Quickinim’s Policy on the Processing and Protection of Personal Data (Privacy Policy)

1. General Provisions

1.1. This Policy is implemented by Quickinim (hereinafter referred to as the “Organization”) concerning the processing and protection of personal data of individuals (data subjects) in accordance with Articles 29 and 33 of the Constitution of the Kyrgyz Republic and Law No. 58 “On Personal Data.”

1.2. The Policy applies to all personal data obtained by the Organization in the course of its activities, including data of its clients. The processing of personal data by the Organization is carried out in compliance with the following legal acts:

• Labor Code of the Kyrgyz Republic(No. 106, August 4, 2004);
• Law No. 58 “On Personal Data”(April 14, 2008);
• Law No. 136 “On Biometric Registration of Citizens of the Kyrgyz Republic”(July 14, 2014);
• Government Resolution No. 759(November 21, 2017) on the procedure for obtaining consent for personal data collection and processing;
• Other regulatory legal acts of the Kyrgyz Republic.

1.3. The purpose of this Policy is to inform individuals providing their personal data about:

• The types of personal data processed by the Organization;
• The purposes of processing;
• Security measures implemented;
• Key principles of personal data processing and protection.

1.4. The Policy ensures the protection of data subjects’ rights and freedoms when processing their personal data (automated or non-automated) and establishes accountability for non-compliance with data protection requirements.

1.5. By using the Organization’s services (including those on www.quickinim.com) and providing personal data, users consent to processing under this Policy. If a user disagrees, they must refrain from using the services.

1.6. Consent for personal data processing may be withdrawn by the data subject. However, the Organization may continue processing if permitted by law.

1.7. The Organization may amend this Policy without prior notice. Updated versions take effect upon publication unless otherwise stated.

1.8. This Policy applies only to data collected through the Organization’s services. The Organization is not responsible for third-party websites linked from its platform.

1.9. Key Definitions:

• Personal Data: Any recorded information identifying an individual directly or indirectly.
• Data Subject: The individual to whom the data relates.
• Data Controller: The entity determining the purposes of processing.
• Data Processor: An entity processing data on behalf of the controller.
• Processing: Any operation performed on personal data (collection, storage, modification, deletion, etc.).

2. Scope and Categories of Personal Data

2.1. Personal data includes any information identifying an individual directly or indirectly.

2.2. The Organization processes data of:

• Employees and job applicants;
• Clients (including potential clients and representatives);
• Website users (via quickinim.com);
• Individuals who consented to processing or whose processing is legally required.

2.3. Processed Data May Include:

• Full name, date of birth;
• Contact details (address, phone, email);
• Identity document details;
• Other data necessary for service provision.

3. Legal Basis and Purposes of Processing

3.1. The Organization processes data to fulfill legal obligations and provide services.

3.2. Processing is Permitted When:

• Consent is given;
• Required by law or contract;
• Necessary for legitimate interests (without violating rights).

3.3. Personal data will not be disclosed without consent unless legally required.

3.4. Processing Purposes Include:

• User identification;
• Domain registration/services;
• Communication (notifications, requests);
• Service improvement.

3.5. Sensitive Data (race, religion, health, etc.) is not processed.

4. Processing Principles

4.1. Processing follows principles of:

• Lawfulness and fairness;
• Purpose limitation;
• Data accuracy;
• Storage limitation;
• Confidentiality and security.

4.2. Employees handling personal data must:

• Comply with legal and internal policies;
• Process data only for authorized purposes;
• Report breaches.

5. Data Retention Periods

5.1. Data is stored as long as necessary for the purposes stated or as required by law.

5.2. Processing stops when:

• Purposes are fulfilled;
• Consent is withdrawn;
• Unlawful processing is detected.

6. Access to Personal Data

6.1. Only authorized personnel may access data.

6.2. Data may be shared with third parties if:

• Consent is given;
• Legally required (e.g., law enforcement).

7. Processing Methods

7.1. Data is processed both manually and automatically.

7.2. The Organization may engage processors under strict confidentiality agreements.

7.3. Data subjects have the right to:

• Access, correct, or delete their data;
• Withdraw consent;
• Request processing restrictions.

7.4. The Organization may:

• Process data for stated purposes;
• Request accurate data;
• Restrict access if legally justified.

7.5 Rights of Data Subjects and the Organization

7.5.1 Data Subject Rights

The data subject (user) has the right to:

• Access: Request information about the processing of their personal data, including its purpose, methods, and storage period, as stipulated by Kyrgyz personal data legislation.
• Rectification/Deletion: Demand correction, blocking, or destruction of their data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer necessary for the stated processing purposes.
• Restricted Access: Enter into a Confidential Access Agreementwith the Organization to limit how their data is accessed.
• Legal Remedies: Take legal action to protect their rights under applicable laws.
• Withdraw Consent: Revoke consent for data processing at any time.

7.5.2 Organization’s Rights

The Organization may:

• Process personal data only for the declared purposes.
• Request accurate and complete datafrom the subject when necessary for contract fulfillment, service provision, or legal compliance.
• Restrict Accessto a subject’s data if:

• Required by anti-money laundering (AML) or counter-terrorism financing (CFT) laws;
• Access would violate third-party rights;
• Otherwise permitted by Kyrgyz law.
  • Process publicly available dataor data subject to mandatory disclosure under Kyrgyz law.
  • Engage third-party processorswith the subject’s consent.

7.6–7.9 Data Accuracy and Termination of Processing

• Inaccurate/Unlawful Processing: If data is found to be incorrect or unlawfully processed, the Organization must correct or cease processing
• Data Destruction: Personal data must be deleted when:

• Processing purposes are fulfilled;
• Consent is withdrawn (unless retention is required by contract or law);
• No other legal basis for processing exists.
  • Transparency: The Organization must provide processing details to the subject upon request.
  • Additional Rights/Duties: The Organization retains other rights and obligations under Kyrgyzstan’s Law on Personal Data.

8. Implementation of Data Protection

8.1 Confidentiality Obligations

All employees must maintain the confidentiality of personal data and comply with internal policies, unless otherwise required by law.

8.2 Security Measures

The Organization implements technical, organizational, and legal safeguards, including:

• Unified Security System: Protects data as part of broader trade secret protections, aligned with Kyrgyz personal data laws.
• Secure Channels: Data exchanges occur via encrypted communication systems.

8.3–8.4 Specific Protections

The Organization ensures:

• Prevention: Measures to block unauthorized access or data leaks.
• Detection: Monitoring for unauthorized access attempts.
• System Integrity: Protection against technical disruptions.
• Data Recovery: Rapid restoration of modified/lost data due to breaches.
• Continuous Oversight: Regular security assessments.
• Accountability:

• Appointing officials responsiblefor data protection;
• Limiting accessto authorized personnel only;
• Training employees on legal and internal requirements;

Educating data subjects about their rights.