Personal Data Collection, Processing and Protection Policy

1. Personal-data controller

ИП «SMM DRUG», entrepreneur Маликов Олег Михайлович, IIN 000527501224, registered address: Республика Казахстан, г. Алматы, мкр. Алмагуль, 27.

For personal-data enquiries: smmdrug@gmail.com, +7 707 521 05 65.

2. Who and what this policy covers

This policy applies to visitors to smmdrug.kz who use the enquiry form, calculators, or otherwise interact with the website. After a visitor follows a link to WhatsApp, Telegram, Instagram, YouTube or another external platform, subsequent processing is also governed by that service's rules.

3. Data we process

• the name and surname, phone number or WhatsApp number, and optional task description entered by the user in the form;
• the selected service, parameters and result of the preliminary calculation, the page and source of the enquiry;
• the consent version, enquiry number, date and server time of acceptance;
• UTM tags, advertising click identifiers, the first page visited and external referrer;
• limited current-visit context: the traffic channel and platform, how the source was identified, supplied campaign, ad-group and ad labels, an advertising keyword, the landing-page path without parameters, the external referring hostname and the visit start time reported by the browser; one previous advertising touch may also be attached with its own date, not as the source of a new visit;
• the IP address and a limited set of technical request data — to protect the form, limit spam and maintain security logs; the raw IP address is not sent to managers in Telegram;
• technical identifiers and visit information created by Yandex Metrica, by Google Tag Manager as the sole loader of one Google Analytics 4 property and Google Ads conversion-measurement tags, and by Meta Pixel for Instagram audiences and retargeting.

4. Purposes and legal grounds

Processing is based on the user's demonstrable consent, steps taken at the user's request before entering into a contract, a concluded contract and obligations expressly imposed by the laws of the Republic of Kazakhstan.

• to respond to an enquiry, clarify the task and prepare a proposal, calculation and draft contract;
• to perform a contract, process payments and prepare mandatory accounting documents;
• to provide the service context to a manager and make contact by the selected method;
• to assess advertising effectiveness using server-accepted enquiries and WhatsApp or phone clicks, and to improve the website;
• to ensure information security, prevent automated spam and protect the controller's lawful rights.

5. Processing operations and recipients

The controller may collect, organise, store, update, use, transfer, block and destroy data to the extent necessary for the stated purposes.

• The form uses the website server, and the primary enquiry database is hosted on server infrastructure in the Republic of Kazakhstan.
• The content of an enquiry may be sent to a closed Telegram workspace for prompt handling. This is a transfer to a third party and a possible cross-border transfer, for which separate, explicit consent is requested in the form.
• Separate technical notifications of phone and WhatsApp link clicks are sent to a closed Telegram workspace: the action type, page path without parameters, button location, time and the limited source context described in section 3. This context contains no visitor name, phone number, message text, IP address, user-agent, full query string, raw advertising click IDs or oppref. A supplied advertising keyword is not a verified search query by that person; a source inferred from an external referral is labelled as inferred, and unavailable data as unknown. A click does not confirm a completed call or a sent message. The server click journal and its context are cleared after 30 days; this does not mean that messages are automatically deleted by Telegram. Weekly and monthly summaries show counts of saved non-test forms and recorded clicks, without visitor contact details. The click journal is rate-limited and retention-limited, not a complete analytics counter.
• Google Tag Manager loads the single Google Analytics 4 property and Google Ads conversion-measurement tags on every page of the website; Yandex Metrica loads alongside it. Google receives only technical events for a server-accepted enquiry and WhatsApp or phone clicks — not the visitor's name, phone number or enquiry message. Google remarketing and Google enhanced conversions are not used.
• Meta Pixel (Main Dataset, ID 708928263783270) runs on production pages to build visitor audiences, show SMM DRUG ads on Instagram and measure results. Meta receives PageView and allowlisted action events, the IP address, user-agent, referrer and current URL, and may create _fbp/_fbc cookies. Names, phone numbers, enquiry text, calculations and advertising click IDs are not sent as Meta event parameters; Meta Conversions API is not used. Processing under the providers' rules may be cross-border.
• Access is granted only to the entrepreneur, authorised employees and contractors who need the data to respond or perform a contract and who are required to maintain confidentiality.
• Data is not published in publicly available sources and is not sold. It is transferred to public authorities only where there is a lawful request.

6. Retention periods

• An enquiry that does not result in a contract, together with evidence of consent, is retained for no more than 12 months after the last meaningful contact and is then deleted or anonymised.
• Current-client data and accounting documents are retained for the term of the contract and the mandatory periods established by law.
• A technical pseudonym of the IP address used for rate limiting is needed for 10 minutes; server security logs must be rotated under an approved procedure.
• Advertising attribution and the _ga*, _ym*, _gcl_*, _fbp and _fbc cookies accessible to the website are removed when the specified period expires or browser data is cleared.
• Retention periods for external analytics services are determined by their settings and policies; collection can be limited with browser tools.

7. User rights

A request may be sent to smmdrug@gmail.com. To prevent disclosure to another person, the controller may request information reasonably needed to verify the requester's identity. Withdrawal does not invalidate processing that was already lawful and does not end retention required by law or contract.

• to obtain information about whether and how their data is processed;
• to request correction, blocking or deletion of inaccurate or unlawfully processed data;
• to withdraw consent to future processing;
• to challenge the controller's actions before the competent authority or a court.

8. Data security and incidents

The controller uses access controls, HTTPS, server-side form validation, rate limiting, storage of secrets outside the public website and other organisational and technical measures. Access permissions are reviewed and data is deleted after its purpose has been achieved. If a security breach is identified, the controller acts under the approved response plan and notifies the competent authority in the cases and within the timeframes required by law.

9. Minors and updates

The services are intended for adult business representatives. The controller does not knowingly request data from minors; a legal representative should submit an enquiry on their behalf.

The current version is published at this address. If the purposes, data categories or recipients change materially, new consent is requested where required by law.

10. Separate OpenAI advertising measurement

After the visitor makes a separate, voluntary choice, our server may send events to OpenAI to measure advertising in ChatGPT. This choice is not part of the mandatory form consent: refusing does not prevent an enquiry, call or WhatsApp contact. It does not change the Google, Yandex Metrica or Meta Pixel processing described above.

The only event fields sent are the action type (a server-saved form, WhatsApp click or phone click), time, a random event identifier, the domain https://smmdrug.kz and the advertising identifier oppref, if present. A click does not confirm a message, completed call, qualified lead or sale. OpenAI event data does not include the visitor's name, phone, email, enquiry text, hashes of those details, IP address, user-agent, browser profile or the full page URL.

OpenAI is a separate foreign recipient and processing may be cross-border. This measurement is pseudonymous, not anonymous: oppref can match an action to an advertising click, and OpenAI may have its own related data. Every event is sent with opt_out=true to exclude it from future user-level personalization. That restriction does not replace measurement consent. OpenAI-side processing and retention are governed by its applicable terms and privacy policy.

The website does not load an OpenAI Measurement Pixel or SDK, enable advanced matching or create OpenAI cookies. The browser sends the permitted information only to our website handler; our server makes the Conversions API request. Actions that occurred before permission are not replayed afterwards.

• The choice and an oppref saved after permission remain in the browser for no more than 30 days. An expired choice stops further transmission until fresh permission is given.
• An unsent event is retried for no longer than 7 days after the original action. The queue removes oppref after successful delivery, a final error or expiry; the technical ledger without oppref is retained for no more than 30 days.
• Use the “OpenAI settings” panel to stop recording new actions. The saved oppref is deleted and further capture and new events stop. An event already in the server queue may finish delivery within the stated 7-day limit. This choice does not recall data already sent to OpenAI or promise automatic deletion by the recipient; requests about previously transferred data may be sent to the controller using the contact in section 1.