1.  GENERAL PROVISIONS

This Confidentiality Policy (hereinafter referred to as the Policy) in FIRCaspian Group of Companies has been developed in accordance with Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 "On Personal Data and Their Protection",  Law of the Republic of Kazakhstan No. 418-V dated 24 November 2015 "On Informatization". 

This Policy informs how FIRCaspian collects, processes and stores your personal data. The Policy contains detailed information about the methods and for what purposes FIRCaspian collects personal data, and also provides an expanded understanding of the following items of personal data related to you stored by us:  

• rights and ways of exercising the rights you have in relation to your personal data;
• types, methods of collection and purposes of use;
• legal basis for use;
• security measures applied to protect personal data;
• shelf life.

2.  SCOPE OF APPLICATION

This Policy applies to all structural divisions of the Company and is used in the process of managing confidential information. 

3.  ABBREVIATIONS AND DEFINITIONS

The following terms are used in this Policy: 

FIRCaspian Group of Companies is Fenix International Resources Caspian LLP and Fenix International Resources CIS LLP. 

Candidate is a person who has applied for a certain vacant position, or is registered on our site or the site of our partners as an applicant for vacant positions. 

Client is a person who is a representative of a company that has a signed contract with FIRCaspian or considers FIRCaspian as a service provider. 

Employee is a person who has a signed employment contract or a civil law contract with FIRCaspian and provides services directly to FIRCaspian. 

Supplier is a person who is a representative of the company supplying goods or services to FIRCaspian . 

Site user is any visitor to the website www.fircaspian.com or third-level domains belonging to it. 

Data subject is a person who owns personal data, and also who can be identified directly or indirectly on the basis of these personal data. 

Personal data is any information related to a certain person, on the basis of which his/her identity can be determined directly or indirectly. 

Personal data processing is any action (operation) or set of actions (operations)  with personal data performed with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data. 

Personal data protection is a set of technical and organizational measures, and also legal norms aimed at ensuring the confidentiality and security of information that relates to a particular person (individual).  

4.  RESPONSIBILITY

General Director is responsible for approving policies and procedures

IT Department is responsible for compliance with the requirements of this Policy

Employees are responsible for meeting the requirements of this Policy

5.  MANAGING PRIVACY POLICY

5.1.   ABOUT OUR ACTIVITIES

A brief description of the company's activities is provided below to make it easier to understand for what purposes we need your personal data to a certain extent. 

FIRCaspian is a company providing services in the field of staffing and recruitment. An integral part of the provision of our services is the collection and processing of various information, including personal information related to data subjects. With the purpose of providing the highest level of services, when doing business we adhere to the highest standards of quality and honesty and also ethics and reliability when working with personal data of individuals. 

FIRCaspian collects and processes personal data to the minimum extent necessary to provide the following services: 

• outsourcing and outstaffing;
• selection of candidates for direct employment;
• checking recommendations;
• conducting interviews;
• decisions on visas and wages;
• logistics and global mobility.

5.2. INFORMATION COLLECTED BY FIRCASPIAN

To ensure maximum confidentiality, the amount of personal data collected by FIRCaspian may vary, depending on the type of relationship between FIRCaspian and a subject of personal data.

5.3. DATA SUBJECTS

FIRCaspian classifies the subject personal data as follows: 

• candidate personal data;
• client personal data;
• employee's personal data;
• supplier personal data;
• website user personal data.

5.4.  PERSONAL DATA

The personal data used by FIRCaspian during the provision of its services include, but are not limited to: first name, last name, citizenship, date of birth, education, employment history, professional skills, bank details, medical, and contact information. 

The data of nearest relatives can also be used for the purpose of providing insurance, medical services or as contacts for emergency cases.  

5.5.  SPECIAL PERSONAL DATA

In certain situations, FIRCaspian or its authorized suppliers may process confidential personal data. If you have expressed interest in a vacancy or have entered into an agreement with FIRCaspian for a position that requires it, the personal data subject to processing may also include:  

• state of physical or mental health, including certificates of narcological registration; 
• penal clearance certificate; 
• passport data; 
• other data required for employment in a specific position; 
• audio and video recordings containing your personal data (biometric information). 

The circumstances for processing such information are compliance with FIRCaspian's labor rights and obligations as an employer. 

5.6.  PURPOSING OF PROCESSING PERSONAL DATA

FIRCaspian processes your personal data to provide our services, update our database records, and fulfill our obligations as a provider for the search, selection, and provision of personnel. Also, the data that was produced in the process of the relationship between the data subject and FIRCaspian can also be used for internal reporting, monitoring and development of the quality of services, provided that they are depersonalized. 

FIRCaspian will not seek your absolute consent to process any data for specific purposes, however, personal data may only be processed for the following purposes: 

• selection and employment of candidates; 
• fulfillment of obligations under the agreement; 
• fulfillment of legal obligations; 
• assistance to law enforcement agencies. 

5.7.  COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA OF CANDIDATES

We are fully aware that employment-related issues are extremely important to you. Therefore, we strive to collect the necessary information in a timely manner in order to offer you the best vacancies that meet your requirements. 

The amount of data required may vary depending on the requirements of our clients and the type of employment contract. Regardless of these conditions, we guarantee that all personal data will be processed in accordance with the established rules and with the necessary security measures. 
5.8.  INFORMATION PROVIDED BY YOU

As a FIRCaspian candidate, you have the opportunity to provide us with information in various ways. Most often, the necessary data will be contained in your CV in full. You can send us your CV in the following ways: 

• uploading a CV via website www.fircaspian.com; 
• response to a vacancy through the website www.fircaspian.com or the website of our partners for publication of vacancies; 
• sending a CV or response directly to a FIRCaspian employee; 
• sending CVs to domain email addresses fircaspian.com; 
• as part of the necessary documents during the employment process. 

The data contained in your CV provided by one of the above methods is freely provided data for the purpose of finding a suitable job on a permanent or contractual basis at FIRCaspian or among its clients. The data will be stored in the appropriate FIRCaspian system and will be available to the recruitment department. 

By submitting your CV, you agree that you have read the rules for processing FIRCaspian personal data described in the Privacy Policy provided. 

Along with sending your CV directly, FIRCaspian collects and uses data obtained from other sources available to us. This may include: 

• clients or other candidates who may give references on your candidacy; 
• search on online bulletin boards such as HeadHunter or Linked-In,and also other sites related to job search and personnel; 
• suppliers engaged in background check activities.  

5.9.  CANDIDATE SELECTION PROCESS

FIRCaspian may use your personal data to contact you regarding any potential job that is suitable for you. We can also use them to compare the skills indicated on your CV with the requirements of the vacancy and, if you are interested in a certain vacancy, collect references and check your qualifications for compliance with the requested position. 

Notes about negotiations and your CV will be saved in our database. Audio recordings of the negotiations and video conference recordings can be saved by us with your consent. 

With your consent, the CV can be sent to our clients as part of the candidate selection process, or, if you are applying for a position within the main FIRCaspian division, to the line manager of the department. The CV will be formatted before sending to make sure that it does not contain any sensitive information, reduce the amount of personal data to a minimum and focus on your work experience and skills. 

If your candidacy has not been selected due to certain criteria, we will save your feedback, and also some personal information (contact details, job preferences, CV) and we can contact you about future new vacancies.  

If you have been selected and you meet the criteria for a specific position, you will proceed to the recruitment process.  

5.10.  RECRUITMENT PROCESS

During the recruitment process, FIRCaspian may request additional information about you in accordance with the Labor Code of the Republic of Kazakhstan and the client's requirements. This is necessary to collect all the necessary documents in a timely manner for concluding an employment contract, conducting the necessary training and other things required for your entry into a new position. The data that FIRCaspian may request includes the following items: 

• proof of qualifications, including your work history, diplomas, certificates, letters of reference or the results of passing tests to confirm qualifications; 
• financial data for the purposes of processing certain payments; 
• general state of health to ensure medical insurance, and also to comply with workplace safety standards defined by the Law of the Republic of Kazakhstan, client's requirements or other industrial safety requirements; 
• passport data – for the process of employment, provision of visas, transport services and accommodation; 
• family information – to provide additional insurance for the family,and also their contact details for emergencies. 

5.11.  COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA OF CLIENTS

To provide high-quality services for the search, selection and provision of personnel, FIRCaspian strives to fully meet the needs of our clients by ensuring the selection of qualified candidates who match the experience and qualifications necessary for the successful completion of tasks. To achieve this goal, it is necessary to establish a strong relationship between you, your company and FIRCaspian, and also a clear understanding of the common purpose of cooperation. 

Therefore, keeping up-to-date client contact information is important both for running a current business and for the future development of relationships.

5.12.  INFORMATION PROVIDED BY YOU

The amount of personal data and information that FIRCaspian stores about clients is extracted in one of the following ways: 

• it is provided by your organization while concluding a contract with FIRCaspian; 
• it is submitted to FIRCaspian by you or your company's representatives when searching for a service provider for the search, selection and provision of personnel or during marketing events or campaigns; 
• is accessible for FIRCaspian if you submitted your information as a Candidate. 

Along with the direct provision of Personal Data by you, we may also use other sources available to us. Such sources include: 

• data submitted by candidates from your projects; 
• obtained from public information sources, mass media, publications and newsletters;  
• received as a potential client from ad sites or other industry sites; 
• personal data generated during the relationship with FIRCaspian. FIRCaspian usually stores your contact information, name, position and history of communication with us obtained during the course of the relationship. 

5.13.  SOLUTIONS FOR THE SEARCH, SELECTION AND PROVISION OF PERSONNEL

We may use your personal data to contact you with a view to discuss business relationships regarding the search, selection and provision of personnel, and also to submit for your consideration candidates suitable for your requirements. If you are assigned as a manager for work and interaction with FIRCaspian, your contact information can be used for: 

• indication in the contract and in other legal documentation; 
• provision of invoices for services stipulated in the contract; 
• fulfillment of FIRCaspian obligations under the contract; 
• entering into the client database. 

5.14.   TO POTENTIAL CLIENTS

If FIRCaspian has received your contact or other personal data from open sources (for example: websites, events, mass media) your personal data may be considered as a potential client for the provision of our services in the context of search, recruitment and provision of personnel.

5.15.  EMPLOYEES DATA

Being an employee of FIRCaspian's main division and providing its services directly to FIRCaspian. We expect to get to know you in more detail, which includes sharing information that will allow us to ensure a good start to our relationship. 

5.16.  EMPLOYMENT

Most of the personal data required by FIRCaspian will be in your CV, however, to fulfill our statutory obligations, we may request additional information from you. Additional information may include: 

• contact information for communication, legal purposes; 
• contact information of nearest relatives for emergencies; 
• citizenship, passport details and personal preferences for travel, accommodation, relocation and visa purposes; 
• work experience and education, including certification, recommendation verification, competency testing and verification of compliance with industry standards for a particular position; 
• financial data for the purposes of processing payments, expenses, benefits, pension obligations and fulfilling our legal obligations under the contract; 
• state of health, including the results of medical examinations and other documents confirming the compliance of your health with your position, and also the necessary amount of data to fulfill our obligations to provide medical insurance; 
• data on close relatives, for the purpose of insuring relatives and providing benefits where applicable, and also compliance with legal requirements. 

If you do not provide the necessary data to the required extent, we will not be able to fulfill our obligations as an employer. 

5.17.  OTHER EMPLOYEES INFORMATION

During our labor relationship, FIRCaspian may save data obtained during your employment and use it for commercial, legal, industrial or other purposes. 

Purposes of processing such information include the following: 

• Attendance tracking. It includes collection and processing of information regarding work leaves, absence from work due to illness, work at home or from another remote location, and also other facts of absence from work. This information may be used for legal purposes related to your absence from the workplace, or may be used to evaluate your performance. 
• Records of your training and competency development are retained and used to comply with occupational safety and health regulations and ensure that your competencies meet the requirements of your position and, where appropriate, to record actions and events related to your business conduct. 
• Health conditions and occupational health and safety incidents are recorded in accordance with the laws of the Republic of Kazakhstan and FIRCaspian's internal policies to ensure your safety and well-being in the workplace. This data may include physician reports and notes. In the event of an incident, your personal data (name, position, address, contacts, emergency contacts) may be provided to the emergency or law enforcement services. 
• Financial data, payments, benefits, financial statements, and also any other information necessary for FIRCaspian to fulfill financial and legal obligations. 
• Physical or digital photographs provided by you or taken as part of a business or marketing campaign may be used for marketing purposes with your consent. 
• Recordings of telephone conversations and video conferences containing your personal data may be created and stored with your consent. 

You will learn more about the procedure for processing and storing personal data during the employment process (Procedure for Processing and Storing Personal Data approved by FIRCaspian General Director No. FIRC-HR-007 dated 03 April 2023 

5.18.  PERFORMANCE ASSESSMENT AND MONITORING OF LABOR PRODUCTIVITY

Certain systems are used in the Company to monitor key performance indicators or labor productivity values for management reporting. They are related to your specialization and are used to evaluate the quality of your work. The data collected during this assessment can be used for:  

• salary increase or promotion; 
• determining the need for training and development; 
• disciplinary actions; 
• fulfillment of legal obligations; 
• payment of bonuses or other rewards; 
• resolving certain situations between FIRCaspian and an employee. 

5.19.  ACCESS TO INFORMATION TECHNOLOGY

As a FIRCaspian employee, you will be equipped with certain IT equipment for business purposes, including a personal computer, email, corporate file servers and, in some cases, mobile devices. All data stored on these devices is the property of FIRCaspian with limited access controlled by an employee. In case of termination of the employment contract between FIRCaspian and an employee, the company has the right to dispose of the accumulated data for legal and business purposes. 

5.20.  COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA OF SUPPLIERS

FIRCaspian strives to establish mutually beneficial relationships with our suppliers and expects them to comply with a high level of ethical and security standards when working with personal data in accordance with the legal requirements specified in the contract and legislative norms. 

Personal data collected and used by FIRCaspian in relation to our suppliers is usually related to the requirements specified in the contract.

5.21.  INFORMATION COLLECTED ABOUT YOU

The information that FIRCaspian stores about you as a representative of the contractor company is limited and can be provided to us in one of the following ways: 

• sent by you personally in the course of your marketing strategy or offering your services and/or products; 
• provided by you or your organization during the signing of the service agreement; 
• sent to FIRCaspian during our search and selection of a supplier or partner. 
• sent to FIRCaspian by a third party in the form of a recommendation or designating you as a representative of a subcontractor; 
• obtained from a public source during the vendor search; 
• through a Business Verification Procedure conducted to ensure compliance with legal and commercial obligations and standards. 

Personal data usually consists of your name and contact information associated with your organization. This data will be used to ensure effective business relationships and will therefore be used for the following purposes: 

• Legal – provision of services, goods and fulfillment of other tasks stipulated in the contract. 
• Communication – includes processing your name, corporate data, contact numbers and email addresses, and also your position in the organization. 
• Financial transactions are used to process invoices and related acts to ensure timely payment for services and/or products. 
• Your name, as a representative of your organization, may also be associated with the assessment of HSE indicators or confidentiality and data protection, and also with other indicators related to the quality of provision of services and/or products. 

When providing services and/or goods to FIRCaspian, your data may be provided to the client company in accordance with the HSE requirements, legal or other contractual requirements. 

5.22.  WEBSITE USERS

When any person visits the website, FIRCaspian may collect information about your visit. This information includes your IP address, operating system, and browser type.  

Further details of the collected information can be found in the Cookie Policy published at the following link: 

www.fircaspian.com/cookies 

5.23.  DATA TRANSFER TO THIRD PARTIES

FIRCaspian will transfer your personal data to third parties only if there is a legitimate or legal reason for this, related to our services or the type of relationship between you and FIRCaspian, as defined in this Privacy Policy. The transfer of personal data to third parties takes place only with your consent, except in cases provided for by the legislation of the Republic of Kazakhstan. 

5.24.  SALE OF PERSONAL DATA

FIRCaspian does not sell personal data to third parties for any purpose under any circumstances. All accumulated personal data can only be used for the purpose of our services. 

5.25.  DISCLOSURE OF DATA UNDER CERTAIN CIRCUMSTANCES

In some cases, personal data stored by FIRCaspian may be disclosed to help prevent and solve crimes, and also at the request of law enforcement agencies without the consent of the person concerned. In this case, FIRCaspian will definitely check the legality of the request prior to disclosing the requested data. 

We may transfer your personal data to a third party as part of the sale of business assets or in case of business restructuring or reorganization, however, we will always adhere to ensuring your rights, confidentiality and data protection. 

5.26.  CROSS-BORDER DATA TRANSFER

Cross-border transfer of personal data is the transfer of personal data to the territory of foreign states. Cross-border transfer is carried out in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection". 

5.27.  CONTROL OVER YOUR PERSONAL DATA

As a client, supplier or employee of FIRCaspian, your consent will be based on acceptance of the relevant clauses when signing the contract, or, if provided for, by any other agreement. 

As a candidate, if you do not agree to the collection and processing of your personal data by FIRCaspian, you can revoke your consent to the processing of personal data at any time by submitting an email to privacy@fircaspian.com. It should be understood that upon withdrawal FIRCaspian will no longer be able to provide its services or fulfill its obligations under the contract" 

5.28.  SECURITY MEASURES

Your personal data is very important to FIRCaspian, in fact, the processing of personal data is the basis for conducting our business and providing our services. We guarantee to ensure respect, integrity and security of your personal data. To achieve that, appropriate technical and security measures are applied to maintain the confidentiality and integrity of the data stored in our information systems. 

As part of our responsibilities and fundamental principles, we use internal regulations and information security management systems, and also information security rules and procedures related to our IT infrastructure. 

5.29.  DATA ACCURACY

FIRCaspian places great importance on the accuracy of data of candidate, client's and supplier's employee that is collected, stored and processed within our IT infrastructure. We strive to maintain a high level of data accuracy in all our operations. However, despite all measures we have taken, FIRCaspian cannot guarantee the continued relevance of your information stored by us. Our staff may contact you with a view to update your information, in addition, you can send your updates at any time through our website or directly to our specialists so as to update the data. 

5.30.  INFORMATION RETENTION PERIODS

The duration of personal data storage inside FIRCaspian information systems may vary depending on the type of your relationship with us. 

If you are in the status of a candidate, the period of storing and processing your personal data will
be determined by the date of achieving the purpose of collecting your personal data, if any other
statement is determined by the RoK law.

In relation to employees, clients and suppliers, FIRCaspian will be required to store a certain amount of data (contracts, financial transactions, etc.) for a longer period, in accordance with the legislation of the Republic of Kazakhstan. 

Any documents that contain personal data are stored in accordance with our document management methods with access control and security. Personal data that has expired will be safely destroyed beyond the possibility of recovery.

5.31.  PERMISSIONS TO PROCESS PERSONAL DATA

FIRCaspian respects the information you share with us and understands that you have the right to know exactly how your data is processed and stored, and you also have the right to ask us to stop processing your data. 

In accordance with our Policy, individuals have the following rights with respect to Personal Data: 

• right to correction; 
• right of access; 
• right to deleting; 
• right to restrict processing. 

At any time, you can exercise these rights related to the processing of your personal data by contacting us by e-mail privacy@fircaspian.com . 

5.32.  POLICY REVIEW

This Policy is subject to revision once every three years or in case of amendments and additions to the legislation of the Republic of Kazakhstan. 

Any changes we make to our Privacy Policy will be reflected on this web page. We recommend visiting our website to keep track of the latest changes. 

Date of the last update of the Privacy Policy: 19.11.2024