Privacy and Personal Data Protection Policy

1. The User gives unconditional consent (no separate consent is required other than this consent) to the provision to authorised bodies and to third parties whose interests will be affected by the User of information related to his/her actions on the pages of the "Bestee" marketplace, exclusively in the cases and in the manner provided for by applicable law.
2. By entering into this User Agreement, for the purposes of enabling the User to use the "Bestee" marketplace and of developing and improving its functionality, the User gives unconditional consent: 1) to the collection of the User's personal data from all sources; 2) to their processing by any means not contrary to applicable law; 3) to the transfer, including cross-border transfer, of personal data; 4) other rights in respect of personal data that may be specified in this Privacy Policy.
3. Categories of Users' personal data collected, stored, processed and disseminated:

1. Surname, first name, patronymic;
2. individual identification number;
3. the User's contact telephone number;
4. email address (e-mail);

6. consent to the collection, processing, storage and other actions with personal data and indication of the term (period) during which the consent is valid;
7. permission to transfer personal data to third parties in cases necessary for the performance of the User Agreement and/or in the cases specified therein;
8. permission to carry out cross-border transfer of personal data in cases necessary for the performance of the User Agreement and/or in the cases specified therein;
9. permission to disseminate personal data in publicly available sources and in other cases specified in the User Agreement;
10. permission to send news and notifications;
11. date of birth.

The said personal data and consents of the User are provided by the User upon registration on the "Bestee" marketplace.

Personal data under this Policy and this Agreement do not include data on the collection, processing and storage of Users' payment data (card numbers, CVC/CVV, bank accounts, other), which are carried out by financial/payment organisations/banks whose services are integrated into the "Bestee" marketplace for the purpose of receiving payments for Goods directly from Users to the Seller. The "Bestee" marketplace receives only the result of the transaction: "successfully completed / not completed (declined)" and has no access to the details of Users' bank cards, and is also not responsible for the security of the communication channels and information systems of the said financial/payment organisations/banks. The functionality of the "Bestee" marketplace does not include a logging function (recording of Users' actions) whereby card numbers and other payment data are recorded in text files (logs) on the server.

4. The collection and processing of the User's personal data is carried out for the following purposes: 1) providing access to the content and functionality of the "Bestee" marketplace; 2) identifying the User and fulfilling the User's Orders; 3) interacting with the User; 4) sending the User advertising materials, information and requests; 5) conducting statistical and other research; 5) improving the quality of service to Users; 6) ensuring compliance with the User Agreement; 7) providing access to the content and functionality of third-party websites/software to which redirection occurs; 8) providing the User with the ability to record the User's attendance; 9) organising the operation of the bonus programme.

The "Bestee" marketplace may collect and process data provided by the User, including mobile telephone number and email address, as well as IP address, geolocation information, search query history, date and time of visits, as well as available "cookies", browser and operating system information, and other data provided by the User, such as: Avatar (Nickname) (an image posted by the User), name, date of birth, the User's consents and confirmations of access rights, and other data necessary to achieve the purposes of collection and processing specified above.

If the User does not wish his/her personal data to be processed, he/she must write to the email address support@bestee.kz. In such a case, the User's account becomes inactive.

5. The data provided by the User must be accurate and up to date and must not violate applicable law, this Agreement and/or the rights of third parties. The User is responsible for the compliance of the User Data with the requirements specified in the Agreement and is obliged to update the User Data in the Personal Account as necessary.
6. The User is prohibited from providing personal data of third parties.
7. The "Bestee" Marketplace Owner and the Seller undertake to use personal data in accordance with applicable law and this Agreement. The confidentiality of personal data and other data of the User is maintained, except where such data are publicly available. The "Bestee" Marketplace Owner has the right to keep an archive copy of personal data.

The "Bestee" Marketplace (Online Platform) Owner shall notify the User no later than within 10 business days: 1) of actions with his/her personal data (viewing, modification, supplementation, transfer to a third party, blocking, destruction); 2) of access by third parties to his/her personal data; 3) of and/or supplementation of personal data on the basis of the User's application (request); 4) of the dissemination of personal data; 5) of the destruction of personal data (upon expiry of the storage period; upon termination of legal relations; upon entry into legal force of a court decision; upon detection of the collection and processing of personal data without the User's consent).

The "Bestee" Marketplace Owner, at the User's request, within one business day: 1) makes amendments and additions to personal data; 2) blocks personal data if there is information on a violation of the conditions for the collection and processing of personal data, and lifts the blocking if the fact of a violation of the conditions for the collection and processing of personal data is not confirmed; 3) ceases the processing of personal data upon receipt from the User of a withdrawal of consent to the collection, processing, dissemination in publicly available sources or transfer to third parties of personal data; 4) processes requests for the provision of information; 5) depersonalises personal data in such a way as to exclude the possibility of reverse recovery of the original personal data (at the User's expense), and also when collecting and processing personal data for statistical, sociological, scientific and marketing research.

8. The "Bestee" Marketplace Owner provides proper protection of personal and other data in accordance with applicable law and takes the necessary and sufficient organisational and technical measures to protect personal data. The protection measures applied, among other things, make it possible to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying and dissemination, as well as from other unlawful actions of third parties with them.

The capabilities of the "Bestee" marketplace ensure: 1) prevention of unauthorised access to personal data; 2) timely detection of unauthorised access to personal data, if such unauthorised access could not be prevented; 3) minimisation of the adverse consequences of unauthorised access to personal data; 4) provision of access to the state technical service of the Republic of Kazakhstan and to authorised bodies for the purpose of examining the security of the processes of storage, processing and dissemination of restricted-access personal data; 5) registration and recording of the above actions.

The "Bestee" Marketplace Owner, from the moment a breach of personal data security is detected, automatically sends a notification of such breach to the authorised body, indicating the contact details of the person responsible for organising the processing of personal data.

9. The processing of the User's personal and other data may be carried out by mixed processing (automated, as well as without the use of automation tools) by the following possible methods: recording (including on electronic media), systematisation, accumulation, storage, compilation of lists, marking, clarification (updating, modification, supplementation), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion, destruction, obtaining an image by photographing, as well as performing any other actions with the User's personal and other data not expressly prohibited by applicable law.
10. The "Bestee" Marketplace Owner and the Seller undertake not to disclose information received from the User. The provision of information to their counterparties and to third parties acting on the basis of a contract with the "Bestee" Marketplace Owner or the Seller, for the performance of obligations to the User, shall not be considered a violation. Disclosure of information in accordance with the reasonable requirements of applicable law shall not be considered a violation of obligations.

If there are suspicions regarding the use of the User's account by a third party or by malicious software, the "Bestee" Marketplace Owner may unilaterally change the User's password and notify the User thereof.

11. The User understands and agrees that, for the purposes provided for by this Agreement, his/her personal data may be transferred across borders to the territory of other countries, both countries that ensure an adequate level of personal data protection (regulatory legal acts determining the procedure for the protection of personal data have been adopted; civil, criminal, administrative and disciplinary liability for violation of the legislation on personal data is provided for; an authorised state body for supervision of compliance with the rights of personal data subjects has been designated) and countries that are not among the countries ensuring an adequate level of personal data protection.
12. The User understands and agrees that, in the case of placing orders for Goods that are subject to customs clearance upon importation into the Republic of Kazakhstan/other EAEU countries/Uzbekistan, in accordance with the requirements of applicable law, including at the request of authorised bodies, processing of personal and other necessary data may be carried out, including: full name, date of birth, citizenship, sex; details of identity documents, tax identifier, telephone number, delivery addresses, data on Goods and orders, as well as the transfer of such data to partners of the "Bestee" Marketplace Owner and/or the Seller.
13. Personal data are stored by the "Bestee" Marketplace (Online Platform) Owner in the territory of the Republic of Kazakhstan for the period necessary to achieve the purpose of their collection and processing under the User Agreement and for three years after the termination of the said User Agreement.
14. The "Bestee" Marketplace Owner, the Seller and their partners possess modern technologies and internal procedures and take all actions aimed at protecting personal data from outside interference, unauthorised attempts to access information, and its modification, disclosure or destruction. The "Bestee" Marketplace Owner and the Seller ensure that a contract is in place with each of their Partners, in the form provided for by applicable law, providing for the confidentiality of information, including Users' personal data.

The Services ensure the protection of data transmitted between the User and the Services over the internet via the secure HTTPS protocol, using the TLS v1.2 cryptographic protocol.

Access to Users' Personal Data is granted only to authorised employees of the "Bestee" Marketplace (Online Platform) Owner and the Seller.

All employees of the "Bestee" marketplace (online platform) and the Seller who work with personal data sign an undertaking not to disclose confidential information and are warned of possible disciplinary, administrative, civil and criminal liability in the event of violation of the rules and requirements of applicable law in the field of personal data processing.

For the purposes of performing the User Agreement and improving the user experience of using the Services, the "Bestee" Marketplace Owner develops, improves, optimises and implements new functionality of the Services (including services and products of an informational, educational, entertainment and other nature), including with the involvement of affiliates and Partners. To ensure the achievement of these purposes, the User agrees to and permits the "Bestee" Marketplace Owner to carry out, in compliance with applicable law, the processing of the User's personal data, including the results of automated processing of such data, including in the form of integer and/or text values and identifiers, and their transfer to affiliates and/or Partners in pursuance of such consent to processing, including cross-border transfer.

The "Bestee" Marketplace (Online Platform) Owner acts as the person responsible for organising the processing of personal data, and this person: 1) exercises internal control over compliance with applicable law on personal data and their protection, including the requirements for the protection of personal data; 2) brings to the attention of its employees the provisions of applicable law on personal data and their protection on matters of personal data processing, and the requirements for the protection of personal data.

The "Bestee" Marketplace Owner regularly analyses the tasks performed with regard to the use of personal data, on the basis of which the List of Personal Data is drawn up and subsequently amended as necessary (in the form of the list below):

The functionality of the "Bestee" marketplace automatically records/prepares/carries out: 1) information security incidents: individually or serially occurring failures in operation that create a threat to proper functioning and (or) conditions for the unlawful obtaining, copying, dissemination, modification, destruction or blocking of information resources; 2) information security threats: a set of conditions and factors that create prerequisites for the occurrence of an information security incident; 3) continuous monitoring of information security events: constant observation for the purpose of detecting and identifying information security events, with regular preparation of reports on the results; 4) information security events: a state of informatisation objects indicating a possible violation of the existing security policy or a previously unknown situation that may be relevant to the security of the "Bestee" marketplace.

15. Notwithstanding the provisions above, the User understands that his/her data are transmitted over the Internet and that this fact does not guarantee the security of the data transmitted by the User, unauthorised access to which may be obtained by third parties as a result of any unlawful actions. In this regard, any transfer of data is made by the User at his/her own risk, and the "Bestee" Marketplace (Online Platform) Owner and the Seller shall not be liable in connection with a leak of data or any part thereof and the causing of corresponding damage to the User.
16. If the User does not agree with the terms of this Privacy Policy, he/she must stop using the "Bestee" marketplace. The signing of this Agreement (as provided for in this Agreement) constitutes unconditional acceptance of this Privacy Policy.