Privacy Policy of the "Birzhevoy Broker" Mobile Application

PRIVACY POLICY

OF THE "BIRZHEVOY BROKER" MOBILE APPLICATION

1. GENERAL PROVISIONS.

1.1. This privacy policy of the "Birzhevoy Broker" mobile application (hereinafter – the "Policy") contains the list of information that Limited Liability Company "Brokery birzhavj" (ООО «Брокери биржавй», TIN 020061919, registered address: 127 Rudaki Ave., office 521, Ismoili Somoni district, Dushanbe) (hereinafter – the "Company") may receive in connection with your use of the Mobile Application, the User’s rights and the Company’s obligations related to the processing of such information, the purposes, methods and procedure of such processing, including information on the implemented requirements for the protection of personal data.

1.2. The terms and definitions used in the Policy are interpreted in the meaning given to them by the User Agreement on the use of the "Birzhevoy Broker" Mobile Application.

1.3. The use of the Mobile Application means the User’s consent to the Policy and, among other things, the User’s consent to the processing by the Company (including transfer to a Bank subject to compliance with the requirements of the current legislation of the Republic of Tajikistan) of the information specified in the Policy.

1.4. If the User does not agree with the terms of the Policy, the User must stop using the Mobile Application.

1.5. The Company does not verify and does not guarantee the accuracy of the personal data provided by Users.

1.6. The Company reserves the right to make changes to the Policy at any time. Changes and additions to the Policy are made by the Company unilaterally; the User must take measures to independently familiarize himself/herself with the changes made. The text of the Policy in its current version is posted on the web page at: https://broker.tj/mobile-app-privacy-policy.

2. LIST OF INFORMATION THAT MAY BE OBTAINED FROM THE USER, PURPOSES AND TERMS OF ITS PROCESSING.

2.1. For the purposes of providing access to the functionality of the Mobile Application, concluding and performing agreements with the Company / Bank to which the User is a party, the Company may process the following information about the User: surname, name, patronymic, mobile phone number, e-mail address, address of permanent residence and registration, gender, date and place of birth, individual taxpayer identification number, as well as other information about the User that he/she independently enters into the interface of the Mobile Application.

2.2. For the purposes of increasing the security of the use of the Mobile Application, including detecting deviations from the most typical way of using the Mobile Application, the Company may process the following information about the Mobile device: information about the model and technical characteristics of the Mobile device, IMEI number, telecom operator, the language and time zone used on the Mobile device.

2.3. For the purposes of improving the quality of the Mobile Application and analyzing errors in the operation of the Mobile Application, the Company may process the following information about the Mobile device: version of the Mobile Application, version of the installed operating system, amount of RAM and storage, model of the Mobile device processor.

2.4. Personal data are processed in an automated manner by performing the following actions: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, blocking, deletion, destruction, transfer (provision, access).

2.5. The Company has the right to process the above information throughout the entire period of the User’s use of the Mobile Application, as well as after the termination of such use if this is required by the applicable legislation.

3. PROCEDURE FOR PROCESSING INFORMATION AND IMPLEMENTED REQUIREMENTS FOR THE PROTECTION OF PERSONAL DATA.

3.1. When processing data obtained in connection with the use of the Mobile Application, the Company fully complies with the requirements of the applicable legislation in the field of personal data protection.

3.2. The processing of the User’s personal data obtained by the Company is limited to the purposes specified in the Policy. The Company processes only those personal data that correspond to the purposes of their processing.

3.3. The Company does not process special categories of personal data and does not carry out cross-border transfer of personal data.

3.4. The Company takes the measures necessary and sufficient to ensure compliance with the obligations established by the legislation of the Republic of Tajikistan on personal data (hereinafter – the "personal data legislation") and the regulatory legal acts adopted in accordance with it. When processing personal data, the Company takes the necessary legal, organizational and technical measures to protect the personal data received from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions in relation to personal data.

3.5. Ensuring the security of personal data is achieved, in particular, by:

• identifying threats to the security of personal data during their processing in personal data information systems;

• applying organizational and technical measures to ensure the security of personal data during their processing in personal data information systems that are necessary to meet the requirements for the protection of personal data;

• assessing the effectiveness of the measures taken to ensure the security of personal data;

• keeping records of personal data storage media;

• detecting incidents of unauthorized access to personal data and taking measures in response;

• restoring personal data that have been modified or destroyed as a result of unauthorized access to them;

• establishing rules for access to personal data processed in a personal data information system;

• monitoring the measures taken to ensure the security of personal data.

4. USER RIGHTS IN CONNECTION WITH THE USE OF THE MOBILE APPLICATION.

4.1. The User has the right to receive information relating to the processing of his/her personal data to the extent provided for by the personal data legislation. The User may obtain such information by sending a written request to the Company’s registered address containing the following information: the number of the main identity document of the User or his/her representative, information on the date of issue of this document and the authority that issued it, information confirming the User’s relationship with the Company (for example, the number of the brokerage service agreement, the date of conclusion of the agreement, the username required to access the Mobile Application), and the signature of the User or his/her representative.

4.2. The User’s right to receive information relating to the processing of his/her personal data may be restricted in accordance with the personal data legislation.

4.3. The User has the right to request that the Company clarify his/her personal data, block or destroy them if the personal data are incomplete, outdated, inaccurate, obtained unlawfully or are not necessary for the stated purpose of processing, as well as to take the measures provided for by law to protect his/her rights.

4.4. If the User believes that the Company processes his/her personal data in violation of the requirements of the personal data legislation or otherwise violates his/her rights and freedoms, the User has the right to appeal the actions or inaction of the Company to the authorized body for the protection of the rights of personal data subjects or in court.

4.5. The User has the right to protect his/her rights and legitimate interests, including the right to compensation for losses and/or moral damage in court.

4.6. The User’s consent to the processing of personal data may be withdrawn by the User at any time by deleting the Mobile Application.

4.7. Information received from the User in connection with the use of the Mobile Application may be transferred by the Company to authorized state bodies in accordance with the requirements of the applicable legislation.

5. COMPANY OBLIGATIONS IN CONNECTION WITH THE USE OF THE MOBILE APPLICATION.

5.1. The Company is obliged to provide the User, upon his/her request, with information provided for by the personal data legislation.

5.2. If unlawful processing of personal data is detected upon a request from the User or his/her representative or upon their inquiry, the Company must block the unlawfully processed personal data relating to this User or ensure their blocking from the moment of such request or receipt of the inquiry for the period of verification. If inaccurate personal data are detected, the Company must block the personal data relating to this User or ensure their blocking from the moment of such request or receipt of the inquiry for the period of verification, provided that blocking the personal data does not violate the rights and legitimate interests of the User or third parties.

5.3. If the inaccuracy of personal data is confirmed, the Company, on the basis of the information provided by the User or his/her representative or other necessary documents, must clarify the personal data or ensure their clarification within seven working days from the date of submission of such information and remove the blocking of the personal data.

5.4. If unlawful processing of personal data carried out by the Company or by a person acting on behalf of the Company is detected, the Company must, within a period not exceeding three working days from the date of detection, cease the unlawful processing of personal data or ensure that the person acting on behalf of the Company ceases such processing. If it is impossible to ensure the lawful processing of personal data, the Company must, within a period not exceeding ten working days from the date of detection of unlawful processing of personal data, destroy such personal data or ensure their destruction. The Company must notify the User or his/her representative of the elimination of the violations or the destruction of personal data.

5.5. Upon achieving the purpose of processing personal data, the Company must cease processing personal data or ensure its cessation and destroy the personal data or ensure their destruction within a period not exceeding thirty days from the date of achieving the purpose of processing personal data.

5.6. If the User withdraws his/her consent to the processing of personal data, the Company must cease processing or ensure that such processing is ceased and, if the retention of personal data is no longer required for the purposes of processing personal data, destroy the personal data or ensure their destruction within a period not exceeding thirty days from the date of receipt of the withdrawal.

5.7. If it is impossible to destroy personal data within the above period, the Company must block such personal data or ensure their blocking and ensure the destruction of the personal data within a period not exceeding six months, unless a different period is established by law.