- GENERAL PROVISIONS
1. This Policy for the processing and protection of personal data (hereinafter - the "Policy") of the operator of personal data - Limited Liability Company "Mazzai Nav" (hereinafter - the "Company"), location: Republic of Tajikistan, Dushanbe, Somoni district, Akhrori street 140/1, apt b.2 defines the basic principles, procedure and conditions for the processing of personal data (hereinafter - "PD"), requirements for the protection of PD, as well as the basic rights and obligations of PD
2. This Policy is the main governing local regulatory act of the Company that defines the requirements for the processing and protection of personal data.
- PRINCIPLES OF PERSONAL DATA PROCESSING
1. PD processing by the Company is carried out in accordance with the principles:
- the legality and fairness of the purposes and methods of PD processing;
- limiting the processing of personal data to achieve specific, predetermined and legitimate goals;
- preventing the unification of databases containing personal data, the processing of which is carried out for purposes incompatible with each other;
- compliance of the volume and content of processed PD with the purposes of PD processing;
- inadmissibility of PD processing, which may be incompatible with the purposes of PD collection;
- ensuring the accuracy of PD, their sufficiency, and, if necessary, the relevance of PD for the purposes of their processing;
- storing PD in a form that allows you to determine the subject of PD, no longer than required by the purpose of PD processing.
- PURPOSES OF PERSONAL DATA PROCESSING
1. The company carries out PD processing for the following purposes:
- fulfillment of the rights and obligations of the parties to labor relations in accordance with labor legislation;
- information support of labor activity;
- conducting marketing and social activities, as well as communication with employees;
- ensuring the organization and implementation of unified intra-group business processes of the group of companies and franchisee companies;
- assistance in finding a job;
- assistance in employment in other legal entities;
- fulfillment of the duties assigned to the operator by the current labor legislation;
- provision of voluntary health insurance;
- communications in emergency situations;
- organization of business trips and other trips, including registration of migration documents;
- conclusion and execution of contracts;
- organizing and conducting external audits by third-party companies;
- conducting marketing and social activities, as well as communication with employees of franchisee companies;
- organization and implementation of interaction between the Company and the consumer (an individual - the recipient of the Company's services and goods);
- holding promotions;
- activity monitoring and analytics;
- monitoring and working with feedback;
- conducting advertising, marketing and information campaigns;
- provision of communication services;
- for other purposes related to the need to fulfill the mutual rights and obligations of the Company and PD subjects, as well as, if it is necessary to comply with the legislation of the Republic of Tajikistan.
- LEGAL BASIS FOR PROCESSING PERSONAL DATA
1. The legal grounds for the processing of personal data are, including:
- Civil Code of the Republic of Tajikistan;
- Labor Code of the Republic of Tajikistan;
- Tax Code of the Republic of Tajikistan;
- Law of the Republic of Tajikistan from13.03.2013 under No. 955 "On compulsory pension insurance".
- Law of the Republic of Tajikistan from January 12, 2010 under No. 595 Law of the Republic of Tajikistan “On insurance and state pensions”.
- Law of February 1, 1996 No. 231 "On the Legal Status of Foreign Citizens in the Republic of Tajikistan";
- Law of the Republic of Tajikistan on the legal status of foreign citizens and stateless persons in the Republic of Tajikistan (Law of the Republic of Tajikistan dated 05.17.2018, No. 1525).
- Law of the Republic of Tajikistan "On Electronic Digital Signature" July 30, 2007 No. 320.
- Law of the Republic of Tajikistan from July 3, 2012, No. 860 "On personalized accounting in the compulsory pension insurance system"
- Law of the Republic of Tajikistan from January 29, 2021, No. 1753 "On conscription and military service"
- Law of the Republic of Tajikistan from May 15, 1997 "On State Notaries"
- Law of the Republic of Tajikistan "On employment of the population" from August 1, 2003.
- Law "On the National Archival Fund and Archival Institutions" from November 13, 1998 No. 705.
- Law of the Republic of Tajikistan from 19.05. 2009, No. 517 "On labor protection in the Republic of Tajikistan"
- Law of the Republic of Tajikistan "On the Protection of Personal Data" from August 3, 2018 No. 1537
- Law of the Republic of Tajikistan "On Protection of Consumer Rights" from December 9, 2004 No. 72.
- Law of the Republic of Tajikistan "On Advertising" of 1.08.2003, No. 34;
- Decree of the Government of the Republic of Tajikistan dated June 6, 2005 No. 209 "Rules for the provision of public catering services"
- other regulatory legal acts of the Republic of Tajikistan, on the basis of which PD is processed;
- Company Charter;
- Agreements concluded between the Company and its counterparties;
- Agreements concluded with PD subjects;
- Consent of PD subjects.
- PROCESSED PERSONAL DATA
1. In the Company, PD processing is carried out in relation to the following categories of PD subjects:
- workers;
- candidates;
- relatives of workers;
- employees of the group of companies;
- counterparties - individuals;
- representatives of counterparties - legal entities;
- performers (actors) of agencies;
- executors (couriers) under delivery contracts;
- verified persons of counterparties - legal entities, shareholders- franchising companies;
- agency workers;
- employees of franchisee companies;
- consumers;
- participants in the shares and their legal representatives;
- users of social networks;
- website visitors;
- Wi-Fi users;
- other entities whose interaction with the Company creates the need for PD processing.
5.2. The content and volume of PD for each category of PD subjects is determined by the need to achieve specific goals of their processing, the need for the Company to exercise its rights and obligations, as well as the rights and obligations of the corresponding PD subject.
- PROCEDURE AND TERMS OF PERSONAL DATA PROCESSING
1. PD processing by the Company is carried out by collecting, recording, systematizing, accumulating, storing, clarifying (updating, changing), extracting, using, transferring (distributing, providing, accessing), depersonalizing, blocking, deleting, and destroying PD.
2. PD processing is carried out through mixed (both automated and non-automated) processing, including using the internal corporate network and the Internet.
3. The source of information about all PD is the PD subject directly. Unless otherwise established by the legislation of the Republic of Tajikistan, the Company has the right to receive the PD of the PD subject from third parties, but the PD subject must be notified of this.
4. The company may transfer PD of PD subjects to third parties, including cross-border transfer of PD on the territory of foreign states, including those that do not provide adequate protection of the rights of PD subjects, subject to the requirements provided for by the legislation of the Republic of Tajikistan.
5. The company has the right to entrust the processing of PD to another person with the consent of the relevant PD subject, unless otherwise provided by the law of the Republic of Tajikistan, on the basis of an agreement concluded with this person (instructions for processing PD). A person carrying out PD processing on behalf of him is obliged to comply with the principles and rules for PD processing provided for by the legislation of the Republic of Tajikistan.
6. The order for the processing of PD by the Company specifies the purposes of processing and a list of actions (operations) with PD that can be performed by the person performing PD processing on behalf of the person, establishes his obligations to ensure the confidentiality and security of PD during their processing, as well as requirements for the protection of processed PD in accordance with the legislation of the Republic of Tajikistan.
7. When processing PD, the Company observes the conditions that ensure the safety and confidentiality of PD.
8. The company takes the necessary technical and organizational measures in accordance with the legislation of the Republic of Tajikistan in the field of personal data in order to ensure their protection from unauthorized access, alteration, disclosure or destruction.
9. Employees of the Company, as well as other persons who have gained access to PD, undertake obligations to ensure the confidentiality of the processed PD.
10. The storage of PD is carried out in a form that allows the identification of the PD subject, but no longer than the purpose of their processing requires, unless a different period is established by the legislation of the Republic of Tajikistan or by an agreement to which the PD subject is a party, beneficiary or guarantor.
11. The destruction of PD is carried out after the goals of their processing have been achieved, in case of loss of the need to achieve the goals of processing, or after the expiration of the storage period for PD established by the law of the Republic of Tajikistan or an agreement to which the PD subject is a party, beneficiary or guarantor.
- UPDATE, CORRECTION AND DESTRUCTION OF PERSONAL DATA
1. The company takes reasonable measures to maintain the accuracy and relevance of the processed PD, as well as to delete them if they are deemed outdated, unreliable or unnecessary, or if the purposes of their processing are achieved.
2. In case of discovery of the fact of inaccuracy of PD or illegal processing of them, the Company is obliged to update or stop processing them.
3. PD processing is terminated by the Company in the following order and terms (unless otherwise provided by the legislation of the Republic of Tajikistan):
- upon detection of illegal actions with personal data within a period not exceeding three working days from the date of such detection, the Company shall eliminate the violations. If it is impossible to eliminate the violations committed, the Company shall destroy the PD within a period not exceeding ten working days from the date of unlawfulness of actions with personal data. The Company notifies the PD subject or his legal representative about the elimination of violations or the destruction of PD, and if an appeal or request was sent to the authorized body for the protection of the rights of PD subjects, also this body;
- upon reaching the goal of PD processing, the Company stops processing PD and destroys the corresponding PD within a period not exceeding thirty working days from the date the purpose of PD processing is achieved;
- when withdrawing the subject of PD consent to the processing of PD Company stops processing and consumes PD (except for PD, which are stored in accordance with the current legislation) PD within a period n not exceeding thirty working days from the date of receipt of the said revocation.
4. If there is no possibility of PD destruction within the specified periods, the Company blocks such PD or ensures their blocking and then ensures the destruction of PD within a period of no more than six months, unless another period is established by the legislation of the Republic of Tajikistan.
5. Destruction of PD should be carried out in a way that excludes further processing of these PD.
- RIGHTS AND OBLIGATIONS OF PERSONAL DATA SUBJECTS
1. The PD subject has the right to receive information regarding the processing by the Company of his PD, including containing:
- confirmation of the fact of PD processing;
- legal grounds and purposes of PD processing;
- the purposes and methods of PD processing used by the Company;
- the name and location of the Company, information about persons (with the exception of employees of the Company) who have access to PD or to whom PD may be disclosed on the basis of an agreement with the Company or on the basis of federal law;
- a list of processed PD of the PD subject, the source of their receipt, unless another procedure for submitting such data is provided for by federal law;
- terms of PD processing, including the terms of their storage;
- the procedure for the exercise by the subject of PD of the rights provided for by the legislation in the field of PD;
- information on the carried out or on the proposed cross-border transfer of PD;
- name (surname, first name, patronymic) and address of the person performing the PD processing on behalf of the Company, if the processing is entrusted or will be entrusted to such a person;
- other information provided by the legislation in the field of personal data.
8.2. The PD subject has the right to demand that the Company clarify his PD, block or destroy it if the PD is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as take measures provided for by law to protect his rights.
8.3. If the PD subject believes that the Company is processing his PD in violation of the requirements of the law, the PD subject has the right to appeal against the actions or inaction of the Company to the authorized body for the protection of the rights of PD subjects or in court.
8.4. The right of a PD subject to access his PD may be limited in accordance with the laws of the Republic of Tajikistan.
8.5. The PD subject is obliged to:
- provide the Company with reliable PD;
- promptly inform the Company about changes and additions to their PD;
- exercise their rights in accordance with the law, other regulatory legal acts and local regulations of the Company in the field of processing and protecting personal data;
- fulfill other obligations stipulated by the law, other regulatory legal acts and local regulatory acts of the Company in the field of processing and protecting personal data.
- RIGHTS AND OBLIGATIONS OF THE COMPANY
1. When processing PD, the Company has the right to:
- establish the rules for processing PD in the Company, make changes and additions to local regulations, independently, within the framework of the requirements of the legislation, develop and apply forms of documents necessary to fulfill the duties of a PD operator;
- exercise other rights provided for by law, other regulatory legal acts and local regulatory acts of the Company in the field of processing and protecting personal data.
9.2. When processing PD, the Company is obliged to:
- ensure the processing of PD solely for the purposes for which the PD was collected;
- receive from the PD subject consent to the processing of his PD, including in writing, in cases established by law;
-protect personal data from their unlawful use or loss; fulfill other obligations stipulated by the legislation of the Republic of Tajikistan and local regulations of the Company in the field of processing and protecting personal data.
- RESPONSES TO INQUIRIES OF PERSONAL DATA SUBJECTS
10.1.The company provides the PD subject with a response to a request for information regarding the processing of his PD, on the basis of a corresponding written application from the PD subject.
10.2. Address for applications of PD subjects to the Company on PD processing issues:
- Dushanbe city, Rudaki street 33A