kz gives unconditional consent to UK Orlovskie Bani LLP, BIN 250140025633 (the Company), and third parties that are or may be connected with the Company’s activities, including the conclusion of a bath complex services agreement between me (or a person I represent or may represent) and the Company, to collect and process personal data on paper and electronically in the Company’s datasets and/or databases.

I. Personal data

Personal data means any information relating to me recorded on electronic, paper and/or other tangible media, which may include, without limitation:

information needed to register and properly identify me as a client of the bath complex (surname, first name, patronymic); citizenship; identity document details (identity card or passport); individual identification number; date and details of birth; sex; signature; biometric data, etc.;
the legal entity’s name and registered address; licence number, issue date, issuing authority and validity period, if applicable; bank details, BIN, residency and registration details; details of its head, beneficial owner and shareholders to the extent specified in subparagraph 1) of paragraph 1 of this consent;
contact information (registered address, actual residence or place of stay), workplace and position; work and mobile telephone numbers and email address;
information related to the Company’s services under the agreement between me (or a person I represent or may represent) and the Company: contracts and agreements, supplementary agreements, applications and consents, correspondence, title documents, etc.;
information about the purpose and nature of business relationships;
other information needed by the Company to conclude an agreement and create the Client’s file under the legislation of the Republic of Kazakhstan and the Company’s internal documents, including for participation in public procurement, tenders, etc.;
information about changes and/or additions to the above data.

II. Collection, processing and use of personal data

My personal data may be collected, processed and used, including collected, processed and stored on paper and/or electronically in the Company’s datasets and/or databases, for purposes including:

concluding, entering into and performing an agreement;
fulfilling the Company’s obligation to retain and record primary accounting documents for the periods established by the legislation of the Republic of Kazakhstan;
protecting the Company’s rights in and out of court: (1) in the event of breaches of obligations under relevant agreements; (2) in disputes, including disputes with third parties;
publishing public (disclosed) data and information in the media in compliance with the legislation of the Republic of Kazakhstan;
identification and granting access to the Company’s premises, offices or information systems under the procedures and restrictions of its internal documents to maintain security;
exchanging information, including reviewing and/or responding to requests, complaints, suggestions, claims and instructions from me and/or third parties; sending or receiving correspondence addressed to me or a person I represent or may represent, including by courier, courier service or express mail;
marketing, providing or sending me information and promotional materials, including about the Company’s products and/or services, and other Company notices by telephone, fax or other means, including open communication channels such as SMS and email;
other purposes established or that may be established by the legislation of the Republic of Kazakhstan.

III. User confirmations

The User hereby confirms that:

I have been informed about the protection of my personal data and have read the Policy on the Protection of Clients’ Personal Data and the list of the Company’s Clients’ personal data;
I have been informed of my right to give or withdraw consent to collect and process my personal data in writing, electronically, through a personal data security service or by another method using protective measures consistent with the legislation of the Republic of Kazakhstan;
this written consent to collect and process my personal data may not be withdrawn only where withdrawal would conflict with the laws of the Republic of Kazakhstan or where an obligation remains unfulfilled;
the Company may collect and process personal data without my consent in cases established by the laws of the Republic of Kazakhstan, including at other organisations for activities not prohibited by that legislation;
the Company may collect or obtain my personal data from me and any third parties and transfer them to third parties or disseminate them in publicly accessible sources, subject to applicable Kazakhstan law and international law, including treaties;
this consent authorises the Company, in accordance with the legislation of the Republic of Kazakhstan, to perform any operation or set of operations on my personal data, with or without automated tools, including collection, processing, recording, copying, backup, protection, organisation, accumulation, storage inside and outside the Company subject to security and confidentiality requirements, clarification, amendment, updating, extraction, use, transfer, dissemination, provision of access, transfer to third parties with processing rights, cross-border transfer, anonymisation, blocking, deletion and destruction;
this consent may be presented to third parties as evidence that I have given UK Orlovskie Bani LLP, BIN 250140025633, consent to collect and process my personal data.