Privacy Policy

1. General provisions

This personal data processing policy has been drawn up in accordance with the requirements of Law of the Republic of Kazakhstan No. 94-V of May 21, 2013 “On Personal Data and Their Protection” (hereinafter, the “Law”) and sets out the procedure for processing personal data and the measures to ensure the security of personal data taken by TOO “Privet iz afriki”, BIN 230540030948 (hereinafter, the “Operator”).

1.1. The Operator’s most important goal and condition for carrying out its activities is to respect human and civil rights and freedoms when processing a person’s personal data, including the protection of the rights to privacy and to personal and family secrets.

1.2. This Operator’s policy on personal data processing (hereinafter, the “Policy”) applies to all information that the Operator may obtain about visitors to the website https://privetizafriki.com.

1.3. If the User does not agree with the terms of the Privacy Policy, the User must stop using the site.

2. Basic concepts used in the Policy

2.1. Automated processing of personal data means the processing of personal data using computer technology.

2.2. Blocking of personal data means the temporary suspension of personal data processing (except where processing is necessary to clarify personal data).

2.3. Website means the set of graphic and information materials, as well as computer programs and databases, that make them available on the Internet at the network address https://privetizafriki.com.

2.4. Personal data information system means the set of personal data contained in databases and the information technologies and technical means that ensure their processing.

2.5. Depersonalization of personal data means actions that make it impossible, without the use of additional information, to determine whether personal data belongs to a specific User or other personal data subject.

2.6. Processing of personal data means any action (operation) or set of actions (operations) performed with or without automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion and destruction of personal data.

2.7. Operator means a government body, a local self-government body, or a legal entity or individual that, alone or jointly with others, organizes and/or carries out the processing of personal data and determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data.

2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of the website https://privetizafriki.com.

2.9. Personal data authorized by the personal data subject for distribution means personal data to which the personal data subject has given access to an unlimited number of persons by giving consent to the processing of personal data authorized by the subject for distribution, in the manner provided for by the Law on Personal Data and Their Protection (hereinafter, “personal data authorized for distribution”).

2.10. User means any visitor to the website https://privetizafriki.com.

2.11. Provision of personal data means actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.12. Distribution of personal data means any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data available to an unlimited number of persons, including publication of personal data in the mass media, posting in information and telecommunication networks, or providing access to personal data in any other way.

2.13. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign individual or a foreign legal entity.

2.14. Destruction of personal data means any actions as a result of which personal data is irreversibly destroyed, with no possibility of further restoring the content of the personal data in the personal data information system, and/or the physical media of personal data are destroyed.

3. Basic rights and obligations of the Operator

3.1. The Operator has the right:

• to receive from the personal data subject reliable information and/or documents containing personal data;
• if consent to personal data processing is withdrawn, the Operator may continue processing personal data without consent where the personal data has been made publicly available and where there are grounds specified in Article 9 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”;
• the Operator shall determine the composition and list of measures necessary and sufficient to ensure the fulfillment of such obligations and tasks, unless otherwise provided by the laws of the Republic of Kazakhstan, in particular:

(a) appointing a person responsible for organizing personal data processing;

(b) developing and approving internal regulations on personal data processing and protection;

(c) applying legal, organizational and technical measures to ensure the security of personal data:

• identifying threats to the security of personal data during their processing in personal data information systems;
• establishing rules for access to data processed in the personal data information system, and ensuring the registration and recording of all actions performed with personal data in the personal data information system;
• determining the list of personal data necessary and sufficient to perform the tasks carried out, stating the purposes of their collection and processing within these tasks;

3.2. The Operator shall:

• provide the personal data subject, at their request, with information regarding the processing of their personal data;
• organize the processing of personal data in the manner established by the applicable legislation of the Republic of Kazakhstan;
• respond to appeals and requests from personal data subjects and their legal representatives in accordance with the requirements of the Law;
• at the request of the authorized body, as part of the review of appeals from individuals and legal entities, provide information on the methods and procedures used to ensure compliance by the owner and/or operator with the requirements of this Law, within one business day;
• publish or otherwise ensure unrestricted access to this Policy on personal data processing;
• the owner and/or operator, as well as a third party, shall take the necessary measures to protect personal data, in accordance with this Law and the procedure determined by the Government of the Republic of Kazakhstan, that ensure:

(1) prevention of unauthorized access to personal data;

(2) timely detection of unauthorized access to personal data, if such unauthorized access could not be prevented;

(3) minimization of the adverse consequences of unauthorized access to personal data;

(4) provision of access for the state technical service to informatization objects that use, store, process and distribute restricted-access personal data contained in electronic information resources, in order to examine the security of the processes of storing, processing and distributing restricted-access personal data contained in electronic information resources, in the manner determined by the authorized body;

(5) registration and recording of the actions provided for in subparagraphs 3), 4), 5) and 6) of paragraph 4 of Article 8 of the Law.

• the obligations of the owner and/or operator, as well as a third party, to protect personal data arise from the moment personal data is collected and remain in effect until it is destroyed or depersonalized;
• take measures to destroy personal data once the purpose of its collection and processing has been achieved, as well as in other cases established by this Law and other regulatory legal acts of the Republic of Kazakhstan;
• perform other obligations provided for by the Law.

4. Basic rights and obligations of personal data subjects

4.1. Personal data subjects have the right:

• to know whether the owner and/or operator, or a third party, holds their personal data, and to receive information containing:
  • confirmation of the fact, purpose, sources and methods of collecting and processing personal data;
  • the list of personal data;
  • the periods of personal data processing, including storage periods;
• to demand that the owner and/or operator change and supplement their personal data where there are grounds confirmed by relevant documents;
• to demand that the owner and/or operator, or a third party, block their personal data if there is information about a violation of the conditions for collecting and processing personal data;
• to demand that the owner and/or operator, or a third party, destroy their personal data collected and processed in violation of the legislation of the Republic of Kazakhstan, as well as in other cases established by this Law and other regulatory legal acts of the Republic of Kazakhstan;
• to give (or refuse) consent to the owner and/or operator to distribute their personal data in publicly available sources of personal data;
• to withdraw consent to the collection, processing, distribution in publicly available sources, transfer to third parties and cross-border transfer of personal data, except in the cases provided for by paragraph 2 of Article 8 of the Law;
• to appeal to the authorized body for the protection of the rights of personal data subjects, or in court, against unlawful actions or inaction of the Operator in processing their personal data, and to protect their rights and legitimate interests, including compensation for moral and material damage;
• to exercise other rights provided for by this Law and other laws of the Republic of Kazakhstan.

4.2. Personal data subjects shall:

• provide the Operator with accurate information about themselves;
• inform the Operator of any clarification (updating, change) of their personal data.

4.3. Persons who have provided the Operator with false information about themselves, or with information about another personal data subject without that subject’s consent, are liable in accordance with the laws of the Republic of Kazakhstan; a violation of the legislation of the Republic of Kazakhstan on personal data and their protection entails liability in accordance with the laws of the Republic of Kazakhstan.

5. Personal data that may be processed under this Privacy Policy is provided by the User by filling in the Order Form on the Site and includes the following information:

5.1. Surname, first name, patronymic.

5.2. Email address.

5.3. Usernames/phone numbers in the Telegram/WhatsApp messengers;

5.4. The site also collects and processes anonymized data about visitors (including “cookies”) using web analytics services (Yandex Metrica, Google Analytics and others).

5.5. The above data is hereinafter collectively referred to in the Policy as Personal Data.

5.16. The Operator does not process special categories of personal data concerning racial or national origin, political views, religious or philosophical beliefs, or intimate life.

5.17. The User gives consent to the processing of personal data authorized for distribution directly to the Operator.

5.17.1. To withdraw consent to the collection, processing, distribution in publicly available sources, transfer to third parties and cross-border transfer of personal data, except in the cases provided for by paragraph 2 of Article 8 of the Law.

5.17.2. Consent to the processing of personal data authorized for distribution ceases to be effective from the moment the Operator receives the request specified in clause 5.17.1 of this Policy on personal data processing, and when the purpose of collecting the personal data is achieved.

6. Principles of personal data processing

6.1. Personal data is processed on a lawful and fair basis.

6.2. Personal data processing is limited to achieving specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of its collection is not permitted.

6.3. Combining databases containing personal data that is processed for purposes incompatible with each other is not permitted.

6.4. Only personal data that meets the purposes of its processing is subject to processing.

6.5. The content and scope of the personal data processed correspond to the stated purposes of processing. Processing personal data that is excessive in relation to the stated purposes of processing is not permitted.

6.6. When personal data is processed, its accuracy, sufficiency and, where necessary, relevance to the purposes of processing are ensured. The Operator takes the necessary measures and/or ensures that they are taken to delete or clarify incomplete or inaccurate data.

6.7. Personal data is stored in a form that makes it possible to identify the personal data subject for no longer than the purposes of processing require, unless the storage period is established by law or by an agreement to which the personal data subject is a party, beneficiary or guarantor. Processed personal data is destroyed or depersonalized once the purposes of processing are achieved or when there is no longer a need to achieve these purposes, unless otherwise provided by the law of the Republic of Kazakhstan on personal data.

7. Purposes of personal data processing

7.1. The Site Administration may use the User’s personal data for the purposes of:

• informing the User by sending emails;
• processing orders for services;
• establishing feedback with the User;
• ensuring security and preventing fraud;
• confirming the accuracy and completeness of the personal data provided by the User;
• providing the User with effective customer and technical support if problems arise in connection with the use of the Site.

7.2. The Operator also has the right to send the User notifications about new products and services, special offers and various events. The User can always opt out of receiving informational messages by sending the Operator an email at privetizafriki@outlook.com with the subject line “Opt-out of notifications about new products and services and special offers”.

7.3. Anonymized User data collected using web analytics services is used to collect information about Users’ actions on the site and to improve the quality of the site and its content.

8. Legal grounds for personal data processing

8.1. The legal grounds for the Operator’s processing of personal data are:

• Law of the Republic of Kazakhstan No. 401-V of November 16, 2015 “On Access to Information”, Law of the Republic of Kazakhstan No. 418-V of November 24, 2015 “On Informatization”, and Law of the Republic of Kazakhstan No. 94-V of May 21, 2013 “On Personal Data and Their Protection”;
• laws and other regulatory legal acts in the field of personal data protection;
• Users’ consent to the processing of their personal data and to the processing of personal data authorized for distribution.

8.2. The Operator processes the User’s personal data only if the User fills it in and/or sends it on their own through the special forms (order forms) on the site https://privetizafriki.com or sends it to the Operator by email. By filling in the relevant forms and/or sending their personal data to the Operator, the User expresses their agreement with this Policy.

8.3. The Operator processes anonymized data about the User if this is allowed in the User’s browser settings (saving “cookies” is enabled).

8.4. The personal data subject decides on their own to provide their personal data and gives consent freely, of their own will and in their own interest.

9. Conditions of personal data processing

9.1. Personal data is processed with the consent of the personal data subject to the processing of their personal data.

9.2. Processing of personal data is necessary for the performance of an agreement to which the personal data subject is a party, beneficiary or guarantor, as well as for concluding an agreement at the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor.

9.3. Processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant purposes, provided that this does not violate the rights and freedoms of the personal data subject.

9.4. Personal data is processed to which access by an unlimited number of persons has been given by the personal data subject or at their request (hereinafter, “publicly available personal data”).

9.5. Personal data that is subject to publication or mandatory disclosure in accordance with the law is processed.

10. Procedure for collecting, storing, transferring and otherwise processing personal data

The security of personal data processed by the Operator is ensured by implementing the legal, organizational and technical measures necessary to fully comply with the requirements of the applicable legislation on personal data protection.

10.1. The Operator ensures the safety of personal data and takes all possible measures to prevent access to personal data by unauthorized persons.

10.2. The User’s personal data will never, under any circumstances, be transferred to third parties, except in cases related to compliance with applicable law or where the personal data subject has given the Operator consent to transfer the data to a third party to perform obligations under a civil law contract.

10.3. If inaccuracies are found in the personal data, the User can update it themselves by sending a notice to the Operator’s email address privetizafriki@outlook.com with the subject line “Updating personal data”.

10.4. The period of personal data processing is determined by the achievement of the purposes for which the personal data was collected, unless a different period is provided for by an agreement or applicable law.

The User may withdraw their consent to personal data processing at any time by sending the Operator a notice by email to the Operator’s address privetizafriki@outlook.com with the subject line “Withdrawal of consent to personal data processing”.

10.5. All information collected by third-party services, including payment systems, means of communication and other service providers, is stored and processed by these persons (Operators) in accordance with their User Agreement and Privacy Policy. The personal data subject and/or User must review these documents on their own in a timely manner. The Operator is not responsible for the actions of third parties, including the service providers referred to in this clause.

10.6. Prohibitions established by the personal data subject on the transfer (except for granting access) and on the processing or conditions of processing (except for obtaining access) of personal data authorized for distribution do not apply where personal data is processed in state, public and other public interests defined by the legislation of the Republic of Kazakhstan.

10.7. When processing personal data, the Operator ensures its confidentiality.

10.8. The Operator stores personal data in a form that makes it possible to identify the personal data subject for no longer than the purposes of processing require, unless the storage period is established by law or by an agreement to which the personal data subject is a party, beneficiary or guarantor.

10.9. Personal data processing may be terminated when the purposes of processing are achieved, when the period of the personal data subject’s consent expires, when the subject withdraws consent, or when unlawful processing of personal data is detected.

11. Actions performed by the Operator with the personal data received

11.1. The Operator collects, records, systematizes, accumulates, stores, clarifies (updates, changes), extracts, uses, transfers (distributes, provides, grants access to), depersonalizes, blocks, deletes and destroys personal data.

11.2. The Operator carries out automated processing of personal data, with or without receiving and/or transmitting the information obtained via information and telecommunication networks.

12. Cross-border transfer of personal data

12.1. Cross-border transfer of personal data means the transfer of personal data to the territory of foreign states.

12.2. In accordance with this Law, cross-border transfer of personal data to the territory of foreign states is carried out only if these states ensure the protection of personal data.

12.3. Cross-border transfer of personal data to the territory of foreign states that do not ensure the protection of personal data may be carried out in the following cases:

(1) with the consent of the subject or their legal representative to the cross-border transfer of their personal data;

(2) as provided for by international treaties ratified by the Republic of Kazakhstan;

(3) as provided for by the laws of the Republic of Kazakhstan, if this is necessary to protect the constitutional order, public order, human and civil rights and freedoms, and public health and morals;

(4) to protect constitutional human and civil rights and freedoms, if it is impossible to obtain the consent of the subject or their legal representative.

12.4. Cross-border transfer of personal data to the territory of foreign states may be prohibited or restricted by the laws of the Republic of Kazakhstan.

12.5. The specifics of the cross-border transfer of service information about subscribers and/or users of communication services are determined by the Law of the Republic of Kazakhstan “On Communications”.

13. Confidentiality of personal data

The Operator and other persons who have obtained access to personal data must not disclose personal data to third parties or distribute it without the consent of the personal data subject, unless otherwise provided by law.

14. Final provisions

14.1. The User can obtain any clarification on matters of interest regarding the processing of their personal data by contacting the Operator by email at privetizafriki@outlook.com.

14.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy is valid indefinitely until it is replaced by a new version.

14.3. The current version of the Policy is freely available on the Internet at https://privetizafriki.com.