1. Purpose and Legal Basis
This policy governs the collection, processing, storage, and protection of personal data of users of the website MegaHub (hereinafter — the Website).
Personal data is processed in accordance with the Law of the Republic of Kazakhstan On Personal Data and Their Protection dated 21 May 2013, No. 94-V (hereinafter — the Law).
2. Personal Data Controller
The personal data controller is ТОО «MegaHub». Address: г. Алматы, ул. Рыскулбекова, д. 28/1.
For questions about personal data processing and data subject rights, use the contact form.
3. Categories of Personal Data Processed
The controller processes the following categories of personal data:
3.1. Retail order form (shopping cart)
- Buyer full name
- Phone number
- Email address
- Order comment (if provided)
- Order contents: book identifiers, quantities, prices at the time of order placement
3.2. B2B request form (wholesale, schools, marketplaces)
- Organisation name and legal form
- Region (oblast / city)
- Full name of the contact person
- Email address of the contact person
- Phone number of the contact person
- Request text
- Attached file or document link (if provided)
- IP address and browser User-Agent string at the time of submission
3.3. Author / publisher application form
- Author full name
- Email address
- Phone number
- Manuscript title
- Manuscript synopsis
- Manuscript file or link (if provided)
- IP address and browser User-Agent string at the time of submission
3.4. Data protection request form (compliance)
- Full name (if provided)
- Email address
- Phone number (if provided)
- Request subject (complaint, ethics violation, data access request, other)
- Request text
- Attached file (if provided)
- IP address and browser User-Agent string at the time of submission
- Version of the privacy policy in effect at the time of submission
3.5. Technical data (collected automatically)
- Visitor IP address
- Browser type and version (User-Agent)
- Page visit data when a Yandex Metrika counter is enabled
4. Purposes of Processing
| Purpose | Data categories |
|---|---|
| Processing and fulfilment of retail orders | Sect. 3.1 |
| Review of B2B requests and negotiations | Sect. 3.2 |
| Review of author and publisher applications | Sect. 3.3 |
| Handling data protection requests | Sect. 3.4 |
| Website traffic analysis and improvement | Sect. 3.5 |
| Compliance with the legislation of the Republic of Kazakhstan | All sections |
5. Consent when submitting forms
Before submitting an enquiry, the user marks consent to personal data processing and can read this policy. The website stores the submission date and time and the policy version configured at the time of the enquiry.
Form data is used to review the enquiry, contact the applicant and arrange a purchase or cooperation. Other purposes or further actions may require separate grounds and agreements under applicable law.
6. Personal data retention
Enquiry data is used to review the request, contact the applicant and arrange a purchase or cooperation. Further retention depends on the purpose of processing, contractual obligations and applicable legal requirements. This revision does not set a single retention period in years for all enquiries.
Technical cookies expire according to the website settings. Basket contents remain in the browser until the user clears or changes them. Questions about retention, correction or deletion of your data can be sent through the contact page form.
7. Services and data recipients
Hosting and email
The website is hosted by ps.kz in Kazakhstan. Notifications are sent through the mhb.kz domain’s mail server to staff listed in notification routes and to the applicant’s address. Messages contain the relevant enquiry details. Where a recipient uses an external email provider, delivery also involves processing by that provider.
External resources
The browser requests Google Fonts to load typefaces. When a Yandex Metrika counter is enabled, visit data may be sent to that service. Its presence depends on the website settings; this revision does not state that the counter is always active.
8. Enquiries about personal data
You may request information about the processing of your data, seek correction of inaccurate details, withdraw consent or request deletion. Enquiries are considered in light of applicable legal requirements and any grounds for continued retention.
Use the contact page form or email comp@mhb.kz. State which enquiry or data your question concerns. You may also contact the competent public authority.
9. Cookies and Analytics
9.1. Cookies set by the Website
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| laravel_session | Session cookie | User session identification | According to website settings |
| XSRF-TOKEN | Session cookie | Cross-site request forgery (CSRF) protection | According to website settings |
9.2. Browser local storage (localStorage)
| Name | Purpose |
|---|---|
| bookstore.cart.v1 | Storing the buyer cart contents in the browser |
bookstore.cart.v1 data is not sent to the server automatically and is not a cookie. It is deleted when the user clears site data in the browser.
9.3. Analytics cookies (Yandex Metrica)
When the counter is enabled, Yandex Metrica sets its own cookies to identify unique visitors and collect traffic statistics. For a list of Yandex Metrica cookies, see: https://yandex.ru/legal/confidential/
9.4. Managing cookies
You may disable cookies in your browser settings. Disabling session cookies (laravel_session, XSRF-TOKEN) will prevent the use of Website forms. Disabling analytics cookies does not affect Website functionality.
Yandex Metrica loads automatically on public website pages unless this browser has a saved preference to disable analytics. You can disable or re-enable it through “Analytics settings” in the footer. Your choice is stored in this browser for up to one year. Webvisor and automatic form tracking are disabled. Our code reports page views and goals without request contents, names, phone numbers, email addresses or request IDs. Disabling analytics stops subsequent events; previously collected data and cookies are not automatically deleted.
10. Personal data safeguards
The website uses HTTPS for transmission between the browser and server. Access to the administration panel requires account authentication and a verification code. Staff permissions are limited by their assigned role.
Sign-ins and administrative actions are recorded in an audit log. Files attached through forms are checked for permitted type and size. Sessions expire according to the server settings.
11. Contact for enquiries
For questions about personal data processing, contact MegaHub LLP through the contact page form or email comp@mhb.kz.
Describe your question and provide an address for a reply. Name and phone are optional in the form. Staff may request clarification to review the enquiry.
12. Changes to This Policy
The controller may update this policy. When changes are made, the document version number is incremented. The current version is always available at /legal/privacy-policy.
When users resubmit forms on the Website after a policy update, they confirm acceptance of the updated version. The version of the policy under which consent was given is recorded in the database together with the date and time of submission.
The specific revision date is not indicated — the operational identifier is the version number. Upon significant changes, the version is increased (1.0 → 1.1 for clarifications / 1.0 → 2.0 for substantial revisions).