Privacy Policy

This is a translation. If the English and Russian versions differ, the Russian version prevails. Russian original: Политика обработки персональных данных.

1. Who processes your data

The owner and operator of the database and/or digital object containing personal data is Expertica LLP (ТОО «Экспертика»), BIN 221140015128, 46/1 Turan Ave., office 613, Astana, Republic of Kazakhstan, email: expert.ciic@gmail.com (“we”, “us”).

This policy covers https://expertica.kz and all its pages, including the English version. It is based on Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection” (the “Law”) as in force on 15 October 2026. Terms have the meanings given to them in Article 1 of the Law.

This policy works together with the Consent to the Collection and Processing of Personal Data that you give when you submit a form, the Cookie Policy and the Terms of Use.

Personal data requests are handled by the person at Expertica LLP responsible for organising the processing of personal data (subparagraph 10) of paragraph 2 of Article 25 of the Law).

2. What data we receive

From the request form

your name or how you would like to be addressed;
your preferred channel: WhatsApp, Telegram, WeChat or email;
your phone number, messenger username or email address;
the services you selected, your message and any details you include in it.

Technical data

the address of the page the request was sent from and the service it relates to;
UTM tags and the source of your visit;
the date and time the request was sent;
your IP address and the browser and device details your browser sends when it opens a page;
cookie data and information on how you use the site: pages viewed, clicks on WhatsApp, Telegram, phone and email links, and the fact that a form was sent (section 8).

If you write to us on WhatsApp, Telegram, WeChat or by email, we receive what you send and your profile details in that service: name, phone number or username.

We do not ask for passport details, IIN, bank details, passwords or biometric data through the site. Please do not enter them in the form: if any documents are needed for work under a contract, we will request them separately.

3. Why we process your data

to reply to your request in the channel you chose, advise you and quote for our services;
to prepare and conclude a contract if you decide to work with us;
to keep a record of requests and related correspondence;
to understand which pages and sources bring requests, and to improve the site;
to comply with the laws of the Republic of Kazakhstan.

We collect only the data needed for these purposes and use it only for them (paragraphs 8 and 9 of Article 7 and Article 14 of the Law). We do not sell data, do not make it available in publicly accessible sources and do not send marketing messages without your separate consent.

We do not take decisions that create, change or end your rights based solely on automated processing of data (Article 19-1 of the Law): requests are read and handled by our staff.

4. Legal basis

The legal basis is your consent to the collection and processing of personal data (Articles 7 and 8 of the Law), which you give when you submit a form on the site. The full text is on the Consent page: it sets out the data, purposes, processing operations, third parties, cross-border transfer, period of validity and how to withdraw.

If you contact us directly by messenger or email, we process what you send for the same purposes and on the same terms as form data. Cookies are used as described in the Cookie Policy.

We process data without consent only in the cases set out in Article 9 of the Law, for example at the request of a court or law enforcement authority acting within its powers. If you sign a contract with us, the processing of data needed to perform it is governed by that contract and the laws of the Republic of Kazakhstan.

5. Who receives your data

For the purposes in section 3, data is received and processed on our behalf by third parties, the services we use:

Tilda, the platform the site runs on: it receives form requests, stores them in Tilda CRM and keeps the pages running and protected;
Telegram: a bot forwards the content of each request to the staff who handle it;
Google Analytics: visit statistics such as pages viewed, traffic sources, devices, clicks on contact links and the fact that a form was sent. The text of your request and the contact details from the form are not sent to Google Analytics;
Google Fonts: font delivery; when a page opens, your browser sends Google your IP address, the page address and browser details;
WhatsApp, Telegram, WeChat and Gmail: when we reply in the channel you chose.

If we add another web analytics service, for example Yandex Metrica, we will list it here and in the Cookie Policy before we start using it.

We disclose data to anyone else only where the laws of the Republic of Kazakhstan expressly provide for it, for example at the request of a competent state authority.

6. Cross-border transfer

The servers of the services in section 5 may be located outside the Republic of Kazakhstan, so your data may be transferred to foreign countries, including countries that do not ensure the protection of personal data. Such transfers follow Article 16 of the Law and are based on your consent (subparagraph 1) of paragraph 3 of Article 16 of the Law), given when you submit a form. You can withdraw it in the same way as consent to processing (section 11).

7. Retention

Data is kept until the purposes of its collection and processing are achieved, unless the laws of the Republic of Kazakhstan provide otherwise (paragraph 2 of Article 12 of the Law).

If no contract follows your request, we keep the request and correspondence for as long as we need them to answer your question, and delete them at your request or once the purpose is achieved.
If a contract is signed, data is kept for the term of the contract and for the periods that the laws of the Republic of Kazakhstan set for contractual and accounting records.
Cookie lifetimes are listed in the Cookie Policy; Google Analytics statistics are kept for the period set in the service settings.

When the retention period ends, when our relationship with you ends and in the other cases set out in Article 18 of the Law, the data is destroyed or deleted.

8. Cookies

Cookies are small files that your browser stores on your device. The site uses technical cookies of the Tilda platform, which the site needs to work, and Google Analytics analytics cookies. Which cookies are used, how long they last and how to turn them off is explained in the Cookie Policy.

9. How we protect your data

Only the staff who handle requests can access them. We take the legal, organisational and technical measures required by Articles 22 and 25 of the Law to prevent unauthorised access to data, detect it promptly and limit its consequences.

If we discover a personal data security breach, we will notify the authorised body for personal data protection within one working day of discovering it (subparagraph 8) of paragraph 2 of Article 25 of the Law). If the breach affects your data, we will tell you using the contact from your request.

10. Your rights

Under Article 24 of the Law you have the right:

to know whether we hold your personal data and to receive confirmation of the fact, purpose, sources and methods of its collection and processing, the list of data and the processing periods, including retention;
to require us to correct or supplement your data where there are grounds supported by documents;
to require us to block and/or anonymise your data where there is information that the conditions for its collection and processing have been breached;
to require us to destroy or delete data collected and processed in breach of the laws of the Republic of Kazakhstan, and in other cases provided by law;
to withdraw consent to the collection, processing, transfer to third parties and cross-border transfer of your data;
to protect your rights and legitimate interests, including compensation for non-pecuniary and pecuniary damage.

You may also require the deletion, anonymisation or restriction of processing of your data in the digital environment (Article 41 of the Digital Code of the Republic of Kazakhstan), review your data free of charge (subparagraph 9) of paragraph 2 of Article 25 of the Law) and ask us to delete your request data if no contract has been signed.

Consent cannot be withdrawn where this would contradict the laws of the Republic of Kazakhstan or where an obligation is still outstanding, such as a contract in force (paragraph 2 of Article 8 of the Law). A deletion request is not carried out in the cases listed in paragraph 4 of Article 41 of the Digital Code of the Republic of Kazakhstan.

You can challenge our actions before the authorised body for personal data protection, the local executive body or a court, in the manner established by the laws of the Republic of Kazakhstan (Articles 27, 27-1 and 30 of the Law). If you are outside Kazakhstan and the law of your country gives you additional rights over your personal data, write to us and we will consider your request.

11. How to make a request

Email expert.ciic@gmail.com with the subject “Personal data”, send a letter to our office address or use the form at the bottom of this page. Say what you need and give the contact you used in your request so that we can find your data. To avoid disclosing it to someone else, we may ask you to confirm that the request comes from you, for example by writing from the same number or address.

Response times:

correcting or supplementing data on the basis of supporting documents, blocking it where there is information about a breach of processing conditions, and destroying or deleting it once a breach is confirmed: within one working day (subparagraph 8) of paragraph 2 of Article 25 of the Law);
withdrawal of consent: we stop processing or send a reasoned refusal within fifteen working days (paragraph 7 of Article 8 of the Law);
other requests: within the time limits set by the laws of the Republic of Kazakhstan.

12. Changes to this policy

We update this policy when the data we collect, the purposes of processing, the services we use or the law change. A new version takes effect when it is published on this page. If a new purpose requires your consent, we will ask for it separately.

Version of 15 October 2026, replacing the Russian version of 14 October 2026. Website: expertica.kz.