PRIVACY AND PERSONAL DATA PROCESSING POLICY

This Privacy and Personal Data Processing Policy (the “Policy”) governs the procedure for the collection, processing, use and disclosure of personal and/or corporate data that Private Company “Documentolog Global Limited” (BIN 190740900207) (the “Operator”) may obtain about the Client in the course of the Client’s use of the Operator’s website located at https://documentolog.com/ (the “Operator’s Website”) and of the Documentolog products available to Clients (the “Documentolog Products”), in the course of the Operator’s performance of any agreements and contracts concluded in connection with the use of the Documentolog Products, as well as of other services, software, products or offerings of the Operator. The Policy applies to all Documentolog services, including the Documentolog electronic document management system, DG Business and DG Personal.

The Operator may also obtain personal information from its partners whose websites, software, products or services are used by the Operator’s Clients, as well as from other sources of publicly available personal data.

Where applicable, Personal Information may be transferred only in the cases established by applicable law and on the basis of specific agreements between the Operator and each of its partners.

1. Terms and Definitions

1) Operator means Private Company “Documentolog Global Limited”, which holds the proprietary rights to Documentolog Business and ensures the operability of the Documentolog Products.

2) Client means persons who have consented to the use of the Documentolog Products and are registered in Documentolog, including individuals, legal entities, individual entrepreneurs, advocates, notaries, private bailiffs and other persons whose activities are not prohibited by the current legislation of the Republic of Kazakhstan, acting on their own behalf, as well as legal entities, their branches or representative offices on whose behalf authorized persons of the Client act.

3) Personal Data Subject (Subject) means an individual to whom personal data relate. A Client that is a legal entity is not a Subject; any reference in this Policy to the Client’s personal data means the personal data of individuals acting on its behalf and of other Subjects whose data are processed in the Documentolog Products.

4) Documentolog Products means the Operator’s products and services located on the Operator’s Website and available to Clients after registration, to which this Policy applies.

2. General Provisions

2.1. This Policy applies to all personal data that the Operator may obtain from the Client.

2.2. This Policy establishes the Operator’s obligations not to disclose, and to ensure the confidentiality protection regime for, the personal data that the Client provides to the Operator upon registration and while working in the Documentolog Products.

2.3. A new version of the Policy shall enter into force upon its publication on the Operator’s Website, unless otherwise provided by the new version of the Policy.

2.4. This Policy, including the interpretation of its provisions and the procedure for its adoption, performance, amendment and termination, shall be governed by the legislation of the Republic of Kazakhstan.

2.5. The main purpose of this Policy is to establish a framework for respecting the rights and freedoms of a person and citizen when the Operator processes their personal data.

2.6. If the Client does not agree with these terms, the Client must refrain from using the Documentolog Products.

2.7. This Policy applies to all Clients of the Operator.

3. Concept and Scope of Personal Information

3.1. For the purposes of this Policy, personal information means information relating to a personal data subject who is identified or identifiable on the basis of such information, including:

1) information provided by the Client independently upon registration or while using the Documentolog Products and/or the Operator’s Website and permitted to be processed under this Policy, including the Subject’s personal data (surname, first name, patronymic (if indicated in the identity document), individual identification number, email address, contact telephone number). Information that is mandatory to provide in Documentolog is specially marked. Other information is provided at the Client’s discretion;

2) data transmitted automatically while using the Documentolog Products by means of software installed on the Client’s device, including IP address, cookie data, information about the Client’s browser (or other program used to access the Documentolog Products and/or the Operator’s Website), technical characteristics of the hardware and software used by the Client, date and time of access to the Documentolog Products and/or the Operator’s Website, addresses of requested pages and other similar information;

3) date and time of access to the Documentolog Products;

4) information about the Client’s activity while using the Documentolog Products and/or the Operator’s Website (for example, search query history, data on organizations visited, email addresses of those with whom the Client corresponds, information about interactions with other users, as well as files and content stored in the Documentolog Products);

5) information about the Client that the Operator receives from its partners in accordance with the terms of agreements concluded between Clients and the relevant partner and agreements concluded between the Operator and the partner;

6) the Client’s payment card data and other payment information provided by the Client, as well as received from partners or other persons involved in a payment transaction made using the Documentolog Products;

7) other information about the Client, the processing of which is provided for by the terms of use of the Documentolog Products and/or the Operator’s Website.

3.2. This Policy concerns only the use and disclosure of information that the Operator obtains from the Client. If the Client discloses its information to other parties using the Documentolog Products and/or the Operator’s Website, or visits other websites linked from the Operator’s Website, different rules may apply to their use or disclosure of the information the Client discloses to them. Since the Operator does not control the privacy policies of third parties or the actions of other persons, the privacy policy of such third party or persons shall apply to the Client.

4. Purposes of Processing Personal Information

4.1. Personal data may be used for the following purposes:

1) identifying the Client for the use of the resources of the Documentolog Products;

2) establishing feedback with the Client, including sending notifications and requests concerning the use of the Documentolog Products and the provision of services, and processing requests and applications from the Client;

3) confirming the accuracy and completeness of the personal data provided by the Client;

4) providing the Client with effective customer and technical support in the event of problems related to the use of the Documentolog Products;

5) providing the Client, with the Client’s consent, with product updates, special offers, pricing information, newsletters and other information;

6) improving the quality of the products offered and the performance of the Documentolog Products;

7) personalizing the Client’s work with the Documentolog Products and preparing analytics based on parameters such as website activity, time of visit, etc.;

8) assessing the effectiveness of the Operator’s advertising, promotions and campaigns promoting the Operator’s services;

9) simplifying the use of the Documentolog Products and adapting their operation and the Operator’s products to the Client’s individual needs and interests;

10) offering participation in various seminars/webinars, contests or advertising campaigns, with the option to opt out of receiving notifications at any time if desired;

11) other purposes of using Clients’ data that do not contradict the legislation of the Republic of Kazakhstan.

5. Methods and Periods of Processing Personal Information

5.1. The Operator undertakes to use personal data in accordance with the legislation of the Republic of Kazakhstan and the Operator’s internal documents.

5.2. The confidentiality of the Client’s personal data and other data shall be maintained, except where such data are publicly available.

5.3. The Client’s personal data shall be processed during the periods specified in Section 6 of this Policy by any lawful means, including in personal data information systems, with or without the use of automation tools.

5.4. The Client’s personal data may be transferred to the authorized bodies of the Republic of Kazakhstan only on the grounds and in the manner established by the legislation of the Republic of Kazakhstan.

5.5. Measures to protect the Client’s personal data are set out in Section 8 of this Policy.

5.6. The Operator, together with the Client, shall take all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the Client’s personal data.

5.7. The Operator has the right to keep an archive copy of personal data.

5.8. The Operator stores personal data on servers located in the territory of the Republic of Kazakhstan.

5.9. The Operator has the right to transfer Personal data to third parties not specified in clause 5.4 of this Policy in the following cases:

1) the Client has given its consent to such actions;

2) the transfer is necessary for the Client’s use of the Documentolog Products and/or the Operator’s provision of services to the Client;

3) as a result of processing the Client’s personal information by depersonalization, depersonalized statistical data have been obtained, which are transferred to a third party for conducting research, performing work or providing services on behalf of the Operator.

6. Place and Period of Storage, Deletion of Personal Data

6.1. Clients’ personal data are stored on servers located in the territory of the Republic of Kazakhstan. Where the Documentolog Products are installed on the Client’s servers (on-premise), personal data are stored on the Client’s servers and under the Client’s control.

6.2. Personal data are stored for the term of the agreement between the Operator and the Client and for 5 (five) years after its termination, unless a longer retention period is established by the legislation of the Republic of Kazakhstan. Documents and messages registered by the Client in the Documentolog Products are stored in accordance with the Client’s document retention rules. Upon expiry of the retention period, personal data are deleted or depersonalized.

6.3. The Client may independently change or delete the personal data it has provided in the “Profile” section of the Documentolog Products or send a request for data deletion or withdrawal of consent to their processing to dev@documentolog.com. Requests are fulfilled within 30 days, taking into account the Operator’s and the Client’s document retention obligations established by law.

6.4. The Client may disconnect connected third-party services (for example, a Gmail mailbox) at any time in its profile; the procedure for processing the data of such services is described in Section 11 of this Policy.

7. Cross-Border Transfer of Personal Data

7.1. The Operator stores and processes personal data on servers located in the territory of the Republic of Kazakhstan. No cross-border transfer of personal data is carried out, except in the cases expressly specified in this Section.

7.2. Connecting a Gmail mailbox. If the Client voluntarily connects its Gmail mailbox to the Documentolog Products, messages are exchanged with the services of Google LLC (United States of America) located outside the Republic of Kazakhstan. Such exchange constitutes a cross-border transfer of personal data, is carried out at the Client’s initiative and on the basis of the Client’s separate consent given when connecting the mailbox, which specifies the existence of the cross-border transfer and its recipient. The scope of the data transferred and the procedure for their processing are set out in Section 11 of this Policy. The Client may stop such transfer at any time by disconnecting the mailbox in the “Profile” section of the Documentolog Products or by revoking access in its Google account at https://myaccount.google.com/permissions.

7.3. Web analytics and marketing services on the Operator’s Website. When the Operator’s Website is visited, the information specified in subclause 2) of clause 3.1 of this Policy (IP address, cookie data, browser and device information, date and time of access, addresses of requested pages) is transferred to the following services located outside the Republic of Kazakhstan:

• Google Analytics and Google Tag Manager — Google LLC (United States of America);
• Yandex Metrica — Yandex LLC;
• Meta Pixel — Meta Platforms, Inc. (United States of America).

The processing of personal data by these services is carried out in accordance with their own privacy policies. Such transfer is carried out subject to the consent of the Website visitor, given through the cookie notice upon the first visit to the Website.

7.4. A Website visitor may at any time opt out of analytics and marketing cookies through the settings of the said notice or the settings of their browser. Opting out does not affect the availability of the Website’s core functions.

7.5. The Operator does not carry out any other cross-border transfer of personal data and does not place personal data on servers outside the Republic of Kazakhstan.

8. Protection of Personal Information

8.1. The Operator ensures proper protection of personal information and other data in accordance with the legislation of the Republic of Kazakhstan and takes the necessary and sufficient organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying and dissemination, as well as against other unlawful actions of third parties with respect to such data.

9. Security Incidents and Breach Notification

9.1. The Operator keeps records of and registers personal data security breaches in the manner established by the legislation of the Republic of Kazakhstan and ensures that information on such breaches is entered into the relevant register.

9.2. Upon detecting a personal data security breach, the Operator shall notify the authorized body for the protection of the rights of personal data subjects immediately, but no later than one business day from the moment the breach is detected, providing the information required by the legislation of the Republic of Kazakhstan.

9.3. Personal data subjects shall be notified of a personal data security breach in the manner, within the time limits and by the means established by the legislation of the Republic of Kazakhstan. In addition, the Operator shall send a notification to the Client and, with respect to personal data received directly from the Client, to the Client at the email address specified by the Client.

9.4. The notification shall contain information on the nature of the breach, the categories of personal data affected, the measures taken by the Operator to remedy the breach and its consequences, as well as recommendations to the personal data subject.

9.5. The Operator investigates each information security incident, eliminates its causes and takes measures to prevent similar incidents from recurring.

10. Rights and Obligations

10.1. The Operator has the right to:

10.1.1. defend its interests in court;

10.1.2. provide personal data of subjects to state and other authorized bodies where provided for by the current legislation of the Republic of Kazakhstan (tax authorities, law enforcement agencies, etc.);

10.1.3. refuse to provide personal data in the cases provided for by the legislation of the Republic of Kazakhstan;

10.1.4. process personal data of a subject without their consent in the cases provided for by the legislation of the Republic of Kazakhstan.

10.2. The Operator undertakes to:

10.2.1. use the information obtained for the purposes specified in this Policy;

10.2.2. keep confidential information secret, not disclose it without the Client’s prior written permission, and not sell, exchange, publish or otherwise disclose, by any other possible means, the Client’s transferred personal data, except as provided for in this Policy;

10.2.3. take precautions to protect the confidentiality of the Client’s personal data in accordance with the procedure customarily used to protect this type of information in existing business practice;

10.2.4. block the personal data relating to the relevant Client from the moment of an application or request by the Client or its legal representative, or by the authorized body for the protection of the rights of personal data subjects, for the period of verification, if inaccurate personal data or unlawful actions are detected.

10.3. The Subject has the right to:

10.3.1. demand the clarification of their personal data, their blocking or destruction if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and to take measures provided for by law to protect their rights;

10.3.2. demand a list of their personal data processed by the Operator and the source from which they were obtained;

10.3.3. appeal in court against unlawful actions or omissions in the processing of their personal data;

10.3.4. the protection of their rights and legitimate interests, including compensation for damages and/or moral harm in court.

10.4. The Client shall:

10.4.1. provide the personal data information necessary for the use of the Documentolog Products;

10.4.2. update and supplement the personal data information provided in the event of changes to such information.

10.4.3. ensure that consent to the processing, storage and transfer of personal data is obtained from its employees, as well as from individuals who are representatives of counterparties and other persons whose information the Client places in the Documentolog Products.

11. Use of Google User Data

Documentolog offers an optional integration with Gmail. This section applies only if you have connected a Gmail mailbox to Documentolog.

Permissions requested. When you connect a Gmail mailbox, Documentolog requests the following Google OAuth permissions (scopes):

• https://mail.google.com/ — the permission Google requires for mailbox access via IMAP and SMTP;
• https://www.googleapis.com/auth/userinfo.email — the primary email address of your Google account.

What we receive.

• The email address of the connected Google account.
• Incoming emails from the Inbox folder (sender, recipients, subject, date, message body and attachments) received after the mailbox was connected and no older than the retrieval window configured by your organization (3 months by default). Documentolog reads emails that have not yet been read in the mailbox.
• OAuth access tokens issued by Google.

We do not receive your Google password. We do not read emails from other folders and do not access your contacts, Calendar, Drive or other Google data.

How we use it.

• To display incoming emails in the Documentolog mail module and register them as incoming documents together with their attachments.
• To send documents and notifications from your mailbox on your behalf when you choose to send them.
• To display the connected mailbox in your profile and use its address as the sender address.

Gmail data is not used for any other purposes: not for advertising, marketing, profiling, or analytics unrelated to the mail feature, and not for training machine learning or artificial intelligence models.

Where and for how long it is stored.

• Emails received in Documentolog, including attachments, are stored on Documentolog servers in the Republic of Kazakhstan or, for on-premise installations, on your organization’s servers. The retention period is determined by your organization’s document retention rules.
• OAuth tokens are stored in encrypted form and are deleted when the mailbox is disconnected.
• Emails in your Gmail mailbox are not modified or deleted.

Sharing. We do not sell, rent, transfer or otherwise disclose Google user data to third parties, including advertising platforms and data brokers. Disclosure is possible only where required by law or by a binding request from a government authority. Documentolog employees do not access the content of your emails, except with your explicit consent (for example, when you contact support) or when investigating a security incident.

Your choices.

• You can disconnect the mailbox at any time (Profile → Mail → Disconnect). Disconnecting stops access and deletes the stored tokens.
• You can revoke Documentolog’s access in your Google account: https://myaccount.google.com/permissions.
• To delete emails already received in Documentolog, contact your organization’s administrator or write to dev@documentolog.com. Requests are fulfilled within 30 days, taking into account the organization’s document retention obligations.

Limited Use. Documentolog’s use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Other Provisions

12.1. The Policy applies throughout the territory of the Republic of Kazakhstan.

12.2. If for any reason one or more provisions of the Policy are found to be invalid or unenforceable, this shall not affect the validity or enforceability of the remaining provisions of the Policy.

12.3. The Operator has the right to amend this Policy unilaterally at any time without prior agreement with the Client. All amendments shall enter into force upon their publication on the Operator’s Website.

12.4. The Client undertakes to independently monitor changes to the Policy by reviewing its current version.

12.5. All suggestions or questions regarding this Policy, as well as requests related to personal data, should be sent by email to: dev@documentolog.com.

12.6. The Policy is valid indefinitely after its approval and until it is replaced.