Policy on the processing of personal data on the website

1. General provisions

1.1. This document (hereinafter — the Policy) sets out the policy on the processing of personal data of users of the website of AGT LLC (hereinafter — the Operator) on the Internet at: https://agt.kg (hereinafter — the Website).

1.2. This Policy has been developed on the basis of the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature", other legislative acts of the Kyrgyz Republic, and local regulatory legal acts.

1.3. In fulfilment of the requirements of the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature", the Policy is published and freely accessible on the Internet on the Operator's Website.

1.4. This Policy applies only to the Website. The Operator does not control and is not responsible for third-party websites that the User may access via links available on the Website.

1.5. Terms used in the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature" are used in this Policy with the same meaning.

1.6. This Policy also uses the following terms:

User — any person who visits the Website and uses the information, materials, and services of the Website. A User of the Website is a data subject within the meaning of the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature".

Website services — interactive (dialogue) software components on the pages of the Website used for integration with information systems and that provide Website users with certain capabilities to access information on the Website.

1.7. Rights and obligations of the Operator.

1.7.1. The Operator shall:

• process personal data solely for the purposes stated in this Policy, in the manner established by the effective legislation of the Kyrgyz Republic, and take measures necessary and sufficient to fulfil the obligations provided for by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature" and regulatory legal acts adopted in accordance with it;
• not disclose personal data without the User's consent, except where otherwise provided by the effective legislation of the Kyrgyz Republic;
• process personal data in compliance with the principles and rules provided for by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature";
• organise the protection of personal data in accordance with the requirements of the legislation of the Kyrgyz Republic;
• consider requests from the User (or their legal representative) regarding the processing of personal data and provide reasoned responses;
• enable the User (or their legal representative) to access their personal data free of charge;
• take measures to rectify, block, or destroy the User's personal data in cases established by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature".

1.7.2. The Operator has the right to:

• independently determine the composition and list of measures necessary and sufficient to fulfil the obligations provided for by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature" and regulatory legal acts adopted in accordance with it;
• entrust the processing of personal data to another person with the User's consent, except where otherwise provided by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature", on the basis of an agreement concluded with that person, including a state or municipal contract, or by adoption of a relevant act by a state or municipal body;
• where the User withdraws consent to the processing of personal data, continue processing personal data without the User's consent where grounds set out in the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature" exist;
• obtain accurate information and/or documents containing the User's personal data from the User for the processing purposes referred to in clause 2.2 of this Policy;
• require the User to promptly update the personal data they have provided.

1.8. Rights and obligations of the User.

1.8.1. The User shall:

• ensure the accuracy of personal data provided to the Operator that is necessary for the processing purposes set out in clause 2.2 of this Policy;
• provide the Operator, where necessary, with information to rectify (update, change) the personal data provided.

1.8.2. The User has the right to:

• full information regarding the processing of their personal data by the Operator, except in cases provided for by the legislation of the Kyrgyz Republic;
• rectification, blocking, or destruction of their personal data where the data are incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data;
• take lawful measures to protect their rights;
• appeal to the authorised body for the protection of the rights of data subjects or challenge in court unlawful actions or inaction of the Operator in processing their personal data;

The Operator and Users also have other rights and bear other obligations provided for by the legislation of the Kyrgyz Republic.

2. Purposes of personal data processing

2.1. Processing of personal data is limited to achieving specific, predetermined, and lawful purposes. Processing that is incompatible with the purposes of collection is not permitted. Personal data processed must not be excessive in relation to the stated purposes. Only personal data that serve those purposes may be processed.

2.2.The Operator processes the User's personal data for the following purposes:

• 2.2.1.To identify the User registered on the Website for further communication regarding the User's request.
• 2.2.2. To inform about the operation of the Website (services), and to monitor and improve the quality of the services.
• 2.2.3. To provide the User with access to personalised resources of the Website.
• 2.2.4. To establish feedback with the User, including sending notices and requests relating to use of the Website, provision of services, performance of work, and handling of requests and applications from the User.
• 2.2.5.To determine the User's location to ensure security and prevent fraud involving the User's personal data on the Website.
• 2.2.6. To create an account where the User has consented to account creation.
• 2.2.7. To provide the User with effective customer and technical support where issues arise in connection with use of the Website.
• 2.2.8. To send informational messages.

3. Legal basis for processing personal data

3.1.The legal bases for the Operator's processing of personal data are:

• the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature";
• consent to the processing of personal data on the Website.

4. Scope and categories of personal data processed; categories of data subjects

4.1.The Operator may process personal data of the following Users: visitors to the Operator's website.

4.2. Personal data processed by the Operator include:

• the User's surname, first name, and patronymic;
• place of residence (region/city);
• mobile telephone number;
• email address;
• data automatically transmitted to the Website services when they are used via software installed on the User's device, namely: IP address, cookie data, information about the User's browser (or other software used to access the services), technical characteristics of the hardware and software used by the User, date and time of access to the services, addresses of requested pages, and history of requests and views on the Website and its services.

4.3. The Operator ensures that the content and volume of personal data processed correspond to the stated processing purposes set out in Section 2 of this Policy.

4.4. The Operator does not process biometric personal data or special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.

5. Procedure and conditions for processing personal data

5.1. The Operator processes personal data in accordance with the requirements of the legislation of the Kyrgyz Republic by the following means:

• non-automated processing of personal data;
• automated processing of personal data with or without transmission of the resulting information via telecommunications networks;
• mixed processing of personal data.

5.2.The list of operations performed by the Operator on the User's personal data for the purposes referred to in clause 2.2 of this Policy includes: collection, recording, systematisation, accumulation, storage, rectification (update, change), retrieval, use, transfer (disclosure, provision, access), anonymisation, blocking, erasure, and destruction.

5.3.Personal data are processed by the Operator subject to the User's consent (hereinafter — Consent) obtained in accordance with the requirements of the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature", except in cases established by the legislation of the Kyrgyz Republic where processing may be carried out without such Consent.

5.4. The User freely decides whether to provide their personal data and gives Consent voluntarily, by their own will and in their own interest.

5.5. The period of processing of personal data is determined by achievement of the purposes for which the data were collected, unless a different period is provided for by an agreement with the User or by effective legislation. Processing may cease upon achievement of the purposes, loss of the need to achieve those purposes, expiry of Consent or withdrawal of Consent by the User, or detection of unlawful processing.

5.6.Consent may be withdrawn by the User sending an official email with the subject line "Cease processing of personal data" to info@agt.kg.

5.7.The Operator discloses personal data that the User has permitted to be disclosed, i.e. carries out actions aimed at disclosure to an indefinite circle of persons, in compliance with requirements, prohibitions, and conditions established by the aforementioned Law. Disclosure to third parties and dissemination of personal data without the User's consent is not permitted, except where otherwise provided by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature". Consent to the processing of personal data that the User has permitted to be disclosed is obtained separately from other consents to processing of their personal data, taking into account the requirements for the content of consent to the processing of personal data permitted by the data subject for disclosure.

5.8. When processing personal data, the Operator takes or ensures the adoption of necessary legal, organisational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, or dissemination, as well as against other unlawful acts.

5.9. Personal data are stored in a form that allows identification of the User for no longer than required by the purposes of processing, except where the storage period is established by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature", an agreement to which the User is a party, beneficiary, or guarantor.

5.10. When processing personal data, the Operator complies with the requirements of the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature".

5.11. When processing personal data, the Operator undertakes to maintain the confidentiality of personal data.

5.12. The Operator does not carry out cross-border transfer of personal data.

5.13. In the event of unlawful or accidental transfer (provision, dissemination, or access) of personal data, the Operator informs the User within seven (7) working days.

5.14.The Operator, together with the User, takes all necessary measures to prevent losses or other adverse consequences caused by unlawful or accidental transfer (provision, dissemination, or access) of the User's personal data.

6. Blocking, rectification, and destruction of personal data; responses to User requests for access to personal data

6.1. Where unlawful processing of personal data is identified upon application by the User (or their representative), upon request of the User (or their representative), or upon request of the authorised body for the protection of the rights of data subjects, the Operator blocks unlawfully processed personal data relating to the relevant User or ensures their blocking from the moment of such application or receipt of the request for the duration of the review. Where inaccurate personal data are identified upon application by the User or their representative, upon their request, or upon request of the authorised body for the protection of the rights of data subjects, the Operator blocks personal data relating to that User or ensures their blocking from the moment of such application or receipt of the request for the duration of the review, provided that blocking does not violate the rights and lawful interests of the User or third parties.

6.2. Where inaccuracy of personal data is confirmed, the Operator, on the basis of information submitted by the User (or their representative) or the authorised body for the protection of the rights of data subjects, or other necessary documents, rectifies the personal data or ensures their rectification within seven working days from the date of submission of such information.

6.3. Where unlawful processing of personal data is identified, the Operator, within no more than three working days from the date of that identification, ceases unlawful processing or ensures cessation of unlawful processing; where lawful processing cannot be ensured, within no more than ten working days from the date of identification of unlawful processing, the Operator destroys such personal data or ensures their destruction.

6.4.Where the purpose of processing personal data has been achieved, the Operator destroys the personal data or ensures their destruction within no more than thirty days from the date the purpose was achieved, unless otherwise provided by an agreement to which the User is a party, beneficiary, or guarantor, another agreement between the Operator and the User, or unless the Operator is entitled to process personal data without the User's consent on grounds provided for by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature" or regulatory legal acts.

6.5.Where the User withdraws consent to the processing of their personal data and retention of the data is no longer required for the purposes of processing, the Operator destroys the personal data or ensures their destruction within no more than thirty days from the date of receipt of such withdrawal, unless otherwise provided by an agreement to which the User is a party, beneficiary, or guarantor, another agreement between the Operator and the User, or unless the Operator is entitled to process personal data without the User's consent on grounds provided for by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature" or other regulatory legal acts.

6.6. Within no more than seven working days from the date the User (or their representative) submits information confirming that personal data were obtained unlawfully or are not necessary for the stated purpose of processing, the Operator destroys such personal data.

6.7. Personal data being processed shall be destroyed if the need to achieve the purposes of processing is lost, unless otherwise provided by the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature".

7. Liability of the parties

7.1. The Operator is liable for violation of the requirements of the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature" in accordance with the legislation of the Kyrgyz Republic.

7.2. The User may seek compensation for damages and/or compensation for non-pecuniary harm in court. Non-pecuniary harm caused to the User as a result of violation of their rights, breach of rules on processing personal data, or requirements for the protection of personal data established in accordance with the Law of the Kyrgyz Republic No. 58 of 14 April 2008 "On Information of a Personal Nature", as well as provisions of this Policy, shall be compensated in accordance with the legislation of the Kyrgyz Republic. Compensation for non-pecuniary harm is made independently of compensation for property damage and losses incurred by the User.

8. Dispute resolution

8.1. Any disputes and/or disagreements arising from the relationship between the User and the Operator shall be resolved in accordance with the effective legislation of the Kyrgyz Republic.

8.2. This Policy and the relationship between the User and the Operator shall be governed by the effective legislation of the Kyrgyz Republic.

9. Final provisions

9.1.The Operator may amend this Policy without the User's consent.

9.2. A new version of the Policy takes effect from the moment it is published on the Website, unless the new version provides otherwise. The new version applies to relations arising after it enters into force. Continued use of the Website or its services after publication of a new version of the Policy constitutes acceptance of the Policy and its terms by the User. If the User does not agree with the terms of the Policy, they must immediately stop using the Website and its services.

9.3. All questions regarding this Policy and/or the processing of personal data should be sent to: info@agt.kg.