PERSONAL DATA COLLECTION AND PROCESSING POLICY

APPENDIX A1 TO PRIVACY POLICY

This Personal Data Collection and Processing Policy (hereinafter referred to as the "Policy") governs the legal relationship between HolyPoly Limited Liability Partnership ("Partnership") and individuals ("User") whose personal data is collected through the use of the Partnership's mobile application and website located at: https://scanwow.com/ ("Website").

1. General Provisions

1.1. This Policy has been developed in accordance with the applicable laws of the Republic of Kazakhstan on personal data and its protection, applicable international rules and standards ratified by the Republic of Kazakhstan, and the Partnership’s internal and public documents.

1.2. This Policy applies to all instances of personal data collection and processing provided by the User.

1.3. The processing of personal data by the Partnership is based on the following principles:

1) Lawfulness of the purposes and methods of processing personal data; integrity and fairness in the Partnership's activities;

2) Accuracy and adequacy of personal data for the stated processing purposes;

3) Ensuring that only data relevant to the processing purposes is processed;

4) Ensuring that the content and scope of processed data align with declared purposes;

5) Ensuring accuracy and adequacy of personal data, and, where necessary, relevance to the processing purposes;

6) Storage of personal data no longer than necessary for processing purposes.

1.4. By using the Website, the User expressly consents to the terms of this Policy. If the Usner disagrees with these terms, they must immediately discontinue using the Website.

1.5. This Policy operates in conjunction with other public documents of the Partnership, including the Privacy Policy.

2. Personal Data Subject to Collection and Processing

2.1. The Partnership collects and processes the following personal data:

1) Full name (last name, first name, patronymic);

2) Age and date of birth (to enforce age restrictions for content accessible only to users over eighteen (18) years old);

3) User's location;

4) Profession, workplace, and employment details;

5) Links to the User's social media profiles and personal websites;

6) Download and purchase history on the Website;

7) Payment information (processed through secure external payment services);

8) Other personal data provided by the User.

2.2. The collection and processing of personal data is conducted by the Partnership for the purposes of the User identification, as well as conducting commercial activities of the Partnership, including building and maintaining a customer database.

2.3. To ensure the protection of personal data, the Partnership undertakes to:

1) Maintain strict confidentiality of the personal data collected;

2) In case User discontinues using the Website, the personal data obtained from them shall be stored under conditions ensuring confidentiality for purposes, including but not limited to internal and external audits, inspections by authorized bodies, except in cases provided for by the applicable laws of the Republic of Kazakhstan.

3. Procedure and Terms of Personal Data Processing

3.1. Personal data shall be collected only after obtaining the User's consent, unless otherwise provided for by law.

3.2. Access to the Users' personal data shall be restricted and granted solely to authorized employees of the Partnership.

3.3. Employees of the Partnership authorized to process personal data must be familiar with the laws of the Republic of Kazakhstan on personal data, including data protection requirements and the Partnership's local regulations.

3.4. The Partnership shall implement all reasonable organizational, technical and legal measures to protect personal data against loss, unauthorized access, alteration or disclosure.

3.5. Personal data shall be stored only for the period necessary to achieve the purposes of their processing, unless otherwise specified by the laws of the Republic of Kazakhstan.

3.6. The User has the right to withdraw consent to the collection and processing of personal data, except in cases provided for by law.

3.7. Personal data may be transferred to the following third parties:

1) Payment service providers – for fulfillment of payment obligations;

2 Government authorities – in cases established by the laws of the Republic of Kazakhstan.

4. Liability

4.1. The Partnership shall be liable for compliance with this Policy to the extent established by the laws of the Republic of Kazakhstan.

4.2. The User shall be liable for the accuracy of the personal data provided.

4.3. The Partnership shall not be liable for potential risks and conditions of secure usage, or network attacks or website breaches, including but not limited to website malfunctions caused by technical issues.

4.4. Any and all disputes between the Partnership and User shall be resolved in the manner stipulated in the Partnership's approved public documents and in compliance with the laws of the Republic of Kazakhstan.

5. Final Provisions

5.1. This Policy shall take effect upon approval and Remain valid until officially revoked.

5.2. The Partnership reserves the right to unilaterally amend or supplement this Policy at any time by publishing updated versions on the Website.