Privacy Policy

1.1. This Privacy Policy (the «Policy») describes what personal data Individual Entrepreneur «QG Consulting», address: office 507, 124 Aimanov St., Almaty, Republic of Kazakhstan (the «Operator», «we») collects when running the website seventysvn.com, the seventysvn cabinet and the Telegram bot @seventysvn_bot (together, the «Service»), why it is needed, where it is stored, to whom it is passed and what rights the people whose data we process have.

1.2. The Policy is drawn up in accordance with Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 «On Personal Data and Their Protection» (the «Personal Data Law»), the Law of the Republic of Kazakhstan «On Informatization» and other legislation of the Republic of Kazakhstan.

1.3. The Policy applies together with the Public Offer and User Agreement (seventysvn.com/terms). By using the Service, sending a request or registering, you confirm that you have read the Policy.

1.4. The person responsible for organizing the processing of personal data is the Operator's head. Requests about personal data are accepted by email at [email protected].

2.1. Personal data — information relating to an individual who is identified or identifiable by it.

2.2. Subject — the individual to whom the personal data relates: a website visitor, a person who has sent a request, a User of the Service.

2.3. Organization — a legal entity or individual entrepreneur using the Service under the Offer (an agency or a business).

2.4. User — an individual given access to the Service by an Organization: the owner, an employee of the Organization or a representative of its client.

2.5. Platforms — the social networks and advertising systems whose data is shown in the Service.

2.6. Processing — any action with personal data: collection, recording, storage, alteration, use, transfer, anonymization, blocking, deletion.

3.1. The request form and messages in WhatsApp and Telegram: name, company, phone, email, Telegram username, city, organization type, number of brands, social networks used, the message text; the date and version of the consent text; the source of the request (for example, an ad or a recommendation).

3.2. Registration and work in the Service: name, email, phone, password (stored only as an irreversible hash), role in the Organization, language and time zone, the Organization's name and details, a photo or logo if uploaded.

3.3. Data of connected Platforms: statistics of accounts and ad accounts, the list and figures of posts, ad campaigns, account identifiers, technical data for access to the Platforms (stored encrypted). Connection is made through the Platforms' official authorization windows; we do not receive or store passwords to Platform accounts.

3.4. Content uploaded by Users: texts and media files of posts, content plans, comments, package names, details for acts, competitor lists.

3.5. Telegram: identifiers of the chats and users who connected the bot, commands sent to the bot, answers to polls in chats.

3.6. Technical data: IP address, browser and device type, date and time of requests, website pages, referral source parameters (UTM), records of the action log in the cabinet (who changed settings and when) — for security and support.

3.7. Data of the Organization's clients: the «Leads and sales» section can receive from the Organization's CRM only anonymized numbers (the number of enquiries and sales, amounts). Names, phones and other personal data of the Organization's clients are not passed to the Service through this section.

3.8. We do not collect biometric data, health data or other restricted-access personal data. The Service is not intended for people under 18.

4.1. To contact you about a request and advise you about the Service.

4.2. To create and maintain an account, give access to the Service and separate rights between Organizations and Users.

4.3. To show the Platforms' figures in the cabinet and to prepare reports, acts and digests.

4.4. To send digests, notifications about approval and publication, reminders about the end of the paid period and polls in Telegram and by email.

4.5. To issue invoices, record payments, and prepare acts and documents required by law.

4.6. To support Users and investigate failures and security incidents.

4.7. To measure the effectiveness of our advertising (section 8) — only on the website's public pages.

4.8. To fulfil obligations established by the laws of the Republic of Kazakhstan.

We do not sell personal data and do not pass it to third parties for their own advertising.

5.1. Data from the request form and registration is processed on the basis of the Subject's consent, given by ticking the box in the form («I accept the offer and the personal data processing policy» or similar). We keep the date of consent and the version of the text the Subject agreed to.

5.2. Data of Users invited by an Organization is processed on the basis of the agreement with the Organization (the Offer). By inviting a User, the Organization confirms that it has a lawful basis for passing their data (an employment or civil-law contract, consent). At first sign-in, the User confirms having read the Policy.

5.3. Platform data is processed on the basis of the permission the Organization gives when connecting accounts in the Platform's authorization window. The permission can be withdrawn in the Platform's settings or by disconnecting the account in the Service.

5.4. Technical data is processed to keep the Service secure and working.

5.5. The Subject may withdraw consent by writing to [email protected]. Processing stops within 15 business days of receiving the withdrawal, except for data the law requires us to keep (section 7).

6.1. For the data the Organization loads into the Service and the data of the Users it invites, the Organization is the owner of the data. The Operator processes this data on the Organization's instruction to the extent needed for the Service to work and does not use it for other purposes.

6.2. The Operator protects such data on the same terms as its own (section 9) and deletes it within the periods set out in the Offer.

6.3. The Organization's clients (companies whose brands the agency runs in the Service) get access to their brand's cabinet at the Organization's decision. Relations between the Organization and its clients are governed by their agreement; the Operator is not a party to it.

7.1. The Service's database, including personal data, is located on a server in the Republic of Kazakhstan, in accordance with Article 12 of the Personal Data Law.

7.2. Retention periods:

• request data — up to 12 months after the last contact, if no agreement has been concluded in that time;
• data of accounts and Organizations — while the agreement is in force and 6 months after it ends (see the Offer), then deleted with 14 days' notice;
• data for access to the Platforms — until the account is disconnected in the Service or the permission is withdrawn;
• media files of posts — while the agreement is in force; published files may be deleted earlier in accordance with the Service's settings;
• action logs and technical logs — up to 12 months;
• payment documents, invoices, acts — for the periods set by the tax and accounting laws of the Republic of Kazakhstan (at least 5 years).

7.3. Database backups are made daily and stored in the Republic of Kazakhstan; data deleted from the Service disappears from the backups within 30 days.

8.1. The website uses the technical cookies it needs to work: the chosen language, the cabinet sign-in session, protection of forms from automated submissions. The Service does not work without them; they are not used for advertising.

8.2. On the website's public pages (home, the pages for agencies and businesses, pricing, the demo cabinet, signup, help articles) Meta's ad measurement tool (the pixel and sending events from our server) may be switched on. It sets its own cookies and passes to Meta: which public pages are opened, and the fact of sending a request, registering or pressing the «Message us on WhatsApp» button. Email and phone are passed only as an irreversible hash (SHA-256) and only from our server. The pixel is not used inside the cabinet, the admin panel or on report pages.

8.3. You can opt out of ad measurement by blocking third-party cookies in your browser settings or by turning off personalized ads in Meta's ad preferences. Technical cookies cannot be turned off.

8.4. Data about the source of the visit to the website (UTM tags) is kept in the browser for up to 90 days and sent with the request, so that we understand where the enquiry came from.

9.1. We apply organizational and technical measures: an encrypted connection (HTTPS), storing passwords only as a hash, encrypting the data for access to the Platforms, separating access between Organizations in the code with automated checks of that separation, logging staff actions in clients' cabinets, daily backups, and limiting staff access to data to what their duties require.

9.2. The Operator's staff get access to an Organization's cabinet only for support and setup at its request; every such entry is recorded in the action log.

9.3. If a personal data leak is detected, the Operator notifies the authorized body and the affected Subjects within the time limits and in the manner established by the laws of the Republic of Kazakhstan.

10.1. We use third-party services to run the Service. Each receives only the data it needs for its task:

10.2. Data is passed outside the Republic of Kazakhstan in accordance with Article 16 of the Personal Data Law: with the Subject's consent, given by accepting the Policy, and only as much as each service needs. Users' personal data (name, email, phone, password) is stored in the database in the Republic of Kazakhstan; only what is listed in the table goes abroad.

10.3. We may pass data to public authorities of the Republic of Kazakhstan at their lawful request.

10.4. If the Operator's business is reorganized or sold, the data may be passed to the successor with the terms of this Policy preserved; Subjects are notified of this by email.

11.1. Under the Personal Data Law, the Subject has the right to:

• know what data of theirs we process and get a copy of it;
• demand correction of inaccurate data;
• demand deletion of the data or blocking of its processing if the processing breaks the law or its purposes have been achieved;
• withdraw consent to processing;
• object to automated decisions, should any be used (the Service takes no automated decisions affecting the Subject's rights);
• appeal against the Operator's actions to the authorized personal data protection body or to court.

11.2. A request is sent to [email protected] from the email address given at registration or in the request, or with confirmation of identity by another reasonable means. We answer within 15 business days.

11.3. A User can change their name, email, phone and password in the cabinet settings, and an Organization can remove Users and disconnect Brands.

12.1. The Service sends the service emails and messages it needs to work: email confirmation, invitations, notifications about approval and publication, reminders about the end of the paid period, messages about failures. They cannot be turned off without stopping use of the Service.

12.2. We do not send marketing mailings. If such mailings appear, they will be sent only with separate consent and with a way to unsubscribe in every email.

13.1. We may change the Policy when the law or the Service changes. The new version is published at seventysvn.com/privacy with its date. We notify Users of substantial changes by email at least 14 calendar days before they take effect.

13.2. Continuing to use the Service after the changes take effect means accepting them. If you do not agree with the changes, you may stop using the Service and request deletion of your data.

14.1. The Policy is published in Russian, Kazakh and English. In case of discrepancies, the Russian version prevails.