Who processes the data
The data operator is ZAF Leather LLP, BIN 160140017811, the owner of zaf.kz. Processing follows the Law of the Republic of Kazakhstan “On Personal Data and Its Protection”.
By using the site and placing an order you consent to the processing of your data to the extent and on the terms described below.
What we collect
- For the order
- Name, phone number, city, delivery address, email (optional) and any order comment.
- For signing in
- Phone number and a one-time SMS code. If you set a PIN, only its irreversible hash is stored — we never see the PIN itself.
- Profile
- The photo, name, email, city and address you entered in profile settings, plus your interface language.
- Purchase history
- The contents and amounts of your orders, their statuses, accumulated bonuses and your personal discount rate.
- Technical data
- IP address, browser and device type, pages you opened, and the referral source (UTM tags).
The site never receives or stores card details: the number, expiry date and CVV are entered on the secure Freedom Pay page. See the payment procedure for details.
Why we use it
- to place, pick and deliver your order and to contact you about it;
- to confirm the phone number belongs to you and let you into your account;
- to show your purchase history, bonuses, warranties and personal discount;
- to accept payment and, if needed, issue a refund;
- to meet legal requirements — tax and accounting records;
- to understand how people use the site and make it better.
We do not send marketing messages without your consent and we never sell your data.
Who the data is shared with
We share the minimum necessary data with those without whom an order cannot be fulfilled:
- Freedom Pay — payment service
- Order number and amount, purchase description, your phone and email for the receipt.
- MoySklad — our inventory system
- The order, its contents, name, phone, city and delivery address.
- SMS provider
- Phone number — to deliver the one-time sign-in code.
- Delivery services (CDEK, Kazpost, couriers)
- Recipient’s name, phone and address.
- Government authorities
- Only in the cases and to the extent directly required by law.
Cookies and browser data
The site uses small cookie files so that it behaves the way you expect:
- lang — the interface language you chose;
- zaf_city — the city you selected, used for stock and delivery;
- zaf_view — the “Personal” or “Business” viewing mode;
- the session file — so you stay signed in as you move between pages.
Your cart, favourites and any entered promo code are kept in your browser’s memory (localStorage), not on our servers — they are not sent to us until you place an order. Clearing your browser data removes them for good.
Analytics and advertising
To understand which pages are useful and to measure our advertising, we use third-party analytics services. They set their own cookies and collect anonymised data about the visit: pages, device, referrer, actions on the site.
- Google (Google Tag Manager, Google Ads) — Google LLC;
- Yandex.Metrica — Yandex, including session recording (Webvisor);
- after payment the services receive the order number, amount and contents.
Your name, phone number, address and email are NOT sent to these services. You can opt out in your browser settings — block third-party cookies or turn on «Do Not Track»; Yandex.Metrica also offers a dedicated opt-out add-on. This does not affect your ability to place an order.
How we protect the data
- the whole site runs over the secure HTTPS protocol;
- a PIN is stored as an irreversible hash, never as text;
- an uploaded profile photo is rebuilt on the server, so a file with foreign code inside never reaches the disk;
- pages with personal data are protected from caching by intermediate servers;
- database access is limited to staff who need it for their work.
How long we keep it
Profile data is kept for as long as your account exists. Order data is kept for the period required by accounting and tax legislation, even if the account has been deleted.
One-time sign-in codes are deleted shortly after use.
Your rights
- to find out what data about you we hold;
- to correct it — name, email, city, address and photo can be changed yourself in profile settings;
- to withdraw consent and request deletion;
- to demand that processing stops if it breaks the law.
To exercise any of these rights, write to sales@zaf.kz from the number or email listed in your profile. We reply within 10 calendar days. Note that data required to fulfil an order you have already paid for can only be deleted once that order is complete.
Changes to this policy
We may update this policy — for example, when the services we rely on change. The current version is always published on this page, with its date shown at the top.