Personal Data Collection, Processing and Protection Policy

1. Personal-data controller

ИП «SMM DRUG», entrepreneur Маликов Олег Михайлович, IIN 000527501224, registered address: Республика Казахстан, г. Алматы, мкр. Алмагуль, 27.

For personal-data enquiries: smmdrug@gmail.com, +7 707 521 05 65.

2. Who and what this policy covers

This policy applies to visitors to smmdrug.kz who use the enquiry form, calculators or analytics settings, or otherwise interact with the website. After a visitor follows a link to WhatsApp, Telegram, Instagram, YouTube or another external platform, subsequent processing is also governed by that service's rules.

3. Data we process

• the name and surname, phone number or WhatsApp number, and optional task description entered by the user in the form;
• the selected service, parameters and result of the preliminary calculation, the page and source of the enquiry;
• the consent version, enquiry number, date and server time of acceptance;
• UTM tags, advertising click identifiers, the first page visited and external referrer — only when analytics is permitted;
• the IP address and a limited set of technical request data — to protect the form, limit spam and maintain security logs; the raw IP address is not sent to managers in Telegram;
• identifiers and visit information created by Google Analytics 4 and Yandex Metrica — only after the user chooses “Allow analytics”.

4. Purposes and legal grounds

Processing is based on the user's demonstrable consent, steps taken at the user's request before entering into a contract, a concluded contract and obligations expressly imposed by the laws of the Republic of Kazakhstan.

• to respond to an enquiry, clarify the task and prepare a proposal, calculation and draft contract;
• to perform a contract, process payments and prepare mandatory accounting documents;
• to provide the service context to a manager and make contact by the selected method;
• to assess advertising effectiveness and improve the website — only with separate consent to analytics;
• to ensure information security, prevent automated spam and protect the controller's lawful rights.

5. Processing operations and recipients

The controller may collect, organise, store, update, use, transfer, block and destroy data to the extent necessary for the stated purposes.

• The form uses the website server. The primary database must be in Kazakhstan; the updated form may go live after hosting evidence is obtained.
• The content of an enquiry may be sent to a closed Telegram workspace for prompt handling. This is a transfer to a third party and a possible cross-border transfer, for which separate, explicit consent is requested in the form.
• Google Analytics 4 and Yandex Metrica receive data only after a separate choice in the analytics settings; processing may take place outside Kazakhstan under those providers' rules.
• Access is granted only to the entrepreneur, authorised employees and contractors who need the data to respond or perform a contract and who are required to maintain confidentiality.
• Data is not published in publicly available sources and is not sold. It is transferred to public authorities only where there is a lawful request.

6. Retention periods

• An enquiry that does not result in a contract, together with evidence of consent, is retained for no more than 12 months after the last meaningful contact and is then deleted or anonymised.
• Current-client data and accounting documents are retained for the term of the contract and the mandatory periods established by law.
• A technical pseudonym of the IP address used for rate limiting is needed for 10 minutes; server security logs must be rotated under an approved procedure.
• Advertising attribution stored in the browser is removed when the user chooses “Essential only”, when its specified period expires or when browser data is cleared.
• Retention periods for external analytics services are determined by their settings and policies; the user may withdraw permission through “Cookie settings”.

7. User rights

A request may be sent to smmdrug@gmail.com. To prevent disclosure to another person, the controller may request information reasonably needed to verify the requester's identity. Withdrawal does not invalidate processing that was already lawful and does not end retention required by law or contract.

• to obtain information about whether and how their data is processed;
• to request correction, blocking or deletion of inaccurate or unlawfully processed data;
• to withdraw consent to future processing and separately change the analytics choice;
• to challenge the controller's actions before the competent authority or a court.

8. Data security and incidents

The controller uses access controls, HTTPS, server-side form validation, rate limiting, storage of secrets outside the public website and other organisational and technical measures. Access permissions are reviewed and data is deleted after its purpose has been achieved. If a security breach is identified, the controller acts under the approved response plan and notifies the competent authority in the cases and within the timeframes required by law.

9. Minors and updates

The services are intended for adult business representatives. The controller does not knowingly request data from minors; a legal representative should submit an enquiry on their behalf.

The current version is published at this address. If the purposes, data categories or recipients change materially, new consent is requested where required by law.