PRIVACY POLICY

and Personal Data Processing Policy of the website www.maximagoods.kz

Effective date: May 13, 2026

This Privacy Policy and Personal Data Processing Policy establishes the procedure for the collection, processing, storage, use, transfer and protection of personal data of users of the website maximagoods.kz, operated by the Limited Liability Partnership “MAXIMA GOODS” (MAKSIMA GUDS), BIN 170140026525, located at: Republic of Kazakhstan, Almaty, Zhetysu district, Kazybaev St., Building 3, Office 34, postal code 050016, hereinafter referred to as the “Company”.

This Policy has been developed taking into account the Civil Code of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan “On Personal Data and Its Protection”, as well as other applicable regulations of the Republic of Kazakhstan.

1. General Provisions

1.1. This Policy governs the relations associated with the collection and processing of personal data of website users, online store customers, recipients of goods, as well as other persons who contact the Company through the website, messengers, telephone, e-mail or other remote means.

1.2. The use of the website, placing an order, registration on the website, submitting an inquiry to the Company, as well as providing one’s data by any means, signifies the user’s familiarization with this Policy and consent to its terms in the part applicable to the relevant method of interaction.

1.3. The Company is guided by the principles of legality, good faith, proportionality of the volume of processed data to the stated purposes, limitation of processing to specific purposes, and ensuring proper protection of personal data. Such purposes correspond to the objective of the personal data protection law — the protection of the rights and freedoms of a person and citizen in the collection and processing of their personal data.

2. Operator and Contact Details

2.1. The personal data operator is: LLP “MAXIMA GOODS” (MAKSIMA GUDS)

BIN: 170140026525

Address: Republic of Kazakhstan, Almaty, Zhetysu district, Kazybaev St., Building 3, Office 34, postal code 050016

Director: Zukhritdinov Akrom Muminkhodzhaevich

E-mail: info@maximagoods.com

Telephone: +77019077776, +77019077775

Website: www.maximagoods.kz

2.2. For matters related to the processing of personal data, the user may contact the Company using the contact details specified on the website.

3. What Data the Company May Collect

3.1. The Company may collect and process the following personal data of the user:

surname, first name, patronymic, if provided by the user;
telephone number;
e-mail address;
delivery address;
information about orders;
information about the recipient of the order;
history of inquiries, requests and correspondence;
data provided when contacting the support service;
other data voluntarily provided by the user and necessary for the fulfillment of the order or the consideration of an inquiry.

3.2. The Company may also process technical data generated when using the website:

IP address;
cookie data;
information about the browser and device;
date and time of website visits;
technical session parameters;
data on user actions on the website necessary for the functioning of the website, analytics, improvement of service convenience and information security.

3.3. The Company does not collect or store the full bank card number, its expiration date, CVV/CVC code, PIN code or other confidential payment details. Card payments must be carried out through an acquiring bank or payment service, and the legal framework for such transactions is determined by the legislation on payments and payment systems.

4. Purposes of Personal Data Processing

4.1. Personal data is processed by the Company for the following purposes:

registration of the user on the website, if such functionality is provided;
placement, confirmation and fulfillment of an order;
communication with the user regarding the order, payment, delivery, return and claims;
identification of the buyer and the recipient of the goods;
provision of information about goods, availability, order status and service notifications;
processing of inquiries, applications and claims;
refund of funds where there are legal grounds;
maintenance of accounting, tax, warehouse and internal records;
ensuring the operability and security of the website;
prevention of fraud, abuse and unlawful actions;
compliance with the requirements of the legislation of the Republic of Kazakhstan.

4.2. Where the user provides separate consent, their data may also be used to send advertising, informational and marketing messages about goods, discounts, promotions and special offers.

5. Legal Grounds for Data Processing

5.1. The Company processes personal data on the following grounds:

consent of the personal data subject;
the necessity of concluding and executing a retail sale and purchase agreement for goods by remote means;
the necessity of fulfilling obligations imposed on the Company by the legislation of the Republic of Kazakhstan;
other grounds expressly provided for by the legislation of the Republic of Kazakhstan.

5.2. The Law of the Republic of Kazakhstan “On Personal Data and Its Protection” is the fundamental specialized act in this area.

6. Procedure for Obtaining Consent

6.1. The user’s consent to the collection and processing of personal data may be provided by:

ticking the corresponding checkbox on the website;
clicking the buttons “Place Order”, “Confirm”, “Pay”, if a link to this Policy and the text of consent are placed alongside;
submitting data through feedback forms, the shopping cart, chat, messengers, e-mail;
performing other actions that unambiguously confirm the user’s expression of will.

6.2. If separate consent is required for certain purposes, including for advertising mailings, the Company obtains it separately.

7. Transfer of Data to Third Parties

7.1. The Company has the right to transfer personal data to third parties only to the extent necessary to achieve the purposes of processing and to fulfill obligations to the user.

7.2. Such persons may be:

acquiring banks;
payment organizations and payment services;
courier, postal and logistics services;
telecommunications operators;
hosting providers and IT contractors;
accounting and cash register services;
other persons engaged by the Company to fulfill an order or comply with the requirements of the law.

7.3. The transfer of data to state bodies, courts, law enforcement and other authorized bodies is carried out in the cases and in the manner provided for by the legislation of the Republic of Kazakhstan.

7.4. When transferring data to third parties, the Company proceeds from the need for them to comply with the confidentiality regime and to use the data only within the limits of the stated purposes.

8. Payments and Confidentiality of Card Data

8.1. When paying for an order by bank card, the user is redirected to a secure page of the acquiring bank or the relevant payment service.

8.2. Bank card details are entered by the user directly in the interface of such payment service and must not be stored in the Company’s information systems.

8.3. The Company may have access only to limited information about the payment necessary for the identification and accounting of the transaction, including:

order number;
amount;
date and time of payment;
payment status;
transaction identifier;
masked details of the payment instrument, if transmitted by the payment service.

8.4. All matters related to the refusal of payment authorization, debiting of funds, chargebacks, refunds and other features of payment processing are resolved with the participation of the servicing bank, acquirer or payment provider within the limits of their competence. The legislative basis for these relations is determined by the Law of the Republic of Kazakhstan “On Payments and Payment Systems”.

9. Personal Data Retention Periods

9.1. Personal data is stored for no longer than necessary to achieve the purposes of its processing, unless a longer retention period is provided for by the legislation of the Republic of Kazakhstan or is required to protect the rights and legitimate interests of the Company in the event of a dispute, claim or inspection.

9.2. Upon achievement of the purposes of processing, withdrawal of consent, or in the absence of legal grounds for further processing, personal data is subject to termination of processing, deletion, depersonalization or destruction in the manner applicable under the law and the internal procedures of the Company.

10. Protection of Personal Data

10.1. The Company takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, distribution, loss and other unlawful actions.

10.2. Such measures may include:

restricting the circle of persons with access to data;
the use of passwords and access control tools;
the application of antivirus protection and other information security tools;
storage of data in protected information systems;
control of access to employees’ work accounts;
internal rules for data processing and storage;
working only with verified contractors on a need-to-know basis.

10.3. The Company proceeds from the assumption that processing must be ensured by protective measures that comply with the requirements of the legislation of the Republic of Kazakhstan on personal data.

11. Rights of the Personal Data Subject

11.1. The user has the right to:

know about the existence of their personal data held by the Company;
demand the clarification, updating and correction of their data;
demand the termination of processing, blocking or deletion of data in the cases provided for by the legislation of the Republic of Kazakhstan;
withdraw consent to the processing of personal data, unless this otherwise impedes the fulfillment of the Company’s obligations under the law or under an already concluded agreement;
file complaints and applications with authorized bodies and the court in the manner established by the legislation of the Republic of Kazakhstan.

11.2. If the withdrawal of consent or deletion of data objectively makes it impossible to fulfill an order, return, accounting or other mandatory actions, the Company has the right to continue processing only to the extent required by law or to complete the relevant obligations.

12. Cookies and Analytics

12.1. The website may use cookies and other similar technologies for:

ensuring the correct operation of the website;
saving user settings;
analyzing website traffic;
improving the user experience;
enhancing security.

12.2. The user may change cookie settings in their browser. Restricting cookies may affect the operability of certain website functions.

13. Handling of Inquiries and Claims

13.1. When a user contacts the Company regarding an order, return, product quality, payment or delivery, the Company has the right to process the data provided by the user, as well as information about the order, correspondence, documents, photo and video materials attached to the inquiry.

13.2. Such processing is carried out to consider the inquiry, establish the circumstances, fulfill obligations to the consumer and comply with the requirements of consumer protection legislation. The Law of the Republic of Kazakhstan “On Consumer Protection” continues to apply in its updated edition.

14. Amendments to the Policy

14.1. The Company has the right to make amendments and additions to this Policy at any time.

14.2. The new edition of the Policy takes effect from the moment it is posted on the website, unless another period is specified in the new edition itself.

14.3. The user is advised to periodically review the current edition of the Policy.

15. Final Provisions

15.1. This Policy is subject to application to the extent that it does not contradict the current legislation of the Republic of Kazakhstan.

15.2. In all matters not regulated by this Policy, the Company and the user are guided by the legislation of the Republic of Kazakhstan.

15.3. The current edition of the Policy is posted at: https://maximagoods.kz/ru/privacy-policy