1. General
1.1. The personal data operator is AVM.AI Partners LLP (the "Company", "we").
1.2. This policy covers data of visitors to avm-ai.kz, representatives of customers and partners, candidates and users of the Service.
1.3. With respect to data of the Customer's end clients that reaches the Service through connected channels, the Company acts as a processor on the Customer's instructions under the DPA. The Customer remains the controller of that data.
1.4. Using the website and the Service means accepting this policy. If you do not agree, please stop using them.
2. Data we process
| Category | Data | Source |
|---|---|---|
| Contact data | first and last name, e-mail, phone, company, job title | request form, correspondence, calls |
| Account data | login, password hash, role, settings, activity log | registration and use of the Customer Account |
| Technical data | IP address, device and browser type, language, referrer, cookie identifiers | collected automatically when visiting the site |
| Support data | correspondence, support tickets, call and video meeting recordings | communication channels named in the agreement |
| Billing data | legal entity details, payment and invoice records | documents and bank statements |
| Service data | content of dialogues with the Customer's end clients | the Customer's connected channels (processed on instruction) |
We do not request special categories of data (health, religious beliefs, biometrics). Do not submit such data to the Service without prior written agreement with the Company.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling requests and demo enquiries | consent; pre-contractual steps | 24 months from last contact |
| Concluding and performing the agreement | performance of a contract | term of the agreement + 5 years (limitation and accounting periods) |
| Providing access to the Service and support | performance of a contract; Customer's instruction | per the DPA and the Customer's settings |
| Accounting and tax records | legal obligation | 5 years |
| Security, abuse prevention, logging | legitimate interest | 12 months |
| Marketing communications and events | consent (withdrawable in one click) | until consent is withdrawn |
| Website analytics | cookie consent | see the Cookie Policy |
3.1. We do not take decisions producing legal effects for a data subject solely on the basis of automated processing without human involvement.
4. Processing by AI models
4.1. The Service uses large language models to generate responses. Processing is limited to what is necessary to deliver the service.
4.2. We do not share Customer data or end-client data for training third-party models. Agreements with model providers exclude the use of this data for training.
4.3. The list of model providers and processing regions is available on request and recorded in the DPA. See also the Responsible AI Use Policy.
6. Cross-border transfers
6.1. Personal data is transferred abroad only where the receiving country ensures protection of personal data, or on the basis of consent or another ground under article 16 of the Kazakhstan Personal Data Law.
6.2. For data subjects in the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses (SCC).
6.3. Storage of Customer data on the territory of the Republic of Kazakhstan is available on request and is recorded in the Order.
7. Security measures
7.1. We apply organisational and technical measures including traffic encryption (TLS 1.2+), encryption at rest, role-based access control, multi-factor authentication, activity logging, backups and regular restore testing.
7.2. Staff access is granted on a least-privilege basis and covered by written confidentiality undertakings.
7.3. In the event of an incident involving unauthorised access to personal data we notify the Customer without undue delay and no later than 24 hours after confirming the fact, and — where required — the supervisory authority. See the Information Security Policy.
8. Your rights
You have the right to:
- obtain information about the processing of your data and its conditions;
- request rectification, blocking or erasure of data that is incomplete, outdated or unlawfully processed;
- withdraw consent — processing then stops, except where the law requires continued retention;
- object to processing for marketing purposes;
- receive a copy of your data in a machine-readable format (portability);
- lodge a complaint with the supervisory authority for personal data protection or with a court.
8.1. Send requests to alibek.abdekov2110@gmail.com, including details sufficient to identify you. We respond within 15 business days.
8.2. Where data is processed on a Customer's instruction, we forward the request to that Customer and provide reasonable assistance in responding.
9. Children's data
9.1. The website and the Service are intended for legal entities and persons over 18. We do not knowingly collect data of minors. Such data is deleted at the request of a legal guardian.
10. Changes to this policy
10.1. The current version is always available at https://avm-ai.kz/en/privacy.html.
10.2. We announce material changes on the website and by e-mail at least 14 calendar days before they take effect.
Data protection contacts
- Operator
- AVM.AI Partners LLP
- BIN
- 250640022260
- Address
- 010000, Astana, Yesil district, Uly Dala Avenue 62, apt. 7, Republic of Kazakhstan
- alibek.abdekov2110@gmail.com