Privacy and Personal Data Protection Policy

1. The User gives unconditional consent (no separate consent is required beyond this consent) for the Site Owner to provide to authorised bodies and to third parties whose interests are affected by the User, information relating to the User's actions on the Site's pages, solely in the cases and in the manner provided for by the applicable laws of the Republic of Kazakhstan.

2. In concluding this User Agreement, for the purposes of enabling the User to use the Site and of developing and improving the Site's functionality, the User gives unconditional consent to the Site Owner:

1. to collect the User's Personal data from all sources;
2. to process Personal data (including by affiliates and Partners) at its own discretion by any means not contrary to the laws of the Republic of Kazakhstan;
3. to transfer, including across borders, Personal data to Partners and affiliates;
4. to other rights in respect of Personal data that may be set out in this Privacy Policy.

3. Categories of Users' personal data collected, stored, processed and disseminated by the Site Owner:

1. surname, given name, patronymic;
2. individual identification number;
3. the User's contact telephone number;
4. email address;
5. consent to the collection, processing, storage and other handling of personal data by the Site Owner, and the period for which that consent is valid;
6. permission for the Site Owner to transfer personal data to third parties in the cases set out in the User Agreement;
7. permission for the Site Owner to carry out cross-border transfer of personal data in the course of processing, in the cases set out in the User Agreement;
8. permission for the Site Owner to disseminate personal data in publicly available sources and in the other cases set out in the User Agreement;
9. consent to news mailings and notifications;
10. date of birth.

4. The User's personal data is collected and processed for the following purposes:

1. providing access to the Site's content and functionality;
2. identifying the User and fulfilling the User's Orders;
3. interacting with the User;
4. sending the User advertising materials, information and enquiries;
5. conducting statistical and other research;
6. improving the quality of service to Users;
7. ensuring compliance with the User Agreement;
8. providing access to the content and functionality of third-party sites/software to which the User is redirected;
9. enabling the User's visits to be recorded;
10. organising the operation of the bonus programme.

When the Services are used, the Site may collect and process data provided by the User, including mobile telephone number and email address, as well as IP address, geolocation information, search query history, the date and time of visits, available cookies, browser and operating system information, and other data provided by the User such as: avatar (nickname) — an image posted by the User — name, date of birth, consents and confirmations of the User's access rights, and other data necessary to achieve the purposes of collection and processing stated above.

If the User does not wish their personal data to be processed, they must write to info@bestee.kz. All information received from the User (including login and password) is then deleted from the Seller's customer database.

To stop the processing of all User data, the Personal account must be deleted, since without such data the relevant functionality cannot properly be used. The User deletes the Personal account independently using the Site's functionality. Deletion of the Personal account may be unavailable where the User has active deliveries, or where the online store suspects a breach of the terms of the Offer, including suspicion of fraudulent or other unlawful acts.

5. Data provided by the User must be accurate and current and must not breach the laws of the Republic of Kazakhstan or the rights of third parties. The User is responsible for the compliance of User data with the requirements set out in the Agreement and must update User data in the Personal account as necessary.

6. The User is prohibited from entering third parties' personal data on the Site (except where representing the interests of those persons and holding documentary confirmation from them permitting such actions).

7. The Site Owner undertakes to use Personal data in accordance with the laws of the Republic of Kazakhstan and the Site's internal documents. Personal data and the User's other Data are kept confidential, except where such data is publicly available. The Site Owner may keep an archival copy of Personal data.

The Site Owner notifies the User no later than 10 business days:

1. of actions taken with their personal data (viewing, modification, supplementation, transfer to a third party, blocking, destruction);
2. of third-party access to their personal data;
3. of modification and/or supplementation of personal data on the basis of the User's application (request);
4. of dissemination of personal data;
5. of destruction of personal data (on expiry of the storage period; on termination of the legal relationship; on a court judgment taking legal effect; on discovery that personal data was collected and processed without the User's consent).

At the User's request, the Site Owner, within one business day:

1. makes changes and additions to personal data;
2. blocks personal data where there is information about a breach of the conditions for collecting and processing personal data, and lifts the block where the breach is not confirmed;
3. destroys personal data;
4. ceases processing personal data where the User withdraws consent to the collection, processing, dissemination in publicly available sources, or transfer to third parties of personal data;
5. processes requests for the provision of information;
6. anonymises personal data so as to exclude the possibility of reconstructing the original personal data (at the User's expense), and likewise when collecting and processing personal data for statistical, sociological, scientific and marketing research.

8. The Site Owner provides proper protection of Personal and other data in accordance with the law and takes the necessary and sufficient organisational and technical measures to protect Personal data. The protective measures applied make it possible, among other things, to protect Personal data against unlawful or accidental access, destruction, modification, blocking, copying and dissemination, and against other unlawful acts of third parties in respect of it.

The Site's capabilities provide for:

1. prevention of unauthorised access to personal data;
2. timely detection of unauthorised access to personal data where such access could not be prevented;
3. minimisation of the adverse consequences of unauthorised access to personal data;
4. provision of access to the state technical service for the purpose of inspecting the security of the processes of storing, processing and disseminating restricted-access personal data;
5. registration and recording of the above actions.

From the moment a personal data security breach is discovered, the Site Owner automatically sends notice of that breach to the authorised body, stating the contact details of the person responsible for organising the processing of personal data.

9. Processing of the User's personal and other data may be carried out by mixed processing (automated as well as without the use of automation) by the following possible means: recording (including on electronic media), systematisation, accumulation, storage, compilation of lists, labelling, refinement (updating, modification, supplementation), extraction, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion, destruction, obtaining an image by photography, and the performance of any other actions with the User's personal and other data not expressly prohibited by law.

10. The Site Owner undertakes not to disclose information received from the User. It is not a breach to provide information to agents and third parties acting under contract with the Site Owner in order to perform obligations to the User. Nor is it a breach of obligations to disclose information in accordance with justified and applicable requirements of the laws of the RK.

Should the Seller suspect that a User's account is being used by a third party or by malicious software, the Site Owner may unilaterally change the User's password and inform the User accordingly.

11. The User understands and agrees that, for the purposes provided for in this Offer, their personal data may be transferred across borders to the territory of the Republic of Korea to K-Beauty X Co., Ltd., Republic of Korea, Seoul, Gangnam district, Bongeunsa-ro 317, 2nd floor, office 2451, which is registered and operates in the Republic of Korea, being a country that provides protection of personal data, namely: regulatory legal acts determining the manner of protecting personal data have been adopted; civil, criminal, administrative and disciplinary liability for breach of personal data legislation is provided for; and an authorised state body for supervising observance of the rights of personal data subjects has been designated (part 2 of Article 16 of the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V “On personal data and its protection”).

12. The Buyer understands and agrees that, where Orders are placed for Goods subject to customs clearance on import into the RK, in accordance with statutory requirements including at the demand of authorised bodies, personal and other necessary data may be processed, including: full name, date of birth, citizenship, sex; identity document data, tax identifier, telephone number, delivery addresses, data on Goods and Orders, as well as transfer of such data to the Site Owner's partners.

13. Personal data is stored by the Site Owner in the territory of the Republic of Kazakhstan for the period necessary to achieve the purpose of its collection and processing under the User Agreement, and for three years after that User Agreement ceases to have effect, unless a shorter period is set by any applicable law.

14. The User may withdraw their consent to the collection and processing of Personal data. Withdrawal of consent may result in suspension or termination of the User Agreement. To withdraw consent the User must submit a written application to info@bestee.kz

15. Users' personal data is confidential information and is protected by the laws of the Republic of Kazakhstan.

16. The Site Owner and its partners have modern technologies and internal procedures and take all actions aimed at protecting Personal data against outside interference and unauthorised attempts to access, modify, disclose or destroy information. The Site Owner ensures that a contract is in place with each of its Partners, in the form provided for by the laws of the Republic of Kazakhstan, providing for the confidentiality of information, including Users' personal data.

The Services protect data transmitted between the User and the Services over the Internet using the secure HTTPS protocol and the TLS v1.2 cryptographic protocol.

Access to Users' Personal data is granted only to the Site Administration for the performance of their official duties.

All Site employees and other persons working with Personal data sign an undertaking of non-disclosure of confidential information and are warned of possible disciplinary, administrative, civil and criminal liability for breaching the norms and requirements of the applicable laws of the Republic of Kazakhstan on the processing of Personal data.

In order to perform the User Agreement and improve the user experience of the Services, the Site develops, improves, optimises and introduces new Service functionality (including informational, educational, entertainment and other services and products), including with the involvement of affiliates and Partners. To enable those purposes, the User agrees and permits the Site to process the User's Personal data in compliance with applicable law, including the results of automated processing of such data, including in the form of integer and/or text values and identifiers, and to transfer it to affiliates and/or Partners in performance of that consent to processing, including cross-border transfer.

The Site Administration (Administrator) acts as the person responsible for organising the processing of personal data, and that person:

1. exercises internal control over compliance with the laws of the Republic of Kazakhstan on personal data and its protection, including requirements for the protection of personal data;
2. informs other Site employees of the provisions of the laws of the Republic of Kazakhstan on personal data and its protection concerning the processing of personal data, and of the requirements for protecting personal data;
3. monitors the receipt and handling of enquiries from Users and/or their legal representatives.

The Site Administrator regularly analyses the tasks performed with regard to the use of personal data, on the basis of which a Register of personal data is compiled and thereafter amended as necessary. The Register is kept in columns: sequence number; name of the task, including functions, powers and duties; purposes of collection and processing within the task performed; names of the personal data for the given purpose; reference to the documents or regulatory legal acts that directly govern the tasks performed by the owner and/or operator.

The Site automatically records, prepares and carries out:

1. information security incidents — individual or serial operational failures that create a threat to proper functioning and/or conditions for the unlawful obtaining, copying, dissemination, modification, destruction or blocking of the Site's information resources;
2. information security threats — the set of conditions and factors creating the preconditions for an information security incident;
3. continuous monitoring of information security events — ongoing observation to detect and identify information security events, with regular reporting on the results;
4. information security events — the state of informatisation objects indicating a possible breach of the existing security policy or a previously unknown situation that may bear on the Site's security.

17. Where Personal data is provided to third parties, the Site takes all permissible measures to protect it against unauthorised use and undertakes to use it in accordance with the provisions of this Agreement and the laws of the Republic of Kazakhstan. The Site upholds Users' right to non-interference in their private life, and accordingly no third parties, including Partners, receive information about Users' correspondence.

Notwithstanding the above, the User understands that their data is transmitted over the Internet and that the Site Owner does not guarantee the security of data transmitted by the User, unauthorised access to which may be obtained by third parties as a result of unlawful acts. Accordingly, any transfer of data is made by the User at their own risk, and the Site Owner is not liable in connection with a leak of data or part of it or with any resulting damage to the User.

18. If the User does not agree with the terms of this Privacy Policy, they must stop using the Site. Unconditional acceptance of this Privacy Policy is the User's commencement of use of the Site.