Consent to collection and processing of personal data

Consent to the collection and processing of personal data

ATTENTION! This consent form is universal. The provision by the Data Subject of consent to the collection and processing of the personal data specified below does not mean that the Data Subject is required to provide all of their personal data listed in the relevant list. The Data Subject will provide only the amount of personal data required by the Operator to provide the service requested by the Data Subject / perform the operation / execute the transaction.

CONSENT TO THE COLLECTION AND PROCESSING OF PERSONAL DATA

I, the personal data subject (hereinafter referred to as the “Data Subject”) and/or the legal representative of the Data Subject, in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” and other regulatory legal acts of the Republic of Kazakhstan, hereby give my consent to the organizations comprising the BCC Financial Group* (hereinafter collectively and/or individually referred to as the “Owner” and/or the “Operator”), as well as to the partners of the Owner and/or the Operator, to the collection and processing of personal data, including the transfer thereof to third parties, dissemination through publicly available sources, as well as cross-border transfer of personal data, and confirm that I have reviewed the List of Personal Data Necessary and Sufficient for the Execution of Assigned Tasks, published on the official internet resource of the Owner and/or the Operator.

However, each of the above-mentioned organizations shall be the Owner and/or the Operator of personal data exclusively with respect to the personal data collected and processed by such organization within the scope of the services provided and activities carried out by it.

This Consent grants the Owner and/or the Operator the right, in accordance with the procedure established by the legislation of the Republic of Kazakhstan (hereinafter referred to as the “RK”), to carry out automated processing of personal data using digital objects, as well as to collect personal data from other sources and from third parties.

I. List of Personal Data Collected:

surname, first name, patronymic (if applicable), individual identification number (IIN); date and place of birth; gender; images and biometric vector (photo/video/audio and other biometric data); details of the identity document; citizenship; residency (country of residence and tax residency); registered and residential address; contact details: mobile subscriber number and/or other telephone number, email address;
information obtained from digital objects of state authorities and/or state and non-state legal entities;
information related to and necessary for the consideration of an application, as well as for the provision by the Owner and/or the Operator of banking and/or brokerage services and/or nominee holding services and/or asset management services, insurance services, leasing and/or other services;
information constituting bank secrecy, commercial secrecy in the securities market, insurance secrecy and other secrecy protected by the legislation of the RK;
information necessary for completing questionnaires, applications, agreements, other documents and compiling a file in accordance with the requirements of the legislation of the RK, as well as the internal regulatory documents of the Owner and/or the Operator.
information necessary for assessing the Data Subject’s creditworthiness, solvency and reliability;
information necessary to ensure the proper quality of the services provided, their improvement and personalization, including, but not limited to: service history and behavioral patterns; IP address; telemetry data; geolocation data; cookie data; information about the browser and operating system; data about the device used, as well as data obtained from the device’s sensors in the course of providing the service (including where access is granted to contacts in the phone book, photo gallery, camera, microphone and other device functions);
information (if available) about the legal representative, beneficial owner, founder(s), manager(s) and employee(s) of the person represented by the Data Subject, including, but not limited to, information to the extent provided for by this Consent;
information in accordance with the approved List of Personal Data Necessary and Sufficient for the Performance of the Tasks Carried Out, published on the official internet resource of the Owner and/or the Operator.

II. Third Parties Include:

subsidiaries/affiliated organizations of the Owner and/or the Operator, the major shareholder of Bank CenterCredit JSC, affiliated organizations of the major shareholder of Bank CenterCredit JSC, as well as their employees, consultants and auditors;
the operator of the “digital government” web portal, owners and/or holders of digital objects of state authorities and/or state and non-state legal entities;
owners and/or operators of databases and/or digital objects containing personal data;
credit bureaus;
certification authorities;
courts, authorized bodies, law enforcement authorities and special state authorities, officials and other authorized persons, as established by the legislation of the RK;
legal entities that, pursuant to a decision of the Government of the RK, carry out activities related to the provision of public services in accordance with the legislation of the RK;
payment systems, including international payment systems, as well as their participants, indirect participants, their subsidiaries/affiliates, payment service providers and payment (mobile) service providers, correspondent banks, processing organizations, and any other third parties that are or may in the future be engaged by the Owner and/or the Operator to provide services, participants in payments and/or money transfers;
mobile network operators;
persons to whom the Owner and/or the Operator assigns (or may assign) claims under concluded and/or to-be-concluded agreements, as well as persons with whom the Owner and/or the Operator enters into (or may enter into) agreements in connection with a change of persons in an obligation;
bodies and/or organizations of the Astana International Financial Centre (hereinafter referred to as the “AIFC”), if the Data Subject carries out transactions with AIFC participants or using bank accounts opened with AIFC banks;
other persons (including partners of the Owner and/or the Operator) with whom legal relationships already exist or may arise in the future.

III. Purposes of the Collection and Processing of Personal Data:

for considering an application, as well as for providing banking and/or brokerage services and/or nominee holding services and/or asset management services, insurance services, leasing and/or other services that may be provided by the Owner and/or the Operator in accordance with the legislation of the RK;
for the Owner and/or the Operator, being a financial monitoring entity, to perform its obligations regarding proper customer due diligence when establishing business relations and carrying out transactions in accordance with the legislation of the RK, including for the proper identification of customers of the BCC Financial Group, of which the Owner and/or the Operator is a participant, in accordance with the Law of the RK “On Counteracting the Legalization (Laundering) of Proceeds Obtained Through Crime, Financing of Terrorism and Financing of the Proliferation of Weapons of Mass Destruction”, as well as for performing currency control functions;
for the internal control and accounting of the Owner and/or the Operator, as well as for monitoring and confirming the proper fulfillment by the Data Subject of their obligations under the relevant agreements (contracts);
for the Owner and/or the Operator to carry out activities (perform obligations) related to the identification/authentication/authorization of the Data Subject and verification of the accuracy (correctness) of the information/data/algorithms/codes/symbols/identifiers/numbers and other information provided by the Data Subject and used by the Owner and/or the Operator (including by obtaining/verifying personal data and other information from sources available to the Owner and/or the Operator and other sources), in order to minimize the risk of unauthorized transactions in accordance with the legislation of the RK and the terms of the relevant agreements;
for judicial and extrajudicial protection of the rights and legitimate interests of the Owner and/or the Operator, including in the event of a breach of obligations under concluded agreements (contracts), as well as in the event of disputes, including those involving third parties;
for the Owner and/or the Operator to work with collection agencies and/or other specialized persons or employees/representatives of the Owner and/or the Operator who will be entrusted with carrying out activities for the collection of indebtedness under the relevant agreements (contracts) in the event of a breach of obligations under such agreements (contracts), as well as for conducting auctions related to the sale of pledged property;
for improving the quality of service and conducting marketing programs, as well as developing marketing and advertising campaigns, by sending the Data Subject informational materials, including information about products and/or services of the Owner and/or the Operator and its partners, and other notifications by telephone and other means of communication, including through open channels (SMS, e-mail, social networks, push notifications, calls, etc.);
for obtaining public and other services provided for by the legislation of the RK when interacting with state authorities and organizations;
for complying with the requirements stipulated by the legislation of the RK;
for other purposes provided for by the legislation of the RK, as well as by agreements concluded between the Data Subject and the Owner and/or the Operator and other documents governing the legal relations between them.

IV. This Consent shall be effective from the date of its provision (confirmation of its provision) by the Data Subject and for the period of:

the period for consideration of the application and/or the period for provision of banking and/or brokerage services, and/or nominee holding services, and/or asset management services, and/or insurance services, leasing and/or other services provided for by the legislation of the RK and provided by the Owner and/or the Operator;
the period during which legal relations exist between the Data Subject and the Owner and/or the Operator (at least one of the Operators specified in this Consent), arising in connection with the provision of services in accordance with the legislation of the RK, as well as the conclusion and performance of agreements, contracts and other transactions between the Data Subject and the Owner and/or the Operator and/or the Operator’s partners;
the period for the Data Subject to fulfill their obligations to the Owner and/or the Operator, as well as to third parties;
the periods established by the legislation of the RK for the Owner and/or the Operator to retain first-level documents (primary documents);
any other period arising from the terms and conditions set forth in Chapter III of this Consent.

The Consent has been signed using one of the following methods:

Data Subject’s handwritten signature
Biometric systems
Electronic digital signature (EDS)
Entry of a one-time dynamic code (OTP)

When accessing personal data contained in digital objects of state authorities and/or state legal entities, consent may also be provided in the following manner through a government service:

SMS gateway of the Unified Contact Center “1414”