Privacy
policy.

This website is operated by Umai Group LLC, 16 Chokan Valikhanov St., Bishkek, Kyrgyz Republic (“Umai Group”, “we”, “us”). Umai Group is the controller of the personal data described in this policy.

For any question about this policy or your personal data, write to office@umai-retail.kg.

This policy covers personal data collected through this website only. The websites and mobile applications of our store chains — Globus, Narodny, Dostor and SPAR — have their own privacy policies.

When you send a form on this website (a supplier proposal, an advertising or real estate request, a job application or a general message), we collect:

• your name
• your phone number
• your email address, if you provide it
• the text of your message and, for job applications, the position you choose
• the page the form was sent from, the language of the page and the date and time of sending

When you send a CV by email, we receive the information contained in your email and its attachments.

When you visit the website, our servers automatically record technical data such as your IP address, browser type and the pages requested, as part of standard server logs.

Please do not include sensitive data (such as health information) in your messages. We do not need it.

• To review and answer supplier, advertising and real estate requests, and to take steps before entering into a contract with you — Article 6(1)(b) GDPR.
• To consider your job application — Article 6(1)(b) GDPR.
• To answer general enquiries and media requests — our legitimate interest in communicating with people who contact us, Article 6(1)(f) GDPR.
• To keep the website secure, prevent spam and abuse and fix technical problems using server logs — our legitimate interest in running a safe website, Article 6(1)(f) GDPR.
• To comply with legal obligations that apply to us — Article 6(1)(c) GDPR.

We do not use your data for automated decision-making or profiling, and we do not send marketing messages based on the forms on this website.

This website uses only strictly necessary cookies:

• a session cookie that keeps the website working while you browse; it expires after 120 minutes of inactivity
• an XSRF-TOKEN cookie that protects the forms against cross-site request forgery

We do not use analytics, advertising or social media tracking cookies. Because these cookies are strictly necessary, they do not require your consent. Fonts are served from our own server, so no data is sent to font providers.

Your request is seen only by the Umai Group employees who handle it — for example, the purchasing, marketing, real estate or HR team.

We use service providers who process data on our behalf, such as our website hosting and email providers. They may only use your data to provide their services to us.

We may disclose data where required by law or to establish, exercise or defend legal claims.

We do not sell your personal data.

Umai Group is based in the Kyrgyz Republic, and your data is processed outside the European Economic Area. The Kyrgyz Republic has not been recognised by the European Commission as providing an adequate level of data protection. Where we transfer personal data from the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or on the transfer being necessary to respond to your request. You can ask us for more information about these safeguards.

We keep form requests for as long as needed to handle them and to continue any resulting business relationship, and then delete them.

We keep job applications for the duration of the recruitment process; if you are not hired, we delete them unless you agree that we keep them for future vacancies.

Server logs are kept for a short period for security purposes and then deleted.

We may keep data longer where the law requires it.

Under the GDPR you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased
• restrict how we use your data
• receive your data in a portable format
• object to processing based on our legitimate interests

To exercise any of these rights, write to office@umai-retail.kg. We will reply within one month.

You also have the right to lodge a complaint with the data protection supervisory authority in the EU country where you live or work.

We use technical and organisational measures to protect your data, including encrypted HTTPS connections, access limited to the employees who need the data and protection of the forms against automated spam.

This website is intended for business partners and job seekers and is not directed at children. We do not knowingly collect personal data from anyone under 16.

We may update this policy when our website or the way we process data changes. The date at the top shows when it was last updated.