Privacy Policy

Privacy policy

General Provisions

Life Insurance Company BCC Life Joint Stock Company (hereinafter referred to as the "Company") appreciates your interest in the services provided by the Company (hereinafter referred to as the "Services"). The protection of your personal information is of utmost importance to us; therefore, the Company takes a responsible approach to ensuring the confidentiality of personal data processed in connection with the use of the Services. The Services include online services available on the bcclife.kz website, enabling users of the Services (hereinafter referred to as the "Users") to interact with the Company in connection with concluded insurance contracts and/or other agreements, as well as without entering into such agreements, in accordance with the legislation of the Republic of Kazakhstan. Access to and use of the Services shall constitute the Users' unconditional acceptance of the provisions of this Privacy Policy (hereinafter referred to as the "Policy"). This Policy applies to information obtained by the Company as a result of the Users' use of the Services.

What Is Meant by Users' Data

The Company places great importance on the objectives, key principles, and legislative requirements governing the collection, processing, storage, and protection of data. The User's personal data shall mean any information provided by the User in any form while using the Services, as well as when interacting with the services of our partners and government organizations.

Categories and Sources of Personal Data

Users are individuals, individual entrepreneurs, authorized employees and/or representatives of legal entities registered in the Services. The personal data obtained by the Company in the course of the use of the Services include, but are not limited to, the User's full name, Individual Identification Number (IIN), mobile phone number, biometric data, identity document data, financial information, information obtained from government services, and other sources.

Purposes of Processing Users' Data

The Services collect and process only such personal data as are necessary for the provision of the Company's services. The Users' data are collected by the Company for the following purposes:

provision of insurance services, use of the services of the Company's partners and government authorities;
providing access to and improving the Services;
conducting marketing and other research;
ensuring compliance with and fulfillment of the requirements of the applicable legislation, as well as for other purposes specified in this Policy, the Company's internal regulations, or the terms of use of individual Services.

Automatically Collected Data

This information is necessary for diagnosing and troubleshooting issues. The Company collects diagnostic data, as well as information about the performance of the BCC Services during their use. This category includes:

information about the User’s device;
data concerning actions performed within the Services;
IP address, unique identifiers, browser data, telemetry, and other technical information.

With the User’s consent, the Services may access:

digital documents provided through integration with government services;
location data using geolocation services;
cookie information.

Use of Cookies

The Services use cookies and similar technologies to ensure the functioning of websites, improve service quality, conduct analytics, and provide personalized content. For more information, please visit: https://www.bcclife.kz/cookies

Disclosure of Users’ Information to Third Parties

The Company does not disclose Users’ information to third parties that do not have contractual or other lawful relationships with the Company, except in the following cases:

to comply with the requirements of the legislation of the Republic of Kazakhstan;
to disclose information to subsidiaries, partners, affiliates, counterparties and other persons in connection with the performance of contractual and legal relationships for the purpose of duly providing services to Users;
where the relevant User Consent has been obtained.

All third parties that have access to personal data are required to maintain confidentiality and ensure the protection of the information provided in accordance with the legislation of the Republic of Kazakhstan. These obligations include, but are not limited to, the requirements of this Policy and the provisions of confidentiality and non-disclosure agreements entered into with the Company. The Company may provide its partners with aggregated and anonymized data of Users of the Services, i.e. information that does not allow the User to be identified without the use of additional information. Such data may be used, among other things, for statistical, analytical and other research purposes.

Personal Data of Minor Users

The Services are not intended for use by persons under the age of 18. The Company does not determine the age of Users of the Services. At the same time, the protection of minors’ privacy is regarded as a joint responsibility of the Company and their legal representatives. Parents or guardians are encouraged to participate in the use of online services and monitor children’s digital activity.

Cross-Border Data Transfers

When transferring Users’ information outside the Republic of Kazakhstan, the Company ensures compliance with applicable legislation by entering into agreements, including agreements that guarantee that the recipients of the information maintain an appropriate level of information security protection. The Company uses secure cloud technologies and storage facilities, regardless of their location, helping to ensure a high level of service reliability, data security, and protection against unlawful attacks.

Ensuring the Security of Personal Data

The Company takes all possible administrative, legal, and technical measures to protect Users’ personal data against unauthorized attempts to access, modify, disclose, destroy, or otherwise compromise the security of such data. The Company ensures the protection of information throughout its entire “life cycle,” including the collection, accumulation, storage, modification, supplementation, use, dissemination, anonymization, blocking, and destruction of personal data, and does not permit any breach of the confidentiality of the information obtained. To ensure the secure storage of data in information systems in accordance with the requirements of applicable legislation, the Company uses the following methods, including but not limited to:

access control to information resources;
data transmission over the secure HTTPS protocol;
use of the TLS cryptographic protocol, version 1.2 or higher;
storage and transmission of data exclusively in encrypted form;
use of secure communication channels, and other measures.

The personal data compromise incident response process includes the identification, assessment, containment, and remediation of incidents involving the leakage of or unauthorized access to Users’ personal information. In addition, the Company has implemented an employee awareness program aimed at training and informing employees about the importance of personal data protection, compliance with applicable legislation and internal policies, as well as methods for preventing incidents involving data compromise. The retention and deletion periods for data at the Company are determined in accordance with the requirements of the legislation of the Republic of Kazakhstan, the Company’s internal regulatory documents, documents governing the Company’s contractual relationships with Users, and Users’ consents to the processing of personal data.

Recommendations for Users on the Safe Use of the Services

Keep account credentials, such as your username and password, confidential and do not disclose them to third parties.
Immediately notify the Company of any suspected unauthorized use of your personal account.
Keep antivirus software up to date.
Connect only to trusted, secure Wi-Fi or cellular networks.
Use only official, trusted sources for downloading applications.
Regularly update applications and device operating systems, as many vulnerabilities are addressed through updates.
Keep your personal information up to date.
Do not allow third parties to use your personal mobile devices.
Do not install applications that enable remote access to or control of your device

Users’ Rights

The Company collects and processes Users’ personal data with the User’s Consent, except in cases provided for by the legislation of the Republic of Kazakhstan. The Company processes Users’ personal data in accordance with this Policy and the Company’s regulatory documents for as long as necessary to achieve the purposes for which such data is collected and processed and/or to comply with the requirements of the legislation of the Republic of Kazakhstan. The User’s rights are governed by the applicable legislation on Personal Data and Their Protection. The User has the right to:

request the modification, supplementation, blocking, or destruction of their personal data where there are grounds supported by the relevant documents;
withdraw their consent by submitting a written application through the Company’s office, except in cases provided for by the legislation of the Republic of Kazakhstan;
exercise other rights provided for by the Law and other regulatory legal acts of the Republic of Kazakhstan.

For the purpose of duly providing services, the Company ensures that Users’ personal data remains up to date by updating it based on:

data provided by the User;
data obtained from government and non-government services;
other sources provided for by the legislation of the Republic of Kazakhstan and the terms of agreements entered into with Users.

Changes to the Privacy Policy

The Company has the right to update and amend the provisions of this Policy at any time. The new version of the Policy shall enter into force upon its publication on www.bcclife.kz, unless otherwise provided by a decision of an authorized body of the Company. The Company recommends that Users of the Services regularly review this Policy to familiarize themselves with the most current version.

Dispute Resolution Procedure

All disputes and disagreements arising between the User and the Company in connection with the application of this Policy shall be resolved through negotiations and, if no agreement can be reached, in accordance with the applicable legislation of the Republic of Kazakhstan. If a dispute cannot be satisfactorily resolved through negotiations, the User has the right to contact the authorized body responsible for personal data protection matters — the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan.

Final Provisions

If the User disagrees with the terms of this Privacy Policy, the User has the right to discontinue use of the Services. To submit a written request or ask questions related to the processing of personal data, the User may send an application to the Company’s official address or use the contact details provided below.

Contact Details

To contact the Company regarding the processing of personal data and the exercise of Users’ rights, as well as to submit comments and complaints, the User may use the following contact details:

Email: info@bcclife.kz
Official website: www.bcclife.kz
Contact Center: +7 727 248 6274.
Company office address: 188 Dostyk Avenue, Medeu District, Almaty, Kulan Business Center, 2nd floor.

Written requests shall be considered by the Company in accordance with the procedure established by its internal regulations and within the time limits prescribed by the legislation of the Republic of Kazakhstan.