Privacy Policy
1. General provisions and Company information
1.1. This Policy explains the processing of personal data of visitors to the OZTA website, applicants, clients, their representatives and partners (the Users).
1.2. The controller that determines the purposes and methods of processing is Limited Liability Company "Great Rock" (the Company): tax identification number 01109202410482, registration number 308258-3301-ООО, address: Kyrgyz Republic, Bishkek, 7a Kulatova Street. The contact for data-processing and protection matters is info@ozta.com.
1.3. Processing of digital personal data is governed by the Digital Code of the Kyrgyz Republic and other applicable rules. Where there is a foreign element, mandatory requirements applying to the relevant processing are also taken into account. This Policy does not constitute a contractual waiver of rights granted by law.
1.4. This Policy also applies to visitors who have not entered into an agreement with the Company. Submitting an Application or reading this Policy does not mean consent to every processing purpose, advertising or transfer of data to any third party.
2. Data, purposes and grounds for processing
2.1. When a User contacts the Company through a form, email or a selected channel, the Company receives the name, contact details, message and information provided to assess the task. A message may include a company name, details of goods or services, quantity, price, delivery, recipient and preferred contact method. These data are processed to respond and take steps at the User's request before an agreement is concluded.
2.2. To perform an accepted Instruction, the Company processes necessary contractual, payment, goods and transport information, correspondence, representative documents, work results and calculations. The ground is the need to conclude or perform an agreement; for mandatory records and compliance with authorities' requirements, the relevant legal duty applies.
2.3. Additional documents may be needed to verify authority and whether a transaction is permissible. Their scope is determined by the particular service and a justified request under the Client and transaction screening policy. The ground is identified for each check: a necessary contractual action, a legal duty or a permissible legitimate interest. Excess documents are not requested in advance for every Application.
2.4. To operate and protect the website, the Company may process network-connection address, browser and device information, request time and address, and technical error messages. The scope is limited to availability, security and remedying failures; where legitimate interest is used, the User's rights and reasonable expectations are considered.
2.5. Yandex Metrica and Google Analytics are used to assess visits and website usability. The services process viewed pages, referral sources and actions on the website, including form completion. They connect automatically when the website is visited. Closing the analytics notice does not control the counters and is not consent to data processing. Closing the notice is not required to submit an Application. The technologies and browser-data controls are described in the Cookie Policy.
2.6. Advertising messages that require consent are sent only after separate consent is obtained. Contact information from an Application is not an automatic advertising subscription. Messages needed to review a request and perform an order are kept separate from advertising.
2.7. The Company does not request passwords, access codes, full payment-card details or other access secrets through general forms. Special categories of data should not be included in free-text fields without necessity and a separate lawful ground for processing.
3. Consent and information
3.1. The ground for processing is determined by its purpose. Consent is used where required by law or where no other statutory ground applies; confirming that the Policy was read does not replace such consent.
3.2. A consent request must be separate, clear and specific. Receiving a necessary service is not conditional on consent to optional processing unrelated to the service. Where processing is based on consent, the Company must be able to confirm its content and receipt.
3.3. A User may withdraw consent through a method no more difficult than giving it, using the available mailing opt-out or contacting info@ozta.com. After withdrawal, processing without another lawful ground stops. Withdrawal does not make earlier lawful processing unlawful and does not end a statutory duty to retain documents.
3.4. Before receiving data, the Company must provide information required by law about the purpose, ground, controller, processing locations, recipients, retention periods or their determining criteria, rights and consequences of refusal. If a particular transaction requires additional data or a new transfer, the relevant information is provided before that processing. Publishing general recipient categories does not replace the duty to provide necessary details about actual processing.
3.5. Failure to provide data objectively necessary to respond, conclude an agreement or perform a stage may make that action impossible. The Company explains how the requested information relates to the task. Refusal of optional advertising is not a ground for refusing service.
4. Recipients and transfer methods
4.1. Form submissions reach the Company by email. Website operation and message delivery may involve hosting, communications and email providers to the extent necessary for those functions. Employees' access is limited by their duties.
4.2. To perform an Instruction, necessary data may be transferred to suppliers, carriers, warehouses, banks and other contractors identified for the relevant transaction. The existence of an agreement with a Client does not authorise transfer of information unrelated to performance.
4.3. Website-interaction data is processed using Yandex Metrica and Google Analytics, which connect automatically when the website is visited. The services' terms apply within their actual role; a link to a third party's policy does not release the Company from its own data-protection duties.
4.4. When a person processes data on the Company's behalf, the relationship is documented with regard to statutory processor requirements. If a recipient independently determines the purposes of processing, transfer to that recipient requires its own proper legal ground and information to the User.
4.5. Information is provided to state authorities in the cases and to the extent established by law. Selling personal data is not a processing purpose of the Company.
5. Cross-border transfers
5.1. International performance of an Instruction and use of external digital services may require data transfers outside the Kyrgyz Republic. Permissibility is assessed by the actual recipient, processing location and transfer ground; the Company's location does not mean that all data are stored only in Kyrgyzstan.
5.2. Before a transfer, the Company checks requirements applying to the destination state and the statutory ground for the transfer. For a state not included among those providing adequate protection, the statutory ground applicable to the particular transfer is used. A general statement that services are international does not replace this check.
5.3. If a particular transfer requires consent, it is requested separately with the necessary information. The initial consent does not automatically authorise transfer to other participants or for other purposes.
6. Retention periods and ending processing
6.1. Data from an initial request are processed while the request and necessary follow-up are handled. After interaction ends, only data with an independent ground remain: mandatory records, an unsettled account, consideration of a claim or protection of rights for the applicable period. Other data are deleted or anonymised.
6.2. Documents under a performed agreement are kept for mandatory periods applicable to the relevant category. For transaction screening and claims, the period is determined by the applicable duty and the need to confirm the circumstances of the particular transaction; all received materials are not kept indefinitely.
6.3. For consent-based processing, the duration of consent, achievement of the purpose and withdrawal are considered. Storage periods for technical tools on the device are described in the Cookie Policy and differ from retention periods held by a recipient.
6.4. When the purpose is achieved, the ground is lost or a lawful deletion request is satisfied, the Company stops the relevant processing. If some data must remain, the User is told the legal ground and limits of that retention.
7. User rights
7.1. A User may receive information about processing and access personal data relating to them, request correction, deletion or restriction of processing, exercise other statutory rights, withdraw necessary consent and challenge unlawful processing.
7.2. Requests must be sent to info@ozta.com. The Company may request only information needed to identify the applicant and prevent disclosure to an unauthorised person. A copy of an identity document is not automatically required for every request.
7.3. Information about processing is provided within seven business days in the cases and manner established by the Digital Code of the Kyrgyz Republic. Statutory periods and grounds apply to other requests. If a request cannot be satisfied, the Company gives reasons in the manner required by law.
7.4. A User may contact the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic or a competent court. Contacting the Company is not a mandatory precondition for that protection unless the law provides otherwise.
8. Data protection and Policy changes
8.1. The Company must take organisational and technical measures required by law and appropriate to the nature and risks of processing, restrict access and prevent unlawful use. This Policy does not guarantee absolute security of transmission or storage.
8.2. A new version applies to processing after it is posted, to the extent permitted by law. Changing the Policy alone does not broaden earlier consent or create a new ground for processing. If a purpose, recipient or condition changes and additional information or consent is required, the necessary steps are taken before the changed processing begins.