Privacy Policy (personal data processing)
Version 2.0 · effective date: 22 August 2026
1. General
1.1. This Policy is drawn up under the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Its Protection” (the “Law”) and defines how LLP «СТРОЙМЕТАЛЛИНВЕСТ 2050» (the “Operator”) processes and protects personal data.
1.2. It applies to all information the Operator obtains about visitors of the website qalarise.kz (the “Website”). The Website developer is not the data operator.
2. What data the Website collects and where (data map)
- Consultation request form — name, phone number.
- Cost calculator — project parameters (type, material, area, finishing level, timeframe), chosen contact channel and phone number.
- Cookies & advertising — cookies of Google (Google Ads), loaded only after consent in the cookie banner.
- There is no user account, registration, online payment, ordering or online booking on the Website. No other third-party counters or chats are used.
3. Purposes, data, legal basis and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling the request, calling back, consulting, preparing an estimate and offer | Name, phone number; calculator project parameters | Consent of the subject; conclusion and performance of a contract | Until the request is handled and the contract performed; if no contract — no longer than 12 months from the last contact, then deleted or anonymised |
| Measuring advertising performance and conversions | IP address, cookies, device and browser type, on-site actions (via Google Ads) | Consent to cookies (cookie banner) | Per Google’s retention (typically up to 24 months) or until consent is withdrawn / cookies are cleared |
The Operator does not run marketing mailings and does not use the phone number for advertising without separate consent. No automated decision-making with legal effects is performed.
4. Automatically collected data and cookies
Before consent to cookies, no analytics or advertising scripts run. After consent, Google (Google Ads) may collect anonymised data: IP address, device and browser type, referral source, on-site actions and cookies. When a form is submitted, the server-side handler records the IP address and time as proof of consent. Yandex.Metrica and other counters are not used on the Website.
5. Recipients and cross-border transfer
- Authorised employees of the Operator — to handle the enquiry;
- Telegram messenger — used by the Operator to receive and process requests;
- The Website’s hosting provider — to host the Website and run the server-side form handler;
- Google (Google Ads) — to measure advertising performance, only with cookie consent.
Telegram, Google and (as of publication) the hosting provider run servers outside the Republic of Kazakhstan, so processing includes a cross-border transfer, carried out on the basis of consent and to states that ensure the protection of personal data. The Operator does not sell the data or transfer it to any other third parties.
6. Your rights
You may: obtain information about the processing of your data; request its correction, blocking or deletion if it is incomplete, outdated, inaccurate or unlawfully obtained; withdraw consent; request that processing stop; appeal to the authorised body or to court.
7. How to send a request & how it is handled
To learn what data we hold, correct it, withdraw consent, stop processing or delete data, email erzhanovtalap@gmail.com (state the subject, e.g. “Withdrawal of consent” or “Data deletion”).
The Operator designates a responsible person who receives the request, verifies the applicant’s identity, locates the data across all systems, replies within the statutory period and keeps proof of the action taken. After consent is withdrawn, processing stops within 15 (fifteen) working days, unless continuation is required by law or an outstanding contractual obligation; the data is then deleted or anonymised.
8. Security measures
Data transfer on the Website is secured with HTTPS. Consent checking and request handling run server-side; access tokens are kept in a protected server configuration, not in page code. The Operator applies organisational and technical measures against unlawful access, alteration, copying, disclosure and destruction, and limits access to staff who need it to handle the enquiry.
9. Data-breach response
If an incident occurs (a leak or unauthorised access), the Operator immediately cuts off access, assesses the scope, notifies the authorised personal-data protection body of the Republic of Kazakhstan within the statutory period, notifies affected subjects where required, changes passwords and access keys, and records the incident and the results of the internal investigation. The response procedure is set out in the Operator’s internal regulation.
10. Final provisions
10.1. This Policy is publicly available at https://qalarise.kz/en/privacy/, linked in the Website footer and next to the forms (via the consent to data processing).
10.2. The Operator may amend this Policy; the version number and date are updated on each change. The current version is always available on this page.
10.3. The specific consent a user gives when submitting a form is set out in a separate document — Consent to the processing of personal data.