Privacy policy

This Privacy Policy (the “Policy”) describes how personal data of users of the gippokrat.kz website and the Gippokrat pharmacy chain's mobile application is collected, used, stored and protected.

The Policy has been drawn up in accordance with the Law of the Republic of Kazakhstan “On personal data and its protection” No. 94-V of 21 May 2013 (the “Personal Data Law”).

1. Personal data operator

Gippokrat MFC LLP, BIN 060440000708
010000, Astana, 46 Respubliki Ave.
E-mail: info@gippokrat.kz

2. What data we collect

While you use the Site, we may collect the following personal data:

• Identification data: last name, first name, patronymic.
• Contact data: phone number, e-mail address.
• Address data: city, delivery address.
• Transaction data: order history, line items, amounts, payment methods.
• Loyalty programme data: bonus balance, transactions, tier.
• Technical data: IP address, browser type, operating system, information about the pages visited (collected automatically via cookies).

3. Purposes of data processing

Personal data is processed solely for the following purposes:

• performance of the retail sale contract (processing and delivering orders);
• registration and servicing of your personal account;
• earning and spending loyalty programme bonuses;
• sending informational and service notifications (SMS, push, e-mail);
• providing customer support;
• improving the quality of service and personalising offers (subject to separate consent);
• compliance with the legislation of the RK (tax accounting, financial reporting).

4. Legal basis

Personal data is processed on the following grounds:

• the consent of the personal data subject (Article 8 of the Personal Data Law);
• performance of a contract to which the subject is a party;
• compliance with the legislation of the Republic of Kazakhstan.

5. Transfer to third parties

Personal data may be transferred to third parties solely for the purposes stated in section 3, and only to the following categories of recipients:

• payment systems and banks — to process payments;
• courier services — to deliver orders;
• SMS/push providers — to send notifications;
• cloud services (server infrastructure) — to store data;
• state bodies of the RK — at their lawful request.

Personal data is never sold, leased or otherwise transferred to third parties for commercial purposes.

6. Storage and protection

6.1. Personal data is stored on servers located in the Republic of Kazakhstan for the term of the contract and for 5 years after it ends (in accordance with tax legislation).

6.2. The Operator applies organisational and technical protection measures: encryption of data in transit (TLS), restricted employee access, regular backups.

7. Cookies

The Site uses cookies for the services to work correctly (session, cart, geolocation) and for analytics. You can disable cookies in your browser settings, but this may affect how the Site works.

8. Rights of the data subject

Under Article 7 of the Personal Data Law you have the right to:

• obtain information about the processing of your data;
• demand that incorrect data be corrected, blocked or destroyed;
• withdraw your consent to the processing of data;
• appeal against the Operator's actions to the authorised body.

To exercise these rights, write to info@gippokrat.kz stating your full name and phone number. We reply within 10 business days.

9. Changes to the Policy

The Operator may amend this Policy. The current version is published on the Site. Continued use of the Site after changes are published constitutes agreement with the new version.

10. Contacts

For questions about the processing of personal data:
E-mail: info@gippokrat.kz
Phone: +7 (7172) 999-888
Address: 010000, Astana, 46 Respubliki Ave.