Instant delivery 24/7

Privacy policy

Version of September 19, 2026

What we collect, why it is needed and what happens to it. In short: an email address, the contents of your order, your IP address and browser details, stored with the order and on every visit to the site, and a log of your visits, which is linked to your email once you give it to us yourself.

1.Who processes the data

  1. 1.1The data controller is KZ Gift Card, owner of the website kzgiftcard.com.
  2. 1.2Enquiries about data processing should be sent to the email address listed in the seller details.

2.What data is collected

  1. 2.1Your email address - required: the code and the order link are sent to it.
  2. 2.2Order data: the amounts chosen, the price, the payment currency, the payment status, the language of the order and the timestamps of order events.
  3. 2.3Technical data: your IP address and browser details, the string your browser uses to introduce itself to websites. They are stored with the order and in the visit log on every visit, even if no order is ever placed. They are used for fraud prevention, rate limiting, the investigation of disputed payments (including requests from your bank), handling buyers' requests and reviewing visits to the site. A coarse device type such as “iPhone, Safari” is derived from the browser details, and an approximate location, country and city, from the IP address.
  4. 2.4Information about your visit: the pages you viewed, the referring source and the advertising click identifier if you arrived from an ad. Web analytics counters receive it anonymised, while the shop's own visit log links it to your email address - see the section on cookies.
  5. 2.5The time of each code reveal - so that a dispute can be investigated.
  6. 2.6Emails to customer support: the sender's address, the text and any attachments. The shop keeps them to reply and to handle the request; automated emails and newsletters the shop has not replied to are deleted after a month.
  7. 2.7The seller neither receives nor stores bank card details: they are entered on the payment provider's side.

3.Why the data is processed

  1. 3.1Performing the contract: issuing the code, sending order emails, giving access to previously purchased codes.
  2. 3.2Preventing fraud and abuse: rate limits, manual review of individual orders, handling disputes with banks.
  3. 3.3Measuring advertising and usability: how many people went from an ad to a purchase and where the others stopped. In the counters' reports this is anonymised statistics.
  4. 3.4Reviewing visits to the site, including those that did not end in a purchase, to improve the shop. In the visit log staff see every visitor: which pages they opened, where they came from, their device, IP address and approximate location, even if no order was placed and the person never contacted support. Staff also open an individual buyer's path when handling their request or a payment problem.
  5. 3.5Meeting obligations under the legislation of the Republic of Kazakhstan.
  6. 3.6The data is not used for marketing mailings.

4.Legal basis

  1. 4.1The concluded contract of sale and the consent given by the buyer when placing an order. The visit log is kept in the shop's legitimate interest in handling buyers' requests and in reviewing visits to the site, including those that did not end in a purchase, to improve the shop.
  2. 4.2Requirements of the legislation of the Republic of Kazakhstan, including accounting rules.

5.Who the data is shared with

  1. 5.1The payment provider - what is needed to process a payment or refund: the amount, the currency, the order identifier and the buyer's contact.
  2. 5.2The email delivery provider - the recipient's address and the contents of the message.
  3. 5.3Government authorities - only in cases expressly provided for by law.
  4. 5.4Analytics and advertising services - Yandex Metrica, Google Analytics and Google Ads: anonymised visit information, the order number and its amount. If the order page is never opened after payment, our server reports the purchase itself, using the visitor number from the Yandex Metrica cookie or the ad click identifier. The email address, gift card codes and payment data are never sent to them.
  5. 5.5Personal data is never sold. Advertising systems receive only the fact and the amount of a purchase against an anonymised ad click identifier, which cannot be used to identify the buyer.

6.Cookies and analytics

  1. 6.1Technical cookies are session cookies only: encrypted session cookies for buyers and staff. Signing in is impossible without them.
  2. 6.2Our own visit and browser cookies. The visit cookie lives for half an hour and is extended as you browse: it groups the pages of one visit. The browser cookie lives for a year: it groups the visits made from one browser into one history. It holds a random number, and only a hash of it gets into the log. These cookies are never passed to the counters.
  3. 6.3The unfinished order cookie lives for three days: it lets the home page remind you of an order awaiting payment. The support chat cookie lives for a year: it lets a conversation you started continue.
  4. 6.4Our own visit log: which pages were opened, including navigation within the site, clicks on site elements (buttons, links, FAQ questions), scroll depth, device type, time away from the tab, promo code checks, sign-ins and checkout steps, as well as where the buyer came from and with which advertising tags. The log is linked to your email address once you give it yourself: when placing an order or signing in to your account. Staff look at the log to handle buyers' requests and to see visits that did not end in a purchase. The link to the order never gets into the log, the order number is stored instead. The IP address and the browser string are stored in the log as they are, and also as hashes for matching with orders. The shop works out an approximate location (country and city) from the IP address itself, using a database on its own server: the address is not sent anywhere for this.
  5. 6.5Cookies of web analytics counters - Yandex Metrica and Google Analytics. They tell visitors apart between visits and link a purchase to the ad the person arrived from. The visitor number from the Yandex Metrica cookie is stored together with the order and in the visit log.
  6. 6.6The advertising click identifier from the page address is kept in your browser for up to 90 days and is sent together with the order, so that advertising knows which ad led to the purchase.
  7. 6.7The counters can be switched off in your browser - with an ad blocker or by blocking third-party cookies. This has no effect on placing an order or receiving your code. Ad blockers do not switch off the shop's own visit log: you can have your records deleted by asking support.
  8. 6.8Yandex Metrica may record on-page actions (Webvisor): scrolling, cursor movement and clicks. The order page and the account area are recorded without their text, as layout only, and email fields without what was typed. Gift card codes never get into the recording.

7.Retention periods

  1. 7.1Order data is kept for the period required by law for accounting records, after which it is deleted or anonymised.
  2. 7.2Visit log records, together with the IP address and the browser string, are kept for a year, those of robots for two weeks. The link between a browser and an email address, and the last IP address and browser string recorded for that browser, are deleted a year after the last visit from that browser.
  3. 7.3One-time sign-in links and rate-limit counters are deleted automatically once they expire.

8.How the data is protected

  1. 8.1Gift card codes are stored encrypted and are decrypted only when shown to the buyer or sent by email.
  2. 8.2The account area has no password - so there is nothing to leak and nothing to brute-force.
  3. 8.3Staff access to data is limited by roles. When a staff member opens a visitor's profile or the steps of a visit, the audit log records who did it and when. Searches and browsing of the visitor list are not recorded in the audit log.

9.Your rights

  1. 9.1You may request information about the processing of your data and ask for it to be corrected, blocked or deleted.
  2. 9.2Consent to processing may be withdrawn. Data the seller is required by law to keep is deleted once that period expires.
  3. 9.3Send your request from the email address the order was placed with - otherwise we cannot confirm that it comes from the data subject.

10.Changes to this policy

  1. 10.1The current version of the policy is published on this page, with its date shown at the top.
  2. 10.2Material changes take effect when published.

Seller details

Seller
KZ Gift Card
Contact email
support@kzgiftcard.com
Telegram
@KZ_Gift_Card