1. General Provisions

This Personal Data Processing Policy (hereinafter referred to as the "Policy") establishes the fundamental principles and conditions for the processing of personal data by Karamarzhan Munai Gas LLP (hereinafter referred to as the "Operator"). We are committed to ensuring the protection of the rights and freedoms of individuals when processing their personal data, including the protection of rights to privacy, personal, and family secrets.

This Policy applies to all personal data that the Operator may obtain about users while they use the official website, services, programs, and products of Karamarzhan Munai Gas LLP.

2. Legal Grounds for Processing

The Operator processes personal data based on the following legal grounds:

• Consent of the personal data subject to the processing of their data.
• Contracts and agreements to which the personal data subject is a party.
• Compliance with applicable international and local laws and regulations governing the energy and corporate sectors.
• Legitimate interests of the Operator, provided that such processing does not infringe upon the rights and freedoms of the personal data subject.

3. Purposes and Methods of Processing

The processing of personal data is limited to the achievement of specific, predetermined, and legitimate purposes. The Operator collects and uses personal data for:

• Providing access to the personalized resources of the website.
• Establishing feedback with the user, including sending notifications and requests regarding the use of the website and processing user requests.
• Employment purposes, including the evaluation of candidates for open positions.
• Executing contracts and fulfilling obligations to clients and partners.
• Conducting statistical and other studies based on anonymized data.

The processing of personal data is carried out using automation tools and/or without the use of such tools (mixed processing).

4. Rights of Data Owners

The subject of personal data has the right to:

• Receive information regarding the processing of their personal data.
• Require the Operator to clarify their personal data, block it, or destroy it if the data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing.
• Withdraw consent to the processing of personal data at any time.
• Appeal the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects or in court.

5. Data Protection Requirements

Karamarzhan Munai Gas LLP implements necessary and sufficient organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, as well as from other illegal actions of third parties.

These measures include:

• Appointment of a Data Protection Officer.
• Limiting access to personal data to authorized employees only.
• Regular security audits and vulnerability assessments of our IT infrastructure.
• Use of encryption protocols for data transmission.