Privacy and Personal Data Processing Policy

Expert Food LLP

Scope of this Document
  • This Privacy and Personal Data Processing Policy has been developed in accordance with the requirements of the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 “On personal data and their protection” and sets out the procedure for processing personal data and the measures implemented to ensure the security of personal data by Expert Food LLP, located at: 50/1 Temirlan Highway, Abay District, Shymkent, Republic of Kazakhstan (hereinafter referred to as the “Operator”), with respect to the processing of personal data collected via the website https://jeti-tandir.kz (hereinafter referred to as the “Website”), and contains information on the personal data protection requirements implemented by the Operator.
  • The legal grounds for the processing of personal data include the regulatory legal acts of the Republic of Kazakhstan, internal regulatory acts of the Operator, agreements with personal data subjects, consents of personal data subjects to the processing of their personal data, and other instances where the processing of personal data is permitted without the consent of the personal data subject in accordance with the legislation of the Republic of Kazakhstan.
  • Personal data shall be processed in compliance with confidentiality requirements.The Operator shall not disclose or distribute personal data of personal data subjects to third parties without the consent of the personal data subject, unless otherwise provided by the legislation of the Republic of Kazakhstan.
Rights and Obligations of the Personal Data Operator and Personal Data Subjects
  • The Operator of personal data shall have the following rights:
    • to obtain from the personal data subject reliable information regarding the personal data provided by them;
    • to request the personal data subject to timely update or clarify the personal data provided;
    • to process personal data without the consent of the personal data subject in cases provided for by the legislation of the Republic of Kazakhstan;
    • to transfer personal data to third parties where necessary to achieve the purposes of processing, to perform a contract, to comply with legal requirements, or upon obtaining the personal data subject’s consent;
    • to request confirmation of the identity or authority of a person requesting access to personal data;
    • to restrict or deny access to personal data in cases provided for by the legislation of the Republic of Kazakhstan, including where such access would violate the rights and legitimate interests of third parties;
    • to use personal data to protect its own rights and legitimate interests in case of disputes;
    • to exercise other rights provided for by the legislation of the Republic of Kazakhstan.
  • The Operator of personal data shall be obliged to:
    • process personal data in accordance with the procedure established by the current legislation of the Republic of Kazakhstan;
    • review requests from the personal data subject (or their legal representative) regarding the processing of personal data and provide reasoned responses within ten (10) business days from the date of receipt of such request;
    • grant the personal data subject (or their legal representative) free access to their personal data;
    • take measures to update, block, or delete the personal data of the personal data subject upon their lawful and justified request, as well as upon achievement of the purposes of processing, expiration of the retention period, or occurrence of other grounds provided for by the legislation of the Republic of Kazakhstan;
    • implement measures for the protection of personal data in accordance with the requirements of the legislation of the Republic of Kazakhstan;
    • fulfill other obligations as established by the legislation of the Republic of Kazakhstan.
  • The personal data subjects shall have the following rights:
    • to obtain information regarding their personal data processed by the Operator by submitting a written request to the postal or email address specified on the “Offer” section of the Website;
    • to access their personal data, except in cases provided for by the legislation of the Republic of Kazakhstan;
    • to request correction, blocking, or deletion of their personal data in cases where the data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the declared purposes of processing, by submitting a written request to the postal or email address specified on the “Offer” section of the Website;
    • to withdraw consent to the processing of their personal data by submitting a written request to the postal or email address specified on the “Offer” section of the Website;
    • to exercise other rights provided for by the legislation of the Republic of Kazakhstan.
  • Obligations of Personal Data Subjects:
    • to provide the Operator only with accurate data and information;
    • to timely inform the Operator of any clarification (update, modification) of their personal data;
    • to comply with the terms of agreements and the privacy policy published on the Website.
Categories of Personal Data Subjects and Types of Personal Data Processed
  • The Operator processes personal data of the following categories of data subjects whose personal data may be collected by the Operator through the Website:
    • unregistered users;
    • registered users;
    • recipients of goods and services provided by the Operator (who are not registered users).
  • The processing of personal data of other categories of data subjects by the Operator is governed by other internal policies of the Operator. The personal data of unregistered and registered users of the Website, as well as recipients of goods and services provided by the Operator, includes all information submitted to the Operator by users through the Website, including by completing the relevant personal data fields on the Website, including but not limited to:
    • surname, first name, and patronymic;
    • mobile phone number;
    • email address;
    • delivery address for goods sold by the Operator;
    • history of orders placed with the Operator;
    • history of search queries and views on the Website and its services;
    • other information (this list may be expanded or reduced depending on the specific case and purposes of processing).
Purposes of Personal Data Processing
  • The Operator shall process the personal data of unregistered users for the following purposes:
    • to enable their use of the Website, which includes:
  1. providing users with reference information on goods and services offered by the Operator;
  2. providing users with consultations regarding the goods and services offered by the Operator, and user support;
  3. improving the usability of the Website;
    • to promote the goods and services offered by the Operator by displaying such goods and services on the Website.
For the achievement of the above purposes, the Operator processes the following personal data of unregistered users:
  1. history of search queries and views on the Website and its services;
  2. other information the user deems necessary to provide.
  • The Operator shall process the personal data of registered users for the following purposes:
    • to enable their use of the Website, which includes:
  1. communication with the Operator;
  2. providing users with reference information on goods and services offered by the Operator;
  3. providing users with consultations regarding the goods and services offered by the Operator, and user support;
  4. improving the usability of the Website;
    • to promote the Operator’s goods and services by initiating direct contact with users;
    • to facilitate delivery of the goods offered by the Operator, which includes:
  5. communication with the Operator;
  6. providing users with information on upcoming deliveries of goods offered by the Operator;
  7. providing recipients of goods and services offered by the Operator with consultations on matters related to the delivery of such goods, as well as support for recipients of goods and services offered by the Operator.
For the achievement of the above purposes, the Operator processes the following personal data of registered users:
  1. surname, first name, and patronymic;
  2. mobile phone number;
  3. email address;
  4. delivery address for goods sold by the Operator;
  5. history of orders placed with the Operator;
  6. history of search queries and views on the Website and its services;
  7. other information (this list may be expanded or reduced depending on the specific case and purposes of processing).
  • The Operator shall process the personal data of recipients of goods and services offered by the Operator for the purpose of enabling the Operator to deliver such goods, which includes:
  1. communication with the Operator;
  2. providing users with information on upcoming deliveries of goods offered by the Operator;
  3. providing recipients of goods and services offered by the Operator with consultations on matters related to the delivery of such goods, as well as support for recipients of goods and services offered by the Operator.
To achieve the above-mentioned purposes, the Operator shall process the following personal data of recipients of goods and services offered by the Operator:
  1. surname, first name, and patronymic;
  2. mobile phone number;
  3. email address;
  4. delivery address for goods sold by the Operator;
  5. other information (this list may be expanded or reduced depending on the specific case and purposes of processing).
Processing of Personal Data
⁠
The Operator may process personal data using automated means or without using such means by way of collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, or destruction.
  • The Operator shall be entitled to transfer personal data to third parties or to entrust the processing of personal data to third parties if necessary for achieving the purposes of such processing in accordance with this Policy, as well as in cases provided for by the applicable legislation of the Republic of Kazakhstan on personal data.
  • The Operator shall process personal data for no longer than required to achieve the purposes of such processing, unless a longer period is prescribed by the applicable legislation of the Republic of Kazakhstan on personal data.
Protection of Personal Data
  • The Operator ensures the protection of personal data being processed by implementing legal, organizational, and technical measures that are necessary and sufficient to fulfill the requirements of the legislation of the Republic of Kazakhstan on personal data, including the prevention of unauthorized access, loss, alteration, blocking, copying, dissemination, and other unlawful actions with respect to personal data.
  • The Operator shall not be liable for cases of personal data becoming accessible to third parties as a result of access to the personal account of a registered user caused by the fault or actions (or inaction) of the user.
Registered users shall ensure the confidentiality and security of their login credentials for accessing their personal account and shall bear the risk of consequences resulting from the loss or transfer of such credentials to third parties.
Consent to the Processing of Personal Data and Applicable Disclaimers
The user of the Website voluntarily, by their own will and in their own interest, provides the Operator with their personal data.
By accepting the terms of this Policy, the Website user hereby confirms that the personal data they have provided is accurate. The Operator assumes that the Website user provides accurate personal data and maintains it up to date.
By completing the data fields provided on the Website, the Website user accepts this Policy and gives their consent to the processing of their personal data in the manner and under the conditions specified in this Policy.
If the user of the Website completes data fields in relation to third parties (recipients of goods and services provided by the Operator), the Website user confirms that he/she has obtained their consent to the transfer and processing of their personal data by the Operator. The Website user shall notify such persons of the transfer of their personal data to the Operator and shall bear responsibility for providing the personal data of third parties without their consent.
By accepting the terms of this Policy, the Website user confirms that they are aware of their rights and obligations under the applicable legislation of the Republic of Kazakhstan on personal data, including the right to access their personal data, to request their correction, blocking, or deletion, as well as the right to withdraw consent to their processing.
The processing of personal data shall be terminated upon the achievement of the purposes for which they were collected, the expiration of the consent period, withdrawal of consent by the data subject, or identification of unlawful processing of personal data. The data subject may withdraw their consent to the processing of personal data by sending a written notice to the email address specified on the “Offer” section of the Website.
If the Website user does not intend to provide personal data or does not accept the terms of this Policy, they must stop using the Website, as the Operator will be unable to provide the user with its functional features without processing personal data.
Other Data That May Be Processed
  • The Operator may collect information about users’ visits to the Website without the corresponding information being directly provided by the users themselves.
Such information may be obtained through various methods, tools, and instruments of internet analytics and configuration (including, but not limited to, Cookie files, Yandex.Metrica, and Google Analytics).
The Operator may use such methods, tools, and instruments for the purposes of promoting the goods and services offered by the Operator, providing information about such goods and services by displaying targeted advertising, and improving the usability of the Website by creating profiles of registered users. These methods, tools, and instruments shall not be used to identify unregistered users.
If a Website user does not agree to Cookie files being stored on their device, the user may independently disable this option in the browser settings. Stored Cookies can also be deleted at any time via the browser’s system settings. The Website user may configure the browser settings to accept or reject all Cookies by default, or to accept or reject Cookies from specific websites, including the Website.
Disabling certain Cookie files may result in some sections or functionalities of the Website becoming unavailable.
If the user of the Website does not agree to the use of internet analytics and configuration methods, tools, and instruments, the user must cease using the Website. In such case, the Operator will be unable to provide the user with access to the Website.
Destruction of Personal Data
  • Upon achieving the purposes of processing personal data, upon the expiration of the validity period of the consent to process personal data, or upon the withdrawal of such consent by the data subject, the personal data shall be subject to destruction, unless:
  • otherwise provided for by a contract to which the data subject is a party, beneficiary, or guarantor;
  • otherwise provided for by a separate agreement between the Operator and the data subject.
If the processing of personal data by the Operator is carried out without the use of automation tools, the document confirming the destruction of personal data shall be a Certificate of Destruction of Personal Data.
If the processing of personal data by the Operator is carried out using automation tools, the documents confirming the destruction of personal data shall include the Certificate of Destruction of Personal Data and a corresponding log export from the personal data information system’s event registry.
If the processing of personal data by the Operator is carried out both with and without the use of automation tools, the documents confirming the destruction of personal data shall include both the Certificate of Destruction of Personal Data and a log export from the personal data information system’s event registry.
The Certificate of Destruction of Personal Data and the log export shall be retained for a period of three (3) years from the date of destruction of the personal data.
Final Provisions
10.1. This Policy is subject to amendment or supplementation in the event of relevant changes or additions to the applicable legislation of the Republic of Kazakhstan on personal data and may also be amended at any time at the discretion of the Operator.
The current version of the Operator’s Policy shall always be publicly available for review on the Website.
10.2. All relations involving the Operator that relate to the processing and protection of personal data and are not directly addressed by this Policy shall be governed by the applicable legislation of the Republic of Kazakhstan on personal data.
10.3. Policy last updated: 16.05.2025