TSUYU’s Policy on the Collection, Processing and Protection of Personal Data
POLICY ON THE COLLECTION, PROCESSING AND PROTECTION OF PERSONAL DATA
Revised on 31 August 2026
1. General Provisions
1.1. This Policy sets out the procedures for the collection, processing and protection of personal data by TSUYU LAB Limited Liability Company, BIN 260340012928 (hereinafter referred to as the ‘Data Controller’ and (or) the Controller) when using the website https://tsuyuperfumes.art, placing and fulfilling orders, and in other interactions with users.
1.2. This Policy has been drawn up in accordance with the Law of the Republic of Kazakhstan ‘On Personal Data and its Protection’, the Rules for the Collection and Processing of Personal Data, and other applicable regulatory legal acts of the Republic of Kazakhstan.
1.3. This Policy applies to the data of Website visitors, customers, payers, recipients of orders, applicants and other individuals who interact with the Operator.
1.4. Acknowledgement of the Policy is confirmed by a specific action taken by the user on the Website. Such acknowledgement does not replace consent to the collection and processing of personal data in cases where consent is required by law.
1.5. Terms are used in the meanings established by the legislation of the Republic of Kazakhstan.
2. Principles of processing
lawfulness, fairness and confidentiality;
collection only of data necessary for pre-defined and lawful purposes;
processing incompatible with the purposes of collection is prohibited;
ensuring the accuracy and up-to-date nature of data;
retention for no longer than is necessary for the purposes of the processing or as required by law;
the application of the necessary legal, organisational and technical safeguards.
3. Categories of data subjects and list of data
3.1. Depending on the user’s actions, the Controller may process:
surname, first name and patronymic — where provided;
telephone number and email address;
delivery address and details of the recipient;
details of orders, payments, deliveries, returns and enquiries;
bank details required for a refund, if the refund cannot be processed via the original payment method;
account details and user preferences — if a personal account is held;
IP address, cookies, information about the browser, device, actions on the Website and other technical data;
information regarding the granting, amendment and withdrawal of consents;
other information that the user voluntarily provides in their enquiry.
3.2. The Operator does not request sensitive or biometric personal data for standard order processing. The Operator does not receive or store full bank card details if these are entered on a secure page of the organisation handling the payment.
3.3. If the Buyer provides the details of another recipient, the Buyer confirms that they have a lawful basis for providing such details and is obliged to notify the recipient of such a transfer.
4. Purposes and legal basis for processing
registration and operation of the personal account;
processing, confirming and fulfilling orders;
receipt of payment, provision of supporting documents and refunds;
organising the delivery and collection of orders;
processing enquiries, complaints, exchanges and returns;
sending mandatory service notifications;
ensuring the operation, security and improvement of the Website, and preventing fraud;
maintaining accounting, tax and other statutory records;
sending promotional and informational messages where separate consent has been given;
protecting the rights and legitimate interests of the Operator and users.
4.2. The grounds for processing are the data subject’s consent, the necessity to conclude and perform a contract, the fulfilment of obligations established by the legislation of the Republic of Kazakhstan, as well as other grounds provided for by law.
4.3. Refusal to provide data that is objectively necessary for an order may make it impossible to process or fulfil the order. Withdrawal of consent to receive advertising does not affect the ability to purchase the Goods.
5. Data operations and processing methods
5.1. The Operator may collect, record, organise, accumulate, store, rectify, amend, retrieve, use and transfer data in the instances and to the extent necessary for the stated purposes, as well as anonymise, block, delete and destroy data.
5.2. Processing is carried out by automated, non-automated and mixed means.
5.3. The Controller shall not disclose personal data to an indefinite group of persons without a specific legal basis.
6. Third Parties and Data Transfer
6.1. To the extent necessary for the relevant function, data may be provided to parties ensuring the operation of the Website and the information infrastructure, banks and payment organisations, delivery services, telecommunications and notification providers, as well as parties providing the Operator with accounting, legal and technical services.
6.2. Such parties process data on the basis of a contract, the law or other appropriate grounds and are obliged to comply with confidentiality and security requirements.
6.3. Data may be transferred to public authorities in the cases and in accordance with the procedure established by the legislation of the Republic of Kazakhstan.
6.4. Cross-border transfers are permitted subject to compliance with the requirements of the legislation of the Republic of Kazakhstan, including requirements regarding the level of protection in a foreign country and the obtaining of consent where necessary.
7. Storage and localisation
7.1. The collection and storage of personal data shall take place in a database located within the territory of the Republic of Kazakhstan.
7.2. The retention period is determined by the date on which the purposes of collection and processing are fulfilled, the termination of the legal relationship, or the mandatory document retention periods established by the legislation of the Republic of Kazakhstan.
7.3. Once the grounds for processing cease to exist, the data shall be destroyed or anonymised in accordance with the procedure and within the timeframes provided for by law, unless its further storage is required by law or to protect rights and legitimate interests.
8. Protection of personal data
8.1. The Controller shall take the necessary legal, organisational and technical measures, including access control, logging of operations, data backup, protection of information systems, supervision of contractors and incident response.
8.2. Access is granted only to persons who require the data to fulfil their official or contractual duties.
9. Rights of the data subject
9.1. The data subject has the right to obtain information regarding the existence, purposes, sources, methods and duration of the processing of their data; to request the rectification, restriction or erasure of their data; to withdraw consent; to object to the processing; and to lodge a complaint with the Controller, an authorised body or a court.
9.2. Consent may not be withdrawn in cases where such withdrawal would contravene the legislation of the Republic of Kazakhstan or where there is an outstanding obligation.
9.3. Requests should be sent to tsuyuperfumes@gmail.com. To protect data, the Controller is entitled to request information enabling the identification of the applicant and confirmation of their authority.
10. Cookies and technical data
10.1. The Website may use cookies and similar technologies to enable functionality, save settings, ensure security and for analytics. The user may restrict cookies in their browser settings; this may affect certain features of the Website.
10.2. Non-essential analytics and advertising technologies are used in accordance with the user’s settings and legal requirements.
11. Changes to the Policy
11.1. The Operator reserves the right to update this Policy. The new version shall take effect from the moment it is published on the Website, unless a different date is specified therein.
11.2. The Policy is published in Kazakh and Russian and is accessible without registration.
Operator’s details
Full name: Limited Liability Partnership ‘TSUYU LAB’
BIN: 260340012928
Registered address: Republic of Kazakhstan, East Kazakhstan Region, Ust-Kamenogorsk, 3 Chelyuskin Street, postcode 070001
Website: https://tsuyuperfumes.art
Email: tsuyuperfumes@gmail.com
KAZAKH VERSION
POLICY ON THE COLLECTION, PROCESSING AND PROTECTION OF PERSONAL DATA
Revised on 31 July 2026
1. General Provisions
1.1. This Policy governs the limited liability partnership ‘TSUYU LAB’, BSN 260340012928 (hereinafter referred to as the ‘Owner’ and (or) the Operator), the use of the https://tsuyuperfumes.art website, the processing and fulfilment of orders, as well as the collection, process and protect personal data.
1.2. This Policy is in accordance with the Law of the Republic of Kazakhstan ‘On Personal Data and its Protection’, the regulations governing the collection and and other applicable regulatory legal acts of the Republic of Kazakhstan.
1.3. This Policy applies to the data of website visitors, purchasers, payers, service recipients, and other individuals who interact with the Operator.
1.4. Acceptance of this Policy is implied by the user’s continued use of the Website. Where consent is required by law, such acceptance does not constitute consent to the collection and processing of personal data.
1.5. Terms are used in the meanings defined in the legislation of the Republic of Kazakhstan.
2. Processing Principles
legality, fairness and confidentiality;
collection of only data necessary for pre-defined lawful purposes;
not permitting processing that is incompatible with the purposes of collection;
ensuring the accuracy and relevance of data;
not retaining data for longer than is necessary to fulfil the purposes or as required by law;
implementing the necessary legal, organisational and technical safeguards.
3. Categories of data subjects and list of data
3.1. Depending on the user’s actions, the Controller: surname, first name, father’s name (if provided); telephone number and email address; delivery address and details of the recipient; information regarding orders, payments, deliveries, returns and complaints; bank details required for a refund where a refund via the original payment method is not possible; account details and settings, where a personal account exists; Technical data regarding IP address, cookies, browser, device and activity on the Website; information regarding the submission, amendment and withdrawal of consents; other information provided by the user in a specific manner.
3.2. No specific or biometric data is requested for the processing of standard orders. If bank card details are entered on the secure page of the payment acceptance organisation, the Operator does not collect or store their full details.
3.3. If the purchaser provides the details of another recipient, they confirm that there is a legal basis for disclosing such information and are obliged to notify the recipient of such disclosure.
4. Purposes and grounds
4.1. Data: registration and management of the personal account; processing, confirming and fulfilling orders; accepting payments, issuing confirmation documents and processing refunds; organising delivery and collection; processing complaints, requests, cancellations and refunds; sending mandatory service notifications; Ensuring the operation, security and maintenance of the website, and preventing unauthorised access; accounting, tax and other mandatory reporting; public and technical notifications where otherwise agreed; This policy has been drawn up to protect the rights and legitimate interests of the operator and users.
4.2. Grounds for processing — the data subject’s consent, the necessity to conclude and fulfil a contract, compliance with obligations set out in the legislation of the Republic of Kazakhstan and other grounds provided for by law.
4.3. Failure to provide the necessary information in an objective manner may prevent the order from being formalised or fulfilled. Termination of the contractual agreement shall not affect the possibility of purchasing the goods.
5. Data processing and handling methods
5.1. The operator may carry out the following actions to the extent necessary to achieve the stated purposes: collecting, recording, organising, storing, store, verify, amend, retrieve, use, disclose, anonymise, restrict access to, or delete data to the extent necessary to achieve the specified purposes.
5.2. Processing is carried out using automated, non-automated and mixed methods.
5.3. The operator must not distribute data to a group of unidentified individuals without a legitimate basis.
6. Provision of collected data and information
6.1. Data required for the relevant function shall be provided to the parties responsible for ensuring the operation of the Website and the IT infrastructure, banks and payment organisations, delivery services, telecommunications and messaging providers, as well as to parties providing accounting, legal and technical service providers.
6.2. Such entities shall process the data in accordance with the terms, law or other relevant grounds, and are obliged to comply with confidentiality and security requirements.
6.3. Disclosure to state authorities shall be carried out in accordance with the conditions and procedures specified in the legislation of the Republic of Kazakhstan.
6.4. Cross-border disclosure is permitted in accordance with the legislation of the Republic of Kazakhstan, provided that the level of protection in the foreign state and, where necessary, the requirements for obtaining consent are observed.
7. Storage and protection
7.1. The collection and storage of personal data shall be carried out in data centres located within the territory of the Republic of Kazakhstan.
7.2. The retention period is determined by the date on which the purposes of collection and processing are fulfilled, the termination of legal relationships or the mandatory retention periods specified by law.
7.3. Once the basis for processing has ceased to exist, unless retention is required by law or to protect rights, the data shall be deleted or anonymised in accordance with the procedure laid down by law.
8. Data Protection
8.1. The controller shall restrict access, log operations, carry out backup transfers, protect information systems, monitoring contractors and responding to incidents, the Operator shall adopt the necessary legal, organisational and technical measures.
8.2. Access to data shall be granted only to persons who require it to fulfil their operational or contractual obligations.
9. Rights of the data subject
9.1. The data subject has the right to obtain information regarding the existence, purposes, grounds, means and processing periods of their data; to request the rectification, restriction or erasure of their data; to withdraw their consent; to object to the processing; to lodge a complaint with the data controller, the competent authority or the court.
9.2. In cases where the agreement contravenes the legislation of the Republic of Kazakhstan or where there has been a failure to fulfil an obligation, the agreement shall not be rescinded.
9.3. Requests shall be sent to the email address tsuyuperfumes@gmail.com. To protect data, the Operator may request information from the applicant that enables the Operator to verify the applicant’s identity and confirm their authorisation.
10. Cookies and technical data
10.1. The website may use cookies and similar technologies to ensure the functionality of the site, save settings, ensure security and carry out analysis. Users may block cookies in their browser, although this may affect certain functions.
10.2. Non-essential analytics and advertising technologies are used whilst respecting users’ preferences and legal requirements.
11. Changes to the Policy
11.1. The Operator reserves the right to amend this Policy. Unless otherwise specified, the new version shall apply from the moment it is published on the Website.
11.2. The Policy is published in Kazakh and Russian, in a format that is accessible without registration.
Operator’s details
Full name: ‘TSUYU LAB’ Limited Liability Partnership
TIN: 260340012928
Registered address: Republic of Kazakhstan, East Kazakhstan Region, Oskemen City, Chelyuskin Street, No. 3, postcode 070001
Website: https://tsuyuperfumes.art
Email: tsuyuperfumes@gmail.com