1. General provisions
This Policy sets out how SBS FINCON LLP, BIN 211140030685 (the “Company”), processes and protects personal data in connection with the FinCon Docs electronic document management service (the “Service”).
The Policy has been drawn up in accordance with the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection” and other regulations of the Republic of Kazakhstan.
The Company acts as the owner and operator of personal data. Using the Service means that the User agrees to this Policy.
The current version of the Policy is permanently available at https://docs.fincon.kz/en/privacy.
2. Definitions
Terms not defined in this Policy have the meaning given to them by the laws of the Republic of Kazakhstan and by the Terms of Use.
- Personal data — information relating to a specific data subject, or making the subject identifiable, recorded on an electronic, paper or other tangible medium.
- Data subject — the individual to whom the personal data relates.
- Processing — collection, recording, systematisation, accumulation, storage, alteration, use, transfer, depersonalisation, blocking and destruction of personal data.
- User — a person using the Service, including a representative of a legal entity.
- User’s counterparty — a person invited by the User to approve or sign a document in the Service.
- Cookie — a small file stored by the browser on the User’s device.
3. Legal grounds for processing
The Company processes personal data where at least one of the grounds listed below applies.
Separate consent is not required in the cases expressly provided for by paragraph 2 of Article 9 of the Law “On Personal Data and Their Protection”, including where processing is necessary to perform an agreement to which the data subject is a party.
- the data subject’s consent to the collection and processing of personal data;
- the need to process data in order to conclude and perform an agreement with the data subject, including under the public offer;
- compliance by the Company with obligations imposed on it by the laws of the Republic of Kazakhstan, including tax and accounting rules;
- protection of the rights and legitimate interests of the Company and the data subject, where this does not infringe the rights of the data subject.
4. Categories of personal data processed
The Company processes the minimum necessary amount of data. It does not collect or process special categories of personal data (racial or ethnic origin, political views, religious beliefs, health data).
Documents uploaded by the User to the Service may contain personal data of third parties. With regard to such data the Company acts on the User’s instructions, while the User is responsible for having a lawful basis to transfer it.
- registration data: surname, first name, patronymic, e-mail address, phone number, password in encrypted form;
- organisation details: name, BIN, registered address, position of the representative;
- data required to sign documents: IIN, electronic digital signature certificate data, including the public key and validity period;
- data from enquiries submitted through the contact form on the Site;
- payment details: payer details, amount and date of payment. The Company does not receive or store full bank card data — payments are processed by the acquiring bank;
- technical data: IP address, browser and operating system type and version, date and time of the request, cookie identifiers;
- activity logs: sign-ins to the personal account, creation, approval and signing of documents.
5. Purposes of processing
The Company processes personal data solely for the purposes listed below and does not use it for purposes incompatible with those stated.
- registration and identification of the User in the Service;
- providing the features of the Service: creating, approving, signing, verifying and storing electronic documents;
- giving legal effect to signed documents and confirming their integrity;
- issuing invoices, settling payments and keeping accounting records;
- handling enquiries and providing technical support;
- ensuring the security of the Service, preventing unauthorised access and investigating incidents;
- complying with the requirements of the laws of the Republic of Kazakhstan;
- sending informational messages about changes to the Service, tariffs and terms of service.
6. Consent and its withdrawal
Consent to the collection and processing of personal data is given by the User on registration in the Service or when submitting the contact form, and is specific, informed and conscious.
The data subject may withdraw consent at any time by sending a request to info@fincon.kz. The Company stops processing and destroys the personal data within ten business days of receiving the request.
Withdrawal of consent does not extend to data whose processing is necessary for the Company to comply with statutory obligations, nor to data contained in documents that have already been signed: destroying it would make it impossible to verify the authenticity of the signature.
Withdrawal of consent makes further use of the Service impossible and constitutes grounds for terminating the agreement.
7. Storage conditions and periods
Personal data is stored for no longer than the purposes of processing require, unless a different period is prescribed by the laws of the Republic of Kazakhstan.
Databases containing the personal data of citizens of the Republic of Kazakhstan are hosted on servers located in the Republic of Kazakhstan.
Once the storage period expires, personal data is destroyed or depersonalised.
- registration data — for the lifetime of the account and three years after it is deleted;
- electronic documents and signature records — for the period set by the User, but at least five years from the date of signing;
- accounting and payment documents — for the periods prescribed by accounting and tax legislation;
- activity logs and technical data — for one year;
- contact form enquiries — for one year from the date of the enquiry.
8. Transfer to third parties
The Company does not sell personal data and does not transfer it to third parties, except in the cases listed below.
Third parties engaged by the Company process personal data solely on the Company’s instructions, to the extent necessary to provide the relevant services, and are bound by confidentiality obligations.
Cross-border transfer of personal data takes place only where the receiving party ensures the protection of personal data, in accordance with Article 16 of the Law “On Personal Data and Their Protection”.
- to the User’s counterparties — to the extent needed to approve and sign a specific document, at the User’s own initiative;
- to certification authorities — to verify electronic digital signature certificates;
- to banks and payment organisations — to settle payments;
- to infrastructure and telecommunications providers that keep the Service running;
- to state authorities — upon a reasoned request, in the cases and in the manner prescribed by the laws of the Republic of Kazakhstan.
9. Data protection measures
The Company takes the organisational and technical measures necessary to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying and distribution.
If an incident involving unlawful access to personal data is detected, the Company takes measures to address it and notifies the affected data subjects and the authorised body in the manner prescribed by law.
- data transfer between the User’s device and the Service over the secure TLS protocol;
- storing passwords solely as irreversible cryptographic hashes;
- granular access rights to data and regular review of employee permissions;
- keeping access and activity logs in the Service;
- regular backups and verification that data can be restored;
- non-disclosure undertakings for employees with access to personal data.
10. Rights of the data subject
The data subject may exercise the rights provided for by Article 12 of the Law “On Personal Data and Their Protection”.
Requests are sent to info@fincon.kz. The Company reviews the request and responds within ten business days of receipt. The Company may ask the applicant for information confirming their identity.
- to know whether the Company holds their personal data and to obtain information on the terms of access to it;
- to receive information about the purposes, periods and methods of processing;
- to request that personal data be amended or supplemented on documented grounds;
- to request that personal data be blocked where there is evidence of unlawful processing;
- to request the destruction of personal data processed in breach of the law;
- to withdraw consent to the collection and processing of personal data;
- to protect their rights and legitimate interests, including by applying to the authorised body or to a court.
11. Cookies and technical data
The Site and the Service use cookies and similar technologies, without which it is impossible to maintain the User’s session and to keep sign-in to the personal account secure.
The User may block cookies in their browser settings or delete previously stored files. In that case some features of the Service, including authorisation, may become unavailable.
- technical cookies — maintaining the session, protecting against request forgery, storing the selected interface language;
- analytics cookies — collecting depersonalised statistics on traffic and on the quality of the Service.
12. Changes to the Policy
The Company may amend this Policy. A new version takes effect when it is published on the Site, unless the version itself specifies another date.
Where the conditions of processing change materially, the Company additionally notifies Users by e-mail or through the Service interface.
13. Enquiries and contacts
Questions, requests and demands concerning the processing of personal data are sent to info@fincon.kz or to the Company’s registered address set out below.
If the Company’s response does not satisfy the data subject, they may apply to the authorised personal data protection body of the Republic of Kazakhstan or to a court.
Company details
- Legal name
- ТОО «SBS FINCON»
- Registered address
- Республика Казахстан, г. Алматы, ул. Тулебаева, 38/61
- BIN
- 211140030685
- Bank
- АО «Kaspi Bank»
- Account (IIC)
- KZ78722S000011156639
- BIC
- CASPKZKA
- KBe
- 17
- info@fincon.kz
- Website
- https://fincon.kz