Privacy Policy.

The operator of personal data within the meaning of article 1 of the Law of the Republic of Kazakhstan «On personal data and its protection» of 21.05.2013 № 94-V (Law 94-V) is Товарищество с ограниченной ответственностью «Universe Pharma (Юниверс Фарма)», BIN 230540026088, registered address: Republic of Kazakhstan, 050026, Almaty, Baizakov str. 202, room 32 (the Operator).

All requests concerning personal-data processing should be sent to 0020602@mail.ru or to the Operator's postal address.

The Operator processes the following categories of personal data provided voluntarily by the user upon registration, order placement, or contacting support:

• last name, first name;
• contact phone;
• email address;
• delivery address;
• order and payment history (without storing full payment-card details);
• technical data: IP address, cookie identifiers, browser type, referrer, on-site behaviour.

Biometric and special categories of personal data (within the meaning of article 1 of Law 94-V) are not processed.

Personal data is processed exclusively for the following purposes:

• conclusion and performance of the retail sale agreement (delivery, payments, returns);
• fiscal reporting and dispatch of electronic receipts;
• notifying the user about order status, assortment updates, and service messages;
• customer support operations;
• aggregated traffic analytics and UX improvement;
• compliance with the laws of the Republic of Kazakhstan.

The legal basis for processing is the data subject's consent, expressed by ticking the corresponding box at registration or checkout (article 8 of Law 94-V), and the obligations arising from the retail sale agreement (article 9 of Law 94-V).

The primary database of personal data is physically located in the territory of the Republic of Kazakhstan in accordance with article 12 of Law 94-V (localisation requirement). Backups may be located outside the Republic of Kazakhstan solely in anonymised or encrypted form.

Retention period: for the lifetime of the user account plus three years following its last use (to handle possible claims), or until consent is withdrawn — whichever comes first. Payment records are retained for the period prescribed by the Tax Code of the Republic of Kazakhstan — five years.

The Operator does not transfer personal data to third parties except where necessary to perform the agreement, namely:

• to the internet-acquiring service of JSC Bank CenterCredit (BCC) — to the extent necessary to process payments;
• to delivery partners — to the extent necessary to deliver the order (full name, phone, address);
• to the fiscal-data operator — to the extent required to issue a fiscal receipt;
• to authorised state bodies — upon their reasoned request, in accordance with the laws of the Republic of Kazakhstan.

Cross-border transfer of personal data to countries that do not provide adequate protection is carried out only with the explicit consent of the data subject.

Under articles 24-26 of Law 94-V the data subject is entitled to:

• obtain information about processing of their personal data;
• request correction and supplementation of their data with valid grounds;
• request blocking or destruction of data processed in violation of legal requirements;
• withdraw previously given consent;
• appeal the actions (inaction) of the Operator to the authorised personal-data-protection body.

The Operator responds to a data subject's written request within no more than three business days of receipt.

The Site uses strictly necessary cookies for cart and authentication functionality, and analytic cookies for aggregated traffic analysis. Analytics is implemented in-house by the Operator without transferring data to third parties.

The user gives informed consent to the use of cookies by acknowledging the cookie banner on the Site. The user may disable cookies in the browser settings; in that case some Site functionality may be unavailable.

The Operator applies legal, organisational and technical safeguards in accordance with Law 94-V and secondary legislation of the authorised body, including: TLS encryption of data in transit, access-rights segregation, regular backups, and audit logging of database operations.

The Operator may amend this Policy unilaterally by publishing a new revision on the Site. Material changes affecting the rights of data subjects are additionally notified to registered users at the email address on file.