PERSONAL DATA PRIVACY POLICY

Pitaya.kz Online Store

Publication Date: August 5, 2026. Revision No. 1

This Personal Data Privacy Policy (hereinafter – the Privacy Policy) is a public Agreement concluded between the owner of the Online Store, Individual Entrepreneur "SALTANAT TECHNIC SOLUTION" represented by Director Nurmagambetova S., acting on the basis of IP Registration Card KZ86TWQ04574376 dated January 29, 2025, and the Buyer in accordance with Article 387 of the Civil Code of the Republic of Kazakhstan, based on the Law of the Republic of Kazakhstan dated May 21, 2013, No. 94-V "On Personal Data and Their Protection," and applies to information containing Buyers' personal data that the online store www.pitaya.kz (hereinafter – the Online Store) may receive about Buyers during their use of the Online Store's website.

1. Definition of Terms

1.1. Personal data — information related to a specific or identifiable personal data subject, recorded on an electronic, paper, and/or other material medium.

1.2. Non-personal data — information automatically transmitted when the Buyer views advertisements and visits pages where a statistical system script is installed: the address of the requested page, cookie information, IP address, browser information, referrer (address of the previous page), access time.

1.3. Collection of personal data — actions aimed at obtaining personal data.

1.4. Processing of personal data — actions aimed at accumulating, storing, modifying, supplementing, using, disseminating, depersonalizing, blocking, and destroying personal data.

1.5. Protection of personal data — a set of measures, including legal, organizational, and technical, implemented for the purposes established by the Law of the Republic of Kazakhstan "On Personal Data and Their Protection."

1.6. Online Store — an Internet site located on a server in Almaty and having the Internet address www.pitaya.kz, which presents goods offered to Buyers for placing Orders, as well as the terms of payment and delivery of these Orders to Buyers.

1.7. Online Store Services — all services available for use on www.pitaya.kz and its subdomains.

1.8. Buyer — a user of the Online Store.

1.9. Seller — Individual Entrepreneur "SALTANAT TECHNIC SOLUTION" represented by Director Nurmagambetova S., acting on the basis of IP Registration Card KZ86TWQ04574376 dated January 29, 2025, who is the owner of the Online Store, IIN 960725401729.

1.10. Cookies — small text files in which the browser stores data from websites visited by Buyers. Cookies perform a number of functions, such as allowing the Buyer to navigate effectively between pages, remembering their preferences, and thereby improving the experience of interacting with the Online Store website. They can also help ensure that the advertisements the Buyer sees online are relevant to their interests. If cookies are not used, it will be impossible to purchase goods in the Online Store, as all shopping cart functionality is built on saving data from these files. For example, if a Buyer selects an item in the Online Store, puts it in the cart, and moves to a new page, that item will simply not be saved in the cart.

1.11. IP address — a unique network address of a node in a computer network built on the IP protocol, which allows determining the Buyer's location. The Online Store does not track location more precisely than city and region.

2. Subject of the Privacy Policy

2.1. This Privacy Policy establishes the Seller's obligations regarding the non-disclosure and protection of the confidentiality of personal data that the Buyer provides at the Seller's request when registering on the Online Store website and/or when placing an order for the purchase of goods.

2.2. Personal data permitted for processing under this Privacy Policy is provided by the Buyer by filling out the registration form on the Online Store website and includes the following information:

2.2.1. Buyer's surname, first name, patronymic (patronymic - optional);

2.2.2. Buyer's contact phone number;

2.2.3. email address;

2.2.4. product delivery address.

2.3. Any other personal information not specified above (purchase history, browsers and operating systems used, etc.) is also subject to secure storage and non-dissemination, except in cases provided for in clauses 4.3.2 and 4.4 of this Privacy Policy.

3. Purposes of Collecting and Processing Buyers' Personal Data

3.1. The Seller collects, processes, and stores only personal data that is necessary for providing Services and/or for the Buyer to purchase Goods from the Online Store catalog.

3.2. The Seller uses the Buyer's personal data for the following purposes:

3.2.1. identification of the Buyer for placing an order and/or concluding a Goods Purchase and Sale Agreement;

3.2.2. processing and receiving payments from the Buyer;

3.2.3. delivering goods to the Buyer;

3.2.4. providing effective customer support to the Buyer;

3.2.5. providing personalized Services to the Buyer;

3.2.6. communicating with the Buyer, including sending notifications, requests, and information related to the use of Services, provision of services, as well as processing requests and applications from the Buyer;

3.2.7. improving the quality of Services, their usability, and developing new Services and offerings;

3.2.8. informing the Buyer about ongoing events and promotions;

3.2.9. conducting statistical and other research based on non-personal data, as well as optimizing advertising messages.

3.3. The Seller is not responsible for information provided by the Buyer on the website in a public form.

3.4. The Seller is not responsible for any losses the Buyer may incur as a result of their login and password becoming known to a third party.

3.5. Bank card details are not collected or stored by the Seller. When paying through the Kaspi service, payment data is processed by Kaspi and is not transmitted to the Seller. When paying by transfer to the Seller's current account, the Buyer's bank card details are also not received by the Seller.

4. Rights and Obligations of the Parties

4.1. The Buyer is obliged to:

4.1.1. provide personal data necessary for using the Online Store;

4.1.2. change, supplement the provided information in case of incorrect data discovered while using the Online Store.

4.2. The Buyer has the right to:

4.2.1. access information about their personal data and edit it through their personal account (if available) or by sending a request to the Seller using the contacts specified in this Policy;

4.2.2. withdraw consent to the processing of personal data by sending a corresponding statement to the Seller. Withdrawal of consent does not apply to processing necessary for the execution of an already placed (paid) order, and to data retention mandatory under the legislation of the Republic of Kazakhstan;

4.2.3. demand the blocking or destruction of their personal data if it is incomplete, outdated, inaccurate, or obtained unlawfully;

4.2.4. refuse to receive promotional and informational messages at any time.

4.3. The Seller is obliged to:

4.3.1. use the received information solely for the purposes specified in Section 3 of this Privacy Policy;

4.3.2. ensure the confidential storage of information, not disclose the transmitted personal data without the Buyer's prior written consent, except for data transfer for the purpose of fulfilling the Buyer's order (to courier services, postal organizations, banks, and payment services, etc.), as well as to authorized state bodies of the Republic of Kazakhstan in the manner established by the legislation of the Republic of Kazakhstan;

4.3.3. take precautions to protect the confidentiality of the Buyer's personal data according to the procedure commonly used to protect such information.

4.4. The Seller has the right to grant access to third parties for the collection and analysis of Buyers' non-personal data for statistical purposes and optimization of advertising messages. The use of non-personal data by third parties is governed by their own privacy policies, and the Online Store is not responsible for their use.

4.5. The Online Store operates on the Shopify platform, which, as a processor, collects and processes technical and non-personal data (cookies, IP address, browser and device information, visited pages) to the extent necessary for the functioning of the Site and basic analytics. Data processing by the platform is governed by Shopify's privacy policy. The Buyer can restrict cookie collection through browser settings.

5. Cross-border Transfer of Personal Data

5.1. For international delivery, the Buyer's personal data (surname, first name, patronymic, delivery address, contact phone number) are transferred to foreign carriers and postal services of the destination country to the extent necessary for delivery and customs clearance, in accordance with Article 16 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection."

5.2. By placing an order with international delivery, the Buyer consents to such cross-border transfer of their personal data.

6. Personal Data Retention Periods

6.1. Personal data is stored for the period necessary to achieve the purposes of processing. Data related to the placement and execution of orders is stored for 5 (five) years from the date of order execution in accordance with the requirements of the tax legislation of the Republic of Kazakhstan. Inquiry data is stored until the inquiry is resolved and for 1 (one) year thereafter.

6.2. Upon expiration of the retention periods, personal data is destroyed or depersonalized.

7. Other Provisions

7.1. The Buyer's use of the Online Store signifies their unconditional agreement with this Privacy Policy and the terms of the Seller's processing of the Buyer's personal data.

7.2. If the Buyer does not agree with the terms of the Privacy Policy, they must stop using the Website and the Online Store.

7.3. This Privacy Policy applies only to the Online Store website www.pitaya.kz and its subdomains. The Online Store is not responsible for third-party websites that the Buyer may access via links available on the Online Store's website.

7.4. Due to the specifics of the method of obtaining information, the Seller does not verify the accuracy of the personal data provided by the Buyer and does not control its relevance. However, the Seller assumes that the Buyer provides accurate personal data and keeps this data up to date. The Buyer bears all responsibility and possible consequences for providing inaccurate or outdated personal data.

7.5. Disabling Cookies may result in the inability to access parts of the Online Store website that require authorization.

7.6. The Online Store collects statistics on the IP addresses of its Buyers. This information is used to identify and resolve technical problems and to monitor the legality of financial payments.

7.7. The current legislation of the Republic of Kazakhstan applies to this Privacy Policy and the relationship between the Buyer and the Seller.

7.8. The Seller reserves the right to unilaterally amend this Privacy Policy to further improve the security system in accordance with the current legislation of the Republic of Kazakhstan. The new version comes into force from the moment of its publication on the Website.

7.9. All suggestions or questions regarding this Privacy Policy should be reported to the address: Almaty, Medeu district, Kabanbai batyr st., 65/76, phone +7 776 608 55 44, e-mail: Pitayakazakhstan@gmail.com.

7.10. The Seller is not responsible for the actions of third parties who, as a result of using the Internet, gained access to information about the Buyer, or for the consequences of using information that is available to any Internet user.