01Who processes the data
The holder of the personal data and the controller within the meaning of the GDPR is Limited Liability Company TOO TRADE (ОсОО «ТооТрейд»).
- Tax ID01809202610009
- OKPO35268153
- Reg. No.334103-3301-ООО
- Address153/1, apt. 9, A. Volkova St., Pervomaysky District, Bishkek, Kyrgyz Republic
- Emailinfo@tootrade.kg
- Phone+996 703 438 481
For any data protection matter, write to info@tootrade.kg with the subject “Personal data”. The company has not designated a representative in the EU, as processing of data of EU residents is occasional and does not include special categories of data (Art. 27(2) GDPR).
02What data we receive
Website requests. Your name, phone number and (optionally) email address, the selected subject, the message text, and technical details of the request: date and time, IP address, site language version and a record of your consent to this document (version number and time).
Correspondence and calls. If you write to order@tootrade.kg or info@tootrade.kg or call us — your address, name, phone number and the content of your enquiry.
Server logs. When you visit the website, the web server automatically records the IP address, date and time of the request, the page requested, the response code and browser details (User-Agent). Repeated failed sign-in attempts to the mail services are recorded by the brute-force protection system.
What we do not do. The website uses no cookies, no web analytics, no advertising pixels and no profiling. We do not ask for special categories of data (health, beliefs, etc.) and ask you not to include them in your messages.
03Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to your request, prepare an estimate or a quotation | request, correspondence | Your consent (KR Law No. 58); steps taken at your request prior to a contract — Art. 6(1)(b) GDPR, and consent — Art. 6(1)(a) |
| Conclude and perform a supply or construction contract | contact person details, correspondence | Contract — Art. 6(1)(b) GDPR; KR Law No. 58 |
| Accounting and tax records for concluded contracts | data in contracts and source documents | Legal obligation under KR law — Art. 6(1)(c) GDPR |
| Security of the website and mail, protection against spam and intrusion | server logs, IP addresses | Legitimate interest in protecting our systems — Art. 6(1)(f) GDPR |
We do not use your data for marketing mailings and do not make decisions about you based solely on automated processing.
04Consent and withdrawal
When you submit the website form, you tick the box agreeing to this document; the form cannot be sent without it. We keep the document version and the time of consent so that we can demonstrate it if needed.
You may withdraw consent at any time by writing to info@tootrade.kg. Withdrawal does not affect the lawfulness of processing carried out before it, nor processing on other legal bases (such as performing a concluded contract or statutory accounting requirements).
05Who receives the data
Data is available only to TOO TRADE staff who need it to handle your enquiry. We do not sell personal data or share it with third parties for their own purposes.
Processors acting on our behalf:
- Hosting provider — provides the virtual server running the website, request handling and @tootrade.kg mail. The server is located in a data centre in Belgrade, Republic of Serbia. The provider has no access to the content of requests or emails in the course of normal operation.
- Google Fonts (Google LLC, USA) — when a page is opened, your browser loads fonts from Google servers, and Google receives your IP address and browser details. Google LLC participates in the EU–U.S. Data Privacy Framework.
Data may also be disclosed to public authorities, but only where the law expressly requires it.
06International transfers
The server storing the data is located in the Republic of Serbia; the website fonts are loaded from Google servers (USA). Data is therefore transferred outside the Kyrgyz Republic and, for visitors from the EU, outside the European Economic Area.
Serbia has a data protection law harmonised with the GDPR (Law on Personal Data Protection, 2018). Transfers take place with your consent given when submitting the form and to the extent necessary to respond to your request (Art. 49(1)(a) and (b) GDPR); for Google — on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework.
07Retention periods
| Data | Period |
|---|---|
| Requests and correspondence that did not lead to a contract | up to 3 years after the last contact, then deleted |
| Data relating to concluded contracts and source documents | for the periods required by KR accounting and archiving law |
| Web server logs | up to 14 days |
| System logs (mail, brute-force protection) | up to 30 days |
When the period expires, data is deleted or anonymised. At your request we will delete data earlier unless the law requires us to keep it.
08How we protect data
- the website and mail work only over encrypted HTTPS/TLS;
- the server is under our control and accessible only with keys;
- mail connections require a password and encryption; password-guessing attempts are blocked automatically;
- only authorised staff have access to requests and correspondence;
- the request form accepts a limited amount of data and is protected against automated submission.
09Your rights
Under KR Law No. 58 and the GDPR you have the right to:
- find out whether we process your data and obtain a copy;
- have inaccurate data corrected or incomplete data completed;
- have your data erased or its processing restricted;
- receive your data in a machine-readable format and transmit it to another party (portability);
- object to processing based on legitimate interest;
- withdraw your consent at any time;
- lodge a complaint with a supervisory authority.
Send your request to info@tootrade.kg. We will reply within one month of receipt; we may ask you to confirm your identity. Requests are handled free of charge.
10Complaints
In the Kyrgyz Republic — the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic.
In the European Union — the data protection supervisory authority of the EU member state where you live, work or where you believe the infringement took place.
We would appreciate the chance to resolve your concern first — please write to us.
11Children
The website is intended for adult customers and businesses. We do not knowingly collect data of persons under 16. If you believe a child has provided us with data, contact us and we will delete it.
12Changes to this document
We may update this document. The current version is always published on this page; the date and version number are shown at the top. Material changes do not apply to consent already given unless consent is obtained again.
This document is published in Kyrgyz, Russian and English. In case of discrepancy, the Russian version prevails for relations governed by the law of the Kyrgyz Republic.