This Privacy and Personal Data Processing Policy (hereinafter – the «Privacy Policy») is a public Agreement concluded between the owner of the Website www.ento.kz – IE «Ento Design» (hereinafter «ENTO») and the «User». This Policy has been drawn up in accordance with the requirements of the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 «On Personal Data and Their Protection», sets out the procedure for processing personal data and the measures to ensure the security of personal data, and applies to all information that ENTO may obtain about the User while the User is using the website.

This Privacy Policy uses the following terms and definitions:

• «Website» – the website located on the Internet at www.ento.kz. All exclusive rights to the Website and its individual elements (including software and design) belong in full to IE «Ento Design».
• «Website Administration» – employees authorised to manage the Website, acting on behalf of IE «Ento Design», who organise and/or carry out the processing of personal data and determine the purposes of processing personal data, the scope of personal data to be processed and the actions (operations) performed with personal data.
• «Non-personal data» – information automatically transmitted while the User views advertising blocks and visits pages on which the system's statistics script (pixel) is installed.
• «User» – a person who has access to the Website via the Internet and uses the website www.ento.kz
• «Personal data» – information relating to a specific data subject, or a data subject identifiable on its basis, recorded on an electronic, paper and/or other tangible medium.
• «Processing of personal data» – actions performed with personal data with or without the use of automation tools and aimed at the accumulation, storage, modification, supplementation, use, distribution, depersonalisation, blocking and destruction of personal data;
• «Website Services» – the set of services available to the User on the Website
• «Registration» – completion by the User of the Registration Form on the Website by entering the required information and sending scanned documents.
• «Registration Form» – a form on the Website that the User must complete in order to use the website in full. «ENTO» – the owner of the Website www.ento.kz – IE «ENTO Design»
• «Cookies» – a piece of data sent by a web server and stored on the User's computer, which the web client or web browser sends back to the web server in an HTTP request each time it attempts to open a page of the Website.
• «IP address» – a unique network address of a node in a computer network built on the IP protocol.

• 2.1 By registering on and using the Website, the User agrees to the terms of this Privacy Policy. If the User does not agree to the terms of this Privacy Policy, the User must stop using the Website immediately.
• 2.2 This Privacy Policy applies only to the website www.ento.kz; it does not control and is not responsible for third-party websites that the User may visit via links available on the Website.
• 2.3 ENTO does not verify the accuracy of the personal data provided by the User. However, ENTO assumes that the User provides accurate personal data and keeps such data up to date. The User bears full responsibility, as well as any possible consequences, for providing inaccurate or outdated personal data.

• 3.1. This Privacy Policy establishes the obligations of the Website Administration to keep confidential and to ensure the protection of the confidentiality of the personal data that the User provides at the request of the Website Administration when registering on the Website or placing an order in order to use any Website Services.
• 3.2. Personal data permitted for processing under this Privacy Policy may include the following information:
• 3.2.1. the User's surname and first name;
• 3.2.2. the User's contact telephone numbers;
• 3.2.3. email address;
• 3.2.4. date of birth;
• 3.2.5. gender;
• 3.2.6. bank details of the individual, including payment card data;
• 3.2.7. data on loyalty programme membership status.
• 3.3. The Website protects Non-personal data:
  • IP address;
  • information from cookies;
  • information about the browser (or other program used to access the advertising display);
  • access time;
  • the address of the page on which the advertising block is located;
  • referrer (address of the previous page).
• 3.3.1. Disabling cookies may make it impossible to access parts of the Website that require authorisation, including making it impossible to place an order on the Website.
• 3.3.2. The Website collects statistics on the IP addresses of its visitors. This information is used to identify and resolve technical problems.
• 3.4. Any other personal information not specified above (purchase history, browsers and operating systems used, etc.) is subject to secure storage and non-disclosure, except in the cases provided for in clauses 5.2 and 5.3 of this Privacy Policy.

• 4.1. ENTO collects, processes and stores only the personal data necessary to provide the Services and/or for the User to purchase goods from the online store catalogue.
• 4.2. ENTO uses the User's personal data for the purposes of:
• 4.2.1. identifying the User in order to place an order and/or conclude a Sales Agreement for goods;
• 4.2.2. processing and receiving payments from the User;
• 4.2.3. delivering goods to the User;
• 4.2.4. providing the User with effective customer support;
• 4.2.5. providing the User with personalised Website Services;
• 4.2.6. communicating with the User, including sending notifications, requests and information regarding the use of the Website Services and the provision of services, as well as processing requests and applications from the User;
• 4.2. ENTO uses the User's personal data for the purposes of:
• 4.2.7. improving the quality and usability of the Website Services and developing new Services and services;
• 4.2.8. informing the User about events and promotions;
• 4.2.9. conducting statistical and other research based on non-personal data, as well as optimising advertising messages.

• 5.1. The User's personal data are processed without time limit, by any lawful means, including in personal data information systems, with or without the use of automation tools.
• 5.2. The User agrees that the Website Administration may transfer personal data to third parties, in particular courier services, postal organisations and mobile network operators, solely for the purpose of fulfilling the User's order and informing the User of its progress.
• 5.3. The User's personal data may be transferred to the authorised state authorities of the Republic of Kazakhstan only on the grounds and in the manner established by the legislation of the Republic of Kazakhstan.
• 5.4. In the event of loss or disclosure of personal data, the Website Administration informs the User of the loss or disclosure of personal data.
• 5.5. The Website Administration takes the necessary organisational and technical measures to protect the User's personal data from unlawful or accidental access, destruction, modification, blocking, copying and distribution, as well as from other unlawful actions of third parties.
• 5.6. The Website Administration, together with the User, takes all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the User's personal data.

• 6.1. The User must:
• 6.1.1. Provide up-to-date personal data information requested by the Website at the time of its use.
• 6.2. The User has the right:
• 6.2.1. To access and edit personal data information at any time via the Website's web interface.
• 6.3. The Website Administration must:
• 6.3.1. Use the information received solely for the purposes specified in clause 4 of this Privacy Policy.
• 6.3.2. Keep confidential information secret, not disclose it without the User's prior written permission, and not sell, exchange, publish or otherwise disclose the User's personal data provided, except as set out in clauses 5.2 and 5.3 of this Privacy Policy.
• 6.3.3. Take precautions to protect the confidentiality of the User's personal data in accordance with the procedures customarily used to protect this kind of information in existing business practice.
• 6.3.4. Block the personal data relating to the relevant User from the moment of an application or request by the User, their legal representative or the authorised body for the protection of the rights of personal data subjects, for the period of verification, if inaccurate personal data or unlawful actions are detected.
• 6.4. The Website Administration has the right:
• 6.4.1. To grant third parties access to collect and analyse the User's non-personal data for the purposes of statistics and optimising advertising messages. The use of non-personal data by third parties is governed by their own privacy policies, and the Website Administration is not responsible for such use.

• 7.1. The Administration ensures the protection of personal data, which is guaranteed by the state, and takes the necessary personal data protection measures to ensure:
• 7.1. prevention of unauthorised access to personal data;
• 7.2. timely detection of unauthorised access to personal data, if such unauthorised access could not be prevented;
• 7.3. minimisation of the adverse consequences of unauthorised access to personal data.
• The obligations of the Administration, as well as of a third party, to protect personal data arise from the moment the personal data are collected and remain in effect until the data are destroyed or depersonalised.
• 7.4. Personal data are collected and processed only where their protection is ensured.
• 7.5. Personal data are protected by applying a set of measures, including legal, organisational and technical measures, in order to:
• 7.5.1. exercise the rights to privacy and to personal and family secrets;
• 7.5.2. ensure their integrity and safety;
• 7.5.3. maintain their confidentiality;
• 7.5.4. exercise the right of access to them;
• 7.5.5. prevent their unlawful collection and processing.

• 8.1. If the Website Administration fails to fulfil its obligations, it is liable for losses incurred by the User in connection with the unlawful use of personal data in accordance with the legislation of the Republic of Kazakhstan, except in the cases provided for in clauses 5.2, 5.3 and 7.2 of this Privacy Policy.
• 8.2. In the event of loss or disclosure of Confidential information, the Website Administration is not liable if such confidential information:
• 8.2.1. Became public knowledge before its loss or disclosure.
• 8.2.2. Was received from a third party before it was received by the Website Administration.
• 8.2.3. Was disclosed with the User's consent.

• 9.1. Before filing a lawsuit in court over disputes arising from relations between a Website User and the Website Administration, it is mandatory to submit a claim (a written proposal for voluntary settlement of the dispute).
• 9.2. The Website Administration notifies the claimant in writing of the results of the review of the claim within the time limits established by the current legislation of the Republic of Kazakhstan.
• 9.3. If no agreement is reached, the dispute will be referred to a court in accordance with the current legislation of the Republic of Kazakhstan.
• 9.4. This Privacy Policy and the relations between the User and the Website Administration are governed by the current legislation of the Republic of Kazakhstan.

• 10.1. The Website Administration may amend this Privacy Policy without the User's consent.
• 10.2. The new Privacy Policy enters into force from the moment it is posted on the Website, unless otherwise provided by the new version of the Privacy Policy.
• 10.3. Users may send their requests to the Website Administration, including requests regarding the use of their personal data, in writing to the email address: designento@gmail.com.
• 10.4. A request sent by the User must comply with the requirements for submitting requests to the Customer Service and Support team, namely, it must contain: