Last updated: 18 September 2026 · Applies to kazavto.com and KAZAVTO Business surfaces described here.
1. Who we are
KAZAVTO operates the Kazakhstan automotive marketplace at kazavto.com. For this Policy, KAZAVTO is the operator (controller) of personal data collected through the site and Business workspace. Privacy requests: use the contact form (topic: Privacy) or the address published for this market. Competent authority: the authorized body for personal data protection in the Republic of Kazakhstan (functions assigned under the Ministry of Digital Development, Innovation and Aerospace Industry).
2. Data we collect
We collect only what is needed to run the marketplace, verify traders, route inquiries, and keep the service secure. We do not collect genetic data. We do not operate a biometric identification system. Identity-document images you upload for KYC are used to verify the company, not for facial recognition.
Account & company
Name, work email, phone (including WhatsApp number if you provide one), company legal name, tax or registration number you submit, city, role, membership plan, and verification documents (trade licence, company extract, ID of the authorised person).
Marketplace activity
Listings you publish (including VIN, price, location, and photos you choose to show), buy requests, quotes, favorites, messages, and lead events (for example Call / WhatsApp / Message clicks on a storefront). Public listing and storefront fields are visible to other users by design.
Technical & usage
IP address, device / browser type, language preference, pages viewed, approximate location derived from IP, and cookies or local storage used for session and language. We do not sell browsing profiles to data brokers.
Support
Content of contact forms and support emails (including careers applications you send us).
What we do not collect by default
Payment-card PAN for vehicle deals (those stay between buyer and seller), special categories such as health, ethnicity, religion, or political views, children’s data, precise GPS, and telecommunications traffic content. If a bank or payment processor is used for membership fees, that processor is the operator of card data under its own notice.
3. Why we process data (legal grounds)
Grounds under the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V «On Personal Data and its Protection» (as amended) include: (a) your consent, which you may withdraw without affecting processing already completed; (b) performance of a contract or steps you requested before a contract (account, listings, messaging, membership); (c) our legitimate operational need to keep the marketplace secure, prevent fraud, and produce aggregated market statistics where that is recognised; and (d) compliance with Kazakhstan law and lawful requests. Marketing emails that are not transactional are sent only with opt-in consent.
- Provide search, listings, storefronts, messaging, and Business workspace features.
- Create and route leads to the correct dealer; prevent spam and fraud.
- Process membership and advertising orders; send transactional notices.
- Improve product performance, security, and market statistics (aggregated where possible).
- Comply with law and respond to lawful requests from Kazakhstan authorities.
4. Cookies & local storage
We use essential cookies / local storage for login session, language, and basic preferences. Analytics cookies — when enabled — help us understand feature usage. You can clear site data in your browser; some features may stop working until you sign in again. Non-essential analytics are not a condition of using the public catalogue.
5. Sharing
- Other users: Public storefront and listing fields you publish are visible on the marketplace. When you contact a dealer, relevant inquiry fields are shared with that dealer so they can reply.
- China supply rail: Inquiries tied to China-origin inventory may be shared with Chehang168 / China Supply operational systems so exporters can respond. That is a transfer you request by sending the inquiry.
- Processors: Hosting, email, and (when enabled) analytics or membership-payment processors under contract, bound to use data only on our instructions.
- Legal: When required by Kazakhstan law or to protect rights, safety, and integrity of the service.
We do not sell personal information to data brokers. We do not share personal data for unrelated third-party advertising.
6. International transfers & localisation
Core marketplace databases for this site are hosted on infrastructure that serves the Kazakhstan market. Some processors (transactional email, China supply rail) operate outside Kazakhstan; those transfers follow section 6 and Law 94-V.
Cross-border transfers are made only to states that ensure protection of personal data, or otherwise on a ground permitted by Law 94-V (including your consent, or where the transfer is necessary to perform a contract with you or in your interest).
Because China export supply and some cloud or email infrastructure may involve processing outside Kazakhstan, your data may be stored in other countries. Safeguards include contracts with processors, access controls, and limiting the fields sent on a lead to what the recipient needs to reply.
7. Retention
Account and company records are kept while your account is active and for a reasonable period afterward for disputes, accounting, and legal obligations (typically up to the limitation period under the Republic of Kazakhstan law, unless a longer period is required). Message and lead logs are retained to support dealers and abuse review, then deleted or anonymized on a rolling schedule. KYC files are kept for the life of the verified membership and a limited period after closure. You may request earlier deletion where the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V «On Personal Data and its Protection» (as amended) allows.
8. Your choices
- Access or correct company / profile data from your workspace where available.
- Request a copy, correction, blocking, or deletion via the privacy contact published on this page.
- Object to certain processing or withdraw consent where processing is consent-based.
- Opt out of non-transactional marketing emails via the email footer.
- Lodge a complaint with the authorized body for personal data protection in the Republic of Kazakhstan (functions assigned under the Ministry of Digital Development, Innovation and Aerospace Industry) if you believe this Policy or the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V «On Personal Data and its Protection» (as amended) has not been followed.
9. Security
We use administrative and technical measures appropriate to a B2B marketplace (access controls, encrypted transport, monitoring). No method of transmission or storage is 100% secure. Report suspected abuse via Contact (topic: Privacy).
10. Children and age
KAZAVTO is directed at business users. You must be at least 18 years old and able to contract under the law of the Republic of Kazakhstan. We do not knowingly collect personal data from children.
11. Changes
We will update this Policy when our practices or Kazakhstan law change and revise the date above. Continued use after an update means you acknowledge the revised Policy. Material changes that require a new consent will be prompted in the Business workspace where the product supports it.
12. Contact
Privacy requests: use Contact (topic: Privacy). Related: Terms of Service. Governing text of this Policy is English; Kazakh and Russian translations, if published, are for convenience.