Privacy and Personal Data Processing Policy

1. General provisions

This Privacy and Personal Data Processing Policy (the “Policy”) describes how personal data of users of colos.kz (the “Website”) is collected, processed, stored, used and protected.

The personal data operator is IFC COLOS Limited Liability Partnership, Business Identification Number 070140005046, address: 76 Abay Avenue, Bostandyk District, Almaty, Republic of Kazakhstan (the “Company” or the “Operator”).

This Policy has been prepared with regard to the personal data legislation of the Republic of Kazakhstan. Where consent is required, it is obtained separately through a checkbox in a form, submission of a request, signing of a document or another method permitted by law.

2. Data that may be processed

Depending on how a user interacts with the Website, the Company may process:

  • full name or the name of a contact person;
  • company name and position;
  • telephone number, email address and other contact details;
  • cargo, route, service, timing, document and other information provided in a request;
  • information contained in a CV, cover letter, LinkedIn profile and attached files submitted for a vacancy;
  • information voluntarily provided in messages and enquiries;
  • technical data such as IP address, browser type and version, operating system, date and time of access, referring page, pages visited, cookies and other technical identifiers.

The Company does not request special categories of personal data unless required by law or by the nature of a specific request. Users should not provide excessive information unrelated to the purpose of their enquiry.

3. Purposes of processing

Personal data may be processed for the following purposes:

  • receiving, registering and handling requests, applications and enquiries;
  • preparing a cost estimate, commercial proposal and logistics solution;
  • contacting the user by telephone, email or another channel provided by the user;
  • entering into and performing contracts and providing freight forwarding, customs and related services;
  • reviewing job applicants and maintaining a candidate pool;
  • operating the personal account and providing requested digital services after their launch;
  • protecting the Website, preventing abuse and resolving technical failures;
  • analysing Website performance and improving its structure, content and service quality;
  • complying with the laws of the Republic of Kazakhstan.

4. Legal grounds and principles

The Company processes personal data on the basis of user consent, the need to enter into or perform a contract, compliance with legal obligations, and other grounds permitted by the laws of the Republic of Kazakhstan.

Collection and processing are limited to specific, predetermined and lawful purposes. The amount of data must be necessary and sufficient for those purposes.

5. Processing operations

Processing may be automated or non-automated and may include collection, recording, organisation, accumulation, storage, updating, use, lawful transfer, anonymisation, blocking and deletion of personal data.

6. Disclosure to third parties

The Company does not disclose personal data without the user’s consent or another lawful basis.

To the extent necessary for the purposes described above, data may be provided to:

  • authorised employees and business units of the Company;
  • providers of hosting, email, information systems, CRM, technical support and information security services;
  • carriers, terminals, warehouses, customs representatives, insurers and other partners involved in preparing an offer or providing a service;
  • government authorities and other persons where disclosure is required by law or necessary to protect the lawful rights and interests of the Company.

Only the amount of data necessary for the relevant purpose is provided. The Company takes reasonable measures to ensure confidentiality and proper handling of the data.

7. Storage and security

Personal data is accumulated and stored in databases located in the Republic of Kazakhstan unless otherwise expressly permitted by law.

Data is retained only for as long as necessary to fulfil the purposes of processing, contractual and legal obligations, resolve potential disputes and protect the Company’s lawful interests.

The Company applies legal, organisational and technical measures designed to prevent unauthorised access, alteration, disclosure, blocking, copying, distribution, destruction and other unlawful actions involving personal data.

No transmission over the internet can be guaranteed to be completely secure. Users should also take reasonable precautions and must not disclose passwords or confidential information to unauthorised persons.

8. Cookies and technical data

The Website may use essential cookies required for page operation, forms, language selection, security and session management. If analytics services are enabled, additional cookies may be used to obtain anonymised visit statistics and improve the Website.

Users may restrict or delete cookies in their browser settings. Disabling essential cookies may prevent certain Website functions from operating correctly.

9. Cross-border transfer

Cross-border transfers of personal data may take place only in compliance with the laws of the Republic of Kazakhstan, including obtaining the user’s consent or relying on another lawful basis where required and ensuring appropriate protection of personal data.

10. User rights

Subject to applicable law, users may:

  • obtain information about whether and how their personal data is processed;
  • request correction, completion, blocking or deletion of data that is incomplete, inaccurate, outdated, unlawfully obtained or no longer required for the stated purpose;
  • withdraw consent where withdrawal is not prohibited by law and there are no outstanding obligations;
  • challenge actions or omissions related to personal data processing;
  • exercise other rights provided by the laws of the Republic of Kazakhstan.

To protect personal data, the Company may request information necessary to verify the identity of the applicant and their connection with the relevant data.

11. Minors

The Website is not intended for the independent submission of personal data by persons who have not reached the age at which they may provide valid consent. If such data has been submitted without proper consent of a legal representative, the Company should be notified.

12. Third-party resources

The Website may contain links to third-party websites and services. The Company is not responsible for their content or data processing practices. Users should review the relevant privacy policies before using those resources.

13. Changes to this Policy

The Company may update this Policy to reflect changes in law, technology and data processing practices. A new version becomes effective when published on the Website unless another effective date is stated.

14. Contact details

Questions regarding personal data processing, access, correction or withdrawal of consent may be addressed to:

  • Operator: IFC COLOS LLP;
  • Business Identification Number: 070140005046;
  • Address: 76 Abay Avenue, Bostandyk District, Almaty, Republic of Kazakhstan;
  • Email: info@colos.kz;
  • Telephone: +7 (701) 331-18-18.