Privacy policy

1. General Provisions

1.1. This Privacy Policy (hereinafter, the Policy) sets out what personal data the Association of Insurance Agents and Brokers (hereinafter, the Association) collects and processes when its website is used, why this is done and how the data is protected.

1.2. The Policy has been developed in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" and other regulatory legal acts of the Republic of Kazakhstan.

1.3. The Association is the owner and operator of the database of personal data received through the website, the personal account and feedback forms.

1.4. A User is an individual who visits the website or uses its services. A personal data subject is the individual to whom the personal data relate.

1.5. The User gives consent to the collection and processing of personal data when registering, submitting a request, publishing a review or in any other way that makes it possible to confirm their will. Without such consent, certain services of the website may be unavailable.

2. Legal Grounds for Processing

2.1. The Association processes personal data on the basis of:

• the consent of the personal data subject;
• the need to perform a contract or agreement to which the subject is a party, including when paying for services and acceding to the Memorandum with insurance market participants;
• the requirements of the legislation of the Republic of Kazakhstan.

2.2. The Association processes only the data needed to achieve the stated purposes and does not use it for purposes incompatible with the original ones.

3. What Data Is Processed

3.1. Registration and personal account: surname, first name, patronymic, email address, telephone number, information about the user's role (client, insurance agent, insurance broker, representative of an organization). The password is stored only in encrypted form.

3.2. Registry profiles. The open registry of insurance agents and brokers publishes the participant's surname, first name, patronymic, city and the list of insurance organizations the participant works with. The individual identification number (IIN) is used only to verify and match registry entries. The IIN is not published and is stored exclusively as an irreversible hash: the original number cannot be recovered from the stored value.

3.3. Requests and policy orders: name, telephone number, email address, city, type of insurance and other information that the user provides in the form in order to send a request to the chosen insurance agent, broker or organization.

3.4. Reviews: the author's name, the text of the review and the rating. Reviews are published after moderation. The Association may reject a review that contains personal data of third parties, insults or information unrelated to the service provided.

3.5. Payments: purpose, amount, status and transaction ID. Bank card details are entered on the payment provider's side. The Association does not receive or store such data.

3.6. Technical data: IP address, browser and device type, information about pages visited, cookies.

3.7. The Association does not request through the website information about health, religious or political beliefs, or any other data not needed for the services to work. Users should not include such information in requests and reviews.

4. Purposes of Processing

4.1. Personal data are processed in order to:

• register the user and provide access to the personal account;
• maintain the open registry of insurance agents and brokers and keep its entries up to date;
• forward clients' requests to the insurance agents, brokers and organizations they have chosen;
• publish and moderate reviews;
• accept payment for membership fees, training and other services of the Association;
• conduct training and accreditation and issue certificates;
• consider complaints and appeals, including by the Disciplinary Committee;
• send service and informational notifications;
• analyze the website's performance and improve its services;
• comply with the requirements of the legislation of the Republic of Kazakhstan.

5. Cookies and Analytics

5.1. The website uses cookies — small files stored in the user's browser. Essential cookies are needed to log in to the personal account, save settings and protect forms. Analytics cookies help us understand which sections of the website are in demand and identify technical errors.

5.2. Analytics data are processed in aggregate form and are not used to identify visitors.

5.3. The user can restrict or disable cookies in the browser settings. In this case, some website functions, including logging in to the personal account, may not work properly.

6. Email Notifications

6.1. The Association sends service messages to the user's email address: registration confirmation, access recovery, information on the status of requests, reviews, payments and training.

6.2. Newsletters about the Association's activities are sent only with the user's consent. You can unsubscribe from them at any time by sending a request to the address given in Section 11. Unsubscribing from newsletters does not stop service messages.

7. Data Storage and Protection

7.1. Personal data are stored in compliance with the requirements of the legislation of the Republic of Kazakhstan, including requirements on the place of storage, for the period necessary to achieve the purposes of processing or for the period established by law.

7.2. Once the purposes of processing have been achieved, consent has been withdrawn or the account has been deleted, the data are destroyed or anonymized, unless the law requires their further storage.

7.3. The Association takes legal, organizational and technical protection measures: it restricts access to data to authorized employees, uses a secure connection, password encryption and irreversible hashing of IINs, and takes measures against unauthorized access, alteration and loss of data.

7.4. Employees of the Association who have access to personal data are obliged to keep them confidential.

8. Transfer of Data to Third Parties

8.1. The Association does not sell personal data or transfer them to third parties for advertising.

8.2. Data are transferred only to:

• insurance agents, brokers and organizations that the user has personally chosen as recipients of a request or policy order — to the extent specified in the request;
• payment providers — to the extent necessary to process the payment;
• government authorities — in the cases and in the manner provided for by the legislation of the Republic of Kazakhstan.

8.3. The recipient of a request is independently responsible for the further processing of the data received in accordance with the law.

8.4. Information from registry profiles (surname, first name, patronymic, city, insurance organizations) is publicly available by virtue of the purpose of the registry. The IIN and contact details from the personal account are not disclosed in the registry.

9. Rights of the Personal Data Subject

9.1. The personal data subject has the right to:

• know that their data are being processed by the Association and receive information about the composition of the data and the purposes of processing;
• demand that the data be changed or supplemented if they are incomplete or inaccurate;
• demand that the data be blocked or destroyed if they are processed in violation of the law;
• withdraw consent to processing, unless this contradicts the law;
• unsubscribe from newsletters;
• appeal against the Association's actions to the authorized body or to a court.

9.2. The user can change some of the data independently in the personal account. For other matters, a request should be sent to the email address given in Section 11.

9.3. The Association considers requests within the time limits established by the legislation on personal data and reports the results by the same means through which the request was received, unless the applicant specifies otherwise.

10. Changes to the Policy

10.1. The Association may amend the Policy, including when legislation or the website's services change. The new version takes effect from the moment it is published on the website, unless it states otherwise.

10.2. Registered users are notified of material changes by email or in their personal account. Continued use of the website after the new version is published constitutes acceptance of it.

11. Contacts

11.1. Questions about the processing of personal data, requests and withdrawal of consent should be sent to info@asab.kz. Other ways to get in touch are listed on the "Contacts" page.