Kebijakan pemrosesan data pribadi

1. Who We Are

The controller of personal data collected through treeple.kz is Keeyo, Inc., a corporation organised under the laws of the State of Delaware, United States of America (File Number 10740376, incorporated on 18 August 2026). In this Policy, "Keeyo", "we", "us" and "our" refer to Keeyo, Inc.

Treeple and treeple.kz are brand names (DBA) used by Keeyo, Inc. for its travel platform. When you see "Treeple" on this website, the legal entity behind it is Keeyo, Inc.

• Registered agent: Corporation Service Company, 251 Little Falls Drive, Wilmington, DE 19808, USA
• Mailing and physical address: 10310 Courtside Lane, Apt C, Boca Raton, FL 33428, USA
• Chief Executive Officer: Yesset Sissenov
• Privacy contact: support@treeple.kz

2. Scope of This Policy

This Policy explains what personal data we collect when you visit treeple.kz, send us a booking request, subscribe to updates, chat with our team, or use any other function of the website; why we collect it; who we share it with; and what rights you have over it.

The Policy covers the treeple.kz website and the services offered through it. It does not cover the practices of the tour operators, guides, hotels, carriers and other suppliers whose products are listed on the website. Those suppliers are independent businesses with their own privacy practices, and we describe in Section 8 what we pass to them and why.

3. What Data We Collect

We collect only what a booking or an enquiry actually needs, and we deliberately keep the set small.

Booking requests and enquiries. A booking request carries your name and exactly one contact channel — a phone number, a messenger handle, or an email address — plus the details of the trip you are asking about (tour, dates, number of travellers, and any notes you choose to add). We do not ask for a second contact channel, and we do not require an identity document number, a date of birth or a residential address in order to submit a request.

Communication content. If you write to us over WhatsApp, the on-site chat, or email, we keep the message history so that we can answer you and honour what was agreed.

Account data. If you create an account, we store your login identifier and the bookings associated with it.

Payment data. Card numbers, CVV codes and bank credentials never reach our servers. Payments are handled by regulated payment providers, which return to us only a transaction reference, the amount, the status and the last four digits of the card. See Section 8 on the operator that currently processes online payments.

Technical and usage data. IP address, browser and device characteristics (screen size, language, time zone, platform), the pages you view, referral parameters (including UTM tags) and interaction events. Where you have consented to analytics, we also derive a device identifier from these characteristics in order to recognise a returning visitor.

Error diagnostics. When something breaks, our error monitoring records the technical circumstances of the failure. Contact values are stripped from these reports before they are stored.

4. How We Use Your Data

• To answer your enquiry, prepare a proposal, and arrange the trip you asked about;
• To pass the necessary booking details to the supplier who will actually deliver the service;
• To process payments and issue confirmations, vouchers and receipts;
• To provide customer support before, during and after the trip;
• To recognise that two requests came from the same person, so you are not contacted twice about the same trip;
• To measure how the website is used and to improve it;
• To send you news and offers, where you have asked to receive them;
• To detect and prevent fraud, abuse and automated attacks;
• To comply with legal, tax and accounting obligations.

We do not sell personal data, and we do not share it with third parties for their own independent marketing.

5. Legal Bases for Processing

Depending on where you are located, our processing rests on one or more of the following grounds:

• Performance of a contract — or steps taken at your request before entering into one — when we handle your booking request and arrange the trip;
• Consent — for analytics and advertising cookies, and for marketing messages. You may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand;
• Legitimate interests — keeping the website secure, preventing fraud, deduplicating requests, and understanding in aggregate how the service is used;
• Legal obligation — retaining transaction records for tax and accounting purposes.

6. Cookies and Analytics

The website uses cookies and similar browser storage. Strictly necessary cookies keep the site working — they remember your language, your session and your cookie choice — and they are set without consent because the site cannot function without them.

Analytics and advertising technologies are loaded only after you accept them in the cookie banner. They are:

• Google Analytics 4 — aggregate traffic and behaviour measurement;
• Google Ads — measuring which advertisements lead to enquiries;
• Microsoft Clarity — anonymous session and interaction analysis used to find usability problems.

These services are provided by third parties who act as independent controllers for the data they collect through their own tags, under their own privacy policies. You can change or withdraw your cookie choice at any time by clearing the site data in your browser, and you can block cookies entirely in your browser settings — the informational parts of the website will continue to work.

7. How We Protect Contact Data

Contact values and IP addresses are never written to our logs or to our analytics in the clear. Where we need to tell two records apart or merge duplicate requests, we store a salted hash of the value rather than the value itself, so the underlying phone number or email cannot be recovered from those systems.

There is no public endpoint that returns a booking request. Enquiries cannot be enumerated, and one visitor cannot retrieve another visitor's request.

Data is transmitted over encrypted connections (TLS), access to production systems is restricted to the personnel who need it, and administrative actions are logged.

8. Who We Share Data With

We share personal data only with the categories of recipient listed below, and only to the extent each of them needs it:

• Suppliers — the tour operators, guides, hotels, carriers and insurers who deliver the service you booked. They receive the traveller details required to perform it;
• Our affiliated local operator in Kazakhstan — an affiliated company and its personnel handle local trip coordination, supplier settlement and customer support on the ground, and currently also accept online payments on behalf of Keeyo, Inc.;
• Service providers (processors) — hosting, communications, analytics, error monitoring and payment providers, acting on our instructions under contract;
• Professional advisers — accountants, auditors and lawyers, where necessary;
• Authorities — where disclosure is required by applicable law or by a valid legal process, or is necessary to protect our rights or the safety of others.

If Keeyo, Inc. is involved in a merger, acquisition or transfer of assets, personal data may be transferred as part of that transaction; this Policy will continue to apply to it, and we will notify you of any material change.

9. International Transfers Between the United States and Kazakhstan

Keeyo, Inc. is established in the United States, while the trips sold through treeple.kz take place in Kazakhstan and neighbouring countries. Personal data therefore moves in both directions:

• data you submit on the website is received and controlled by Keeyo, Inc. in the United States;
• the details needed to actually run a trip are transferred to Kazakhstan, where our affiliated local operator and the suppliers process them locally in order to coordinate the trip, settle with suppliers and, at present, accept online payments;
• certain processors we use may store or replicate data in other jurisdictions where they operate.

Kazakhstan and the United States have different data protection regimes, and neither has been recognised by the European Commission as offering an adequate level of protection. Where a transfer originates from a jurisdiction that restricts international transfers, we rely on the appropriate safeguards available to us — including contractual data protection commitments with the recipient, such as the European Commission's Standard Contractual Clauses — or, where no such safeguard applies, on your explicit consent or on the necessity of the transfer for the performance of your booking contract. By submitting a booking request, you acknowledge that the details of your trip will be transferred to and processed in Kazakhstan for that purpose.

10. How Long We Keep Data

• Booking requests that did not lead to a trip — up to 24 months from the last contact, then deleted or anonymised;
• Completed bookings and payment records — for the period required by applicable tax, accounting and limitation rules, normally not less than 5 years;
• Correspondence — up to 36 months from the last message;
• Analytics data — for the retention period configured in the relevant analytics service, normally not more than 14 months;
• Salted hashes used for deduplication — for as long as the underlying record is retained.

When a retention period ends, data is deleted or irreversibly anonymised.

11. Your Rights

Subject to the law that applies to you, you have the right to:

• Access the personal data we hold about you, and obtain a copy of it;
• Correct data that is inaccurate or incomplete;
• Delete your data, where we have no overriding legal ground to keep it;
• Restrict or object to processing, including processing based on our legitimate interests;
• Portability — receive the data you provided in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, including consent to analytics cookies and to marketing messages;
• Opt out of marketing — every marketing email contains an unsubscribe link, and you may also write to us;
• Not be subject to a decision producing legal or similarly significant effects that is based solely on automated processing. We do not make such decisions;
• Non-discrimination — we will not deny you service or offer you worse terms because you exercised a privacy right;
• Complain to your competent data protection authority.

To exercise any of these rights, write to support@treeple.kz. We answer within 30 days and may ask you for information sufficient to confirm that the request comes from you. Where the law allows you to act through an authorised agent, we will honour a properly documented authorisation.

12. Children

The website is not directed at children, and we do not knowingly collect personal data from anyone under 16. Bookings for minors are made by an adult, who provides the traveller details. If you believe a child has provided us with personal data, write to support@treeple.kz and we will delete it.

13. Security

We apply organisational and technical measures appropriate to the risk: encryption in transit, restricted and logged access to production systems, minimisation of the data collected, hashing of contact identifiers, and scrubbing of contact values from diagnostic reports. No method of transmission or storage is perfectly secure, but if a breach affects your personal data we will notify you and the competent authorities as required by applicable law.

14. Changes to This Policy

We may update this Policy as our services or the applicable law change. The current version and its effective date are always shown at the foot of this page. Material changes will be announced on the website before they take effect, and where the law requires it we will ask for your consent again.

15. Contact Us

Questions about this Policy, or about how we handle your data, go to support@treeple.kz, or by post to Keeyo, Inc., 10310 Courtside Lane, Apt C, Boca Raton, FL 33428, USA.

Last updated: 02.09.2026 · Effective date: 02.09.2026 · Version 2.0
Keeyo, Inc., a Delaware corporation · treeple.kz is a brand (DBA) of Keeyo, Inc.