On this page
Last updated: ждёт данныхTO FILL: date of publication
1. Who is responsible for your data
The controller of your personal data (the “owner and operator” under Kazakhstan law) is:
ждёт данныхTO FILL: exact registered name of the contracting entity in Latin letters, for example “Individual Entrepreneur
Person responsible for the organisation of personal data processing: ждёт данныхTO FILL: name or role
EU representative under Article 27 GDPR: [OWNER DECISION: name and address of an appointed representative, or remove this line, see README.md] UK representative under Article 27 UK GDPR: [OWNER DECISION: same as above]
2. What this policy covers
This policy explains how we handle personal data when you visit aoe-marketing.com, fill in a form, write to us, book a call, or become our client or partner. It does not cover websites of our clients; their own privacy notices apply there.
3. What data we collect
3.1. Data you give us through the contact or audit request form
[CHECK AFTER SETUP: match the final form fields]
| Field | Required |
|---|---|
| Name | yes |
| Work email | yes |
| Company name | no |
| Website address | yes |
| Country | no |
| Message: what you need | no |
| Budget range | no |
| Consent tick boxes (see section 5.4) and the time you ticked them | yes |
Please do not send us sensitive data (health, religion, political views and similar) or data about other people through the form.
3.2. Data from emails, calls and meetings
Your name, email, job title, company, what you tell us about your project, and notes from calls. We do not record calls without telling you in advance and asking for your agreement.
3.3. Data about clients and partners
Contact details of your team, contract and billing details (company details, invoices, payment records), and correspondence.
3.4. Data collected automatically
- Technical data processed by our hosting and security provider Cloudflare when you open the site: IP address, browser and device type, pages requested, time of request. Cloudflare uses it to deliver the site and protect it from attacks.
- Analytics data, only if you agree in the cookie banner (for visitors from the EU, EEA, UK and Switzerland): pages viewed, time on page, approximate location (country, city), device type, how you reached the site, and for Microsoft Clarity also clicks, scrolls and mouse movements on our pages. Clarity is set up to mask text you type into fields. [CHECK AFTER SETUP: masking set to “strict” or “balanced”]
- Details are in our Cookie Policy [link /cookies/].
4. Why we use your data and on what legal basis
| Purpose | Data | Legal basis under GDPR and UK GDPR | Basis under Kazakhstan law |
|---|---|---|---|
| Answer your request, prepare a proposal, run a free check or audit you asked for | form data, emails | steps at your request before entering into a contract (Art. 6(1)(b)); for contacts at a company, our legitimate interest in answering business enquiries (Art. 6(1)(f)) | your consent (Law No. 94-V, Art. 7, 8) |
| Provide services under a contract, invoices, payments | client and partner data | performance of a contract (Art. 6(1)(b)) | consent; performance of a contract |
| Keep accounting and tax records, comply with currency control and bank requests | billing data | legal obligation (Art. 6(1)(c)); for laws outside the EU and UK, our legitimate interest in complying with them (Art. 6(1)(f)) | performance of obligations under Kazakhstan law |
| Website security, fraud and spam prevention | technical data | legitimate interest (Art. 6(1)(f)) | consent; legitimate interest of the operator |
| Website analytics (Google Analytics 4, Microsoft Clarity) | analytics data | consent (Art. 6(1)(a)) for EU, EEA, UK and Swiss visitors; legitimate interest for visitors elsewhere | consent |
| Occasional emails about our services to existing clients and people who asked for them | name, email | consent, or legitimate interest for existing clients with an easy opt-out in every email | consent |
| Defend legal claims | relevant records | legitimate interest (Art. 6(1)(f)) | performance of obligations under law |
Where we rely on legitimate interest, we have balanced it against your rights. You can object at any time (section 9).
We do not sell personal data, do not use it for targeted advertising, and do not make decisions about you based solely on automated processing.
5. Who receives your data
5.1. Service providers that process data for us
[CHECK AFTER SETUP: keep only providers actually used]
| Provider | What for | Where data may be processed |
|---|---|---|
| Cloudflare, Inc. | hosting, content delivery, security, processing of form submissions | worldwide network, including the USA and the EU |
| ждёт данныхTO FILL: hosting company of our server in Kazakhstan | storing form submissions and client records | Republic of Kazakhstan |
| ждёт данныхTO FILL: email provider, for example Google Workspace | ждёт данныхTO FILL | |
| Telegram | instant notification to our team that a new request has arrived | outside the EU and the UK, according to Telegram’s privacy policy |
| Google (Google Ireland Limited for visitors from the EEA and UK, and Google LLC) | Google Analytics 4, only with consent where consent is required | EU and USA |
| Microsoft (Microsoft Ireland Operations Limited and Microsoft Corporation) | Microsoft Clarity, only with consent where consent is required | EU and USA |
| ждёт данныхTO FILL: calendar or call booking tool, if used | booking calls | ждёт данныхTO FILL |
| ждёт данныхTO FILL: bank and payment provider | receiving payments from clients | Republic of Kazakhstan and ждёт данныхTO FILL |
The Telegram notification contains only [OWNER DECISION: (a) recommended: your first name, company and country, without email and message text; (b) all form fields].
5.2. Others
We may share data with our professional advisers (accountants, lawyers) under confidentiality, with banks for payment and currency control checks, and with public authorities when the law requires it. If we work for an agency partner under a white label arrangement, data about that agency’s end clients is shared only as the partner instructs.
5.3. Our team
Our team is based in Kazakhstan. Only people who need the data for their work have access to it.
5.4. International transfers
We are based in the Republic of Kazakhstan. If you are in the EU, EEA, UK or Switzerland, you send your data directly to us in Kazakhstan when you use the form or email us. Kazakhstan does not have an adequacy decision of the European Commission or the UK. We protect your data with the measures described in this policy and in our contracts.
When we use service providers in other countries:
- for providers in the USA certified under the EU-US Data Privacy Framework and the UK Extension, we rely on that certification [CHECK AFTER SETUP: confirm current certification of each provider on dataprivacyframework.gov];
- otherwise we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum included in the provider’s data processing terms, or on another lawful transfer mechanism.
Under Kazakhstan law, personal data are stored in a database located in the Republic of Kazakhstan (Law No. 94-V, Art. 12(2)), and transfer to service providers in other countries listed above takes place with your consent (Art. 16). The form asks for this consent with a separate tick box:
[ ] I agree to the processing of my personal data by [entity name] as described in the Privacy Policy, including storage in Kazakhstan and transfer to the service providers listed in section 5 in other countries.
6. How long we keep data
[OWNER DECISION: confirm periods]
| Data | Period |
|---|---|
| Form requests and emails that did not lead to a contract | 24 months after our last contact, then deleted |
| Client and partner records (contracts, correspondence) | for the duration of the contract and 3 years after it ends |
| Invoices, payment and accounting records | as long as Kazakhstan tax and accounting law requires ждёт данныхTO FILL: period confirmed by the accountant, at least 5 years |
| Consent records (what you agreed to and when) | as long as we process data on that basis, plus 3 years |
| Google Analytics 4 event data | [OWNER DECISION: 2 or 14 months, setting in GA4] |
| Microsoft Clarity recordings and heatmaps | according to Clarity’s retention settings [CHECK AFTER SETUP] |
| Cloudflare technical logs | according to Cloudflare’s standard retention |
| Telegram notifications | deleted from the team chat after [OWNER DECISION: 90 days] |
7. Security
We use encrypted connections (HTTPS), access only for the team members who need it, two-factor authentication on accounts that hold personal data, backups stored in Kazakhstan, and logs of access to the request database. If a personal data breach happens, we notify the competent supervisory authorities and, where required, you, within the time limits set by law, including the authorised body in Kazakhstan within the period set by Kazakhstan rules.
8. Children
Our services are for businesses. The site is not intended for children under 16, and we do not knowingly collect their data.
9. Your rights
9.1. EU, EEA and UK
You have the right to: access your data and get a copy; correct it; delete it; restrict processing; data portability; object to processing based on legitimate interest, and to object at any time to direct marketing; withdraw consent at any time, without affecting processing before withdrawal (for cookies, use the “Cookie settings” link in the footer).
You may complain to the data protection authority in your country of residence or work, or in the UK to the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to resolve your concern first.
9.2. California
We do not meet the thresholds that make the California Consumer Privacy Act (as amended by the CPRA) apply to us [CHECK: confirm yearly], but we offer California residents the same choices voluntarily: to know what personal information we collected in the last 12 months (categories listed in section 3, sources: you and your devices, purposes: section 4, recipients: section 5), to delete it, and to correct it. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information. We will not treat you differently for using these rights.
9.3. Kazakhstan
Under Law No. 94-V you have the right to know whether we hold your data and receive information about it, to require correction, blocking or destruction of data that is incomplete, outdated, inaccurate or unlawfully obtained, to withdraw consent, to object to processing, and to protect your rights in the authorised body or in court.
9.4. How to use your rights
Write to ждёт данныхTO FILL: privacy email. We may ask you to confirm your identity. We answer within one month (GDPR, UK GDPR) or sooner where Kazakhstan law sets a shorter period. Requests are free unless they are clearly unfounded or excessive.
10. Changes to this policy
We will publish any changes on this page with a new date. If a change materially affects how we use data you already gave us, we will tell you by email.
11. Contact
ждёт данныхTO FILL: entity name, ждёт данныхTO FILL: registered address, Almaty, Republic of Kazakhstan. Privacy requests: ждёт данныхTO FILL: privacy email.