Last updated: 21.09.2026
Payment organization: PayDala LLP
BIN: 190740011843
Registration No. 02-19-057 dated 06.09.2019, issued by the National Bank of the Republic of Kazakhstan
Website: https://paydala.kz
Registered address: 050013, Republic of Kazakhstan, Almaty, Bostandyk district, Al-Farabi Ave, 21, premises 1071k
This Privacy Policy ("Policy") sets out the purposes, procedure, and conditions for the collection, storage, use, transfer, and protection of the personal data of individuals ("Payers", "users") who use the services of PayDala LLP ("Company", "Payment Organization"), including through the paydala.kz website ("Site").
This Policy is developed and applied in accordance with the legislation of the Republic of Kazakhstan, including: Law of the RK dated May 21, 2013 No. 94-V "On Personal Data and Its Protection"; Law of the RK dated July 26, 2016 No. 11-VI "On Payments and Payment Systems"; Law of the RK dated May 4, 2010 No. 274-IV "On Consumer Protection"; the Civil Code of the RK; and regulations of the National Bank of the Republic of Kazakhstan.
The Policy is binding on all Company employees, as well as its partners and agents who gain access to Payers' personal data while providing services.
The Policy applies to all personal-data processing carried out in the course of providing payment services: collecting data via the Site and other Company services; processing data during payments, refunds, and dispute procedures; transferring data to acquiring banks, payment systems, Beneficiaries, and authorized government bodies; storing and protecting data.
By using the Company's services and providing personal data, the Payer confirms agreement with the terms of this Policy.
Identification data: full name, national ID number (IIN), date of birth — where required for a specific service.
Contact data: phone number, email address, mailing address — where required to send notices.
Payment details: data on payment instruments (bank cards, e-wallets) in a masked, tokenized, or encrypted form that prevents unauthorized access.
Transaction data: amount, currency, date and time of the operation, recipient of the payment, purpose of the payment.
Technical data: IP address, browser and device information, cookies — collected automatically for information-security purposes and to protect the Site from automated abuse (see Section 8).
The payment-status check form on the Site does not request or collect personal data, but it does process payment-specific data: the payment ID (operation ID), sum, and date — these three values are used together to find one specific payment. For technical purposes (preventing automated enumeration, see Section 8), the requesting IP address is also processed.
The Company does not collect special categories of personal data (racial or ethnic origin, political views, health status, etc.), except where directly required by the legislation of the RK.
Concluding and performing the payment-services agreement, including accepting, processing, and remitting payments to Beneficiaries.
Complying with the legislation of the RK, including anti-money-laundering and counter-terrorist-financing (AML/CFT) legislation, and tax and currency-control requirements.
Ensuring information and financial security: identifying Payers, preventing fraud, monitoring transactions.
Reviewing Payers' requests, applications, and complaints, and liaising with banks and payment systems to resolve disputes.
Processing partner-onboarding requests (the "Connect with Paydala" form) and support requests.
Maintaining internal reporting and statistics required to comply with regulators' requirements.
The Company does not use personal data for direct marketing without the separate consent of the data subject.
Acceptance of the public offer, which constitutes an agreement between the Payer and the Company.
The explicitly expressed consent of the data subject (including by checking a box on the Site).
Compliance with the requirements of the legislation of the Republic of Kazakhstan.
Performance of agreements with Beneficiaries in the Payer's interest, where providing data is necessary to confirm payment.
The Payer may withdraw consent at any time by sending a notice using the contact details in Section 10; withdrawal does not affect the lawfulness of processing carried out before that point.
The Company does not disclose or transfer personal data to third parties without the data subject's consent, except as provided by the legislation of the RK or this Policy.
Data may be transferred to: acquiring and issuing banks, to carry out payment operations; payment systems, for transaction processing and clearing; Beneficiaries, to the extent necessary to confirm payment; partner organizations involved in service delivery (processing centers, data centers, technology providers), provided they observe confidentiality requirements; government bodies, where required by law.
Cross-border transfer of data is permitted only where an adequate level of data protection is ensured in the recipient country, or with the data subject's consent, or where necessary for the performance of a contract.
The Company does not sell or otherwise commercially exploit Payers' personal data.
Data related to payments, refunds, and cancellations (including data needed for accounting, tax purposes, and financial monitoring) is retained for at least 5 (five) years, in accordance with AML/CFT and tax legislation of the RK.
Correspondence, complaints, and other requests from Payers are retained for at least 3 (three) years.
Other retention periods may be established by specific regulations of the Republic of Kazakhstan.
Upon expiry of the retention period, data is destroyed or anonymized, except where further retention is necessary to execute a court order, participate in a dispute, or protect the parties' lawful interests.
The Payer has the right to: obtain information about the facts and purposes of the processing of their personal data; request correction, blocking, or deletion of data that is incomplete, outdated, inaccurate, or unlawfully processed; withdraw previously given consent; and appeal the Company's actions to the authorized government body or to court.
To exercise these rights, contact the Company using the details in Section 10. Requests are reviewed within 15 (fifteen) business days of receipt, unless another period is set by law.
Withdrawing consent may make it impossible to continue providing services that require the use of the relevant personal data.
The Company applies organizational measures: appointing a person responsible for personal-data protection, training staff, restricting data access on a need-to-know basis, and imposing confidentiality requirements on partners and agents.
The Company applies technical measures: encrypting data-transmission channels, tokenizing payment details, using information-security tools, performing backups, controlling data access, and logging information-security incidents.
The payment-status check form on the Site is additionally protected by rate limiting — both per IP address and per specific payment ID — which prevents automated enumeration of payment data. All three search parameters (ID, sum, date) are matched simultaneously.
The Site may use cookies to function correctly, authenticate users, ensure information security, and collect anonymized visit statistics.
The Payer may manage cookies independently via their browser settings, including disabling them; this may limit the Site's functionality.
This Policy is published on the Company's official website and is a publicly available document.
The Company may amend the Policy; the new version takes effect upon publication on the Site. Continued use of the Company's services after publication of a new version constitutes acceptance of the changes.
For questions about the processing of personal data, please contact us via the WhatsApp or Telegram links in the "Contacts" section of the Site.
