PoZapisi · pozapisi.kz
Privacy Policy
1. Who we are
The personal-data operator and owner of PoZapisi is Individual Entrepreneur KUZMIN (proprietor: Sergey Andreevich Kuzmin), Shymkent, Republic of Kazakhstan (hereafter “Service”, “we”). Service website: pozapisi.kz. Operator contact: info@pozapisi.kz.
2. What data we process
- First and last name (if provided at registration).
- Phone number — for OTP sign-in and notifications.
- E-mail — for sign-in and notifications.
- Telegram ID — if sign-in was performed via Telegram WebApp.
- Booking history, correspondence with the business, avatar photos (optional).
- When a business connects WhatsApp Business Platform: Meta Business and WABA identifiers, phone-number identifier and display number, business-profile name, quality status, message templates and technical access tokens.
- Inbound and outbound WhatsApp messages, message and delivery identifiers, and media submitted by the user, including images, documents, video and voice messages.
- WhatsApp consent records, including the source, date and wording of the opt-in and any subsequent opt-out.
- Technical data: IP address, user-agent, timestamp — for security and audit.
3. Legal basis
- User consent (Art. 7 of the Kazakhstan Law «On Personal Data and Its Protection»).
- Performance of contract (provision of the online-booking service).
- Legitimate operator interests (fraud prevention, anonymous analytics).
4. Why we process it
- Creating and confirming bookings.
- Sending notifications (WhatsApp, Telegram, SMS and e-mail) and handling booking conversations.
- Connecting and operating WhatsApp Business Platform, managing templates and processing delivery and phone-quality events.
- Operating the virtual administrator and transferring a conversation to a human agent.
- Billing and invoicing — for business customers.
- User support.
- Service security and abuse prevention.
5. Whom we share data with
We share the minimum necessary data with the following categories of recipients:
- The business the user booked with (name, phone, chosen service, time).
- Telegram, SMS and e-mail providers — strictly for notification delivery.
- Meta Platforms, Inc. and Meta group companies — to provide WhatsApp Business Platform, Embedded Signup, message delivery and template management.
- Artificial-intelligence providers, including OpenAI, and the LLM provider configured by the business — to transcribe voice messages and generate replies. Only the content needed for the requested operation is sent.
- Hosting, storage and monitoring providers — only as required to operate the Service securely.
- Payment providers — when business customers pay for the service.
- Government authorities — upon lawful request.
We do NOT sell personal data to third parties. We do not use it for third-party ad targeting.
6. Where data is stored
Primary Service data is stored on servers in the Republic of Kazakhstan. When WhatsApp Business Platform, OpenAI or another external provider is used, limited data may be processed in other countries under that provider's terms and safeguards. Backups are encrypted and stored separately. Production access is limited to authorised staff and is audited.
7. How long we keep it
- Active account — as long as it stays active.
- After account deletion — technical data is removed within 30 days.
- Disconnecting WhatsApp disables the channel immediately. Stored credentials and identifiers are deleted or irreversibly anonymised as part of a verified deletion request, normally within 30 days.
- Security logs and backups may remain for up to 90 days until their normal rotation, unless a longer period is required by law.
- Financial documents — 5 years (Kazakhstan tax law requirement).
8. Your rights
Under the Kazakhstan Law «On Personal Data and Its Protection» you have the right to:
- Request a copy of the data we hold about you.
- Request correction of inaccurate data.
- Request data deletion (right to be forgotten).
- Withdraw consent for processing at any moment.
- Opt out of WhatsApp communications by telling the business in chat or contacting support. After an opt-out, no business-initiated messages will be sent unless you give a new explicit opt-in. The business may still answer a new request that you initiate or communicate where the law requires it.
- File a complaint with the Ministry of Digital Development of Kazakhstan.
All requests — to support@pozapisi.kz. Reply within 10 business days.
9. Cookies and similar technologies
The pozapisi.kz landing does not use cookies. The Business Dashboard and the Client Mini App use session JWT tokens (HttpOnly Cookies) and localStorage — strictly for authentication. Third-party analytics is disabled.
10. Security
- TLS 1.3 on all communication channels.
- Password hashing (BCRYPT).
- Tenant isolation: each business's data is isolated.
- Audit log of all changes to critical entities.
- Regular encrypted backups.
11. Policy changes
We will notify users about material changes to this policy 30 days in advance via e-mail and Telegram. The current version is always available at pozapisi.kz/en/privacy/.
12. Contacts
For personal-data processing questions: info@pozapisi.kz. Deletion requests: support@pozapisi.kz. Phone: +7 747 293 84 47.