Privacy Policy

1. General Provisions

This Privacy Policy is drafted in accordance with the requirements of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” dated May 21, 2013, No. 94-V (hereinafter referred to as the Personal Data Law) and establishes the procedure for processing personal data and measures to ensure the security of personal data undertaken by TOO “MARVEL KAZAKHSTAN” (hereinafter referred to as the Operator).

The Operator considers the protection of human and civil rights and freedoms during the processing of personal data, including the right to privacy, personal and family secrets, as its primary goal and condition for conducting its activities.
This Privacy Policy of the Operator applies to all information that the Operator may obtain about visitors to the website https://ekit.huawei-marvel.com/.

2. Basic Terms Used in the Policy

Automated Processing of Personal Data – processing of personal data using computer technology.
Blocking of Personal Data – temporary cessation of personal data processing (except when processing is necessary to clarify personal data).
Website – a collection of graphic and informational materials, software, and databases ensuring their availability on the Internet at the network address https://ekit.huawei-marvel.com/.
Personal Data Information System – a system containing personal data stored in databases and the information technologies and technical means ensuring their processing.
Depersonalization of Personal Data – actions resulting in the inability to determine, without additional information, the affiliation of personal data to a specific User or other subject of personal data.
Processing of Personal Data – any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
Operator – a state or municipal authority, legal entity, or individual who independently or jointly with others organizes and/or conducts the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data to be processed, and the actions (operations) performed on personal data.
Personal Data – any information relating directly or indirectly to an identified or identifiable User of the website https://ekit.huawei-marvel.com/.
Personal Data Permitted for Distribution by the Subject – personal data whose access is granted by the data subject through consent for processing such personal data in accordance with the procedure established by the Personal Data Law (hereinafter referred to as Personal Data Permitted for Distribution).
User – any visitor to the website https://ekit.huawei-marvel.com/.
Provision of Personal Data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
Distribution of Personal Data – any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or making personal data accessible to an unlimited number of persons, including publishing personal data in mass media, placing them in information and telecommunication networks, or providing access to personal data by other means.
Cross-Border Transfer of Personal Data – transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual, or a foreign legal entity.
Destruction of Personal Data – any actions resulting in the irreversible destruction of personal data with no possibility of further recovery of their content within the personal data information system and/or destruction of physical media containing personal data.

3. Main Rights and Obligations of the Operator

3.1. The Operator has the right to:

Obtain accurate information and/or documents containing personal data from the data subject.
Continue processing personal data without the data subject’s consent if the data subject withdraws consent but the Operator has legal grounds under the Personal Data Law to proceed.
Independently determine the scope and list of measures necessary and sufficient to ensure compliance with the obligations stipulated by the Personal Data Law and associated regulations, unless otherwise provided by the Personal Data Law or other federal laws.

3.2. The Operator is obligated to:

Provide the data subject, upon request, with information regarding the processing of their personal data.
Organize the processing of personal data in accordance with the current legislation of the Republic of Kazakhstan.
Respond to requests and inquiries from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law.
Provide the authorized body for the protection of personal data subjects’ rights with the necessary information within 30 days of receiving such a request.
Publish or otherwise ensure unrestricted access to this Privacy Policy.
Implement legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, distribution, or other unlawful actions.
Cease the transfer (distribution, provision, access), processing, and destroy personal data in accordance with the procedure and cases stipulated by the Personal Data Law.
Fulfill other obligations prescribed by the Personal Data Law.

4. Main Rights and Obligations of Data Subjects

4.1. Data subjects have the right to:

Obtain information regarding the processing of their personal data, except in cases provided by legislative acts of the Republic of Kazakhstan. Such information must be provided in an accessible form and must not include personal data related to other data subjects unless there are legitimate grounds for disclosing such data. The list of information and the procedure for obtaining it are established by the Personal Data Law.
Request the Operator to clarify, block, or destroy their personal data if the data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, and take legal measures to protect their rights.
Withdraw consent to the processing of personal data.
Challenge unlawful actions or omissions of the Operator in court or before the authorized body for the protection of personal data subjects’ rights.
Exercise other rights provided by the legislation of the Republic of Kazakhstan.

4.2. Data subjects are obligated to:

Provide the Operator with accurate information about themselves.
Inform the Operator of any updates or changes to their personal data.

4.3. Individuals who provide false information about themselves or about another data subject without the latter’s consent shall bear responsibility in accordance with the laws of the Republic of Kazakhstan.

5. The Operator May Process the Following Personal Data of the User

Last name, first name, patronymic.
Email address.
Phone numbers.
Individual identification number.
Legal name, legal address, and Business Identification Number (BIN).
The website also collects and processes anonymized data about visitors (including cookies) through internet statistics services (Yandex Metrica, Google Analytics, etc.).
The above data is collectively referred to as “Personal Data” throughout this Policy.
The Operator does not process special categories of personal data related to race, ethnicity, political views, religious or philosophical beliefs, or intimate life.
The processing of personal data permitted for distribution, among the special categories listed in Article 10 of the Personal Data Law, is allowed only if the prohibitions and conditions specified in Article 10.1 of the Personal Data Law are observed.
Consent for the processing of personal data permitted for distribution is obtained separately from other consents for processing personal data. This consent must comply with the conditions outlined in Article 10.1 of the Personal Data Law. Requirements for the content of such consent are established by the authorized body for the protection of personal data subjects’ rights.
Consent for the processing of personal data permitted for distribution is provided directly to the Operator by the User.
Within three working days of receiving such consent, the Operator must publish information on the terms of processing, restrictions, and conditions applicable to the processing of personal data permitted for distribution.
The transfer (distribution, provision, access) of personal data permitted for distribution by the data subject must cease at any time upon the data subject’s request. Such a request must include the data subject’s last name, first name, patronymic (if applicable), contact information (phone number, email address, or postal address), and a list of personal data whose processing must be terminated. The personal data specified in such a request may only be processed by the Operator to whom the request is addressed.
Consent for the processing of personal data permitted for distribution ceases to be valid upon receipt of the corresponding request by the Operator.

6. Principles of Personal Data Processing

Personal data processing is carried out lawfully and fairly.
Personal data processing is limited to achieving specific, predetermined, and lawful purposes. Processing personal data incompatible with the purposes of collection is prohibited.
Combining databases containing personal data processed for incompatible purposes is prohibited.
Only personal data relevant to the purposes of processing are processed.
The content and volume of processed personal data correspond to the stated purposes of processing. Excessive processing of personal data relative to the stated purposes is prohibited.
The accuracy, sufficiency, and, where necessary, relevance of personal data are ensured in relation to the purposes of processing. The Operator takes necessary measures to delete or clarify incomplete or inaccurate data.
Personal data is stored in a form that allows the identification of the data subject for no longer than is required to achieve the purposes of processing.

7. Purposes of Personal Data Processing

7.1. The purposes of processing personal data of the User include:

Informing the User by sending emails.
Providing the User with access to services, information, and/or materials contained on the website https://ekit.huawei-marvel.com/.
Online payment processing.
Contract signing.

7.2. The Operator also has the right to send the User notifications about new products, services, special offers, and various events. The User can always opt out of receiving informational messages by sending an email to the Operator at info@marvel.kz with the subject line “Opt-out from notifications about new products, services, and special offers.”

7.3. Anonymized User data collected via internet statistics services are used to gather information about User actions on the website, improve the quality of the website, and enhance its content.

8. Legal Basis for Personal Data Processing

8.1. The legal basis for processing personal data by the Operator includes:

The Law of the Republic of Kazakhstan “On Personal Data and Their Protection” dated May 21, 2013, No. 94-V.
Other regulatory legal acts in the field of personal data protection.
User consents for the processing of their personal data and for the processing of personal data permitted for distribution.

8.2. The Operator processes personal data of the User only if the User fills out and/or submits the data independently through special forms located on the website https://ekit.huawei-marvel.com/ or sends them to the Operator via email. By filling out the relevant forms and/or submitting their personal data to the Operator, the User expresses their consent to this Privacy Policy.

8.3. The Operator processes anonymized User data if this is permitted in the User’s browser settings (e.g., cookies and JavaScript are enabled).

8.4. The data subject independently decides to provide their personal data and gives consent freely, voluntarily, and in their own interest.

9. Procedure for Collecting, Storing, Transferring, and Other Types of Personal Data Processing

The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of current legislation in the field of personal data protection.

9.1. The Operator ensures the confidentiality of personal data and takes all possible measures to prevent unauthorized access to personal data.

9.2. The User’s personal data will never be transferred to third parties, except in cases related to the execution of current legislation or if the data subject has given consent to the Operator for such transfer.

9.3. In case of inaccuracies in personal data, the User can update them independently by sending a notification to the Operator at info@marvel.kz with the subject line “Update of personal data.”

9.4. The duration of personal data processing is determined by the achievement of the purposes for which the data were collected, unless otherwise specified in a contract or by current legislation.

9.5. The User can revoke their consent to personal data processing at any time by sending a notification to the Operator via email at info@marvel.kz with the subject line “Revocation of consent to personal data processing.”

9.6. All information collected by third-party services, including payment systems, communication tools, and other service providers, is stored and processed by those entities (Operators) in accordance with their User Agreements and Privacy Policies. The data subject and/or User are responsible for reviewing these documents in a timely manner. The Operator is not liable for the actions of third parties, including service providers mentioned in this clause.

9.7. Restrictions imposed by the data subject on the transfer (except for access), processing, or conditions of processing (except for access) of personal data permitted for distribution do not apply in cases of personal data processing in state, public, or other public interests as defined by the laws of the Republic of Kazakhstan.

9.8. The Operator ensures the confidentiality of personal data during processing.

9.9. The Operator stores personal data in a form that allows the identification of the data subject for no longer than is required to achieve the purposes of processing, unless otherwise specified by law, contract, or agreement involving the data subject.

9.10. The termination of personal data processing may occur due to the achievement of the purposes of processing, the expiration of the consent period, the revocation of consent by the data subject, or the detection of unlawful processing of personal data.

10. List of Actions Performed by the Operator with Collected Personal Data

10.1. The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

10.2. The Operator performs automated processing of personal data with the receipt and/or transmission of information via information and telecommunication networks or without such means.

11. Confidentiality of Personal Data

The Operator and other parties who gain access to personal data are obligated not to disclose such data to third parties or distribute it without the data subject’s consent, unless otherwise provided by the laws of the Republic of Kazakhstan.

12. Final Provisions

12.1. The User can obtain clarifications on any questions regarding the processing of their personal data by contacting the Operator via email at info@marvel.kz.

12.2. Any changes to the Operator’s Privacy Policy will be reflected in this document. The Policy is effective indefinitely until replaced by a new version.