Privacy Policy

1. General Provisions

1.1. This Privacy Policy (hereinafter — the "Policy") establishes the procedure for the collection, processing, storage, use, transfer and protection of the personal data of users of the online store shop.lamelacosmetics.com (hereinafter — the "Website"), as well as of persons placing orders through the official account of the "La mela" brand on the social network Instagram (@lamelacosmetics) and the WhatsApp messenger.

1.2. The operator (owner of the database) of personal data is the Limited Liability Partnership "La Pomme Group", BIN 240940003095, address: 050040, Republic of Kazakhstan, city of Almaty, Bostandyk district, Al-Farabi avenue, building 41/3-67 (hereinafter — the "Operator").

1.3. The Policy has been developed in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" dated 21 May 2013 No. 94-V, the Law of the Republic of Kazakhstan "On Protection of Consumer Rights" dated 4 May 2010 No. 274-IV and other applicable legislation of the Republic of Kazakhstan.

1.4. By using the Website and (or) placing an Order, the visitor (hereinafter — the "User", the "personal data subject") confirms that they have read the terms of this Policy and gives consent to the collection and processing of their personal data on the terms set out herein. Consent is given by ticking the relevant box on the Website or by conduct implying consent (placing an order, subscribing to the newsletter). The text of the consent is set out in the document "Consent to the Processing of Personal Data".

1.5. If the User does not agree with the terms of this Policy, they shall cease using the Website and refrain from transferring their personal data to the Operator.

1.6. The person responsible for organising the processing of personal data is the director of "La Pomme Group" LLP, Kassenova Dinara M. Contact for enquiries on personal data matters: info@lamelacosmetics.com with the subject line "Personal Data".

1.7. The person responsible for the information and technical support of the Website and for the implementation of technical personal data protection measures is the technical director of "La Pomme Group" LLP, Kassymkul Temirlan Y., t.kassymkul@lamelacosmetics.com.

2. Categories of Personal Data

2.1. Depending on the manner of interaction with the Website, the Operator may collect the following categories of data:

• surname, first name, patronymic (where indicated) of the User;
• contact telephone number;
• e-mail address;
• preferred method of communication;
• WhatsApp number or account (username) on Instagram — where communication via a messenger is chosen;
• the content of correspondence with the Seller's operator in the WhatsApp messenger or Instagram Direct;
• the delivery address of the Goods: city, street, building, apartment, postal code, number of the post office branch;
• data required for payment for the Goods — processed by payment systems and acquiring banks; the Operator does not receive or store payment card details, with the exception of the masked card number (the first six and the last four digits) transmitted by the bank for information purposes;
• the history of the User's orders and preferences;
• information on the consents given by the User: the fact of consent, the date and time, the IP address, the type and version of the browser, the page language, the edition of the document and the checksum of the text of the consent banner to which the User agreed — stored as confirmation of the receipt of consent and not subsequently altered;
• technical data: IP address, type and version of the browser and device, cookie identifiers and advertising identifiers, the source of referral to the Website, information on the pages viewed and the actions performed (viewing a product, adding to the cart, placing an order);
• where consent to marketing cookies has been given — irreversibly transformed (hashed) e-mail address, telephone number, first name, surname, city, postal code and country, as well as the internal identifiers of the Website visitor and of the buyer, used by advertising services to match advertising impressions and purchases;
• other data voluntarily provided by the User when contacting customer support, participating in Promotions or subscribing to the newsletter.

2.2. The Operator does not process special categories of personal data (concerning the state of health, racial or ethnic origin, religious or other beliefs), except where information on intolerance to ingredients of the Goods is communicated by the User voluntarily for the purpose of obtaining a consultation and is used exclusively for that purpose.

2.3. The procedure for the processing of the personal data of persons who have not attained the age from which the legislation of the Republic of Kazakhstan permits the independent conclusion of transactions of this kind is set out in section 10 of this Policy.

3. Purposes of the Processing of Personal Data

3.1. Personal data are processed for the following purposes:

• conclusion and performance of the retail sale contract: processing, confirmation and delivery of the Order, informing of its status;
• communication with the User in order to confirm the contents of the Order and the delivery address prior to its dispatch;
• identification of the User, creation and administration of the account (where such a function is available);
• effecting settlements, generating and sending the fiscal receipt, issuing documents;
• transfer to the postal service of the data required for delivery;
• informing of new products, promotions and special offers — only where separate consent to receiving advertising or marketing mailings has been given;
• consideration of the User's enquiries, claims and reviews, including matters of the quality of the Goods;
• handling of disputes concerning payments, including where a payment dispute (chargeback) procedure is initiated, and provision of the necessary information to the acquiring bank;
• improvement of the operation of the Website, analytics of traffic and customer experience;
• measurement of the effectiveness of advertising campaigns, building of audiences for advertising and assessment of the return on advertising expenditure — where the User has consented to the use of marketing cookies;
• ensuring security and preventing fraudulent actions;
• compliance with the requirements of the legislation of the Republic of Kazakhstan, including tax and accounting requirements.

3.2. The processing of personal data is limited to the achievement of the specific, predetermined and lawful purposes set out in this section, in accordance with paragraph 8 of Article 7 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection".

4. Legal Grounds for Processing

4.1. The legal ground for the processing of personal data is the consent of the personal data subject, given in the manner provided for in Article 8 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection". The processing is carried out on the conditions and within the limits established by Article 7 of the said Law.

4.2. In the cases expressly provided for by the laws of the Republic of Kazakhstan, certain information is processed without the consent of the personal data subject — in particular, where the Operator discharges obligations imposed on it by tax legislation, by the legislation on accounting and financial reporting, and by the legislation on consumer protection (Article 9 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection").

4.3. Consent is given by the User for the period necessary to achieve the purposes of processing set out in section 3 of this Policy, and may be withdrawn at any time in the manner provided for in section 8 of this Policy. The withdrawal of consent does not terminate the processing of information the storage of which is mandatory by virtue of the legislation of the Republic of Kazakhstan.

5. Procedure for the Collection, Storage and Transfer of Data

5.1. Personal data are collected directly from the User when placing an Order, registering on the Website, subscribing to the newsletter, contacting customer support or in any other manner expressly provided for in this Policy.

5.2. Place of data storage. The database containing the personal data of citizens of the Republic of Kazakhstan is located on servers situated within the territory of the Republic of Kazakhstan, in accordance with Article 12 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection". Backup copies of the database are likewise stored within the territory of the Republic of Kazakhstan.

5.3. The Operator takes the necessary organisational and technical measures to protect personal data against unlawful access, erasure, alteration, blocking, copying, dissemination, as well as against other unlawful acts of third parties, including: encryption of the data transmission channel (HTTPS/TLS), differentiation of employees' access rights, two-factor authentication for access to the administrative panel, logging of actions performed with the data, and regular backup.

5.4. For the purposes of performing the Order and ensuring the operation of the Website, the Operator shall be entitled to transfer the User's personal data to the following categories of third parties to the extent necessary for the provision of the relevant services:

• Kazpost JSC — for delivery of the Goods to localities outside Almaty and Astana (surname, first name, telephone, post office number). Delivery within Almaty and Astana is carried out by the Operator itself, by its own employees, and the User's data are not transferred to third parties for that purpose;
• acquiring banks and payment systems — for the purposes of processing payments and handling disputes;
• the fiscal data operator and the provider of the cloud cash register — COMRUN LLP (the re:Kassa service, Republic of Kazakhstan) — for the purposes of generating the fiscal receipt, transmitting it to the fiscal data operator and sending the receipt to the User. The e-mail address, the names, quantities and prices of the Order items and the amount paid are transferred;
• providers of IT services and hosting — for the purposes of the technical support of the operation of the Website;
• Meta Platforms, Inc. and its affiliates — where the WhatsApp messenger and Instagram Direct are used for communication, if the User has chosen that method of communication, and where Meta's web analytics services and advertising services are used — subject to the User's consent to the use of marketing cookies;
• Google LLC and its affiliates — where the Google Analytics web analytics service is used, subject to the User's consent to the use of analytics cookies;
• the RANDOM.ORG random number generation service — when conducting prize draws, exclusively in anonymised form: limited to the sequential numbers of entries, which do not permit the identification of a participant. The matching of the sequential number and the participant is stored solely with the Operator within the territory of the Republic of Kazakhstan;
• state authorities of the Republic of Kazakhstan — in the cases and in the manner expressly provided for by the legislation of the Republic of Kazakhstan.

5.5. The Operator does not transfer or sell the personal data of Users to third parties for marketing purposes without the separate consent of the User.

5.6. Cross-border transfer of personal data

5.6.1. The principal operations involving the processing of personal data are carried out exclusively within the territory of the Republic of Kazakhstan: the acceptance and performance of Orders, settlements, delivery, the maintenance of the database of personal data and of its backup copies, and the Operator's corporate e-mail. The Operator's servers are located in the Republic of Kazakhstan.

5.6.2. At the same time, where certain communication, web analytics and advertising services are used, part of the User's data is transferred to persons located outside the Republic of Kazakhstan. Such transfer is carried out on the basis of the consent of the personal data subject in accordance with Article 16 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection".

5.6.3. The list of cases of cross-border transfer, the categories of data transferred and the purposes of the transfer:

WhatsApp messenger. Recipient — Meta Platforms, Inc. and its affiliates (United States of America, Ireland). Data transferred: name, telephone number, the content of correspondence, information on the contents and status of the Order. Purpose: communication with the User for the confirmation and support of the Order. Basis: the User's choice of this method of communication.

Instagram Direct. Recipient — Meta Platforms, Inc. and its affiliates (United States of America, Ireland). Data transferred: account (username), the content of correspondence, information on the contents and status of the Order. Purpose: acceptance and support of Orders placed through the official account of the brand, and communication with the User. Basis: the User's enquiry through this channel or their choice of this method of communication.

Meta's web analytics services and advertising services, including the Meta pixel. Recipient — Meta Platforms, Inc. and its affiliates (United States of America, Ireland). Data transferred: IP address, type of device and browser, cookie identifiers and advertising identifiers, source of referral, information on the pages viewed and the actions performed on the Website (viewing a product, adding to the cart, placing and paying for an Order), the number, amount and contents of the Order (the SKUs, quantity and price of the Goods), and also the irreversibly transformed (hashed) e-mail address, telephone number, first name, surname, city, postal code, country and internal identifiers of the Website visitor and of the buyer. Part of the said information is transferred not from the User's browser but from the Operator's server: information on viewing a product, adding a product to the cart and starting to place an Order — at the same time as the transfer from the browser, and information on a paid Order — after payment has been confirmed by the bank. Information on a return is not transferred to Meta's advertising services. Purpose: measurement of the effectiveness of advertising, building of audiences for advertising. Basis: the User's consent to the use of marketing cookies.

Google Analytics. Recipient — Google LLC and its affiliates (United States of America, Ireland). Data transferred: cookie identifiers or, where analytical cookies are unavailable in the User's browser, an internal Order identifier not linked to any other information about the User, type of device and browser, source of referral, information on the pages visited and the actions performed, and also the number, amount and contents of the Order (the SKUs, quantity and price of the Goods). Information on a paid Order and on a return is transferred from the Operator's server; the User's IP address is not sent with such a transfer. Where a request is made from the User's browser, the IP address is used by Google to determine the approximate location and is not retained in the reports. Purpose: analysis of traffic and user behaviour in order to improve the operation of the Website. Basis: the User's consent to the use of analytical cookies.

RANDOM.ORG. Recipient — the operator of the random number generation service (Ireland). Data transferred: exclusively anonymised sequential numbers of entries and the number of participants in the prize draw. The personal data of participants are not transferred; the matching of the sequential number and the participant is stored solely with the Operator within the territory of the Republic of Kazakhstan.

5.6.4. What is not transferred outside the Republic of Kazakhstan. The Operator does not transfer to foreign persons the User's delivery address, identity documents, or payment card details. Payments are processed by the acquiring bank — a legal entity of the Republic of Kazakhstan; the transfer of data to international payment systems is carried out by the bank in accordance with the rules of those systems and to the extent necessary for effecting the transaction. The fiscal receipt is generated by a cash register whose provider and whose fiscal data operator are both legal entities of the Republic of Kazakhstan; no data for generating the receipt is transferred outside the Republic of Kazakhstan.

5.6.5. How to decline cross-border transfer. The User shall be entitled to:

• choose a telephone call or e-mail as the method of communication instead of messengers — in which case the User's data are not transferred to Meta Platforms;
• decline analytical and marketing cookies in the consent banner upon the first visit to the Website, or change their choice in the Website settings at any time — in which case the scripts of Google Analytics and of Meta's services are not loaded and the data are not transferred;
• withdraw the consent previously given in the Website settings: following withdrawal, the scripts of Google and Meta are stopped, the corresponding cookies are deleted, and the transfer of information from the Operator's server ceases, including in respect of Orders placed earlier;
• make use of the advertising preference settings directly in Meta's and Google's services.

Declining cross-border transfer does not affect the ability to place, pay for and receive an Order.

5.6.6. The Operator does not transfer personal data outside the Republic of Kazakhstan for purposes other than those specified in this clause.

5.7. Conducting prize draws. When determining the winners of Promotions, the Operator uses the RANDOM.ORG random number generation service. The personal data of participants — surname, first name, telephone number, e-mail address, social network accounts — are not transferred to the said service. Exclusively anonymised sequential numbers of entries are transferred to the service; the matching of the sequential number and the participant is stored solely with the Operator within the territory of the Republic of Kazakhstan. The detailed procedure is described in the Regulation on the Conduct of Promotions.

5.8. Notification of the transfer of data. The Operator informs the User of the transfer of the User's personal data to third parties in the Order confirmation message sent to the e-mail address indicated by the User, specifying the categories of recipients and the categories of information transferred. The message is sent within a period not exceeding ten working days from the moment of transfer, in accordance with Article 19 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection".

6. Use of Cookies

6.1. The Website uses cookies and similar technologies. Cookies are divided into the following categories:

• strictly necessary — ensure the operation of the cart, the retention of the contents of the order, authorisation and protection against request forgery. Without them the Website cannot function, and they are therefore used without separate consent;
• analytical — make it possible to collect statistics on traffic and behaviour on the Website with a view to improving its operation. The Google Analytics service (Google LLC) is used. They are applied only with the User's consent;
• marketing — used to assess the effectiveness of advertising, to build audiences and to display relevant offers. The Meta pixel and Meta's advertising services (Meta Platforms, Inc.) are used. They are applied only with the User's consent.

6.2. Upon the first visit to the Website, the User is invited to choose which categories of cookies they permit: "Accept all", "Necessary only" or "Customise". Declining analytical and marketing cookies means that the corresponding scripts are not loaded on the Website at all and the data are not transferred to Google and Meta. The User may change their choice at any time in the Website settings.

6.3. No third-party scripts are placed on the Order checkout page. Analytical and advertising services do not operate on that page: information on the purchase made is transferred to the advertising services from the Operator's server after payment has been confirmed, without the involvement of the User's browser. This is done in order to protect the data entered when placing the Order.

6.4. The User may independently restrict or disable the use of cookies in the settings of their browser; this may, however, affect the availability of certain functions of the Website.

6.5. The User shall also be entitled to manage the display of personalised advertising directly in the advertising preference settings of Meta's and Google's services.

6.6. Consent to the use of analytical and marketing cookies is valid for 12 months. Upon the expiry of that period, and also where the list of cookies used is changed, the consent banner is displayed again.

6.7. The history of the User's choice — the date and time, the categories permitted, the edition of this Policy, the page language, the IP address and the type of browser — is stored by the Operator as confirmation of the consent received and is not altered. The current list of cookies used, indicating their purpose, their storage period and by whom they are set, is set out in the Website settings at shop.lamelacosmetics.com/en/legal/cookies.

7. Measures in the Event of a Personal Data Security Breach

7.1. If unlawful access to personal data, or their loss, alteration or dissemination, is identified, the Operator shall take measures to localise and eliminate the consequences of the incident.

7.2. Upon discovery of a personal data security breach, the Operator shall notify the authorised body for personal data protection within one working day of the discovery of the breach. The notification shall state the contact details of the person responsible for organising the processing of personal data, information on the measures taken to remedy the breach, and information on the affected personal data subjects to the extent provided for by the legislation of the Republic of Kazakhstan.

7.3. The notification of personal data subjects of a personal data security breach shall be carried out in the manner established by the legislation of the Republic of Kazakhstan, through the electronic government infrastructure. The Operator shall be entitled additionally to inform the affected Users using the contact details they have provided.

7.4. The Operator shall maintain a record of personal data security incidents and of the measures taken in respect of them.

8. Rights of the Personal Data Subject

8.1. In accordance with Article 24 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection", the User shall be entitled to:

• receive, free of charge, information concerning the processing of their personal data, including information on the purposes, the sources, the categories of data and the periods of their storage, and to access their personal data;
• demand the clarification, blocking or erasure of their personal data where such data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw their consent to the processing of personal data;
• give or withhold consent to the dissemination of their personal data in publicly accessible sources;
• demand the cessation of the receipt of advertising and marketing mailings;
• appeal against the acts or omissions of the Operator to the authorised body for personal data protection or through the courts;
• demand compensation for losses and (or) compensation for moral harm through the courts in the event of a violation of their rights relating to the processing of personal data.

8.2. In order to exercise the said rights, the User shall send an enquiry to the e-mail address info@lamelacosmetics.com with the subject line "Personal Data", or to the postal address of the Operator. The enquiry should indicate the surname, first name, telephone number or e-mail address used when placing the order, and the substance of the demand.

8.3. The Operator shall consider the enquiry and provide a response on the merits within 15 (fifteen) calendar days of its receipt, unless another period is established by the legislation of the Republic of Kazakhstan.

8.4. The Operator shall carry out the amendment and (or) supplementation of personal data, their blocking, their erasure and the removal of blocking within one working day of receipt of the relevant enquiry and of the documents confirming that it is well founded — in accordance with subparagraph 8 of paragraph 2 of Article 25 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection".

8.5. The withdrawal of consent to the processing of personal data shall entail the cessation of processing and the erasure or anonymisation of the data, with the exception of information the storage of which is mandatory by virtue of the legislation of the Republic of Kazakhstan (in particular, information on transactions effected, subject to storage as part of primary accounting and tax documents).

8.6. Advertising mailings may be declined via the "Unsubscribe" link in each message or by an enquiry to the address indicated above.

9. Period of Storage of Personal Data

9.1. Personal data are stored for the period necessary to achieve the purposes of their processing set out in section 3 of this Policy, unless another period is established by the legislation of the Republic of Kazakhstan, in particular by the requirements for the storage of primary accounting and tax documents.

9.2. Data used to subscribe to the newsletter are stored until the User withdraws their consent.

9.3. Upon achievement of the purposes of processing, or in the event of the withdrawal of consent, personal data shall be subject to erasure or anonymisation, except where their further storage is expressly provided for by the legislation of the Republic of Kazakhstan.

9.4. Consent to the use of cookies is valid for 12 months. The history of the User's choice is stored for no more than two years from the date of the last choice and, where the User has declined analytical and marketing cookies, for no more than one year from the date of the refusal.

9.5. Information on the events transferred to web analytics services and advertising services is stored in the dispatch queue for no more than 30 days from the moment of the transfer.

10. Processing of the Data of Minors

10.1. The Website is not intended for persons who have not attained the age from which, in accordance with the legislation of the Republic of Kazakhstan, the independent conclusion of transactions of this kind is permitted. The placing of Orders in the interests of minors shall be carried out by their legal representatives.

10.2. If it becomes known to the Operator that personal data have been obtained from a person who has not attained the said age, without the consent of that person's legal representative, such data shall be erased within one working day of the establishment of that circumstance, and the corresponding Order shall be agreed with the legal representative or cancelled.

11. Amendment of the Privacy Policy

11.1. The Operator shall be entitled to make amendments to this Policy. The new edition shall enter into force from the moment of its posting on the Website at shop.lamelacosmetics.com/en/legal/privacy, unless otherwise provided for by the new edition.

11.2. The Operator recommends that Users regularly review the current edition of this Policy.

12. Contact Details of the Operator

Limited Liability Partnership "La Pomme Group"

• Country: Republic of Kazakhstan
• City: Almaty
• Registered address: 050040, Republic of Kazakhstan, city of Almaty, Bostandyk district, Al-Farabi avenue, building 41/3-67
• BIN: 240940003095
• Person responsible for organising the processing of personal data: director Kassenova Dinara M.
• Person responsible for information and technical support and technical protection measures: technical director Kassymkul Temirlan Y., t.kassymkul@lamelacosmetics.com
• E-mail for personal data matters: info@lamelacosmetics.com
• Telephone: +7 701 013 0748
• Working hours: daily from 09:00 to 20:00 (UTC+5)

13. Language of the document

This document is published in the Kazakh, Russian and English languages. Legal force is vested in the Kazakh and Russian texts, which have equal legal force.

The English text is published for the convenience of foreign customers, has no legal force and shall not apply in the event of any discrepancy with the Kazakh and Russian texts — in such case the Kazakh text shall prevail.

Any discrepancy between the texts shall be eliminated by publishing a corrected edition.