This Policy sets out the procedures for collecting, processing, storing and protecting the personal data of visitors to the Aiziya Interiors website and persons submitting enquiries through the website forms.
VERSION DATED 22 JULY 2026
ASTANA, KAZAKHSTAN
SECTION 01
1.1. This Privacy and Personal Data Processing Policy (hereinafter referred to as the “Policy”) has been developed in accordance with the Constitution of the Republic of Kazakhstan, Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 “On Personal Data and Their Protection” (hereinafter referred to as the “Law”), the Rules for the Collection and Processing of Personal Data, and other applicable regulatory legal acts of the Republic of Kazakhstan.
1.2. This Policy applies to information obtained by Individual Entrepreneur “Abdurasilova” (IE “Abdurasilova”) from individuals when they use the website aiziya.com, its pages, contact forms and other communication channels associated with the website (hereinafter referred to as the “Website”).
1.3. The owner and operator of the database containing personal data is IE “Abdurasilova”, IIN 940930450232, represented by Shayakhmetova Aiziya Zhanuzaqqyzy, acting under Certificate of State Registration as an Individual Entrepreneur, Series 6202 No. 0006970 dated 9 July 2014 (hereinafter referred to as the “Operator”).
1.4. A personal data subject is an individual to whom the personal data relates, including a Website visitor, an applicant, or a prospective or existing client of the Operator (hereinafter referred to as the “Data Subject”).
1.5. Use of the Website without submitting a form does not require the provision of a name, telephone number or email address. The Website may nevertheless automatically receive a limited amount of technical information required for its secure and proper operation.
1.6. This Policy is publicly available and is published on the Website. The Operator may amend the Policy in response to changes in legislation, services or data-processing operations. A revised version becomes effective upon publication on the Website unless it specifies a different effective date.
SECTION 02
The Operator may collect and process the following information:
The following information may be processed automatically when the Website is visited:
Cookies are used to maintain the operation of the Website, retain technical settings, protect forms against misuse and, where relevant services are enabled, obtain anonymised website-traffic statistics. Optional analytics or marketing cookies are used only where the Data Subject has provided the consent required by law.
The Data Subject may restrict or delete cookies through browser settings. Disabling essential cookies may cause certain Website functions to operate incorrectly.
The Operator does not request special, biometric or other sensitive categories of personal data through the Website forms. The Data Subject should not submit information concerning health, religious or political beliefs, banking details, identity documents or information about third parties unless required for a separate contractual relationship and agreed with the Operator.
SECTION 03
The Operator collects and processes personal data solely to the extent necessary for the following lawful and predetermined purposes:
The Operator does not use personal data for purposes incompatible with those stated in this Policy. Advertising and marketing communications are sent only with separate consent where such consent is required by law.
SECTION 04
4.1. Personal data processing includes collection, recording, organisation, accumulation, storage, clarification, alteration, supplementation, use, disclosure in the cases provided for by this Policy and law, anonymisation, blocking and destruction of data.
4.2. Processing is carried out by automated and non-automated means, on paper and electronic media, in accordance with the principles of lawfulness, confidentiality, purpose limitation, data minimisation and accuracy.
4.3. All personal data databases used by the Operator to operate the Website and process enquiries, including primary databases and their backup copies, are stored on servers physically located within the territory of the Republic of Kazakhstan. The Operator also requires its hosting providers and technical contractors to comply with this requirement.
4.4. The retention period for personal data is determined by fulfilment of the purposes for which it was collected and processed, unless a longer period is required by the laws of the Republic of Kazakhstan or is necessary to perform or evidence contractual obligations.
4.5. Once the purposes of processing have been achieved, the applicable retention period has expired, or a valid withdrawal of consent has been received, processing shall cease and the data shall be blocked, anonymised or destroyed in accordance with the procedures and time limits established by the laws of the Republic of Kazakhstan, unless another lawful basis for retention applies.
4.6. The Operator implements necessary legal, organisational and technical safeguards, including access controls, user accounts and passwords, backups, software updates, protection of communication channels, event logging, restriction of the persons granted access and confidentiality obligations for such persons.
4.7. The Operator does not make decisions producing legal effects for the Data Subject, or otherwise significantly affecting the Data Subject’s rights, solely on the basis of automated data processing.
SECTION 05
5.1. Before submitting a form, the Data Subject is provided with a link to this Policy and a separate consent checkbox that is not pre-selected. By selecting the consent checkbox and clicking the form submission button, the Data Subject confirms that they have read this Policy and gives the Operator freely given, specific, informed and unambiguous consent to collect and process the personal data provided.
5.2. Consent covers the personal data listed in Section 2, the processing operations described in Section 4, the purposes stated in Section 3 and disclosure to authorised third parties subject to the conditions of Section 6 of this Policy.
5.3. Consent remains valid until the earliest of the following events:
5.4. The duration of consent may not exceed the period objectively required to achieve the stated processing purposes unless otherwise provided by the laws of the Republic of Kazakhstan.
5.5. The Data Subject may withdraw consent by sending an email to interiors@aiziya.com. The request should state the name, contact details used in the enquiry and clearly describe the requested action. The Operator may request additional information necessary to verify the applicant’s identity and confirm that the data relates to them.
5.6. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received and does not terminate processing where it is permitted without consent or is required to comply with law or fulfil an outstanding obligation.
SECTION 06
6.1. The Operator maintains the confidentiality of personal data and does not publish, sell or disclose it to the general public, except where expressly permitted by this Policy, the Data Subject’s consent or the laws of the Republic of Kazakhstan.
Personal data may be disclosed to:
6.2. Third parties are granted access only to the minimum amount of data necessary and must use it solely for agreed purposes and ensure its confidentiality, security and storage in accordance with the laws of the Republic of Kazakhstan.
6.3. Cross-border transfer of personal data is carried out only where there is a lawful basis, the required consent of the Data Subject and compliance with Article 16 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”. The Operator does not conduct cross-border transfers where these conditions are not met.
SECTION 07
The Data Subject has the right to:
To exercise these rights, the Data Subject shall send a request to interiors@aiziya.com. The Operator will review the request after the applicant’s identity has been sufficiently verified and will respond or fulfil the request in accordance with the procedures and time limits established by the laws of the Republic of Kazakhstan.
Where a request cannot be fulfilled in full, the Operator will provide a reasoned response stating the lawful grounds for refusal or restriction.
SECTION 08
Enquiries concerning privacy, personal data protection, amendment or deletion of data, or withdrawal of consent should be sent to the Operator using the details below.
OPERATOR
Individual Entrepreneur “Abdurasilova”
IIN
940930450232
REPRESENTATIVE
Shayakhmetova Aiziya Zhanuzaqqyzy
ADDRESS
5 A. Baitursynuly Street, Astana, Kazakhstan
WEBSITE
This version remains effective until replaced by a new version published on the Website.
