Privacy and personal data processing policy

1. Data controller

The owner and operator of the database and (or) digital object containing personal data is ТОО «СК Фаворит Инжиниринг» (hereinafter “the Operator”, “the Company”, “we”).

Operator details:

• Name: ТОО «СК Фаворит Инжиниринг».
• BIN: 980140004721.
• Legal address: Republic of Kazakhstan, Astana, Nura district, Syganak Street 2, apartment 228.
• Email for personal data matters: info@skfavorit.kz.
• Phone: +7 778 808 00 09.

These contacts can be used to ask whether personal data are held and how they are processed, to have them clarified, corrected or deleted, and to withdraw consent where the law allows such withdrawal.

2. What data we collect

We aim to collect only the information needed to handle an enquiry, prepare an offer, run the website, analyse its use and protect our services from abuse.

2.1. Request forms on the website

• first name and/or surname, if the user gives them;
• phone number;
• email address;
• organisation name and position/desired role, where the form has such fields;
• region, site, project type or types of work;
• approximate timeline and scope of work;
• the message text and any other information the user enters in the form.

Technical details needed to deliver and record the request may be logged with it: the page address, the referral source, the date and time of sending, the technical ID of the form or ad campaign, and other service parameters.

2.2. Website visit data and cookies

If the user consents to the optional categories of cookies and similar technologies, data about the visit may be processed: pages viewed, events on the site, the length and sequence of visits, device type, browser, operating system, technical identifiers, IP address and approximate region. Such data are used for the statistical and advertising purposes described in sections 3 and 5.

The content of request form fields — name, phone, email and message text — is deliberately not sent by us to Meta through the standard pixel setup. This rule applies to the configuration used on the site and may be changed only after this Policy and the related consent settings are updated.

2.3. Chat assistant

When a question is sent in the chat, the question text and the technical details needed to run and protect the chat are processed. Please do not share personal, financial, medical or other sensitive information in the chat. If the user wants to be contacted, the separate request form should be used.

2.4. Facebook and Instagram ad forms

If the user sends a request directly from a Facebook or Instagram ad form, we receive the information entered in that form, as well as the technical IDs of the ad form and campaign. Details are given in section 7.

3. Why we process data

Personal and technical data are used only for predefined and compatible purposes, in particular:

• handling incoming requests and replying to the user;
• clarifying the parameters of the site, project, scope of work, timeline and equipment needs;
• preparing a commercial offer, an estimate or a reply to a request;
• keeping a history of enquiries and preventing duplicate requests;
• arranging further contact at the user’s initiative within their enquiry;
• analysing traffic and improving the structure, content and usability of the site — only with the relevant consent;
• measuring advertising effectiveness, identifying the source of requests and assessing the number of leads/enquiries — only with the relevant consent to advertising technologies;
• ensuring the information security of the website and the chat assistant, and preventing automated attacks, spam and abuse;
• fulfilling obligations under the legislation of the Republic of Kazakhstan, and protecting the rights and legitimate interests of the Company where there is a legal basis.

We do not sell personal data. Contact details from an ordinary request are not used for advertising mailings or for uploading advertising audiences without a separate proper basis and, where required, the user’s separate consent.

4. Legal basis and consent to processing

The main legal basis for collecting and processing the data the user provides through the website forms, ad forms and the chat is the consent of the personal data subject, given in a way that allows the fact of consent to be confirmed. In cases provided for by law, processing may take place without the subject’s consent.

The user’s consent covers only the purposes stated when it was obtained and in this Policy. Consent to the processing of a request means consent to handling the enquiry and replying to it; it does not mean automatic consent to advertising mailings.

For analytics and advertising technologies, consent is given through the banner for managing cookies/similar technologies. Until such consent is given, optional analytics and advertising tools must not be activated.

When transferring personal data to third parties or across borders, the Company acts in accordance with the legislation of the Republic of Kazakhstan and the terms of the user’s consent. Where GDPR requirements apply to a particular user, the Company applies the relevant GDPR requirements to the extent they cover such processing.

5. Cookies and similar technologies

The website may use cookies, localStorage and other technical identifiers. They fall into the following categories:

The choice can be changed at any time via «Cookie settings» on the site, where this function is available, or by deleting cookies and site data in the browser settings. After the choice is changed, new optional events must not be sent without the relevant consent; data already passed to third-party services are processed by them under their own terms and applicable law.

6. Chat assistant

The chat assistant is meant to answer questions about the Company’s services and activities. Answers are formed by an artificial intelligence model via Cloudflare Workers AI and by materials from the website passed into the assistant’s context.

The question text is sent to the service to generate an answer. The Company does not use the content of questions to train its own models. Under the Cloudflare Workers AI terms, Customer Content is not used by Cloudflare to train models or improve services without the customer’s separate explicit consent. The actual storage regime depends on the technical configuration used; the Company must not deliberately keep question texts in its own chat history unless the user is told so separately.

Cloudflare Turnstile is used to protect the chat. The service analyses technical signals, including the IP address, User-Agent, TLS/browser characteristics, sitekey and related parameters, solely to check whether a request comes from a human and to protect against automated abuse.

To limit an excessive number of requests, the chat server may count the questions from one IP address per minute and per day. Where a daily anti-abuse counter is used, it stores not the original IP address but a one-way hash of it with a temporary key; such counters are deleted or reset at the start of the next counting period. This processing is necessary for the chat to work and stay secure.

Do not share personal data, document details, bank details, health information or other confidential information in the chat. To send contact details, use the request form, to which sections 2–4 of this Policy apply.

7. Requests from Facebook and Instagram ad forms

A request can be sent through the built-in ad forms on Facebook or Instagram, provided by Meta Platforms. The set of fields depends on the specific ad campaign.

Usually the required field is the phone number; the form may also ask for the name, company, work email, region or site, project type, timeline, approximate scope of work and a comment. The date and time of sending and the IDs of the form, ad campaign, ad set and specific ad may come with the request.

The information received is used for:

• contacting the user about their request;
• clarifying the project and preparing a commercial offer;
• keeping a history of enquiries and preventing duplicates;
• analysing the effectiveness of ad campaigns and sources of enquiries.

Requests are available to authorised Company staff and to service providers engaged for technical processing: Meta provides the ad form; Make or a similar integration service may pass the data to the CRM/lead-tracking system; work-notification services may tell the responsible staff about a new request. Each service must receive only the data needed for its function.

Meta and other external services may process technical data independently under their own policies. Where data are transferred or processed outside the Republic of Kazakhstan, such processing is treated as a cross-border transfer and takes place on a legal basis provided by law and with the relevant consent where it is required.

8. Storage, protection and transfer of data

The Company takes organisational and technical measures to protect personal data against unlawful or accidental access, alteration, blocking, copying, disclosure, destruction and other unlawful actions.

The main measures include:

• using a protected HTTPS connection when data are sent from the website;
• limiting staff access to requests according to their duties;
• using accounts and authentication tools for the systems in which enquiries are handled;
• limiting the amount of data passed to contractors and technical services;
• using protection against automated attacks and abuse;
• deleting or anonymising data once the purposes of processing are achieved, unless further storage is required by law or contractual obligations.

Personal data that the Operator is to accumulate are stored in a database and (or) digital object on the territory of the Republic of Kazakhstan in accordance with the legislation of the Republic of Kazakhstan. The use of foreign cloud and technology services does not remove the Company’s obligation to ensure the local storage required by law.

Certain technical processes may be performed by services whose infrastructure is located outside the Republic of Kazakhstan, including Meta, Google, Cloudflare, Make and other connected services. Such transfer takes place only to the extent necessary for the relevant purpose and on a legal basis. The Company aims to choose services that provide adequate data protection.

The storage period depends on the purpose of processing. Requests are kept as long as needed to handle the enquiry, conduct negotiations, prepare an offer and document the interaction; if a contract is concluded, data may be kept for the periods set by the contract and the law. Data whose processing purpose has been achieved and which have no other lawful basis for storage are deleted or anonymised. The chat’s technical anti-abuse counters are kept for a short time, as described in section 6.

9. User rights

Under applicable law, the personal data subject has the right to:

• receive confirmation that their personal data are processed, and information on the purposes, sources and methods of processing, the data held and storage periods;
• demand correction or completion of inaccurate or outdated data, where there are grounds;
• demand that processing stop and data be deleted in the cases provided for by law;
• withdraw consent given earlier, unless the law provides grounds for continuing processing without consent and there are no unfulfilled obligations preventing withdrawal;
• change or withdraw consent to analytics and advertising cookies through the available settings;
• raise a question or complaint about data processing through the Operator’s contacts and, where there are grounds, with the competent state authority.

Requests are sent to info@skfavorit.kz. To protect data, the Company may ask for information sufficient to confirm the applicant’s identity and their link to the data concerned. When consent is withdrawn, processing stops within the periods set by the legislation of the Republic of Kazakhstan, unless further processing is required by law or another permitted basis.

10. Policy changes

We may update this Policy when the law, the data collected, the purposes of processing, the website, the connected analytics, advertising, integration or AI services, or the Company’s internal processes change.

The current version is published on the website with the date of the update. Material changes affecting the purposes of processing, the data collected, transfers to third parties or cross-border transfers must be accompanied by updated consent mechanisms where the law requires new consent.

Continuing to use the website after a new version is published does not by itself replace separate consent where the law requires it.