PERSONAL DATA SUBJECT’S CONSENT
TO THE PROCESSING OF PERSONAL DATA (INCLUDING SENSITIVE DATA)
This document constitutes a written consent (hereinafter – the “Consent”) for the processing of personal data in accordance with the AIFC Data Protection Regulations No. 10 of 2017, AIFC Data Protection Rules No. 1 of 2018, and the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” dated 21 May 2013, No. 94-V (collectively referred to as the “Applicable Law”).
I hereby provide my explicit consent to Bigone Investment Ltd., a private company registered under BIN 230740900475 with its registered address at 55/17 Mangilik Yel Avenue, Office No.149, Astana, Republic of Kazakhstan (hereinafter – the “Company”), to collect, process, store, and transfer the following personal data (hereinafter – “Personal Data”):
Full name, patronymic, gender, ethnic origin, passport details, registration and residential address, nationality, date and place of birth;
Employment details (employer name, job titles, departments, employment periods, clock number, work schedule, experience, leaves, sickness certificates);
Education, professional qualifications, membership in professional associations;
Marital status, military registration details;
Contact information (phone numbers, email addresses);
Financial data (income, tax and pension contributions, credit history, alimony, bonuses, assets, deposits, material assistance, ownership interests in companies);
Individual Identification Number (IIN), banking details, tax residency status, real estate and vehicle ownership;
Information regarding legal or regulatory violations.
Purposes of Processing
The Company may process Personal Data for the following purposes (the “Purposes”):
To provide services in accordance with the Client Agreement;
To perform Know Your Customer (KYC) and Client Due Diligence (CDD) procedures in compliance with applicable AIFC and Republic of Kazakhstan legislation;
To cooperate with state authorities and authorized third parties for compliance and regulatory obligations;
To fulfil legal obligations required under AIFC and Kazakhstan legislation.
Scope of Processing Activities
The processing of Personal Data may include, but is not limited to, the following actions:
Collection, recording, categorization, accumulation, storage, updating (modification), retrieval, usage, transfer (distribution, access provision), depersonalization, blocking, deletion, destruction, including transfer via:
Public communication networks;
International information and telecommunication networks;
Cross-border transfers to countries that:
Are signatories to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data;
Provide adequate protection of personal data;
Do not provide adequate protection (with explicit consent).
Access to the Personal Data is strictly limited to individuals specifically authorized by the Company.
Storage and Processing Duration
Personal Data will be stored and processed throughout the duration of the business relationship and for a period of six (6) years following its termination, in accordance with regulatory retention obligations.
All data will be securely stored on servers located at the data center operated by Transtelecom JSC (BIN 991140001226), situated at 28 Kabanbai Batyr Avenue, Astana, Republic of Kazakhstan.
Data Subject Obligations
I undertake to:
Provide accurate and complete Personal Data upon request;
Bear full responsibility for the accuracy and timeliness of the information provided;
Notify the Company of any changes to my Personal Data within three (3) working days of such changes.
Failure to provide accurate or complete information may result in delays or inability to deliver services under the stated Purposes.
Validity of Consent
This Consent shall remain valid throughout the duration of services provided by the Company and for six (6) years after service termination.
Right to Withdraw Consent
I acknowledge my right to withdraw this Consent at any time by submitting a written request. However, I understand that the withdrawal of Consent may render the Company unable to fulfil the Purposes stated above, particularly those required by law.
Right to Data Retention and Deletion
In accordance with data protection principles:
Subjects have the right to request deletion of their Personal Data when the original purposes of processing have been fulfilled;
Where legal obligations (e.g. under AIFC AML Rules) require retention of certain data, the Company reserves the right to retain such data;
All deletion requests will be reviewed within a reasonable period. If approved, the data will be securely erased or anonymized in line with applicable laws.
Data Controller and Processor
The data controller and processor is:
Bigone Investment Ltd., private company
Email for data-related inquiries: compliancekz@big.one
If you suspect a data breach or wish to exercise your data rights, please submit a written request to the email address above.