| Revision | No. 1 |
| Approved | by order of the Director of LLP "ALA INTERNATIONAL" dated 20 May 2026, No. 228 |
| Effective date | 20 May 2026 |
| Internet resource | https://go.ala.kz |
| Permanent address of the document | https://go.ala.kz/en/privacy.html |
1. General provisions
1.1. This Privacy Policy (hereinafter – the Policy) determines the procedure for the collection, processing, storage, transfer, protection and destruction of the personal data of users of the internet resource go.ala.kz (hereinafter – the Site) and constitutes the document determining the operator's policy on the collection, processing and protection of personal data within the meaning of subparagraph 1-1) of paragraph 2 of Article 25 of the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 "On Personal Data and Their Protection" (hereinafter – the Personal Data Law).
1.2. The Policy has been developed in accordance with:
- the Constitution of the Republic of Kazakhstan (Article 18);
- the Civil Code of the Republic of Kazakhstan;
- the Personal Data Law;
- the Digital Code of the Republic of Kazakhstan No. 255-VIII dated 9 January 2026;
- the Rules for the Collection and Processing of Personal Data approved by order of the authorised body;
- the Rules for the Implementation by the Owner and (or) Operator, as Well as by a Third Party, of Measures for the Protection of Personal Data;
- other regulatory legal acts of the Republic of Kazakhstan.
1.3. The Policy is a publicly available document, is placed in open access on the Site and applies to all personal data which the Operator obtains in connection with the use of the Site.
1.4. Use of the Site means that the User has familiarised themselves with this Policy. Consent to the collection and processing of personal data shall be given separately, by an active action of the User, in the manner described in Section 6 of the Policy.
1.5. This Policy shall not apply:
- to the processing of personal data in the personal account and other digital services hosted on domains other than go.ala.kz (including ala-cargo.com) – such services have their own legal documents;
- to the processing of data by third-party services and messengers to which the User navigates via links from the Site (WhatsApp, Instagram, 2GIS and others) – such processing is governed by the documents of the respective persons.
2. Terms and definitions
Terms not defined in this Section shall be applied in the meaning established by the Personal Data Law and the Digital Code of the Republic of Kazakhstan.
| Term | Meaning |
|---|---|
| Personal data (PD) | information or a set of information about a personal data subject supplemented by one or more personal data identifiers (subparagraph 2) of Article 1 of the Personal Data Law) |
| Subject / User | a natural person to whom personal data relate and who uses the Site or contacts the Operator through the Site |
| Operator | the person carrying out the collection, processing and protection of personal data – the details are set out in Section 3 of the Policy |
| Third party | a person who is not a subject, owner and (or) operator, but who participates in the processing of personal data |
| Processing of PD | actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalisation, anonymisation, blocking, destruction and deletion of personal data |
| Cookie | small text files and similar technologies (localStorage, pixels, counters) stored in the User's browser |
| Authorised body | the state body of the Republic of Kazakhstan exercising regulation and control in the field of personal data protection |
3. Information about the Operator
| Item | Value |
|---|---|
| Full name | Limited Liability Partnership "ALA INTERNATIONAL" |
| Commercial designation | ALA International |
| BIN | 250640012858 |
| Registered address | Republic of Kazakhstan, Almaty city, Alatau district, Algabas microdistrict, Street 7, Building 134/3 |
| Actual address | Almaty city, Alatau district, Algabas microdistrict, Street 7, Building 134/3 |
| Telephone | +7 775 708 88 80 |
| E-mail (general) | info@ala.kz |
| E-mail for personal data enquiries | privacy@ala.kz |
| Person responsible for organising the processing of personal data | Director Dias Manasuly Nurtiliyev, tel. +7 775 708 88 80, e-mail privacy@ala.kz |
| Operator category (Article 25-1 of the Personal Data Law) | small |
4. Principles and legal grounds of processing
4.1. The Operator shall carry out the processing of personal data on the basis of the principles set out in Article 5 of the Personal Data Law: observance of human and civil rights and freedoms, legality, confidentiality of restricted-access PD, equality of the rights of subjects, owners, operators and third parties.
4.2. The legal grounds of processing shall be:
- the consent of the Subject or of their legal representative (Articles 7 and 8 of the Personal Data Law) – the principal ground for the processing of data obtained through the Site;
- the cases provided for by Article 9 of the Personal Data Law, where collection and processing are permitted without the consent of the Subject;
- performance of a contract to which the Subject is a party, or the taking of steps to prepare for its conclusion at the initiative of the Subject;
- discharge of the obligations imposed on the Operator by the legislation of the Republic of Kazakhstan (tax, accounting, transport and customs legislation, and legislation on countering the legalisation of proceeds of crime).
4.3. The Operator shall process only such volume of personal data as is necessary and sufficient to achieve the stated purposes (the principle of minimisation, paragraph 1 of Article 12 of the Personal Data Law).
4.4. The Operator shall not collect through the Site personal data of special categories (information on health, religious or political beliefs, biometric data) and shall not request such data. Where such information has been provided by the User on their own initiative in a free-text field of a form or in correspondence, the Operator shall not use it for decision-making and shall delete it at the earliest opportunity.
5. Composition of the personal data processed, purposes and periods
5.1. The Site is an information (presentation) resource. Registration of accounts, acceptance of online payments and placing of orders are not carried out on the Site.
5.2. The Operator shall process the following categories of data:
| No. | Source of receipt | Composition of the data | Purpose of processing | Legal ground | Storage period |
|---|---|---|---|---|---|
| 1 | "Supply request" form (pages contacts.html, business.html, partners.html) | company name or personal name, type of task, point of departure, point of destination, description of the cargo and of the requirements, frequency of supplies, as well as information which the User voluntarily provides in free-text fields | consideration of the request, preparation of a commercial offer, calculation of cost and timeframes, conclusion and performance of a contract | consent of the Subject; preparation for the conclusion of a contract | 3 years from the date of the last interaction; where a contract is concluded – for the term of the contract and 5 years after its termination |
| 2 | Correspondence in messengers (WhatsApp at the number +7 775 708 88 80, Telegram, Instagram) | telephone number, name or nickname in the messenger, content of the correspondence, attachments transferred by the User | handling of the enquiry, communication regarding the request, support of the carriage | consent of the Subject (expressed by the sending of a message); performance of a contract | 3 years from the date of the last message |
| 3 | Response to a vacancy (page careers.html, "Apply" button) | name, contact details, information on education and work experience, other information contained in the CV | consideration of the candidacy, conduct of the selection, formation of a talent pool | consent of the Subject | until completion of the selection; where consent to inclusion in the talent pool is given – 1 year |
| 4 | Cookies and analytics services (Yandex.Metrica, Google Analytics 4) | IP address, cookie identifiers and localStorage records, browser type and version, operating system, screen resolution, language, referrer, pages viewed, time and depth of viewing, actions on the page, approximate location at city level | analysis of attendance, assessment of the effectiveness of sections and advertising channels, improvement of the Site, ensuring technical operability and security | consent of the Subject (for analytics and marketing cookies); lawful grounds of ensuring operability (for strictly necessary cookies) | in accordance with the periods specified in the Cookie Policy (from session to 24 months) |
| 5 | Pick-up point search (the "Pick-up points" block) | search query (city, address or point number) | display of the search results | consent of the Subject; the processing is carried out in the User's browser | not stored by the Operator |
| 6 | Technical server journals (logs) | IP address, date and time of the request, resource requested, response code, User-Agent | ensuring information security, detection and investigation of incidents, diagnosis of failures | ensuring the protection of personal data (Article 22 of the Personal Data Law) | 6 months |
5.3. Specific feature of the forms on the Site. The forms of the Site do not send data automatically to the Operator's server: upon the pressing of the button, the text of a message is generated which the User then sends themselves via the WhatsApp messenger. This means that:
- the actual transfer of data to the Operator takes place at the moment when the User sends the message in the messenger;
- the content of the message passes through the infrastructure of the owner of the messenger and is processed by it on the terms of its own documents;
- such transfer constitutes a cross-border transfer of personal data (Section 9 of the Policy).
5.4. Upon the expiry of the storage periods, as well as upon the achievement of the purposes of processing, the termination of the legal relations with the Subject or in other cases provided for by Article 18 of the Personal Data Law, the personal data shall be subject to destruction, deletion or anonymisation.
6. Consent of the Subject: procedure for giving and withdrawing consent
6.1. Consent to the collection and processing of personal data shall be given by the User in writing, by means of a state service, a non-state service or in another manner making it possible to confirm the receipt of consent (paragraph 1 of Article 8 of the Personal Data Law). On the Site, consent shall be given by an active action – by ticking the consent field, which is not pre-filled, before sending the form or enquiry.
6.2. The consent shall contain the information provided for by paragraph 4 of Article 8 of the Personal Data Law: the name and BIN of the Operator; the surname, first name and patronymic of the Subject; the term or period of validity of the consent; information on the presence or absence of transfer of the data to third parties; information on the presence or absence of cross-border transfer; information on the possibility of dissemination of the data in publicly available sources; the list of data collected; and other information determined by the Operator. The full texts of the consents are set out in the document "Consents to the Collection and Processing of Personal Data" published on the Site.
6.3. The period of validity of the consent may not exceed the period necessary to achieve the purposes of the collection and processing. Where no period is specified, the consent shall be valid until the achievement of the purposes of processing determined at the time it was given (paragraphs 5 and 6 of Article 8 of the Personal Data Law).
6.4. Withdrawal of consent. The User shall be entitled at any time to withdraw their consent by sending a notice to privacy@ala.kz or to the postal address of the Operator. Within fifteen business days of the date of receipt of the notice, the Operator shall cease the processing of the personal data and shall ensure their destruction or deletion, except in cases where the processing continues on the basis of law.
6.5. Consent may not be withdrawn where this is contrary to the laws of the Republic of Kazakhstan or where there is an outstanding obligation (paragraph 2 of Article 8 of the Personal Data Law).
6.6. Refusal to provide personal data or withdrawal of consent shall not entail adverse consequences for the User, save for the impossibility of providing a service for which the relevant data are objectively necessary.
7. Cookies and analytics services
7.1. The Site uses cookies and similar technologies. The terms of their use, the list of specific files, their purpose and storage periods are set out in the Cookie Policy published at https://go.ala.kz/en/cookies.html.
7.2. Strictly necessary (technical) cookies ensure the basic operability of the Site, including the retention of the selected language version, and are used without separate consent.
7.3. Analytics and statistical cookies (Yandex.Metrica, Google Analytics 4) shall be set only after the consent of the User has been obtained, expressed in the information banner. Until consent has been obtained, the corresponding scripts shall not be loaded.
7.4. The User shall be entitled at any time to change or withdraw their decision via the "Cookie settings" link at the bottom of every page of the Site, and also to delete cookies themselves by means of their browser.
8. Transfer of personal data to third parties
8.1. The Operator does not sell personal data and does not transfer them to third parties, except in the cases specified in this Section.
8.2. Personal data may be transferred to the following categories of recipients:
| Category of recipient | Purpose of the transfer | Comment |
|---|---|---|
| Provider of hosting and Site maintenance services | hosting and technical support of the Site | PS.KZ (ps.kz), Republic of Kazakhstan |
| Providers of analytics services | collection of depersonalised visit statistics and of statistics identifiable by cookie | Yandex.Metrica (counter No. 109996317) – Yandex LLC, Russian Federation; Google Analytics 4 – Google LLC / Google Ireland Limited |
| Owner of the messenger through which communication is conducted | delivery of messages between the User and the Operator | WhatsApp and Instagram / Meta Platforms Ireland Limited, Telegram |
| Carriers, customs representatives, warehouse operators, insurance organisations, partners for the release of cargo | organisation of carriage, customs clearance, storage, insurance and release of the cargo | the minimum necessary volume of data is transferred |
| Banks and payment organisations | performance of settlements under the contract | – |
| State bodies of the Republic of Kazakhstan and of foreign states | discharge of the obligations provided for by legislation (customs clearance, tax reporting, responses to lawful requests) | to the extent provided for by law |
| Consultants (auditors, lawyers, IT contractors) | provision of professional services to the Operator | subject to an obligation of confidentiality |
8.3. When transferring personal data to a third party, the Operator shall ensure that such person is placed under obligations to observe confidentiality and to take measures for the protection of personal data.
8.4. Where there is a condition requiring the Subject to be notified of the transfer of their personal data to a third party, the Operator shall notify the Subject within ten business days (Article 19 of the Personal Data Law).
9. Cross-border transfer of personal data
9.1. Cross-border transfer of personal data shall be carried out in accordance with Article 16 of the Personal Data Law – only provided that the foreign state ensures the protection of personal data, and in other cases – where there is the consent of the Subject or of their legal representative.
9.2. In connection with the operation of the Site and the activities of the Operator, cross-border transfer may be carried out as follows:
| Direction | Recipient | Ground |
|---|---|---|
| Communication via messenger | Meta Platforms Ireland Limited (WhatsApp, Instagram) – Ireland, USA | consent of the Subject, expressed by an active action when sending a message |
| Web analytics | Google LLC / Google Ireland Limited – USA, EU | consent of the Subject, expressed in the cookie banner |
| Web analytics | Yandex LLC – Russian Federation | consent of the Subject, expressed in the cookie banner |
| Performance of supplies and logistics operations | divisions and partners of the Operator in the PRC (Guangzhou, Yiwu) and in transit countries | performance of a contract; consent of the Subject |
9.3. The User shall be entitled to refuse the cross-border transfer of their personal data. In such case, the Operator shall offer alternative communication channels (telephone, e-mail, personal visit to the office) which do not involve such transfer.
10. Place of storage of personal data
10.1. In accordance with paragraph 2 of Article 12 of the Personal Data Law, the storage of personal data shall be carried out in a database and (or) digital object located within the territory of the Republic of Kazakhstan.
10.2. Details of the location of the database: hosting provider PS.KZ (ps.kz), Republic of Kazakhstan. The Site and the Operator's information systems run on the Operator's own software; third-party services take part in the processing only in correspondence via messengers and Instagram.
10.3. The use of third-party services whose servers are located outside the Republic of Kazakhstan shall be permitted subject to compliance with the requirements of Section 9 of the Policy and provided that the primary accumulation and storage of personal data are carried out within the territory of the Republic of Kazakhstan.
11. Measures for the protection of personal data
11.1. The Operator shall take legal, organisational and technical protective measures ensuring the prevention of unauthorised access to personal data, the timely detection of instances of such access and the minimisation of adverse consequences (Article 22 of the Personal Data Law).
11.2. Organisational measures:
- approval of a list of the personal data processed which is necessary and sufficient for the tasks being performed;
- appointment of a person responsible for organising the processing of personal data;
- approval of internal rules for the processing and protection of personal data;
- differentiation of employees' access rights on the principle of least privilege;
- familiarisation of employees with the requirements of legislation and the obtaining of non-disclosure undertakings;
- periodic training of employees and monitoring of compliance with the requirements.
11.3. Technical measures:
- transfer of data over the secure HTTPS (TLS) protocol;
- differentiation and journaling of access to information systems;
- registration and recording of actions involving the modification, blocking, destruction and deletion of personal data;
- back-up copying and monitoring of data integrity;
- anti-virus protection, firewalling, vulnerability control;
11.4. The obligations of the Operator with respect to the protection of personal data shall arise from the moment of their collection and shall remain in force until the moment of their destruction, deletion, anonymisation or depersonalisation (paragraph 2 of Article 22 of the Personal Data Law).
12. Actions in the event of a breach of personal data security
12.1. Upon detecting a breach of personal data security (leakage, unauthorised access, modification or destruction of data), the Operator shall:
- immediately upon detection notify the authorised body, specifying the contact details of the person responsible for organising the processing of personal data;
- take measures to contain the incident and minimise its consequences;
- conduct an internal investigation and record its results;
- where there is a risk of infringement of the rights of subjects, inform the affected subjects of the nature of the incident and of the recommended measures.
12.2. Information on breaches of personal data security shall be recorded in the manner established by the legislation of the Republic of Kazakhstan.
13. Automated processing and algorithmic systems
13.1. The Operator uses automated means of data processing, including transport management systems (TMS), a warehouse system (WMS), CRM and software assistants based on algorithmic systems.
13.2. Decisions entailing legal consequences for the User (conclusion of a contract, determination of the cost of services, refusal to provide a service) shall not be taken solely on an automated basis – the final decision shall be approved by an authorised employee of the Operator.
13.3. In accordance with Article 43 of the Digital Code of the Republic of Kazakhstan, the User shall be entitled:
- to obtain information on the fact that an algorithmic system has been applied in respect of them;
- to obtain an explanation of the key factors and criteria which influenced the decision, without disclosure of algorithms, source code and information constituting a secret protected by law;
- to demand a review of the decision with the participation of an authorised specialist, where the decision entails legal consequences or is capable of affecting their rights and legitimate interests.
13.4. The results of automatic calculations (including those of the logistics cost calculator) are of a preliminary and indicative nature and do not constitute an offer.
14. Rights of the personal data subject and the procedure for exercising them
14.1. In accordance with Article 24 of the Personal Data Law and Article 41 of the Digital Code of the Republic of Kazakhstan, the User shall be entitled:
- to know whether the Operator holds their personal data and to receive information confirming the fact, purposes, sources and methods of the collection and processing, the list of personal data, and the periods of their processing and storage;
- to demand the modification and supplementation of their personal data where there are grounds confirmed by the relevant documents;
- to demand the blocking and (or) anonymisation of their personal data where there is information about a breach of the conditions of their collection and processing;
- to demand the destruction or deletion of their personal data whose collection and processing were carried out in breach of legislation, and also in other cases established by law;
- to withdraw consent to the collection, processing, dissemination in publicly available sources, transfer to third parties and cross-border transfer of personal data;
- to give consent to, or refuse, the dissemination of their personal data in publicly available sources;
- to demand the restriction of the processing of personal data in the manner provided for by Article 41 of the Digital Code of the Republic of Kazakhstan;
- to the protection of their rights and legitimate interests, including compensation for moral and material harm;
- to appeal against the actions (inaction) of the Operator to the authorised body and to a court.
14.2. Procedure for making an enquiry. An enquiry shall be sent to privacy@ala.kz or to the postal address of the Operator. The enquiry shall contain: the surname, first name and patronymic of the Subject; information making it possible to identify the Subject and to confirm their connection with the data processed; the substance of the demand; and the method by which the response is to be sent. The Operator shall be entitled to request additional information necessary exclusively for the identification of the applicant.
14.3. Time limits for consideration:
| Demand of the Subject | Time limit for compliance |
|---|---|
| Modification and (or) supplementation of personal data on the basis of supporting documents; destruction or deletion where modification is impossible | one business day |
| Blocking of personal data where there is information about a breach of the conditions of collection and processing | one business day |
| Destruction or deletion of personal data where the fact of their collection and processing in breach of legislation is confirmed | one business day |
| Removal of blocking where the fact of the breach is not confirmed | one business day |
| Cessation of processing and destruction of data following withdrawal of consent | fifteen business days |
| Provision of information at the request of the Subject or a reasoned refusal | within the time limits established by the legislation of the Republic of Kazakhstan |
14.4. Access by the Subject to the personal data relating to them shall be provided free of charge.
14.5. The Operator shall be entitled to refuse to satisfy a demand where this is contrary to the laws of the Republic of Kazakhstan, or is necessary for the performance of an outstanding obligation, for the protection of life and health, of the rights and legitimate interests of third parties, for the consideration of cases concerning offences, for the administration of justice or for archival storage. The refusal shall be provided in written and reasoned form.
15. Personal data of minors
15.1. The Site is not intended for persons under eighteen years of age, and the Operator does not carry out any targeted collection of their personal data.
15.2. The processing of the personal data of a minor shall be permitted only with the consent of their legal representative.
15.3. Where it is established that the personal data of a minor obtained without the consent of the legal representative are being processed, such data shall be subject to deletion within the shortest possible time from the moment this circumstance is established.
16. Links to third-party resources
16.1. The Site contains links to external resources: the personal account and calculator at ala-cargo.com, the WhatsApp messenger, the Instagram social network, the 2GIS mapping service and partners' websites.
16.2. The Operator does not control the processing of personal data by the owners of such resources and shall not be liable for their privacy policies. It is recommended that the legal documents of the relevant resources be reviewed independently.
17. Amendment of the Policy
17.1. The Operator shall be entitled to make amendments to the Policy. The current revision is always available at https://go.ala.kz/en/privacy.html, with an indication of the effective date.
17.2. The Operator shall give notice of material amendments affecting the volume of data processed, the purposes of processing or the range of recipients by placing a prominent information notice on the Site not less than 10 (ten) calendar days before the amendments take effect.
17.3. Where the amendments require new consent of the Subject, processing on the new terms shall commence only after such consent has been obtained.
18. Appeals and settlement of disputes
18.1. All enquiries concerning the processing of personal data shall be considered by the Operator by way of pre-trial procedure.
18.2. Where the User disagrees with the Operator's response, the User shall be entitled to apply to the authorised body in the field of personal data protection of the Republic of Kazakhstan – the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, Information Security Committee – and also to a court in accordance with the rules of jurisdiction established by the Civil Procedure Code of the Republic of Kazakhstan.
18.3. The law of the Republic of Kazakhstan shall apply to this Policy.
19. Language versions
19.1. The Policy is published in the Kazakh, Russian, English and Chinese languages.
19.2. The Kazakh and Russian texts have equal legal force. The English and Chinese texts are translations provided for ease of reference. In the event of any discrepancy between the English or Chinese text and the Kazakh or Russian texts, the Russian text shall prevail.
20. Contact details for enquiries
Limited Liability Partnership "ALA INTERNATIONAL" BIN 250640012858 Address: Republic of Kazakhstan, Almaty city, Alatau district, Algabas microdistrict, Street 7, Building 134/3 E-mail for personal data enquiries: privacy@ala.kz Telephone: +7 775 708 88 80 Person responsible for organising the processing of personal data: Director Dias Manasuly Nurtiliyev