PERSONAL DATA PROCESSING AND PRIVACY POLICY Almaty 1. GENERAL PROVISIONS 1.1. This Personal Data Processing and Privacy Policy (hereinafter referred to as the Policy) determines the procedure for the collection, recording, systematization, accumulation, storage, clarification, updating, modification, supplementation, use, transfer, provision of access, distribution, publication, anonymization, blocking, and destruction of personal data carried out by the Public Association "League of Cinematographers of Kazakhstan" (hereinafter referred to as the League). 1.2. This Policy is developed in accordance with the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan "On Personal Data and Its Protection", the Law of the Republic of Kazakhstan "On Informatization", as well as other regulatory legal acts of the Republic of Kazakhstan governing the processing, storage, use, and protection of information. 1.3. This Policy applies to all personal data received by the League through its official internet resource, personal accounts of users, electronic services, applications for League membership, questionnaires, registration forms, events, festivals, forums, competitions, educational programs, social networks, means of electronic communication, and other legal sources. 1.4. The League is the owner and administrator of the information resources used to maintain the register of League members, ensure the functioning of personal accounts, and other services related to the activities of the League. 1.5. Using the League's internet resources, registering a personal account, submitting an application for League membership, participating in League events, or providing personal data in any other way implies the personal data subject's familiarization with this Policy. 1.6. The processing of personal data is carried out on the principles of legality, good faith, reasonableness, fairness, proportionality, and ensuring the security of personal data. 1.7. The League takes reasonable organizational, legal, and technical measures aimed at protecting personal data from unlawful access, destruction, modification, blocking, copying, distribution, loss, and other unlawful actions. 1.8. The League has the right to engage contractors, software providers, hosting providers, developers, information system administrators, telecom operators, and other persons to ensure the functioning of the League's information resources. 1.9. The League has the right to make changes and additions to this Policy in order to bring it into compliance with the legislation of the Republic of Kazakhstan, changes in the League's activities, the introduction of new services, and the improvement of personal data processing mechanisms. 1.10. The current version of the Policy is posted on the official internet resource of the League. 2. TERMS AND DEFINITIONS 2.1. For the purposes of this Policy, the following basic terms are used. 2.2. Personal data – information relating to a specific or identifiable (on its basis) personal data subject, recorded on an electronic, paper, or other material medium. 2.3. Personal data subject – a natural person to whom the personal data processed by the League relates. 2.4. Processing of personal data – any action or set of actions performed with personal data, including the collection, recording, accumulation, systematization, storage, clarification, updating, modification, supplementation, use, transfer, provision of access, distribution, publication, anonymization, blocking, and destruction of personal data. 2.5. Personal account – an individual section of the user on the League's internet resource, providing access to personal data, profile settings, and the functionality of the respective resource. 2.6. Site section containing information about League members – an information resource containing information about League members and other persons who have voluntarily provided information for posting for the purpose of professional interaction among film industry participants. 2.7. Site user – any person who has gained access to the League's internet resources. 2.8. Cross-border transfer of personal data – the transfer of personal data to the territory of foreign states or the storage of such data on servers located outside the Republic of Kazakhstan. 2.9. Anonymization of personal data – actions as a result of which it becomes impossible to determine the affiliation of personal data to a specific personal data subject without the use of additional information. 2.10. Information resource – a set of software, databases, electronic documents, personal accounts, services, and other digital resources used by the League. 3. CATEGORIES OF PERSONAL DATA SUBJECTS AND THE COMPOSITION OF PROCESSED DATA 3.1. The League processes the personal data of the following categories of persons: 1. League members; 2. candidates for League membership; 3. actors; 4. directors; 5. screenwriters; 6. producers; 7. cinematographers; 8. production designers; 9. composers; 10. film editors; 11. sound designers; 12. casting directors; 13. film industry representatives; 14. participants of League events; 15. representatives of League partners; 16. visitors to the League's internet resources; 17. other persons who have voluntarily provided personal data. 3.2. The following information may be processed in relation to personal data subjects: • surname, first name, patronymic; • creative pseudonym; • date of birth; • citizenship; • region of residence; • contact phone number; • email address; • links to social networks; • links to professional internet resources; • photographic images; • video materials; • biographical information; • information about education; • information about professional development (advanced training); • information about professional activities; • information about profession and specialization; • information about foreign language proficiency; • information about professional skills; • information about filmography; • information about participation in films; • information about participation in TV series; • information about participation in television projects; • information about participation in theatrical productions; • information about participation in advertising projects; • information about participation in music videos; • information about awards, prizes, and achievements; • information about participation in film festivals; • information about participation in competitions; • information about participation in pitchings; • information about membership in professional associations; • information about current and completed projects; • portfolio; • interviews; • publications in mass media; • other information voluntarily provided by the personal data subject. 3.3. In the process of using the League's internet resources, technical data may be automatically processed, including the IP address, browser type, device information, date and time of visiting the site, cookies, user action logs, and other technical information. 4. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA 4.1. The primary purpose of processing personal data is to ensure the activities of the League and the development of the cinematographic industry of the Republic of Kazakhstan. 4.2. Personal data may be processed for the purposes of: • maintaining the register of League members; • considering applications for League membership; • creating and maintaining personal accounts; • publishing information about League members; • facilitating professional interaction among film industry participants; • popularizing the activities of League members; • organizing festivals, competitions, forums, conferences, master classes, and other events; • informing about the activities of the League; • ensuring the operation of the League's internet resources; • providing access to information services; • interacting with state bodies, partners, and professional associations; • protecting the rights and legitimate interests of the League; • considering appeals and requests; • preparing statistical and analytical materials; • archival storage of information about the activities of the League; • complying with the requirements of the legislation of the Republic of Kazakhstan. 4.3. The legal grounds for processing personal data are: consent of the personal data subject; application for League membership; participation of the personal data subject in the activities of the League; the need to execute contracts and agreements; the need to fulfill the requirements of the legislation of the Republic of Kazakhstan; other grounds provided by the legislation of the Republic of Kazakhstan. 4.4. The League does not process personal data in ways incompatible with the purposes for which they were obtained. 4.5. The League takes measures to ensure that the volume of processed personal data corresponds to the stated purposes of processing. 5. SOURCES OF OBTAINING PERSONAL DATA AND THE PROCEDURE FOR UPDATING THEM 5.1. The League collects and processes personal data exclusively from sources the use of which is permitted by the legislation of the Republic of Kazakhstan. 5.2. Personal data may be obtained directly from the personal data subject by: • submitting an application for League membership; • filling out questionnaires and registration forms; • creating a personal account; • providing information through the League's internet resource; • sending documents via email; • sending information via messengers; • participating in League events; • registering at events; • providing written or electronic consent. 5.3. Information received from various sources may be cross-checked against each other in order to verify its completeness, accuracy, and relevance. 5.4. The League has the right to clarify, update, and supplement information about the personal data subject based on: • information provided by the subject themselves; • documents confirming the relevant information; • information provided by event organizers and League partners. 5.5. Upon identifying incomplete, inaccurate, contradictory, or outdated information, the League has the right to clarify, supplement, correct, or update it. 5.6. The League has the right to keep a history of changes to information, including the date of change, the source of obtaining the information, and the content of the changes made. 5.7. The personal data subject has the right to apply to the League with a request to update or correct their personal data. 6. USER PERSONAL ACCOUNTS 6.1. To ensure the functioning of the internet resource, the League has the right to create and administer user personal accounts. 6.2. The personal account is intended for: • posting information about the personal data subject; • storing personal data; • forming a professional profile; • interacting with the League; • participating in events; • receiving notifications; • using other services of the internet resource. 6.3. The personal data subject independently determines the volume of information posted in the personal account, unless a different volume is required to use the respective service. 6.4. The personal account may contain: • personal data; • photographs; • video materials; • filmography; • information about professional activities; • information about awards and achievements; • portfolio; • biographical information; • contact information; • links to social networks; • other materials voluntarily posted by the user. 6.5. The user is obliged to ensure the accuracy and relevance of the information posted in the personal account. 6.6. The user bears independent responsibility for the content of information, documents, photographs, video materials, and other materials posted by them in the personal account. 6.7. The user guarantees the availability of the necessary rights to the posted materials and confirms the absence of violations of the rights of third parties. 6.8. The League has the right to restrict or delete materials containing: • inaccurate information; • information violating the legislation of the Republic of Kazakhstan; • information violating the rights of third parties; • materials that do not correspond to the purposes of the League's activities. 6.9. The League has the right to temporarily restrict or terminate access to the personal account upon identifying violations of the legislation of the Republic of Kazakhstan or this Policy. 6.10. The League has the right to store the information contained in the personal account for the period necessary to achieve the purposes of processing personal data. 7. PROCEDURE FOR PUBLISHING INFORMATION ABOUT CINEMATOGRAPHERS 7.1. Information about the personal data subject may be posted: • on the official website of the League; • in mobile applications; • on the League's social networks; • in the League's presentation materials; • on the League's information resources. 7.2. The publication of personal data is carried out on the basis of the consent of the personal data subject or other legal grounds provided by the legislation of the Republic of Kazakhstan. 7.3. As part of a professional profile, the following may be published: • surname, first name, patronymic; • creative pseudonym; • photograph; • video materials; • profession; • specialization; • filmography; • information about projects; • information about awards; • information about education; • information about work experience; • biography; • portfolio; • links to social networks; • contact details, if the personal data subject has expressed consent to their publication; • other information authorized by the personal data subject for publication. 7.4. The personal data subject is notified and agrees that the published information may be accessible to an unrestricted number of persons. 7.5. Published information may be indexed by Internet search engines, displayed in search results, saved in the cache of search engines, and reproduced by third parties. 7.6. The League does not bear responsibility for the actions of third parties committed with respect to information lawfully published on the basis of the consent of the personal data subject. 7.7. The League has the right to use the published information for informational, cultural, educational, presentation, archival, and reporting purposes. 8. USE OF PHOTOGRAPHS, VIDEO MATERIALS, AND IMAGES 8.1. The League has the right to use photographs, video recordings, interviews, biographical information, and other materials provided by the personal data subject or created within the framework of the League's activities. 8.2. The specified materials may be used for: • forming a professional profile; • covering the activities of the League; • covering events; • preparing reports; • preparing presentations; • preparing informational materials; • preparing publications; • popularizing the activities of the League; • developing the cinematographic industry of the Republic of Kazakhstan. 8.3. Photographs and video materials may be posted: • on the official website of the League; • on the League's social networks; • in newsletters; • in presentations; • in printed materials; • in reports; • on other information resources of the League. 8.4. The use of photographs and video materials is carried out without payment of remuneration, unless otherwise provided by a separate agreement. 8.5. The League has the right to store photographs and video materials in the League's archive after the termination of the personal data subject's membership, if such storage is necessary to document the League's activities, preserve the organization's history, and achieve other legitimate purposes. 8.6. The personal data subject confirms the availability of the necessary rights to the transferred photographs, video materials, and other intellectual property objects and guarantees the absence of violations of the rights of third parties upon their use by the League. 9. PROCEDURE FOR TRANSFERRING PERSONAL DATA AND PROVIDING ACCESS TO THIRD PARTIES 9.1. The transfer of personal data and the provision of access to personal data are carried out exclusively in cases where such transfer is necessary to achieve the purposes of processing personal data provided for by this Policy, the consent of the personal data subject, or the legislation of the Republic of Kazakhstan. 9.2. The transfer of personal data is carried out in compliance with the principles of legality, good faith, proportionality, and minimization of the volume of transferred information. 9.3. The League has the right to provide access to personal data to its employees, representatives, contractors, and other persons participating in ensuring the activities of the League, exclusively within the limits of their authority and official necessity. 9.4. Personal data may be transferred to: • organizers of film festivals; • organizers of competitions and pitchings; • educational organizations; • professional associations; • state bodies; • contractors providing technical support for the League's information resources; • hosting providers; • software providers; • cloud service providers; • other persons in the presence of legal grounds. 9.5. The transfer of personal data is carried out exclusively to the extent necessary to achieve the respective purposes of processing. 9.6. The League has the right to engage third parties to provide services for data storage, backup, technical support, software maintenance, information security, modernization of information systems, and the provision of other services related to the functioning of the League's internet resources. 9.7. In the event of the reorganization of the League, the transfer of functions for the maintenance of information resources, or the transfer of the respective information systems to a successor, personal data may be transferred to such a person to the extent necessary to continue the activities of the League. 9.8. Personal data may be transferred to state bodies, law enforcement agencies, courts, notaries, and other persons in cases and in the manner provided by the legislation of the Republic of Kazakhstan. 9.9. The League takes reasonable measures to ensure the confidentiality and security of personal data during its transfer to third parties. 10. CROSS-BORDER TRANSFER OF PERSONAL DATA 10.1. In order to ensure the functioning of the League's internet resources, store information, back up data, use cloud technologies, analytical services, social networks, and other information technologies, the League has the right to carry out the cross-border transfer of personal data. 10.2. Cross-border transfer may be carried out to states on the territory of which servers, data processing centers, cloud platforms, software solutions, and other technical means used by the League are located. 10.3. The personal data subject is notified and agrees that the use of certain services may involve the processing of personal data outside the Republic of Kazakhstan. 10.4. The League takes reasonable measures to ensure the protection of personal data during its cross-border transfer and strives to use services that provide an appropriate level of information protection. 10.5. Cross-border transfer is carried out in accordance with the requirements of the legislation of the Republic of Kazakhstan. 11. COOKIES, TECHNICAL DATA, AND ACTION LOGS 11.1. When using the League's internet resources, technical information about users may be collected automatically. 11.2. Such information may include: • IP address; • browser type; • browser language; • information about the operating system; • device identifiers; • date and time of visiting the site; • addresses of the visited pages; • information about page transitions; • information about user actions; • cookies; • session information; • technical errors and failures. 11.3. Cookies are used for: • ensuring the correct operation of the website; • saving user settings; • user authorization; • improving the usability of the website; • analyzing traffic; • improving the functionality of the League's information resources. 11.4. The user has the right to restrict the use of cookies through their browser settings. 11.5. Disabling cookies may lead to the restriction of certain functions of the website. 11.6. The League has the right to maintain user action logs. 11.7. Action logs may contain information about: • user registration; • logins and logouts; • changes to information in personal accounts; • posting of materials; • deletion of materials; • administrator actions; • other events related to the use of the League's information resources. 11.8. The specified information is used to ensure information security, resolve disputes, investigate incidents, and protect the rights of the League. 12. PERSONAL DATA PROTECTION MEASURES 12.1. The League takes organizational, technical, and legal measures aimed at ensuring the protection of personal data. 12.2. In order to protect personal data, the League has the right to apply: • differentiation of access rights; • user authorization systems; • user authentication systems; • data backup; • antivirus protection; • threat detection tools; • information security monitoring; • logging of user actions; • other information protection tools. 12.3. Access to personal data is granted only to persons who need such access to perform their respective functions. 12.4. Persons who have gained access to personal data are obliged to comply with the requirements of the legislation of the Republic of Kazakhstan on personal data and information confidentiality. 12.5. The League takes measures to prevent: • unauthorized access to personal data; • unlawful modification of personal data; • destruction of personal data; • blocking of personal data; • distribution of personal data without legal grounds; • other unlawful actions with respect to personal data. 12.6. Despite the security measures taken, the League cannot guarantee the absolute security of information against all possible threats associated with the use of the Internet and information technologies. 12.7. In the event of information security incidents, the League has the right to take measures to restrict access to the respective information resources, conduct internal investigations, eliminate the consequences of the incident, and protect the rights of personal data subjects. 13. RIGHTS OF PERSONAL DATA SUBJECTS 13.1. The personal data subject has the rights provided for by the legislation of the Republic of Kazakhstan on personal data and its protection. 13.2. The personal data subject has the right to receive information about the presence of their personal data held by the League, as well as information about its collection, processing, storage, use, and transfer. 13.3. The personal data subject has the right to demand the clarification, updating, modification, and supplementation of personal data in the event of identifying incomplete, outdated, or inaccurate information. 13.4. The personal data subject has the right to demand the blocking or deletion of personal data in cases provided for by the legislation of the Republic of Kazakhstan. 13.5. The personal data subject has the right to revoke the previously granted consent to the collection and processing of personal data. 13.6. The personal data subject has the right to determine the volume of information to be published on the League's internet resources, unless otherwise provided by the legislation of the Republic of Kazakhstan or the terms of use of the respective services. 13.7. The personal data subject has the right to demand the cessation of the publication of personal data in cases provided for by the legislation of the Republic of Kazakhstan. 13.8. The personal data subject has the right to receive information about third parties to whom their personal data has been transferred, if the provision of such information is permitted by the legislation of the Republic of Kazakhstan. 13.9. The personal data subject has the right to protect their rights and legitimate interests by all means provided for by the legislation of the Republic of Kazakhstan. 13.10. The exercise of the rights of the personal data subject is carried out taking into account the requirements of the legislation of the Republic of Kazakhstan, the rights and legitimate interests of other persons, as well as the purposes of the League's activities. 14. PROCEDURE FOR REVOKING CONSENT TO THE PROCESSING OF PERSONAL DATA 14.1. The personal data subject has the right to revoke the previously granted consent to the collection, processing, storage, use, publication, and transfer of personal data at any time. 14.2. The revocation of consent is carried out by sending a written appeal or an electronic appeal to the League in a manner that allows the applicant to be identified. 14.3. The appeal must indicate information allowing to identify the personal data subject and determine the scope of the claims. 14.4. The League considers the appeal within the time limits provided for by the legislation of the Republic of Kazakhstan and the internal procedures of the League. 14.5. The revocation of consent does not affect the legality of the processing of personal data carried out prior to the receipt of such revocation. 14.6. After receiving the revocation of consent, the League has the right to: • cease the processing of personal data; • limit the processing of personal data; • anonymize personal data; • delete personal data; • continue the processing of personal data in cases provided for by the legislation of the Republic of Kazakhstan. 14.7. The revocation of consent to the publication of personal data does not entail the automatic deletion of information previously lawfully published in printed publications, archival materials, reports, publications, presentations, and other documents created prior to the receipt of the revocation. 14.8. The League has the right to retain information confirming the fact of provision and revocation of consent in order to protect its rights and legitimate interests. 15. PERIODS OF STORAGE AND DESTRUCTION OF PERSONAL DATA 15.1. Personal data is stored for the period necessary to achieve the purposes of its processing. 15.2. Personal data may be stored during the period of membership of the personal data subject in the League, as well as after the termination of membership in cases provided for by this Policy and the legislation of the Republic of Kazakhstan. 15.3. The League has the right to carry out archival storage of information about its activities, including information about former League members, participants of events, festivals, competitions, and other projects. 15.4. Archival storage may be carried out for the purposes of: • preserving the history of the League's activities; • preparing reports; • confirming previously committed actions; • protecting the rights and legitimate interests of the League; • fulfilling the requirements of the legislation of the Republic of Kazakhstan. 15.5. Upon achieving the purposes of processing personal data or in the absence of legal grounds for its further storage, the League has the right to destroy or anonymize the respective personal data. 15.6. The destruction of personal data may be carried out by deleting electronic data, destroying material information carriers, or by other means precluding the possibility of further restoration of the information. 15.7. The League has the right to retain anonymized information, statistical data, and archival information that do not allow identifying a specific personal data subject. 16. CONSIDERATION OF APPEALS AND REQUESTS 16.1. Personal data subjects have the right to send to the League appeals, requests, applications, and claims related to the processing of personal data. 16.2. Appeals may relate to: • obtaining information about the processing of personal data; • clarification of data; • updating of data; • correction of data; • blocking of data; • deletion of data; • revocation of consent; • protection of the rights of the personal data subject. 16.3. The League has the right to request additional information and documents necessary to identify the applicant and consider the appeal. 16.4. In case of impossibility to identify the applicant, the League has the right to refuse to provide information or fulfill the corresponding requirement until the specified circumstances are eliminated. 16.5. Consideration of appeals is carried out in the manner and terms provided for by the legislation of the Republic of Kazakhstan. 16.6. The League has the right to refuse to satisfy the appeal in whole or in part in cases provided for by the legislation of the Republic of Kazakhstan. 17. FINAL PROVISIONS 17.1. This Policy is an internal document of the League and is subject to posting on the official internet resource of the League. 17.2. The League has the right to make changes and additions to this Policy without obtaining the separate consent of personal data subjects, if such changes do not contradict the legislation of the Republic of Kazakhstan. 17.3. The new version of the Policy shall enter into force from the moment it is posted on the official internet resource of the League, unless a different term is specified in the respective version. 17.4. The continued use of the League's internet resources after the new version of the Policy enters into force implies the user's consent to the changes made to the extent permitted by the legislation of the Republic of Kazakhstan. 17.5. Issues not regulated by this Policy are regulated by the legislation of the Republic of Kazakhstan. 17.6. If individual provisions of this Policy are recognized as invalid or unenforceable, this does not entail the invalidity of the remaining provisions of the Policy. 17.7. This Policy is valid indefinitely until a new version of the Policy is approved or the activities of the League are terminated in the manner prescribed by the legislation of the Republic of Kazakhstan.