Personal Data Processing Policy (Privacy Policy)

1.1. This Personal Data Processing Policy is drafted in accordance with the requirements of the Law of the Republic of Kazakhstan dated May 21, 2013 No. 94-V “On Personal Data and Their Protection” and defines the procedure for processing personal data and measures to ensure the security of personal data by the company — ИП Раимкулов Тынчтык, BIN 911015000124 (hereinafter referred to as the “Operator”) with regard to the processing of personal data collected through the use of the website https://evde.kz (hereinafter referred to as the “Website”), and contains information about the requirements for the protection of such personal data implemented by the Operator.

1.2. The legal grounds for processing personal data are the regulatory legal acts of the Republic of Kazakhstan, the Operator’s local regulations, agreements with personal data subjects, and the consents of personal data subjects to the processing of their personal data.

1.3. The processing of personal data is carried out in compliance with confidentiality. The Operator does not disclose personal data to third parties and does not distribute the personal data of subjects without their consent, unless otherwise provided for by the legislation of the Republic of Kazakhstan.

2.1. The Operator of personal data has the following rights: to receive from the personal data subject reliable information regarding the personal data provided; to request timely updates of personal data from the personal data subject.

2.2. The Operator of personal data undertakes to: process personal data in the manner established by the current legislation of the Republic of Kazakhstan; consider requests from the personal data subject (or their legal representative) regarding the processing of personal data and provide reasoned responses within ten working days from the date of receiving the request; provide the personal data subject (or their legal representative) with free access to their personal data; take measures to update or destroy personal data of the subject based on their lawful and reasonable requests, as well as upon achieving the purposes of processing; organize the protection of personal data in accordance with the requirements of the legislation of the Republic of Kazakhstan; fulfill other obligations in accordance with the legislation of the Republic of Kazakhstan.

2.3. Rights of personal data subjects: to obtain information about their personal data processed by the Operator by sending a written request to the postal or email address indicated on the Website on the “Offer” page; to gain access to their personal data, except in cases provided by law; to update their personal data, demand blocking or destruction if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, by sending a written request to the postal or email address indicated on the Website on the “Offer” page; to withdraw consent for the processing of personal data by sending a written request to the postal or email address indicated on the Website on the “Offer” page; to exercise other rights provided for by the legislation of the Republic of Kazakhstan.

2.4. Obligations of personal data subjects: to provide the Operator only with reliable data and information; to notify the Operator of updates (renewal, changes) to their personal data.

3.1. The Operator processes the personal data of the following categories of subjects whose personal data may be collected through the Website: unregistered users; registered users; recipients of goods and services provided by the Operator (who are not registered users).

3.2. The processing of personal data of other categories of subjects is regulated by other local acts of the Operator. The personal data processed for unregistered and registered users of the Website, as well as for recipients of goods and services provided by the Operator, includes all information submitted by users through the Website, including by filling in relevant data fields on the Website, such as: full name; mobile phone number; email address; delivery address; order history; history of requests and views on the Website and its services; other information (this list may be shortened or extended depending on the specific case and purpose of processing).

4.1. The Operator will process the personal data of unregistered users for the following purposes: use of the Website, which includes providing users with information on goods and services offered by the Operator; providing users with consultations regarding goods and services, user support; improving the usability of the Website; promoting the goods and services offered by the Operator by displaying them on the Website. For these purposes, the Operator processes the following personal data of unregistered users: browsing and request history on the Website and its services; other information the user considers necessary to provide.

4.2. The Operator will process the personal data of registered users for the following purposes: use of the Website, which includes communication with the Operator; providing users with information on goods and services; providing consultations and support; improving usability of the Website; promoting goods and services by direct contact with users; delivery of goods, which includes communication with the Operator; providing users with information on upcoming deliveries; providing consultations and support related to deliveries. For these purposes, the Operator processes: full name; mobile phone number; email address; delivery address; order history; browsing and request history; other information depending on the case and purpose of processing.

4.3. The Operator will process the personal data of recipients of goods and services for the purpose of delivering such goods, which includes communication with the Operator; providing delivery information; providing consultations and support related to delivery. For these purposes, the Operator processes: full name; mobile phone number; email address; delivery address; other information depending on the case and purpose of processing.

5.1. The Operator may process personal data with or without the use of automation tools through collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, deletion, or destruction.

5.2. The Operator has the right to transfer personal data to third parties or assign processing to third parties if necessary to achieve the purposes of processing in accordance with this Policy, as well as in cases provided by the legislation of the Republic of Kazakhstan on personal data.

5.3. The Operator processes personal data no longer than required for the purposes of processing, unless otherwise established by the legislation of the Republic of Kazakhstan on personal data.

6.1. The Operator takes personal data protection seriously and implements measures necessary and sufficient to ensure compliance with the legislation of the Republic of Kazakhstan on personal data.

6.2. At the same time, the Operator is not responsible for third parties obtaining personal data through access to the personal accounts of registered users. Registered users are responsible for securing their account credentials.

7.1. The Website user freely, by their own will and in their own interest, provides the Operator with their personal data.

7.2. By accepting this Policy, the user confirms that the personal data they provide is accurate. The Operator assumes that the user provides accurate personal data and keeps it up to date.

7.3. By filling out the data fields provided on the Website, the user accepts this Policy and consents to the processing of their personal data in accordance with the terms of this Policy.

7.4. By filling out data fields regarding recipients of goods and services, the user guarantees that such recipients have consented to the processing of their personal data under the terms of this Policy. The user also undertakes to notify such recipients about the transfer of their personal data to the Operator and guarantees such notification.

7.5. By accepting this Policy, the user confirms that they are aware of their rights and obligations under the legislation of the Republic of Kazakhstan on personal data, including the right to access and to withdraw their consent.

7.6. The condition for terminating the processing of personal data is achieving the purposes of processing, the expiration of the consent period, withdrawal of consent, or identification of unlawful processing. The subject of personal data may withdraw their consent by sending a written notice to the email address indicated on the Website on the “Offer” page.

7.7. If the user does not intend to provide personal data or does not accept this Policy, they must stop using the Website, in which case the Operator cannot provide access to the Website.

8.1. The Operator may collect information about users’ visits to the Website without users providing such data themselves. This information may be obtained through various tools, including cookies, Yandex.Metrica, Google Analytics. The Operator may use such tools for marketing, providing information about goods and services through targeted advertising, and improving usability by creating user profiles. These tools are not used to identify unregistered users.

8.2. If a user does not agree with cookies being stored on their device, they can disable this option in their browser settings. Saved cookies can also be deleted at any time. The user can adjust browser settings to accept or reject all cookies by default or only cookies from certain sites, including this Website.

8.3. Disabling some cookies may make certain sections or functions of the Website unavailable.

8.4. If a user does not agree with the use of online statistics and customization tools, they must stop using the Website, in which case the Operator cannot provide access to the Website.

9.1. When the purposes of processing have been achieved, the consent has expired, or the consent has been withdrawn, personal data must be destroyed unless otherwise provided by an agreement to which the subject is a party or by another agreement between the Operator and the subject.

9.2. If personal data is processed without automation, the document confirming destruction is an Act of Personal Data Destruction.

9.3. If personal data is processed with automation, the documents confirming destruction are an Act of Personal Data Destruction and an export from the event log of the information system.

9.4. If personal data is processed both with and without automation, the documents confirming destruction are an Act of Personal Data Destruction and an export from the event log.

9.5. The Act of Destruction and the event log export must be stored for three years from the moment of destruction.

10.1. This Policy is subject to change in case of amendments to the legislation of the Republic of Kazakhstan on personal data, and may also be changed at any time at the discretion of the Operator. The current version of the Policy is always available for public access on the Website.

10.2. All relations involving the Operator regarding the processing and protection of personal data that are not directly covered in this Policy are governed by the legislation of the Republic of Kazakhstan on personal data.