Privacy Policy

1.1. This Privacy Policy (the Policy) explains what personal data the City Mall website trc-citymall.kz (the Website) collects, what it is used for, where it is stored and how it is protected.

1.2. The Policy has been prepared in accordance with the Constitution of the Republic of Kazakhstan, Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection” (the Law), the Digital Code of the Republic of Kazakhstan and other legal acts of the Republic of Kazakhstan.

1.3. By submitting a form on the Website or clicking “Got it” in the cookie banner, you confirm that you have read the Policy. If you do not agree with it, do not submit forms and disable cookies in your browser settings.

2.1. The owner and operator of the personal data collected through the Website is Trading Company MDM LLP (the Operator).

• BIN: 040840002587
• Legal and actual address: Republic of Kazakhstan, 56 Ch. Valikhanov St., Petropavlovsk
• E-mail for personal data requests: info_citymall@mail.ru
• Phone: +7 (708) 432-15-87

3.1. Through the leasing request form: name, phone number, company or brand name, the space you are interested in and a comment. Through the “Notify me” form on the “For tenants” page: only a phone number.

3.2. Through the feedback form: type and topic of the message, the message text, a phone number and, optionally, a store and photos. The phone number is used only to contact you about the message and is not shared with tenants or third parties, except in the cases listed in section 7. Please do not attach photos in which other people can be recognised.

3.3. Technical data — only if you have accepted analytics cookies: an anonymised browser identifier, device and browser type, approximate location down to the city, pages viewed, referral source, date and time of the visit.

3.4. We do not request your IIN, identity document details, biometric data or other restricted information. Please do not include them in your messages.

4.1. We process personal data in order to:

• review a leasing request and contact you about it;
• answer your question or message;
• ensure the operation and security of the Website;
• collect anonymised visit statistics to improve the Website — only with your consent to analytics cookies.

4.2. We do not use your data for advertising mailings without separate consent and do not make decisions about you based solely on automated processing.

5.1. We process personal data on the basis of your consent. Consent is given electronically: by ticking “I agree to the collection and processing of my personal data in accordance with the Privacy Policy” before submitting a form, and for analytics cookies — by clicking “Got it” in the cookie banner.

5.2. Without consent, data is processed only in the cases expressly provided for by Article 9 of the Law.

5.3. You may withdraw your consent by sending a request to info_citymall@mail.ru or to the Operator’s address. Consent to cookies can be withdrawn by deleting cookies and Website data and blocking cookies in your browser settings. After withdrawal, we stop processing and delete the data within the time limits set by the Law, unless storage is required by the legislation of the Republic of Kazakhstan.

6.1. Form data is stored in the Website database on servers located in the Republic of Kazakhstan, in accordance with paragraph 2 of Article 12 of the Law.

6.2. Retention periods:

• leasing requests and feedback messages — 3 years from the last message or until consent is withdrawn;
• detailed analytics data in Google Analytics — 14 months (the maximum period in Google Analytics); aggregated anonymised visit statistics — indefinitely;
• the consent mark of the cookie banner — in your browser until you delete the Website data.

6.3. When the retention period expires or the purposes of processing are achieved, the data is deleted or anonymised.

7.1. We do not sell your data and do not share it with third parties, except:

• the Operator’s employees who handle requests and messages;
• contractors who maintain the Website and the server — under a contract and an obligation of confidentiality;
• government authorities — in the cases provided for by the legislation of the Republic of Kazakhstan.

7.2. Cross-border transfer. If you have accepted analytics cookies, technical data is transferred to Google Analytics (Google LLC, USA, and Google Ireland Limited). The basis is your consent under Article 16 of the Law. Google Analytics 4 does not store IP addresses. Form data is not transferred outside the Republic of Kazakhstan.

7.3. 2GIS, Google and Yandex maps on the home page and the “Contacts” page load only after you click the map. The chosen service then receives your IP address and may store its own cookies; it processes this data under its own privacy policy.

8.1. Cookies are small files that the Website stores in your browser. The browser’s local storage (localStorage) works in a similar way. We use:

• a necessary local storage entry — it remembers that you have closed the cookie banner. Always on;
• analytics cookies — Google Analytics: they show which pages are visited and where visitors come from. Turned on only after clicking “Got it”;
• map cookies of 2GIS, Google and Yandex — set by the services themselves, only after you click the map (p. 7.3).

8.2. On your first visit, the Website shows a cookie banner. Analytics cookies are turned on only after clicking “Got it”. You can refuse them at any time: delete cookies and Website data and block cookies in your browser settings.

9.1. We take legal, organisational and technical protection measures:

• data between your browser and the Website is encrypted with HTTPS;
• only authorised employees of the Operator have access to requests, using personal accounts;
• actions in the Website control panel are logged;
• database backups are made regularly.

9.2. In the event of a personal data security breach, the Operator notifies the authorised body in the manner and within the time limits set by the legislation of the Republic of Kazakhstan.

10.1. Under Article 24 of the Law, you have the right to:

• know whether the Operator holds your personal data and obtain it;
• request that your data be changed or supplemented if it is incomplete or inaccurate;
• request that your data be blocked or deleted if it is processed in violation of the law;
• withdraw your consent to collection and processing;
• object to decisions made solely on the basis of automated processing;
• protect your rights before the authorised personal data protection body or in court.

10.2. To exercise your rights, write to info_citymall@mail.ru or send a letter to the Operator’s address marked “Personal data”. We will reply within the time limits set by the legislation of the Republic of Kazakhstan.

11.1. The forms on the Website are intended for adults. If you are under 18, submit them only with the consent of your parents or other legal representatives.

12.1. The Operator may update the Policy. A new version takes effect from the moment it is published on the Website. The current version is always available on this page; the version date is shown at the top.

13.1. For questions about personal data processing, write to info_citymall@mail.ru, call +7 (708) 432-15-87 or visit the mall administration: 56 Ch. Valikhanov St., Petropavlovsk.