HERRA

Privacy policy

1. General Provisions

1.1. The individual entrepreneur "TB Corp" (hereinafter referred to as the IE "TB Corp", Operator), operating under the HERRA brand, ensures the protection of personal data of website visitors and customers. This Policy defines the rules for their collection, use, storage, and protection.

1.2. Key concepts used in this Policy:

1.2.1. personal data - information relating to a specific or identifiable individual based on which the personal data subject is determined, recorded on electronic, paper, and/or other material carriers;

1.2.2. operator of the database containing personal data (hereinafter - operator) - a state body, individual, and/or legal entity that carries out the collection, processing, and protection of personal data;

1.2.3. processing of personal data - actions aimed at:

accumulation;
storage;
modification;
supplementation;
use;
distribution;
anonymization;
blocking;
destruction of personal data.

1.2.4. automated processing of personal data - processing of personal data using computing technology;

1.2.5. distribution of personal data - actions aimed at disclosing personal data to an indefinite number of persons;

1.2.6. provision of personal data - actions aimed at disclosing personal data to a specific person or a specific group of persons;

1.2.7. blocking of personal data - actions to temporarily cease the collection, accumulation, modification, supplementation, use, distribution, anonymization, and destruction of personal data;

1.2.8. accumulation of personal data - actions to systematize personal data by entering them into a database containing personal data;

1.2.9. destruction of personal data - actions after which it is impossible to restore the data. Anonymization - actions after which it is impossible to determine to whom the data belongs.

1.2.10. information system of personal data - a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

1.3. The Policy regarding the processing of personal data in IE "TB Corp" (hereinafter - the Policy) defines any action (operation) or a set of actions (operations) for the collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data, as well as information about the implemented requirements for the protection of personal data.

1.4. The Policy is developed in accordance with the current legislation of the Republic of Kazakhstan, and the processing of personal data is based on the following regulatory legal acts:

Constitution of the Republic of Kazakhstan;
Civil Code of the Republic of Kazakhstan;
Law of the Republic of Kazakhstan dated May 21, 2013 No. 94-V “On Personal Data and Their Protection”;
Law of the Republic of Kazakhstan dated November 24, 2015 No. 418-V “On Informatization”;
Order of the Minister of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan dated October 21, 2020 No. 395/NQ “On Approval of the Rules for the Collection and Processing of Personal Data”;
other regulatory legal acts of the Republic of Kazakhstan and normative documents of authorized state bodies.

1.5. Individual Entrepreneur “TB Corp” processes personal data on a lawful and fair basis.

1.6. Individual Entrepreneur “TB Corp” does not process biometric personal data.

1.7. Individual Entrepreneur “TB Corp” has the right to delegate the processing of personal data of the data subject to other parties in accordance with Article 7 of the Law “On Personal Data and Their Protection”. In this case, the operator bears responsibility to the data subject for the actions of the specified party.

2. Purposes of Processing Personal Data

2.1. Personal data is processed by Individual Entrepreneur “TB Corp” for the following purposes:

2.1.1. ensuring the legality of personal data processing;

2.1.2. fulfilling the functions, powers, and obligations imposed on the Operator by the legislation of the Republic of Kazakhstan, in particular:

fulfilling obligations for the registration and execution of orders and tax legislation requirements;
maintaining current accounting and tax records, forming, preparing, and timely submitting accounting, tax, and statistical reports;
complying with the requirements for processing and protecting the data of customers and website visitors;

2.1.3. Conducting the activities of the HERRA online store, including:

considering customer inquiries, returns, and complaints;
processing, payment, delivery, and execution of retail purchase agreements;
sending advertisements for HERRA products through channels selected by the client with the necessary consent;

2.1.4. Other specific lawful purposes communicated to the subject before the commencement of the relevant processing. Data is not used for incompatible purposes without proper grounds.

3. Composition of Personal Data and Processing Periods

3.1. All personal data processed by Individual Entrepreneur “TB Corp” is confidential and strictly protected information in accordance with the legislation.

3.2. For orders, the following data is processed: full name, phone number, email address, delivery address, composition and cost of the order, payment and receipt information, content of inquiries. For website operation - IP address, device data, session data, and consent confirmation. IIN, passport information, family data, criminal record, and employment history are not collected for regular purchases.

3.3. The policy applies to website visitors, customers, agreed recipients of orders, and applicants for inquiries. The processing of employee data and other individuals for personnel purposes is regulated separately.

Order data is used until the completion of execution and related requests. Mandatory accounting documents are kept for the periods established by law. Other data is stored no longer than necessary to achieve a specific purpose; the terms for website services are disclosed in the processing list.

4. Procedure for the collection, storage, transfer, and other types of processing of personal data

4.1. The processing of personal data is carried out in both automated and non-automated ways.

4.1.1. The processing of personal data, conducted without the use of automation tools, is carried out in such a way that it is possible to determine the storage locations of personal data (material carriers) for each category of personal data. The operator establishes a list of individuals who process personal data or have access to it. Separate storage of personal data (material carriers), which is processed for different purposes, is ensured. The operator ensures the safety of personal data and takes measures to prevent unauthorized access to personal data.

4.1.2. The processing of personal data, carried out using automation tools, is conducted on the condition of performing the following actions:

The operator conducts technical measures aimed at preventing unauthorized access to personal data and/or transferring them to individuals who do not have the right to access such information;
protective tools are configured for timely detection of unauthorized access to personal data;
technical means of automated processing of personal data are isolated to prevent any impact on them that may disrupt their functioning;
The operator performs data backup to ensure the immediate restoration of personal data that has been modified or destroyed due to unauthorized access;
constant monitoring is conducted to ensure the level of protection of personal data.

4.2. Only employees who have undergone a specific clearance procedure are allowed to process personal data, which includes:

familiarization of the employee with local regulatory acts governing the procedure and process of working with personal data, with a signature;
obtaining a confidentiality agreement from the employee regarding personal data when working with them;
the employee receiving and using individual access attributes to information systems containing personal data in their work. Each employee is provided with the minimum necessary rights to access personal data information systems to fulfill their job responsibilities.

Employees with access to personal data receive only the personal data necessary for them to perform specific job duties.

4.3. Personal data is stored in both paper and electronic form.

4.3.1. Personal data in paper form is stored in specially equipped metal cabinets and/or safes, or in other places that are locked and sealed. The keys are held by the responsible employee appointed by the relevant order.

4.3.2. Electronic data is stored in a database within the territory of the Republic of Kazakhstan. Information about the storage location, recipients, purposes, and terms: [list of actually used services, their functions, processing countries, and storage periods].

4.3.3. When storing personal data, organizational and technical measures are taken to ensure their safety and to prevent unauthorized access, including but not limited to:

appointing an employee responsible for processing personal data;
restricting physical access to personal data processing locations, including the installation of locking devices, limiting the circle of individuals with access, etc.;
removable electronic media on which backup copies of personal data of data subjects are stored (if necessary, they are labeled and recorded in the registration, accounting, and issuance journal for external media for storing backup copies of personal data);
accounting for all information systems, electronic and paper media, as well as archival copies;
applying necessary information protection measures in accordance with the legislation;

4.3.4. The detailed procedure is regulated by the internal local acts of the Operator.

4.4. For the purposes of data processing, IP «TB Corp» may transfer personal data:

to employees of IP «TB Corp»;
to third parties who have signed an obligation to ensure the confidentiality and security of the received information on behalf of IP «TB Corp», where the list of actions (operations) with personal data that will be performed by the person processing the personal data and the purposes of processing must be specified, and the obligation of such person to maintain the confidentiality of personal data and ensure the security of personal data during processing must be established, as well as the requirements for the protection of processed personal data must be specified;
at the request of investigative and judicial authorities in connection with an investigation or court proceedings, at the request of the criminal enforcement authority in connection with the execution of a criminal sentence and monitoring the behavior of a conditionally convicted person, a convicted person whose sentence has been deferred, and a person released on parole.

The transfer to third parties is allowed with the consent of the subject or on another basis provided by law and only to the necessary extent. Cross-border transfer is carried out in accordance with Article 16 of the Law of the Republic of Kazakhstan on Personal Data and Their Protection. The use of WhatsApp and other foreign services is taken into account in the list of recipients and in the relevant consent.

When transferring personal data electronically to third parties via open communication channels, IP "TB Corp" is obliged to take all necessary measures to protect the transmitted information in accordance with the requirements of the current legislation of the Republic of Kazakhstan, in the manner regulated by local acts.

4.5. Changes to personal data are made based on the application of the personal data subject, based on official documents containing the personal data of the subject, and in other lawful cases.

4.6. Personal data is stored no longer than required for the purposes of their processing and must be destroyed upon achieving the processing goals or in case of loss of necessity for achieving them.

Destruction from carriers and devices containing personal data of subjects must comply with the following rules:

it must be as reliable and confidential as possible, excluding the possibility of subsequent recovery;
it must be formalized by a corresponding act;
it must be carried out by an authorized person with the recording of the result;
destruction must only concern those personal data that are subject to destruction in connection with the achievement of the purpose of processing the specified personal data or loss of necessity in achieving them, avoiding accidental or intentional destruction of current carriers.

5. Rights and Obligations of the Personal Data Subject

5.1. The personal data subject has the right to:

know about the existence of their personal data with the owner and/or operator, as well as third parties, and to receive information containing: confirmation of the fact, purposes, sources, methods of collection and processing of personal data; a list of personal data; the terms of processing personal data, including the terms of their storage;
require the owner and/or operator to change and supplement their personal data when there are grounds confirmed by relevant documents;
require the owner and/or operator, as well as third parties, to block their personal data in case of information about violations of the conditions for collecting and processing personal data;
require the owner and/or operator, as well as third parties, to destroy their personal data, the collection and processing of which were carried out in violation of the legislation of the Republic of Kazakhstan, as well as in other cases established by this Law and other regulatory legal acts of the Republic of Kazakhstan;
withdraw consent to the collection and processing of personal data, except in cases provided for in paragraph 2 of Article 8 of this Law;
give consent (refuse) to the owner and/or operator for the dissemination of their personal data in publicly available sources of personal data;
protect their rights and legitimate interests, including compensation for moral and material damage;
exercise other rights provided for by this Law and other laws of the Republic of Kazakhstan.

5.2. The personal data subject is obliged:

to provide your personal data in cases established by the laws of the Republic of Kazakhstan;
to notify about changes in the data necessary for order fulfillment via WhatsApp +7 707 122 9876;

Requests for data processing should be sent via WhatsApp +7 707 122 9876 or to the Operator's address. A response will be provided within the timeframe established by law for the respective request. Upon withdrawal of consent, processing will cease within 15 working days or a reasoned refusal will be sent if there is a legal basis for continuation.

The procedure for processing requests from personal data subjects regarding the exercise of their legal rights is carried out in accordance with an approved internal document developed in accordance with the current legislation on personal data protection and is under the control of the employee responsible for personal data processing.

6. Information on the requirements for personal data protection

6.1. The Operator obtains data from subjects or other persons when there is a legal basis. Receiving data from another person does not relieve the obligation to ensure the legality of processing.

6.2. The Operator ceases the processing of personal data in the following cases:

when the conditions for ceasing the processing of personal data arise or upon the expiration of established deadlines;
upon achieving the purposes of their processing or if the necessity to achieve these purposes is lost;
at the request of the personal data subject, if the personal data processed by IP “TB Corp” is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing;
in the event of unlawful processing of personal data being identified, if ensuring the legality of personal data processing is impossible;
in the case of the personal data subject withdrawing consent to the processing of their personal data or upon the expiration of such consent (if personal data is processed by IP “TB Corp” solely on the basis of the consent of the personal data subject);
upon the cessation of the activities of the individual entrepreneur, taking into account mandatory storage periods and the legal procedure for transferring or destroying data.

6.3. IP “TB Corp” ensures the following protective measures:

6.3.1. identifies the person responsible for organizing data processing;

6.3.2. establishes rules for processing, access, and ensuring the security of data:

regulations on the processing of clients' personal data;
this Policy;
other local acts on the issues of processing and ensuring the security of personal data.

6.3.3. legal, organizational, and technical measures have been applied to ensure the security of personal data;

6.3.4. internal control of compliance of personal data processing with the requirements of the legislation of the Republic of Kazakhstan on personal data and their protection, this Policy, and local acts of the Operator is carried out;

6.3.5. assesses the risks of violation of the rights of subjects and the proportionality of the protective measures applied;

6.3.6. Introduces employees authorized to access the data to the applicable confidentiality requirements and rules.

6.4. The Operator implements the following requirements for the protection of personal data:

A security regime is organized for the premises where information systems are located, preventing unauthorized access or presence of individuals without access rights in these premises;
Measures are in place to ensure the safety of personal data carriers;
A list of individuals who require access to fulfill their duties is defined;
Information protection tools that have undergone the compliance assessment procedure according to the legislation of the Republic of Kazakhstan in the field of informatization and information security are used.

7. Provisions on confidentiality and personal information protection in the online store

7.1. Individual Entrepreneur "TB Corp" processes the data of customers and visitors of the HERRA online store.

7.2. The personal data collected on the website includes:

Full name;
Information about placed orders and their fulfillment;
Delivery address of the order;
Mobile phone number;
Email address;
Content of inquiries and technical information necessary for the operation and protection of the website;

7.3. Customer data is used for order processing, payment, delivery, returns, and order support. Consent for processing is confirmed separately when required by law. Providing data for an order does not imply consent for advertising.

7.4. If a personal account is available, access to it is provided in the manner specified on the website. The account may contain order history and client settings.

7.5. The client has the right to use all sections of the personal account on the website, to modify and delete information about themselves.

7.6. To delete or clarify data, please contact WhatsApp +7 707 122 9876. Deletion is carried out when the purpose ceases and there are no legal grounds for storage. Mandatory documents are not destroyed until the established term expires.

7.7. The client is obliged to keep access data confidential. If there is suspicion of unauthorized actions, the store should be informed. The responsibility of the parties is determined taking into account the established reasons for the violation; the Operator retains its own obligations for data protection.

7.8. Advertising is sent with separate consent through selected channels. You can opt out via available settings or by sending a message to WhatsApp +7 707 122 9876. Refusal of advertising does not hinder purchasing.

7.9. Necessary messages about the order and client actions are sent to support the corresponding inquiry or purchase. Inclusion of advertising requires a separate basis.

7.10. The website may use cookies for the cart, login, and settings. The composition, suppliers, purposes, and terms are disclosed in the list of website technologies: [link or list]. Optional analytics and advertising are included after the user's corresponding choice. Simply visiting the website does not replace the necessary consent.

7.11. The IP address and technical information are used to the necessary extent for the operation and protection of the website. They are subject to personal data requirements when they allow for the identification of the user.

7.12. Recording a phone conversation is permitted with prior notification of the client and the presence of a necessary legal basis. Access to the recording is limited to the purpose of the inquiry and the established retention period.

8. Information about the Seller

8.1. Seller and Operator: Individual Entrepreneur “TB Corp”, brand HERRA. Entrepreneur's full name: Turkebaev B.B. Address: Almaty, Taugyly 1 d. 43 office 80 Website: __________. WhatsApp for inquiries, delivery, and returns: +7 707 122 9876.

9. Final Provisions

9.1. This Policy is subject to change and addition in the event of new legislative acts and special regulatory documents regarding the processing and protection of personal data.

9.2. The Policy is posted on the HERRA website. Changes to the text do not automatically extend the previously obtained consent. If necessary, the Operator obtains new consent.

9.3. The control of compliance with the requirements of this Policy is carried out by the responsible person for ensuring the security of personal data of Individual Entrepreneur “TB Corp.”