1. Data controller
ТОО «Нурсат Темир», BIN 050140011106, address: 28G Toretay Street, Almaty 050050, Republic of Kazakhstan, is the owner and operator of the personal-data database used in connection with ASAR Market. Privacy contact: info@nurtaugroup.kz.
This Policy applies to the App, connected web pages, support communications and Order processing. It does not govern independent third-party services opened through external links; their own terms must be available before data is transferred.
2. Data we process
| Category | Examples |
|---|---|
| Contact and profile | name, phone, e-mail, account ID and an avatar if uploaded |
| Order and delivery | cart, goods, amount, status, order history, address, entrance, floor, intercom and comments |
| Payment | method, amount, status and transaction ID; not the full card number or CVC |
| Support | request text, attachments and complaint-resolution records |
| Device and security | IP address, device type, OS, app version, push token, login logs and security signals |
| Device permissions | location or photos only if the feature exists and the User grants permission |
3. Sources
We receive data directly from you during registration, profile completion, Order checkout, address selection and support requests; automatically from devices and security controls; and from payment, courier or other providers to the extent a transaction status is needed to fulfil an Order.
We do not collect more than is necessary for the stated purposes. Required fields should be identified in the interface; the related feature may not work without them.
4. Purposes and legal grounds
Legal grounds include consent, entering into and performing a contract, compliance with law and protection of legal rights where Kazakhstan law permits.
- creating and securing accounts, authentication and access recovery;
- creating, confirming, paying, delivering, collecting and returning Orders;
- service communications and handling requests, complaints and rights requests;
- fraud prevention, App security and incident investigation;
- accounting, tax and other mandatory records;
- improvement and diagnostics only through tools that are actually enabled and disclosed;
- promotions and marketing only with separate voluntary consent.
5. Recipients
Only as necessary, data may be received by payment organisations, couriers and warehouses, communications providers, technical-infrastructure and security providers, professional advisers and government bodies where disclosure is legally required.
Actual processor list before launch: [[INSERT THE LEGAL NAMES OF THE PAYMENT PROVIDER, DELIVERY SERVICE, HOSTING, PUSH/AUTHENTICATION AND ALL OTHER RECIPIENTS]].
Processors must act only on documented instructions and provide adequate confidentiality and security. We do not sell personal data or use it for cross-service advertising tracking without a separate lawful basis.
6. Localisation and international transfers
The primary personal-data database is located at: [[ПОДТВЕРДИТЬ ПЛОЩАДКУ ОСНОВНОЙ БАЗЫ ПЕРСОНАЛЬНЫХ ДАННЫХ В РЕСПУБЛИКЕ КАЗАХСТАН]]. Kazakhstan law requires the personal-data database to be stored in the Republic of Kazakhstan.
A limited technical operation or transfer outside Kazakhstan is permitted only after the countries, recipients, purposes and safeguards have been documented, required consent has been obtained and international-transfer rules have been met. Consent does not replace the primary-database localisation duty.
7. Retention and deletion
Profile data is retained while the account is active and for a short technical period after a deletion request. Saved addresses, avatar, active push tokens and optional preferences are deleted or de-identified with the account.
Order, payment, return, accounting and tax records are retained for periods directly required by law, with restricted access and no use for new purposes. Security logs and backups are kept only for a documented necessary period.
When the purpose is achieved or consent is validly withdrawn, processing stops and data is destroyed or de-identified unless law or an outstanding obligation requires retention. Requests are handled without undue delay and, where applicable, within 15 business days.
8. Security
We use access controls, multifactor protection for administrative accounts, encryption in transit, logging, backups, component updates and provider reviews. Access is limited to people who need it for their duties.
The Company appoints a responsible person and maintains a necessary-data list, retention schedule, access matrix and incident-response process. Security incidents trigger the actions and notifications required by law.
9. Your rights
Submit a request through a verified account or to info@nurtaugroup.kz. To prevent unauthorised deletion we may request proportionate identity verification, but will not require excessive data.
- learn whether your data is processed and obtain available information about the processing;
- request correction, completion, blocking or destruction of inaccurate or unlawfully processed data;
- withdraw consent as permitted by law, understanding that a feature or Order performance may become impossible;
- opt out of marketing without opting out of essential service messages;
- delete the account and associated data through the App and the public web page;
- complain to a competent authority or court.
10. Children
The App is not intended for children and does not knowingly target collection of their data. If we learn that a minor’s data was provided without required participation of a legal representative, we will take steps to delete it or establish a lawful basis.
11. Updates and contact
If data categories, purposes or recipients materially change, we will update this Policy and obtain fresh consent where required. A version archive and effective date should remain available.
Questions, consent withdrawal and rights requests: info@nurtaugroup.kz; phone +7 (727) 233-67-55; postal address: 28G Toretay Street, Almaty 050050, Republic of Kazakhstan.
Hosting of legal pages
Public pages may be hosted on GitHub Pages. When the site is opened, GitHub may process an IP address and technical logs to operate and secure its infrastructure. ASAR pages do not use first-party analytics, advertising trackers, or data-collection forms.
GitHub General Privacy Statement