1. General provisions
1.1. This Policy defines the procedure for collecting, processing and protecting the personal data of individuals who visit the website https://marvik-partners.com, complete the forms placed on it, or send enquiries, applications or CVs (hereinafter respectively — the Policy, the Website, the User, the Subject).
1.2. The owner and operator of the database containing personal data is MARVIK PARTNERS Limited Liability Partnership, BIN 230240029359, registered address: 160800, Republic of Kazakhstan, city of Shymkent, Yenbekshi district, Zhuldyz residential area, building 336 (hereinafter — the Operator).
1.3. The Policy has been developed in accordance with the Constitution of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 On Personal Data and Its Protection, the Rules for the Collection and Processing of Personal Data approved by order No. 395/NQ of 21 October 2020, the Rules for Implementing Personal Data Protection Measures approved by order No. 179/NQ of 12 June 2023, and other regulatory legal acts of the Republic of Kazakhstan as currently in force.
1.4. The terms used in the Policy have the meanings established by the legislation of the Republic of Kazakhstan on personal data and its protection.
1.5. The Policy applies to information received through the Website, including feedback forms, cooperation forms, call-back requests, enquiries by email, the CV submission form, technical logs and cookies.
1.6. The User may browse the publicly available pages of the Website without completing any forms. Refusal to provide the data that is mandatory for a specific form may make it impossible to submit the form and prepare a reply, but does not in itself restrict access to publicly available materials.
1.7. Through the general forms of the Website, the Operator does not request an individual identification number, copies of identity documents, bank details, information about health, racial or ethnic origin, political views, religious or other beliefs, intimate life, or any other data not required to consider the enquiry.
2. Principles and legal grounds for processing
2.1. The Operator processes personal data lawfully and confidentially, to the extent necessary and sufficient for specific, predefined purposes. Excessive data is not collected or processed.
2.2. Personal data is collected and processed with the consent of the Subject or their legal representative, obtained in a way that allows the fact of its provision to be confirmed. Processing without consent is permitted only in the cases expressly provided for by Article 9 of the Law of the Republic of Kazakhstan On Personal Data and Its Protection and by other laws of the Republic of Kazakhstan.
2.3. If a User enquiry leads to the conclusion of a contract or to another obligation, the required personal data is processed within the limits of the purposes initially stated, the consent given and the requirements of the law. Withdrawal of consent does not terminate processing that is necessary to perform an outstanding obligation or a duty established by law.
2.4. Consent to advertising and information mailings not directly related to the User enquiry is obtained separately and is not a condition for submitting the main form.
2.5. Decisions that create, change or terminate the rights or legitimate interests of the Subject are not made solely on the basis of automated processing without the involvement of an authorised employee, except in cases expressly provided for by law or by separate consent of the Subject.
3. Data categories, purposes and processing periods
| Category of Subject / process | Personal data | Purposes of processing | Processing period |
|---|---|---|---|
| Website visitor | IP address; date and time of the request; page address; information about the browser, operating system and device; technical identifiers; necessary cookies; information about security events. | Operation and security of the Website; protection against abuse; error diagnostics; maintenance of technical logs. | Up to 12 months, unless a shorter period is set by technical settings or internal documents. |
| User of the feedback, cooperation or call-back form | Surname, first name, patronymic (if any); telephone; email; city/region; organisation; position; content of the enquiry; information in attached files; date and time of submission; IP address; consent version. | Registration and consideration of the enquiry; feedback; preparation of a reply, offer or quotation; arrangement of cooperation; confirmation of the fact of consent. | Until the purpose is achieved, but no longer than 1 year from the date of the last interaction, except for data subject to retention by law or contract. |
| Candidate who has submitted a CV | Full name; contact details; city of residence; information about education, qualifications, work experience, skills and the desired position; other information voluntarily included in the CV; technical submission data. | Consideration of the candidate; contact with the candidate; creation of a talent pool — only with the candidate's separate consent. | Until the selection process is completed, or up to 1 year from the date the CV was received, unless a shorter period is set by separate consent. |
| Mailing subscriber — where separate consent is given | Name; email address; telephone number — if selected as a channel; history of consent and withdrawal. | Sending news, offers and other materials through the selected channel. | Until the separate consent is withdrawn or the mailing is discontinued. |
| Consent confirmation log | Full name; date and time; form identifier; page address; IP address; user-agent; version of the Policy and of the consent; checkbox state; technical result of submission. | Confirmation that consent was obtained; consideration of enquiries and disputes; verification of the lawfulness of processing. | For the term of the consent and up to 3 years after it ends, unless longer retention is required by law. |
| Representative of a prospective or current counterparty | Full name; position; organisation; business contact details; content of business correspondence; information about authority — where necessary. | Negotiations; conclusion and performance of a contract; business communication; protection of the rights and legitimate interests of the parties. | For the duration of the negotiations and the contract, and thereafter — for the periods established by law and by the Operator's internal documents. |
3.2. If the User submits information not listed in the table on their own initiative, the Operator assesses whether it is necessary. Excessive data is deleted or anonymised unless its retention is required by law or needed to protect the rights of the Subject and the Operator.
4. Procedure for obtaining consent
4.1. Before a form is submitted, the User is given access to this Policy and to the text of the relevant consent to the collection and processing of personal data.
4.2. Consent is given by independently completing the field Surname, first name, patronymic (if any), ticking a checkbox that is not pre-selected, and pressing the form submission button. Submission of the form without ticking the mandatory checkbox is blocked.
4.3. To confirm that consent has been obtained, the Operator records the information listed in the Consent confirmation log row of Section 3 of the Policy.
4.4. Separate consents are used for:
- advertising and information mailings;
- sending and storing CVs;
- activating optional analytical or marketing cookies;
- publishing personal data in publicly available sources;
- other purposes incompatible with the purpose initially stated.
5. Cookies and technical information
5.1. The Website may use technically necessary cookies, without which certain functions, security, language selection or the saving of settings cannot work correctly.
5.2. Analytical, third-party functional and marketing cookies are activated only after the User makes the corresponding choice in the cookie management interface. Refusing optional cookies does not restrict access to the main content of the Website.
5.3. The current list of cookies used, their lifetimes, providers and purpose is available to the User in the cookie settings interface. Only services actually used by the Website are included in the list.
5.4. The User may delete or restrict cookies using browser tools. This may affect the operation of certain Website functions.
6. Accumulation, storage and destruction of data
6.1. Personal data is accumulated and stored in a database located in a server room or data centre on the territory of the Republic of Kazakhstan. The main database and the backup copies used for permanent storage of Website data are located on the territory of the Republic of Kazakhstan.
6.2. The Operator does not allow personal data to be stored exclusively outside the Republic of Kazakhstan.
6.3. Once the purpose of processing has been achieved, the established period has expired, or upon a lawful request of the Subject, personal data is destroyed or anonymised, unless further retention is required by the legislation of the Republic of Kazakhstan, by a contract or by an outstanding obligation.
6.4. Destruction is carried out in a manner that excludes recovery of the data. The Operator documents destruction operations in the cases provided for by internal documents and by law.
7. Transfer to third parties
7.1. Possibility of transferring personal data to third parties: provided for. Transfer is carried out only to the minimum extent necessary for the stated purposes.
7.2. Categories of recipients may include:
- the provider of hosting, data centre and backup services in the Republic of Kazakhstan;
- the developer and the technical support organisation of the Website;
- providers of corporate email, CRM, telephony and feedback services;
- providers of information security, anti-spam and technical monitoring tools;
- web analytics providers — only where consent to the corresponding cookies has been given;
- consultants, auditors and other contractors for whom access is objectively necessary to provide services to the Operator;
- state authorities and other persons — in the cases and in the manner established by the legislation of the Republic of Kazakhstan.
7.3. Third parties are granted access to the data where a contract or another lawful ground exists; they are obliged to maintain confidentiality, use the data only for the assigned purpose and take the protective measures provided for by law.
7.4. The Operator does not sell personal data and does not provide it to third parties for their own marketing without the separate consent of the Subject.
8. Cross-border transfer
8.1. Information on the existence of cross-border transfer: cross-border transfer is provided for.
8.2. Cross-border transfer of personal data may be carried out to the Russian Federation and to other foreign states where the infrastructure is located of the actually used providers of technical support, corporate email, communications, analytics or other services listed in Section 7.
8.3. Only those categories of data that are necessary for the operation of the relevant service are transferred: contact details, the content of the enquiry and/or technical information about the visit to the Website.
8.4. Cross-border transfer is carried out with the consent of the Subject and in compliance with Article 16 of the Law of the Republic of Kazakhstan On Personal Data and Its Protection. If a foreign state does not ensure the required level of protection, transfer is permitted only where a ground provided for by law exists, including the Subject's consent to cross-border transfer.
8.5. Cross-border transfer does not cancel the requirement to keep the database and permanently store personal data on the territory of the Republic of Kazakhstan.
9. Publicly available sources
9.1. Distribution of Users' personal data in publicly available sources, including publication on the Website, on social networks, in advertising materials or in the mass media, is not carried out without the separate consent of the Subject, except in cases expressly provided for by the legislation of the Republic of Kazakhstan.
10. Rights of the Subject
10.1. The Subject or their legal representative has the right to:
- know whether the Operator holds their personal data;
- receive confirmation of the fact, purposes, sources and methods of collection and processing, the list of data and the periods of its storage;
- demand that the data be changed or supplemented where there are supporting grounds;
- demand that data collected or processed in breach of the law be blocked or destroyed, as well as in other cases provided for by law;
- withdraw consent, except where withdrawal is contrary to the law or an outstanding obligation exists;
- give or refuse consent to the distribution of data in publicly available sources;
- appeal against the Operator's actions to the authorised body or to a court and demand protection of their rights.
10.2. To obtain information or exercise their rights, the Subject sends a request to the Operator's email address or to its registered address. The Operator may request the information necessary to verify the applicant's identity and to prevent disclosure of data to an unauthorised person.
10.3. Information relating to the Subject is provided, or a reasoned refusal is sent, within 3 working days from the date the enquiry is received, unless another period is established by the legislation of the Republic of Kazakhstan.
11. Withdrawal of consent
11.1. Consent may be withdrawn by sending an application to the email address office@marvik-partners.kz or to the address: 160800, Republic of Kazakhstan, city of Shymkent, Yenbekshi district, Zhuldyz residential area, building 336.
11.2. The application must contain the applicant's full name, contact details, a description of the request and information making it possible to identify the record or the enquiry.
11.3. Within 15 working days from the date the withdrawal is received, the Operator and the third parties involved terminate processing, unless further storage or processing is required by the legislation of the Republic of Kazakhstan or by an outstanding obligation, or they send a reasoned refusal.
11.4. Withdrawal of consent does not affect the lawfulness of processing carried out before it was received and may make further consideration of the enquiry, feedback or provision of the requested service impossible.
12. Protection measures
12.1. The Operator takes legal, organisational and technical measures appropriate to the nature and volume of the data processed, including:
- identifying the business processes that involve personal data;
- approving internal documents, the list of necessary and sufficient personal data, retention periods and the destruction procedure;
- appointing a person responsible for organising the processing of personal data;
- defining the list of employees and other persons who have access to the data;
- differentiating access rights, identifying and authenticating users;
- logging actions performed with personal data and maintaining technical logs;
- encryption and the use of secure channels when transmitting restricted-access data;
- backup, integrity monitoring, software updates and anti-virus protection;
- oversight of contractors and contractual obligations regarding confidentiality and security;
- detecting, containing and documenting personal data security breaches;
- notifying the authorised body of a personal data security breach within the period and in the manner established by law.
12.2. The list of measures may be further specified by the Operator's internal documents without restricting the rights of the Subject and without reducing the level of protection established by law.
13. Obligations of the User
13.1. The User provides accurate and up-to-date information and does not send copies of identity documents, an individual identification number, bank details or other excessive data through the general forms.
13.2. By transferring the data of another individual, the User confirms that a lawful ground and the necessary authority exist. The Operator may request the corresponding confirmation.
13.3. Inaccuracy of the information provided does not release the Operator from its obligations to protect personal data.
14. Amendments to the Policy
14.1. The Operator may amend the Policy when the law, the processing procedures or the information systems used change. The current version is published on the Website with the date indicated.
14.2. Amendments introducing new purposes, additional categories of data, a new cross-border transfer, transfer to new categories of third parties or distribution in publicly available sources apply to previously collected data only where there is a proper legal ground and new consent, if required by law.
15. Operator contacts
15.1. Name: MARVIK PARTNERS Limited Liability Partnership.
15.2. BIN: 230240029359.
15.3. Registered address: 160800, Republic of Kazakhstan, city of Shymkent, Yenbekshi district, Zhuldyz residential area, building 336.
15.4. Email for personal data enquiries: office@marvik-partners.kz.
15.5. Website: https://marvik-partners.com.
15.6. Revision date: 16 July 2026.