PRIVACY POLICY

on the processing of personal data (hereinafter — the “Policy”)

Version dated 25 August 2026, Kyrgyz Republic, Bishkek

1. GENERAL PROVISIONS
1.1. The Policy sets out the procedure for the processing of personal data (hereinafter — “PD”) and the measures taken to protect them, which Individual Entrepreneur Nataliia Viktorovna Pichugova (hereinafter — the “Record Owner”, the “Operator”) may obtain about the User through the Site. The Policy establishes the Record Owner's obligations of non-disclosure and confidentiality with respect to PD provided by the User in connection with the use of the Site and collected both by active and passive means.
1.2. The Policy has been developed in accordance with the Constitution of the Kyrgyz Republic, the Digital Code of the Kyrgyz Republic No. 178 of 31 July 2025 (Chapter 11 “Processing of Personal Data”, Articles 77–91), the Law of the Kyrgyz Republic “On Electronic Commerce” No. 154 of 22 December 2021, the Law of the Kyrgyz Republic “On Consumer Rights Protection” No. 90 of 10 December 1997 and other regulatory legal acts of the Kyrgyz Republic.
1.3. Please note: the Law of the Kyrgyz Republic “On Information of a Personal Nature” No. 58 of 14 April 2008 has been repealed; since February 2026 the processing of personal data is governed by the Digital Code of the Kyrgyz Republic. The competent (sectoral) regulator in the field of personal data is the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic (Article 90 of the Digital Code of the KR).
1.4. When processing the User's PD, the Record Owner ensures the confidentiality of PD and compliance with the requirements of the legislation of the Kyrgyz Republic.
2. TERMS AND DEFINITIONS
2.1. For the purposes of the Policy the following definitions apply:
·       “Site” — the set of computer programs, databases, graphic, audiovisual and information materials accessible via the Internet at the permanent address https://tochka-pro.com/, including all levels of that domain and any landing pages originating from it.
·       “Information of a personal nature” — any information relating to a natural person which allows that person to be identified, directly or indirectly.
·       “Personal data (PD)” — digital data containing information of a personal nature.
·       “Processing of PD” — any operation or set of operations performed on personal data, including collection, recording, systematisation, accumulation, storage, rectification (updating, alteration), retrieval, use, transfer (provision, access), anonymisation, restriction, blocking, erasure and destruction.
·       “Record Owner (Operator)” — Individual Entrepreneur Nataliia Viktorovna Pichugova, who determines the purposes and means of processing PD.
·       “Processor” — a person processing PD on behalf of and under the written instructions of the Record Owner (Article 86 of the Digital Code of the KR).
·       “User (Data Subject, data principal)” — a natural person with full legal capacity who has voluntarily, of their own will and in their own interest, provided their PD and/or consent to their processing, or the legal representative of such a person.
·       “Personal data breach” — a form of unlawful processing in which PD become accessible to unauthorised persons.
·       “Cross-border transfer of PD” — the transfer of PD to the territory of a foreign state, to a foreign public authority, or to a foreign natural or legal person.
·       “Cookies” — small pieces of data sent by the Site server and stored on the User's device, which the browser sends back to the server when Site pages are requested.
2.2. The terms may be used in the singular or plural and in abbreviated form. Terms not defined in the Policy shall be construed in accordance with the legislation of the Kyrgyz Republic.
3. PRINCIPLES AND LEGAL BASES OF PROCESSING
3.1. PD are processed in accordance with the principles established by Article 78 of the Digital Code of the Kyrgyz Republic:
·       lawfulness, fairness and transparency of processing;
·       purpose limitation — PD are collected only for specified, predetermined and lawful purposes;
·       data minimisation — only PD that are necessary and sufficient to achieve the purpose are processed;
·       accuracy and currency of PD, and the taking of measures to rectify or erase inaccurate data;
·       storage limitation — PD are kept in a form permitting identification of the subject no longer than is necessary for the purpose;
·       integrity and confidentiality — protection of PD against unlawful or accidental access, destruction, alteration, copying and dissemination;
·       accountability — the Record Owner is responsible for compliance with these principles and is able to demonstrate such compliance.
3.2. The legal bases for processing PD are set out in Article 79 of the Digital Code of the Kyrgyz Republic. The Record Owner processes PD on the following bases: consent of the data subject; necessity of processing for the conclusion and performance of a contract to which the subject is a party; necessity of compliance with a legal obligation imposed on the Record Owner by the legislation of the Kyrgyz Republic; and the legitimate interests of the Record Owner, where these do not override the rights and freedoms of the subject.
3.3. The consent of the data subject is freely given, specific, informed and conscious, and is expressed by an affirmative action — ticking a dedicated checkbox under a form on the Site or clicking the relevant button in the cookie banner. Consent shall not be regarded as valid if it is hidden among other terms, is formulated unclearly, or is requested where another legal basis for processing exists (Article 79(2)–(6) of the Digital Code of the KR).
3.4. The Record Owner does not process special categories of personal data (Article 80 of the Digital Code of the KR), including data on racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life, biometric and genetic data, or criminal record information.
3.5. The Site and the materials offered through it are not intended for persons under 14 years of age. The Record Owner does not deliberately collect children's PD; where the processing of a child's data is permitted, the rules of Article 81 of the Digital Code of the Kyrgyz Republic apply.
4. PURPOSES OF PROCESSING AND CATEGORIES OF PERSONAL DATA
4.1. PD are provided by the User by completing forms on the Site and may also be provided via a messenger or online chat where such functionality is available.
4.2. The purposes of processing, categories of PD, legal bases and retention periods are set out in the table below:
4.3. For Site visit statistics the Record Owner uses the Yandex Metrica web analytics service, which generates statistical information about the Site using cookies stored on the User's device as well as data on the User's use of the Site. That information is used to compile reports on the use of the Site. The data obtained are stored by Yandex LLC (PSRN 1027700229193, TIN 7736207543, registered address: 16 Lva Tolstogo St., Moscow, 119021, Russian Federation). The service's privacy policy is available at: https://yandex.ru/legal/confidential/. The composition of the data collected and the list of cookies are set out in Annex No. 3 to the Policy.
4.4. As the said web analytics service is located outside the Kyrgyz Republic, the processing of the data collected through it involves a cross-border transfer on the terms of Article 89 of the Digital Code of the Kyrgyz Republic and Section 9 of the Policy.
4.5. The Record Owner does not collect PD that are excessive in relation to the stated purposes and does not merge databases processed for mutually incompatible purposes.
4.6. For the operation of the Site, payment acceptance, mailings and web analytics, the Record Owner engages service providers (hosting provider, payment provider, mailing service, web analytics service) which act as Processors on the basis of contracts and the written instructions of the Record Owner in accordance with Article 86 of the Digital Code of the Kyrgyz Republic. An up-to-date list of such providers is available on request sent to info@tochka-pro.com.
5. PROCEDURE AND CONDITIONS OF PROCESSING
5.1. Operations performed on PD: collection, recording, systematisation, accumulation, storage, rectification (updating, alteration), retrieval, use, transfer (provision, access), anonymisation, restriction of processing, blocking, erasure and destruction.
5.2. Means of processing: automated processing using computing equipment, with receipt and/or transmission of data via the Internet, as well as non-automated processing.
5.3. Grounds for termination of processing: achievement of the purposes of processing; withdrawal of consent by the data subject (where consent was the sole basis); satisfaction of the subject's objection to processing; detection of unlawful processing; cessation of the Record Owner's activity; and other cases provided for by the legislation of the Kyrgyz Republic.
5.4. As a general rule the Record Owner does not disclose or disseminate the User's PD to third parties. Transfer of PD to third parties is permitted: with the User's consent; where necessary to achieve the purposes set out in the Policy and to perform the contract; where provided for by the legislation of the Kyrgyz Republic (including at the request of competent public authorities); and to protect the rights and legitimate interests of the Record Owner.
5.5. The Record Owner is not liable for the acts of third parties which independently determine the purposes and means of processing PD, save where such parties act on the Record Owner's instructions.
6. RIGHTS OF THE DATA SUBJECT
6.1. The User has the right to:
·       obtain information about the processing of their PD, including the purposes, legal bases, categories of data, retention periods and recipients;
·       request the rectification, updating and correction of incomplete, inaccurate or outdated PD;
·       request the erasure of personal records in the cases provided for by Article 83 of the Digital Code of the Kyrgyz Republic (the purpose is no longer necessary, consent is withdrawn, an objection is upheld, processing is unlawful);
·       object to the processing of PD under Article 84 of the Digital Code of the Kyrgyz Republic;
·       request the restriction of processing (Article 85 of the Digital Code of the Kyrgyz Republic);
·       withdraw consent previously given at any time;
·       lodge a complaint against the acts or omissions of the Record Owner with the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic or before a court.
6.2. Requests and enquiries shall be sent to info@tochka-pro.com with a subject line reflecting the substance of the request (“Data subject request”, “Rectification of PD”, “Erasure of PD”, “Objection to processing”, “Withdrawal of consent to the processing of PD”). The Record Owner may request information enabling the applicant to be identified.
6.3. An objection to processing shall be examined and a reasoned written decision sent to the applicant within 7 (seven) business days of receipt of the objection (Article 84 of the Digital Code of the Kyrgyz Republic).
6.4. Other requests of the data subject shall be examined within 10 (ten) business days of receipt. That period may be extended by no more than 5 (five) business days, with a reasoned notice of the reasons for the extension sent to the applicant.
6.5. The User undertakes to provide accurate PD belonging to them personally and to notify the Record Owner of any changes without delay. Persons who provide inaccurate information about themselves, or information about another person without that person's consent, shall be liable under the legislation of the Kyrgyz Republic.
7. RIGHTS AND OBLIGATIONS OF THE RECORD OWNER
7.1. The Record Owner has the right to: process PD on the bases provided for by Article 79 of the Digital Code of the Kyrgyz Republic; transfer PD to Processors and third parties in the cases set out in clause 5.4 of the Policy; refuse a subject's request in the cases provided for by law, stating the reasons for the refusal; continue processing PD after the withdrawal of consent where another legal basis exists; and independently determine the composition and list of measures necessary and sufficient to ensure the protection of PD.
7.2. The Record Owner undertakes to: process PD in accordance with the legislation of the Kyrgyz Republic; maintain records of processing operations; provide the subject, upon request, with information about the processing of their PD; ensure free access to the Policy on every page of the Site where PD are collected; take legal, organisational and technical measures to protect PD; cease processing and erase PD in the cases provided for by law; and cooperate with the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic.
8. PERSONAL DATA SECURITY MEASURES
8.1. The protection of PD is ensured through legal, organisational and technical measures necessary to comply with Article 88 of the Digital Code of the Kyrgyz Republic, including:
·       data protection by design and by default in the design of processing operations;
·       maintaining records (a register) of personal data processing operations;
·       designating a person responsible for organising the processing and protection of PD;
·       establishing access rules for PD and limiting the range of persons authorised to process them;
·       familiarising persons carrying out processing with statutory requirements and internal documents;
·       using anti-virus software, password identification and authentication, backup and recovery tools;
·       transmitting data over secure communication channels (HTTPS);
·       internal monitoring of compliance and assessment of the effectiveness of the measures taken.
8.2. Processors and other persons granted access to PD on the Record Owner's instructions are obliged to maintain the confidentiality of PD and to take the necessary organisational and technical protection measures.
8.3. Upon detection of a personal data breach or another incident resulting in a violation of data subjects' rights, the Record Owner shall promptly take measures to remedy the breach and its consequences, conduct an internal investigation, notify the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic in the manner and within the time limits established by the legislation of the Kyrgyz Republic, and inform the affected data subjects where the incident poses a high risk to their rights.
9. CROSS-BORDER TRANSFER OF PERSONAL DATA
9.1. The Site is accessible to users in various countries, and certain Processors (hosting provider, mailing services, payment services and web analytics services) may be located outside the Kyrgyz Republic. Accordingly, the processing of PD may involve their cross-border transfer.
9.2. Cross-border transfers of PD are carried out in accordance with Article 89 of the Digital Code of the Kyrgyz Republic: freely to states ensuring an adequate level of personal data protection, the list of which is determined by the competent authority; in other cases — subject to the consent of the data subject, or where the transfer is necessary for the conclusion or performance of a contract concluded in the subject's interest, or where contractual data protection safeguards are in place, or in other cases provided for by the legislation and international treaties of the Kyrgyz Republic.
9.3. Before commencing a cross-border transfer, the Record Owner satisfies itself that the receiving party ensures an adequate level of protection of data subjects' rights and includes confidentiality and data protection provisions in its contracts with such parties.
10. TERMINATION OF PROCESSING AND ERASURE OF PERSONAL DATA
10.1. The User may withdraw consent to the processing of PD at any time by sending the Record Owner an electronic document to info@tochka-pro.com with the subject line “Withdrawal of consent to the processing of PD”. Consent ceases to have effect from the moment the withdrawal is received by the Record Owner.
10.2. Withdrawal of consent does not terminate processing carried out on another legal basis, in particular for the performance of a concluded contract or a legal obligation established by the legislation of the Kyrgyz Republic.
10.3. Upon achievement of the purposes of processing, withdrawal of consent (where it was the sole basis), satisfaction of an erasure request or detection of unlawful processing, the Record Owner shall cease processing and erase the PD within 30 (thirty) calendar days of the relevant ground arising, unless another period is established by the legislation of the Kyrgyz Republic.
10.4. Upon detection of unlawful processing of PD, the Record Owner shall cease such processing within no more than 3 (three) business days. If it is impossible to bring the processing into compliance, the PD shall be erased within no more than 10 (ten) business days, and the data subject shall be notified accordingly.
10.5. Where PD are found to be inaccurate, the Record Owner shall, at the User's request, restrict their processing for the period of verification and rectify the data within 7 (seven) calendar days of the User submitting the corrected information.
10.6. PD on electronic media are erased by wiping and/or formatting the medium; documents on physical media are destroyed by a method that precludes the restoration of their content. An act is drawn up and/or an extract from the information system event log is retained following erasure.
10.7. The Record Owner may continue to use information about the User after erasure of their PD provided that such information is anonymised so as to preclude identification of the subject.
11. FINAL PROVISIONS
11.1. The Policy applies to all relations between the Record Owner and the User concerning the collection, processing and protection of PD. Matters not governed by the Policy shall be resolved in accordance with the legislation of the Kyrgyz Republic.
11.2. The Policy is valid indefinitely until a new version is adopted. Amendments are made where the scope, means or procedure of processing changes, or where the legislation of the Kyrgyz Republic changes, and take effect upon publication of the new version on the Site with an indication of the publication date.
11.3. The Policy is accessible to the User around the clock, except during periods when the Site is unavailable for technical reasons.
11.4. This document is an English translation prepared for the convenience of users. The Policy is drawn up in Russian; in the event of any discrepancy between the English and Russian versions, the Russian version shall prevail. At the User's request, information on the processing of their PD is also provided in the state (Kyrgyz) language.
11.5. Liability for breaches of personal data legislation is established by the Code of the Kyrgyz Republic on Offences No. 128 of 28 October 2021 (including Articles 228-3, 228-6, 228-7, 413-2 and 413-3) and other regulatory legal acts of the Kyrgyz Republic.
11.6. Annexes to the Policy:
·       Annex No. 1 — Consent to the processing of personal data;
·       Annex No. 2 — Consent to receive advertising and informational messages;
·       Annex No. 3 — Cookie Policy.
DETAILS