ZIYLAN KZ LLP PRIVACY POLICY

Scope

This Privacy Policy regulates the processing and provision of the security of all categories of personal data by Ziylan Kz Limited Liability Partnership (BIN 151040011304, place of residence: Kazakhstan, Almaty city, Bostandyk county, Bayzakov Avenue, No: 280, Office No: 15d, postal code: 050040) (hereafter “Operator”).

In the Policy, the Operator informs which personal data is subject to processing, for what purposes it is used by the Operator, what the rights of the owners of the processed personal data are and how the security and confidentiality of this data is ensured.

The Policy applies to all actions of the Operator relating to the processing of personal data, which are processed both using automated means and without using such means or in a mixed manner, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (access, including cross-border transfer), anonymization, blocking, deletion, disposal.

Principles on the Processing of Personal Data

During the processing of Personal Data, the Operator relies on the following principles:

• Collection and processing of personal data is carried out only based on legal grounds.

• Processing of personal data is carried out only for the purposes specified in the Policy or for other purposes, if the personal data owner consents to the processing, or for the fulfillment of the legal obligation of the Operator or if there is another basis for processing without the consent of the personal data owner;

• Only personal data, which fulfills the purposes of processing, are subject to processing to the extent that it is minimally necessary and not excessive to achieve those purposes.

• During the processing of personal data, the accuracy, adequacy and compliance with the purposes of processing are ensured by deleting / clarifying incomplete or incorrect data;

• Personal data are retained by the Operator, until the purposes of processing are achieved and are destroyed or anonymized, when the purposes of processing are achieved or the need to achieve these purposes is eliminated.

• Operator implements organizational and technical measures to protect personal data from unauthorized access, damage, partial or complete destruction.

• Transfer of personal data to the third parties, including cross-border transfer, is only carried out, if there are legal grounds and organizational and technical measures are taken to ensure the security of the personal data transferred.

Scope and Purposes of the Processing of Personal Data

Operator does not process biometric data, as well as data on race, nationality, political opinions, religious or philosophical beliefs and private life.

Actions on the Processing of the Personal Data

Actions of the Operator on the processing of personal data include all actions related to the processing of personal data, which are processed both using automated means and without using such means or in a mixed manner, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access, including cross-border transfer to the Turkish Republic) anonymization, blocking, deletion, destruction.

During the collection of personal data of citizens of the Republic of Kazakhstan, the Operator ensures the initial registration, systematization, accumulation, storage, clarification (updating, changing), extraction of personal data by databases in the Republic of Kazakhstan.

Rights of the Personal Data Owner

Collection and processing of personal data is carried out by the Operator, only after the relevant person has consented to the processing of personal data, or on other legal grounds in accordance with this Policy.

Personal Data Owners have the following rights:

• The right not to allow for the processing of personal data.

• The right to withdraw previously granted consent to the processing of personal data. Withdrawal of consent does not imply that the processing, which is carried out on the basis of the consent previously granted before its withdrawal, is unlawful and does not prevent processing on other legal grounds.

• The right of the data owner to receive information regarding the processing of personal data, including information such as:

• Confirmation that personal data is processed by the Operator;

• Legal reason and purpose of the processing of the personal data;

• Methods for the processing of the personal data;

• Name and location of the Operator, information about the persons (excluding employees), who have access to the personal data based on agreement or law;

• Nature of the personal data processed; sources of acquisition;

• Condition on the processing of the personal data, including retention conditions

• Procedure for exercising the rights of the personal data owner;

• Information on actual and (or) expected cross-border transfers of Personal Data;

• Information on the name of the legal entity or natural person, who processes personal data on behalf of the Operator, if such persons have been or will be authorized;

• Other information provided by the Law.

Acquisition of the above information by the personal data owner and exercise of his/her other rights are carried out by sending a scanned copy of the written request to the e-mail address customerservice@flo.com.kz or sending the original request to the address, where the Operator is located. Personal data owner is entitled to request the clarification, updating, blocking or disposal of personal data from the Operator in the same way, if the personal data is incomplete, outdated, incorrect, illegally obtained or unnecessary in terms of the purposes of processing specified by the Operator.

Operator is entitled to continue processing the personal data without the consent of the data owner in the following cases:

• If the processing of Personal Data is necessary for the conclusion of a contract with the initiative of the personal data owner or for the performance of a contract, in which the personal data owner is the beneficiary/guarantor.

• When the processing of personal data, to which access is granted to an unlimited number of persons, is performed by the Personal Data owner himself/herself or upon his/her request.

• In other cases provided by the Law.

Rules on the Transfer of Personal Data to the Third Parties

Operator may transfer the personal data to the state and local executive and representative authorities, as well as to the legal/natural persons, who process the personal data on behalf of Operator, including those located abroad, in order to fulfill the requirements of the law.

When transferring the personal data to the legal and natural persons, including cross-border transfers, the Operator concludes bilateral agreements obliging the counterparties to comply with the necessary measures to ensure the personal data security.

Especially, the Operator may transfer the personal data to the Republic of Turkey.

Operator independently implements the organizational and technical measures to ensure the security of personal data during the transfer of personal data to the third parties.

Measures on Ensuring the Security and Privacy of the Personal Data

Operator takes the following technical and organizational measures to ensure the security and privacy of the personal data by acting in accordance with the principles set out in the Policy:

• To appoint the persons responsible for the organization of the processing of personal data and ensuring personal data security;

• To enact local regulations, which define the policy on the processing of personal data and establish the procedures aimed at preventing and detecting violations of the conditions on the processing of personal data and eliminating the consequences of such violations;

• To inform the employees, who directly carry out the processing of personal data, about the provisions of legislation and local regulations, including personal data protection requirements, rules and conditions of personal data processing (including non-automated processing) and/or train such employees.

• To determine the rules of access to the personal data processed in the information systems and to take measures in order to record and monitor all transactions performed with data in the information systems.

• To provide the opportunity to determine and detect cases of unauthorized access to the personal data and to take the necessary measures to eliminate violations;

• To recover the personal data that has been altered or destroyed due to the unauthorized access.

Operator reserves the right to make changes on the Privacy Policy and shall notify the relevant parties of such changes regarding the processing of personal data, in particular, through the publication of an updated version on the website of the Operator at https://www.flo.com.kz/

In order to place in the page of the online store and the mobile application:

I have read the Privacy Policy of Ziylan Kz LLP.

I approve for the processing of my personal data in accordance with the provisions of the Privacy Policy of Ziylan Kz LLP.

COOKIE POLICY

This Cookie Policy regulates the processing of cookies by Ziylan Kz Limited Liability Partnership (BIN 151040011304, place of residence: Kazakhstan, Almaty city, Bostandyk county, Bayzakoy Avenue, No: 280, Office No: 15d, postal code: 050040) (hereafter “Operator”). Policy is an integral part of the Operator's Privacy Policy.

A cookie is a small file consisting of letters and numbers, which shall be placed on your device (computer, tablet or smart phone) when you visit the online store, mobile application or other websites of the Operator or when you view an advertisement.

Cookies are used to provide for you with convenience, when using the websites of the Operator, to provide for you with relevant or special content, to conduct market research as well as to analyze the websites of the Operator, to ensure their functioning and to improve their performance.

Information, which is received by the Operator as a result of the collection of cookies, is not associated with the data of specific users and is not transferred to the third parties.

When you visit the site, a cookie may be saved on your device (if the settings on your computer, tablet or smart phone allow cookies to be saved), which may be read later when you visit the site again. The cookie may not read data on your hard disk or cookies created by other websites.

Following categories of cookies may be placed on your device, when you navigate between the sections of the Operator's websites:

If you do not accept the use of cookies, change the settings of the device you use, when visiting the Operator's websites. When you do so, some functions of the Operator's websites may not be available to you.