PRIVACY POLICY

Preliminary version. Information about the personal data operator will be added. The operator’s full name, IIN and details of the future LLP have not yet been provided. Alshyn Trans

1. General Provisions

1.1. This Privacy Policy (the "Policy") establishes the procedures for collecting, processing, using, storing, transferring and protecting the personal data of individuals who use the Alshyn Trans website (the "Website").

1.2. The Website is intended to provide information about transportation and logistics services and to receive and review enquiries from prospective customers.

1.3. Personal data is processed in accordance with the legislation of the Republic of Kazakhstan, including Law No. 94-V of the Republic of Kazakhstan dated 21 May 2013, "On Personal Data and Their Protection."

1.4. This Policy applies to personal data obtained through the Website, including its enquiry form, and to technical data processed when visitors access the Website.

1.5. The mere use of the Website does not constitute consent to all forms of personal data processing. Where required by law, consent is obtained separately.

1.6. At the time this Policy was prepared, the Alshyn Trans project was in its testing stage. The legal entity intended to conduct the business has not yet been registered.

2. Information About the Personal Data Operator

2.1. The personal data operator is the actual individual or legal entity responsible for collecting, processing and protecting personal data relating to Website users.

2.2. Alshyn Trans is the name of the project. This name does not, by itself, indicate the existence of a registered legal entity.

2.3. Following the state registration of the legal entity, the operator's details must be updated as follows:

  • Full legal name: [COMPLETE AFTER REGISTRATION]
  • Business Identification Number (BIN): [COMPLETE AFTER REGISTRATION]
  • Registered legal address: [COMPLETE AFTER REGISTRATION]
  • Actual business address: [IF APPLICABLE]
  • Contact telephone number: +77072270828
  • Email address: abdraimovsardor4@gmail.com
  • Last updated: [PROVIDE]

2.4. If genuine enquiries are accepted before the registration of the LLP, the actual operator must be identified before personal data processing begins:

  • Full name of the individual operator: [PROVIDE THE ACTUAL OPERATOR'S FULL NAME]
  • Individual Identification Number (IIN): [PROVIDE, TAKING INTO ACCOUNT STATUTORY CONSENT CONTENT REQUIREMENTS]
  • Contact details for privacy enquiries: +77072270828; abdraimovsardor4@gmail.com

2.5. Following registration of the LLP and an actual change in the entity or person processing the data, this Policy must be updated. Any transfer of previously collected data to a new operator must have an appropriate legal basis.

3. Categories of Personal Data Processed

3.1. When a user submits an enquiry or request, the following information may be processed if supplied by the user and included in the relevant form:

  • Surname, first name, patronymic or contact person's name.
  • Contact telephone number.
  • Email address.
  • Name of the company represented by the user and the contact person's position.
  • Content of the enquiry, including proposed transportation details, routes, cargo type and requested services.
  • Any other information voluntarily included in the user's message.

3.2. When the Website and external technical services operate, technical information may be processed, including IP addresses, browser and device information, dates and times of requests, referral sources and website performance data. The precise categories depend on the services actually used and their configuration.

3.3. The Website is not intended to collect visitors' Individual Identification Numbers, copies of identity documents, banking details, health information or other data unnecessary for handling an initial enquiry.

3.4. Users are advised not to include such information in free-text fields. If additional information becomes necessary to provide a service, the conditions for processing it will be determined separately.

3.5. The operator processes only personal data that is necessary and sufficient for the stated purposes. The actual data categories must correspond to the fields included in the active form.

4. Purposes and Legal Grounds for Processing

4.1. Personal data may be processed for the following purposes:

  • Receiving, recording and reviewing enquiries.
  • Contacting applicants by telephone or email.
  • Clarifying requirements for transportation and logistics services.
  • Preparing responses, preliminary quotations or commercial proposals.
  • Arranging further communication at the applicant's initiative.
  • Maintaining Website functionality, security and technical performance analysis within the limits of applicable law.

4.2. The principal legal ground for processing personal data submitted through the enquiry form is the data subject's consent, obtained in accordance with Articles 7 and 8 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection."

4.3. Personal data may be processed without separate consent in cases expressly permitted by the legislation of the Republic of Kazakhstan.

4.4. Personal data will not be used for purposes incompatible with those originally stated.

4.5. Submitting an enquiry does not, by itself, constitute consent to marketing communications. Should such processing be introduced, a separate appropriate legal basis must be established.

5. Enquiry Form and Formspree

5.1. The Website is intended to use Formspree, a third-party service provided by Formspree, Inc., to receive enquiries submitted through its contact form.

5.2. When a user submits the form, the information entered is transmitted to Formspree, which provides technical receipt, processing and delivery of notifications to the operator's configured email address.

5.3. Depending on the service configuration, submitted information may also be retained within the Formspree interface. The service may process technical information necessary for its operation, security and spam prevention.

5.4. According to information published by Formspree, its service infrastructure is hosted in the United States. Accordingly, its use for actual personal data raises issues concerning cross-border transfers and the territorial location of data processing and storage.

5.5. Formspree may be used to collect genuine enquiries only after the actual arrangements for collecting, transferring and storing personal data have been reviewed for compliance with the laws of the Republic of Kazakhstan.

5.6. A user's consent does not release the operator from mandatory requirements concerning data localisation, security and lawful processing.

5.7. Information about Formspree's processing practices is available at: https://formspree.io/legal/privacy-policy/

6. Cloudflare Web Analytics, Cookies and Technical Data

6.1. The Website is intended to use Cloudflare Web Analytics to assess website traffic and performance.

6.2. This service enables analysis of visits, page views, referral sources, loading metrics and Website performance.

6.3. According to Cloudflare's documentation, Web Analytics does not use cookies or localStorage to track individual visitors for analytics purposes and is not intended to create individual user profiles.

6.4. Nevertheless, technical requests to Cloudflare's infrastructure may involve the processing of network-related data. The actual categories depend on the integration method and any additional Cloudflare products enabled.

6.5. The use of Cloudflare Web Analytics does not establish that other Website components are free of cookies. Technologies associated with hosting, bot protection and third-party integrations must be separately reviewed.

6.6. If additional cookies or similar technologies are introduced, information concerning their purposes, categories and conditions of use must be incorporated into this Policy before implementation. Separate consent must be obtained where required by applicable law.

6.7. Users may control cookies through their browser settings. These settings do not necessarily prevent the transmission of technical information required for ordinary webpage delivery.

7. Disclosure of Data to Third Parties

7.1. Personal data may be disclosed, to the extent necessary for the stated purposes, to the following categories of recipients:

  • Formspree, for technical processing of enquiries, provided such use is lawful.
  • The email service provider, for delivering and storing correspondence with applicants.
  • Website hosting and technical infrastructure providers, within the scope of their services.
  • Cloudflare, to the extent that technical data is processed by the services in use.
  • Public authorities and other persons where there is a legal basis for disclosure.

7.2. Third parties are engaged subject to applicable personal data protection requirements, including confidentiality, security and lawful disclosure.

7.3. The operator does not intend to sell users' personal data or publish it in publicly accessible sources.

7.4. Submission of an initial enquiry does not automatically involve disclosure of personal data to independent carriers, freight forwarders or other commercial partners. Any such disclosure, if required, must have a separate legal basis.

8. Cross-Border Transfers of Personal Data

8.1. A cross-border transfer means a transfer of personal data to the territory of a foreign state.

8.2. The use of Formspree may involve transferring personal data to the United States, while other foreign technical services may process data outside the Republic of Kazakhstan. The specific countries and recipients must be verified.

8.3. Cross-border transfers may take place only in accordance with Article 16 of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection," including requirements concerning the level of protection in the recipient country or the availability of a statutory exception, including appropriate data subject consent where applicable.

8.4. Regardless of whether consent for cross-border transfers has been obtained, the operator must comply with applicable requirements for locating and storing personal data within the Republic of Kazakhstan.

8.5. Until the legality of the relevant infrastructure has been confirmed, the enquiry form must not be used to collect actual personal data through arrangements that fail to meet these requirements.

9. Data Storage, Processing Periods and Security

9.1. Personal data is processed and stored for the period necessary to achieve the specific purposes for which it was collected and processed, unless another period is required by the legislation of the Republic of Kazakhstan or an applicable agreement.

9.2. The validity period of consent must not exceed the period necessary to achieve the purposes of processing, except where otherwise provided by law or contract. If no period is specified in the consent, the statutory rules concerning validity until the stated purposes are achieved apply.

9.3. Once the purposes of processing have been achieved, personal data must be destroyed or deleted unless a lawful ground for further retention exists.

9.4. Data may exist in several locations, including the form submission system, email correspondence, backups and technical logs. The operator determines and documents the actual retention periods and deletion procedures for each system, taking applicable legal requirements into account.

9.5. The operator implements necessary legal, organisational and technical measures to protect personal data against unauthorised access, unlawful alteration, disclosure, destruction and other improper actions.

9.6. Such measures include appropriate access restrictions, account protection, secure data transmission and oversight of service providers, as required by applicable rules. These measures must be implemented in practice before actual personal data processing begins.

9.7. No method of transmitting or storing information can guarantee absolute protection against every security threat.

10. User Rights and Withdrawal of Consent

10.1. In accordance with the legislation of the Republic of Kazakhstan, a personal data subject has the right to:

  • Obtain information about the existence and processing of their personal data.
  • Request information about processing purposes, sources, methods, categories of data and retention periods.
  • Request correction or supplementation of their data where appropriate grounds exist.
  • Request blocking, anonymisation, deletion or destruction of data in circumstances established by law.
  • Withdraw consent, including consent relating to third-party disclosures and cross-border transfers, subject to statutory limitations.
  • Protect their rights and legitimate interests, including by contacting competent authorities or bringing proceedings before a court.

10.2. To exercise these rights, the user may submit a request using the contact details provided in Section 11.

10.3. The request must allow identification of the applicant, the nature of the request and the relevant personal data. The operator may use necessary and proportionate identity-verification measures to prevent unlawful disclosure.

10.4. Following withdrawal of consent, the operator and relevant third parties must cease processing within fifteen working days, unless continued storage or processing is required under the legislation of the Republic of Kazakhstan, or provide a reasoned refusal.

10.5. Withdrawal of consent does not automatically terminate processing where withdrawal would contradict the laws of the Republic of Kazakhstan or where outstanding obligations referred to in Article 8 of the Law exist.

11. Contact Information

11.1. Requests, enquiries and notices of withdrawal of consent may be submitted to the actual personal data operator:

  • Operator: [IDENTIFY THE ACTUAL OPERATOR]
  • Email: abdraimovsardor4@gmail.com
  • Telephone: +77072270828
  • Postal address for correspondence: [PROVIDE IF APPLICABLE]

11.2. Requests are considered in accordance with the procedures and time limits prescribed by the legislation of the Republic of Kazakhstan.

12. Amendments and Effective Date

12.1. The operator may amend this Policy following changes to legislation, the project structure, categories of personal data, processing purposes or the technical services used.

12.2. The current version will be made available on the Website with its last updated date. Where amendments require new consent, such consent will be requested before the relevant processing takes place.

12.3. This Policy takes effect on the date of its publication on the Website unless another effective date is specified.

Effective date: [PROVIDE]

Last updated: [PROVIDE]

Project name: Alshyn Trans