Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") is developed in accordance with the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan dated May 21, 2013, No. 94-V "On Personal Data and Their Protection" (as amended), and regulates the procedure for the collection, processing, storage, and protection of personal data of users of the website itakeli.kz (hereinafter referred to as the "Website").

The Policy applies to all persons who visit the Website, create a personal account, place orders, participate in loyalty programs, or otherwise use the Restaurant's services through the web version and other interfaces (including mobile devices).

By using the Website, creating a personal account, placing an order, and/or providing personal data, the user (hereinafter referred to as the "User") confirms that they have read this Policy and agree to its terms.

In cases provided for by law, consent may be formalized separately (including by checking a box, accepting an offer, entering a confirmation code, etc.).

OPERATOR AND REQUISITES

1.1. Processing of Users' personal data is carried out by:

Individual Entrepreneur ZHUMALEEVA ALYONA VLADIMIROVNA
IIN/BIN: 841125450307
Registration address: Republic of Kazakhstan, Petropavlovsk, Mira Str., 282, apt/office 2
Establishment (restaurant) address: Republic of Kazakhstan, Petropavlovsk, Pavla Vasilyeva Str., 61, 1st floor

1.2. The Operator is the owner and/or holder of personal data databases formed during the use of the Website, ordering and delivery, participation in loyalty programs, and other services of the Restaurant.

1.3. This Policy defines:

• categories of personal data being processed;
• purposes and legal grounds for processing personal data;
• procedure for storage, transfer, and protection of personal data;
• rights and obligations of the personal data subject and the Operator;
• procedure for making changes to the Policy.

TERMS AND LEGAL GROUNDS

2.1. Personal data — information relating to an identified or identifiable natural person (personal data subject), including surname, first name, contact details, delivery address, as well as other data necessary for the provision of services by the Restaurant.

2.2. Personal data processing — any action (operation) or set of actions (operations) performed with personal data using automation tools or without them, including but not limited to: collection, recording, systematization, accumulation, storage, alteration, supplementation, use, distribution, depersonalization, blocking, and destruction of personal data.

2.3. Personal data subject (User) — a natural person who uses the Website, creates a personal account, places an order, participates in loyalty programs, and/or otherwise interacts with the Restaurant and provides their personal data to the Operator.

2.4. The Operator processes Users' personal data on the following legal grounds:

• consent of the personal data subject to the processing of their personal data;
• necessity of processing personal data for the conclusion and (or) execution of a contract to which the personal data subject is a party or beneficiary (including retail sale, delivery, and other related services contracts);
• compliance with the requirements of the legislation of the Republic of Kazakhstan;
• exercise of the rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the personal data subject are not violated.

2.5. In cases where personal data processing is based on separate consent, the Operator requests such consent in the form provided for by law, including in electronic form.

CATEGORIES OF PROCESSED PERSONAL DATA

3.1. The Operator processes the following categories of Users' personal data:

3.1.1. Identification data

• surname, first name (patronymic if available);
• phone number;
• email address (e-mail);
• account data (login, User ID in the system, profile ID);
• data obtained during authorization through third-party services (e.g., Google account) within the scope provided by the settings of these services and agreed upon by the User.

3.1.2. Delivery and service data

• delivery address(es) (city, street, house, apartment/office, entrance, landmarks, and other clarifications);
• order comments;
• preferred pickup points (if available);
• User order history.

3.1.3. Order and payment data

• information about ordered goods and dishes (name, quantity, price);
• information about applied discounts, promotions, promo codes, bonuses;
• total order amount, currency of calculations;
• information about the chosen payment method (without storing bank card details);
• data on order statuses, delivery, and fulfillment of obligations.

3.1.4. Loyalty program and integration data

• User bonus balance, history of accrual and deduction of bonuses;
• client identifier in accounting and loyalty systems (including R-Keeper, Prime Hill, and other integrated systems);
• data on the User's participation in promotions and special offers.

3.1.5. Technical and analytical data

• IP address, browser and operating system data;
• information about cookies and similar technologies;
• session data (visit time, duration, page navigation routes);
• device data (device type, model, OS version, interface language, screen resolution);
• other technical data automatically transmitted by the User's software when using the Website.

3.2. The Operator does not process or store:

• full bank card details of the User;
• CVV/CVC codes, PIN codes, and other confidential payment data.

The processing of such data is carried out by payment organizations and payment services (including Kaspi Pay, Halyk Pay, and other similar systems) in accordance with their own rules and privacy policies.

3.3. The Operator does not request or process special categories of personal data (information about racial and ethnic origin, political opinions, religious or philosophical beliefs, health status, private life, etc.), except in cases directly provided for by the legislation of the Republic of Kazakhstan.

PURPOSES OF PERSONAL DATA PROCESSING

4.1. Personal data are processed by the Operator exclusively for the following purposes:

1. Registration, maintenance, and support of the User's personal account on the Website, ensuring access to its functionality.
2. Registration, processing, and execution of orders, including: receiving orders through the Website; formation and accounting of orders in accounting systems (including R-Keeper); assembly of orders and transfer of information to the kitchen/production; organization of pickup or delivery.
3. Organization of order delivery, including the transfer of necessary data to courier and logistics services (Yandex Couriers (Yandex Go) and other delivery partners — when connected).
4. Implementation of loyalty programs, promotions, and special offers, including: maintaining bonus accounts; accrual and deduction of bonuses; providing discounts and personalized offers; calculation of the maximum allowable deduction and predicted accrual of bonuses.
5. Informing the User about the order status, promotions, and Restaurant services, including via: SMS messages; e-mail newsletters; messages in instant messengers and push notifications; phone calls from Restaurant employees.
6. Ensuring the functioning and improving the Website's operation, conducting analytics and statistical studies of User behavior, improving the interface and quality of service.
7. Ensuring information and financial security, preventing fraud and unlawful actions, protecting the rights and legitimate interests of the Operator and Users.
8. Compliance with the requirements of the legislation of the Republic of Kazakhstan, including maintaining accounting, tax, and statistical records, as well as fulfilling requests from state authorities within their competence.

COOKIES AND SIMILAR TECHNOLOGIES

5.1. The Website uses cookies and similar technologies (including local storage) to ensure the correct operation of the Website, save User settings, and improve the quality of service.

5.2. Cookies may be used for:

• identifying the User and maintaining a session in the personal account;
• saving the selected interface language and other settings;
• ensuring the correct operation of the cart and order forms;
• analyzing website visit and usage statistics.

5.3. The User has the right to restrict or prohibit the use of cookies in their browser settings.

However, it should be noted that disabling or blocking cookies may lead to incorrect operation of certain Website functions.

TRANSFER OF PERSONAL DATA TO THIRD PARTIES

6.1. The Operator has the right to transfer personal data to third parties to the extent necessary to achieve the processing purposes specified in Section 4 of this Policy, including:

• order accounting and restaurant business systems (including R-Keeper);
• loyalty and order aggregation systems (including Prime Hill);
• payment organizations and payment services (Kaspi Pay, Halyk Pay, and other connected services);
• courier and logistics services (including Yandex Couriers (Yandex Go) and other delivery partners);
• SMS, email, and messenger service providers;
• hosting providers, IT infrastructure providers, and web analytics services.

6.2. Transfer of personal data to these persons is carried out provided they comply with the requirements of the legislation of the Republic of Kazakhstan on personal data and their protection, and based on contracts and/or User consents when required.

6.3. The Operator does not transfer personal data to third parties for their own marketing purposes, except in cases where separate User consent is obtained.

STORAGE AND PROTECTION OF PERSONAL DATA

7.1. Personal data is stored in electronic form in the information systems of the Operator and/or its authorized contractors (hosting providers, IT infrastructure providers, accounting systems, etc.).

7.2. The Operator takes necessary organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, provision, distribution, as well as from other unlawful actions, including:

• restricting access to personal data on a "need-to-know" basis;
• using secure communication channels (including HTTPS protocol);
• applying anti-virus protection and access control tools;
• regular monitoring and analysis of information security incidents;
• training employees who have access to personal data on the rules of their processing and protection.

7.3. In cases provided for by the legislation of the Republic of Kazakhstan, the Operator notifies the authorized body of personal data security breaches.

7.4. The Operator is not responsible for personal data leaks occurring due to the User's own actions, including unauthorized access by third parties to the User's devices and/or accounts, use of insecure devices and communication networks, disclosure of login and password, etc.

USER RIGHTS (PERSONAL DATA SUBJECT)

8.1. The User as a personal data subject has the rights provided for by the legislation of the Republic of Kazakhstan, including the right to:

• receive information about the Operator's possession of their personal data, their composition and sources of acquisition, purposes, and methods of processing;
• request clarification, updating, or modification of their personal data if they are incomplete, outdated, or inaccurate;
• request blocking or destruction of their personal data if they are processed in violation of the legislation;
• withdraw their consent to the processing of personal data (if processing is based on consent), except in cases where processing is mandatory by law;
• object to the processing of personal data in cases provided for by law;
• apply with requests to the Operator, as well as to the authorized body for personal data protection and/or to the court to protect their rights.

8.2. To exercise their rights, the User may send an inquiry to the Operator using the contacts specified in Section 12 of this Policy. The Operator considers such inquiries within the timeframes and in the manner provided for by the legislation of the Republic of Kazakhstan.

RETENTION PERIODS AND DESTRUCTION OF PERSONAL DATA

9.1. Personal data is stored by the Operator until the processing purposes specified in Section 4 of this Policy are achieved, or until the moment of consent withdrawal by the User (if processing is based on consent), unless other retention periods are established by the legislation of the Republic of Kazakhstan.

9.2. Data necessary for accounting, tax, and other mandatory records are stored within the timeframes established by the legislation of the Republic of Kazakhstan.

9.3. Upon achieving the processing purposes or expiration of established retention periods, personal data are subject to destruction or depersonalization in the manner provided for by the legislation of the Republic of Kazakhstan and internal documents of the Operator.

CROSS-BORDER TRANSFER OF PERSONAL DATA

10.1. In certain cases, when using external IT services, payment systems, delivery services, and analytics, cross-border transfer of personal data to the territory of foreign states may occur.

10.2. Cross-border transfer of personal data is carried out by the Operator in compliance with the requirements of the legislation of the Republic of Kazakhstan, including restrictions established in relation to countries that do not ensure adequate protection of the rights of personal data subjects, and, if necessary, based on separate User consent.

10.3. The Operator takes reasonable measures to ensure proper protection of personal data during its cross-border transfer, including concluding contracts with data recipients and applying necessary organizational and technical protection measures.

POLICY MODIFICATION

11.1. The Operator has the right to unilaterally make changes and additions to this Policy within the framework of the current legislation of the Republic of Kazakhstan.

11.2. The current version of the Policy is always available on the Website at: itakeli.kz. When significant changes are made to the Policy, the Operator may additionally notify Users by any available means (e.g., by posting a notice on the Website, sending messages, etc.).

11.3. Continued use of the Website after the entry into force of the new version of the Policy means the User's agreement with such version.

OPERATOR CONTACT DATA

12.1. For questions related to the processing and protection of personal data, as well as for the exercise of their rights, the User may contact the Operator:

Individual Entrepreneur ZHUMALEEVA ALYONA VLADIMIROVNA
📞Phone: +7 (707) 711-69-95📍Establishment address: Republic of Kazakhstan, Petropavlovsk, Pavla Vasilyeva Str., 61, 1st floor🌐Website: itakeli.kz