1. Legal Grounds for Personal Data Processing
The processing of the User’s personal data is carried out by the Operator in accordance with the Law of the Republic of Kazakhstan No. 94-V dated May 21, 2013 “On Personal Data and Their Protection” (hereinafter referred to as the “Personal Data Law”) on the following legal grounds:
(a) consent of the personal data subject to the collection, processing, and storage of their personal data (Clause 1, Article 7 of the Personal Data Law);
(b) performance of a contract to which the personal data subject is a party (Sub-clause 4, Clause 1, Article 7 of the Personal Data Law);
(c) exercise of the rights and legitimate interests of the Operator, except where such processing infringes upon the rights and freedoms of the personal data subject;
(d) compliance with the requirements of the legislation of the Republic of Kazakhstan.

2. Categories of Personal Data Collected
2.1. Data Provided Voluntarily by the User
When completing contact forms, submitting requests, or registering on the Website, the Operator may collect the following personal data: full name (surname, first name, patronymic); contact telephone number; email address; organisation name and position (for corporate clients); passport details (when booking flights); route and travel date preferences.
2.2. Data Collected Automatically
The following technical information is automatically recorded when the User visits the Website: device IP address; browser type and version, operating system; date, time, and duration of the visit; pages viewed and navigation sequence; referral source (referrer); cookie data and similar technologies; geographical location data (at the city/region level).

3. Purposes of Personal Data Processing
The Operator processes personal data exclusively for the following purposes:
(a) processing incoming enquiries and requests from Users;
(b) provision of Services and fulfilment of contractual obligations;
(c) notifying the User of the status of their enquiry or order;
(d) sending informational and marketing communications (with the User’s consent);
(e) improving the quality of the Website and Services, and analysing user behaviour;
(f) ensuring the security of the Website and preventing unauthorised access;
(g) compliance with the requirements of the legislation of the Republic of Kazakhstan.

4. Storage and Protection of Personal Data
Personal data is stored on servers located within the territory of the Republic of Kazakhstan, in accordance with the requirements of Article 16 of the Personal Data Law.
The Operator implements the necessary legal, organisational, and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions, including:
(a) encryption of communication channels (SSL/TLS protocol);
(b) differentiation of access rights to information systems;
(c) maintenance of access logs and audit trails for personal data operations;
(d) regular updates to information security systems;
(e) staff training on personal data processing and protection procedures.
Personal data is retained for no longer than is necessary for the purposes of its processing and shall be destroyed once the purposes of processing have been achieved or the need for such processing has ceased, unless otherwise provided by the legislation of the Republic of Kazakhstan.

5. Disclosure of Personal Data to Third Parties
The Operator does not disclose the User’s personal data to third parties, except in the following cases:
(a) the User has provided explicit consent;
(b) data is disclosed at the request of authorised government bodies of the Republic of Kazakhstan in cases prescribed by law;
(c) third parties are engaged to fulfil obligations to the User (contractors, service partners), provided that they ensure an adequate level of personal data protection and appropriate confidentiality agreements are in place;
(d) reorganisation of the Operator in accordance with the legislation of the Republic of Kazakhstan.
Cross-border transfer of personal data is carried out in accordance with the requirements of Article 16 of the Personal Data Law and only to states that ensure adequate protection of the rights of personal data subjects.

6. User Rights Regarding Personal Data
In accordance with the Personal Data Law, the User has the right to:
(a) be informed of and access their personal data held by the Operator (Article 15 of the Personal Data Law);
(b) request the amendment or supplementation of their personal data in the event of incompleteness or inaccuracy;
(c) request the blocking of their personal data if unlawful processing is identified;
(d) request the deletion of their personal data in the event of unlawful collection or processing;
(e) withdraw previously given consent to personal data processing;
(f) file a complaint with the authorised personal data protection body or a court regarding actions (or inaction) of the Operator.

To exercise these rights, the User may submit a request to the following email address: [specify email] or by post to: Republic of Kazakhstan, Almaty, Bostandyk District, 286V Zharokova Street, postal code 050060. The Operator undertakes to process the request within 15 (fifteen) business days of receipt.