Personal Data Processing Policy
P-O KOO "NARVESEN LTD" in the Kyrgyz Republic

1. General Provisions1.1. This Personal Data Processing Policy of Global Marine and Offshore Travel LLC (hereinafter referred to as the “Policy”) has been developed in accordance with the Law of the Kyrgyz Republic “On Personal Information” No. 58 dated 14 April 2008 (hereinafter – the “Law”) to ensure the protection of the rights and freedoms of individuals when processing their personal data, including the right to privacy and personal confidentiality.

1.2. This Policy applies to all personal data processed by the Company (the “Operator”).
1.3. This Policy applies to all personal data processing activities carried out before and after its approval.
1.4. This Policy is publicly available and published on the Company’s website.

1.5. Key Definitions Personal Data (Personal Information) – any information relating to an identified or identifiable individual.

• Operator – a legal or natural person determining the purposes and means of processing personal data.
• Processing – any action performed on personal data, including:
• collection
• recording
• storage
• systematization
• updating
• use
• transfer
• anonymization
• blocking
• deletion
• destruction
• Automated Processing – processing using IT systems.
• Provision – disclosure to specific persons.
• Distribution – disclosure to an undefined group.
• Blocking – temporary suspension of processing.
• Destruction – irreversible deletion of data.
• Anonymization – processing that prevents identification of the data subject.
• Cross-border Transfer – transfer of personal data outside the Kyrgyz Republic.

1.6. Rights and Obligations of the Operator

• 1.6.1. The Operator has the right to:
• Determine appropriate measures to ensure compliance with applicable legislation
• Engage third parties to process personal data under contractual agreements
• Continue processing where permitted by law
• 1.6.2. The Operator is obliged to:
• Process personal data in accordance with the Law
• Ensure confidentiality and security of personal data
• Respond to requests from data subjects
• Cooperate with authorized state bodies of the Kyrgyz Republic

1.7. Rights of Data Subjects Data subjects have the right to:

• Receive information about the processing of their personal data
• Request correction, blocking, or deletion of inaccurate or unlawfully processed data
• Withdraw consent to processing
• Protect their rights through authorized state bodies or courts

1.8. Control and Responsibility Control over compliance with this Policy is carried out by a designated responsible person.
Liability for violations is determined in accordance with the legislation of the Kyrgyz Republic.

2. Purpose of Personal Data Processing
2.1. Personal data is processed for specific, lawful purposes only.
2.2. Only data necessary for these purposes is processed.
2.3. The Company processes personal data for:

• Compliance with applicable laws of the Kyrgyz Republic
• Conducting business operations
• Human resources management
• Recruitment and staffing
• Contract execution and client servicing
• Accounting and financial reporting
• Ensuring security and access control

3. Legal Basis for Processing
3.1. Processing is based on:

• Law of the Kyrgyz Republic “On Personal Information”
• Civil, labor, and tax legislation of the Kyrgyz Republic
• Other applicable нормативные акты

3.2. Additional legal grounds include:

• Company charter
• Contracts with clients, employees, and partners
• Consent of data subjects

4. Scope and Categories of Personal Data
4.1. The scope of personal data must be relevant and not excessive.
4.2. Categories include:

• 4.2.1. Job Applicants: Name and contact details
• Education and work experience
• Other information provided voluntarily
• 4.2.2. Employees: Identification and contact details
• Employment and qualification data
• Payroll and tax-related data
• Other data required under labor law
• 4.2.3. Clients and Partners: Identification and contact details
• Business and contractual information
• 4.2.4. Representatives of Legal Entities: Name, position, contact details

4.3. Biometric data is processed only where permitted by law.
4.4. Special categories of personal data are not processed unless required by law.

5. Processing Procedures
5.1. Processing is carried out in accordance with the Law.
5.2. Consent is obtained where required.
5.3. Processing may be automated or manual.
5.4. Access is limited to authorized personnel.
5.5. Data is collected:

• directly from data subjects
• from lawful public sources
• through internal systems

5.6. Personal data is not disclosed to third parties without consent unless required by law.
5.7. Data may be transferred to government authorities in accordance with legal requirements.
5.8. Data Protection Measures The Company implements:

• technical and organizational safeguards
• internal policies and procedures
• access controls
• employee training

5.9. Data Retention Personal data is retained only for as long as necessary to fulfill processing purposes or comply with legal obligations.
5.10. Cross-Border Transfer Cross-border transfer of personal data is carried out in accordance with the legislation of the Kyrgyz Republic and only where adequate protection is ensured.

6. Updating, Correction, and Deletion
6.1. The Operator provides information upon request, subject to proper identification.
6.2. Inaccurate data is corrected promptly.
6.3. Unlawfully processed data is blocked or deleted.
6.4. Personal data is deleted when:

• processing purposes are achieved
• consent is withdrawn
• legal grounds no longer apply

Director
P-O KOO "NARVESEN LTD" in the Kyrgyz Republic