Privacy Policy

Last Updated: January 10, 2026

1. Introduction

This Privacy Policy (hereinafter "Policy") defines the procedure for collection, processing, storage, use, and protection of personal data of users of the website gse.kz (hereinafter "Website"), owned by GSE (DzhiEsE) Limited Liability Partnership (hereinafter "Company", "we", "us", "our").

This Policy applies to all personal data that the Company may receive from Website users, as well as personal data obtained by other means in connection with the use of the Website and Company services.

By using the Website and providing your personal data, you consent to its processing in accordance with this Policy. If you do not agree to the terms of this Policy, please refrain from using the Website.

2. Data Controller

The personal data controller is:

3. Terms and Definitions

The following terms are used in this Policy:

3.1. Personal Data

information relating to a specific or identifiable personal data subject, recorded on electronic, paper, and (or) other material media (in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Their Protection").

3.2. Processing of Personal Data

actions aimed at accumulation, storage, modification, supplementation, use, distribution, depersonalization, blocking, and destruction of personal data.

3.3. Personal Data Subject

an individual to whom the personal data relates.

3.4. Subject's Consent

a voluntary expression of will by the personal data subject to grant permission for the collection and processing of their personal data.

3.5. Cross-Border Transfer

transfer of personal data by the operator across the State Border of the Republic of Kazakhstan to a foreign state authority, individual, or legal entity.

4. Legal Framework

Personal data processing is carried out by the Company in accordance with the legislation of the Republic of Kazakhstan, including:

• Law of the Republic of Kazakhstan dated May 21, 2013 No. 94-V "On Personal Data and Their Protection" (as amended);

• Civil Code of the Republic of Kazakhstan;

• Law of the Republic of Kazakhstan "On Informatization".

5. Categories of Personal Data Collected

The Company collects and processes the following categories of personal data:

5.1. Data Provided by the User

• Identification data: surname, first name, patronymic (if any)
• Contact data: email address, phone number
• Organization data: organization name, position (for corporate clients)
• Communication data: content of inquiries, messages, requests
• Feedback data: reviews, comments, ratings
• Other data voluntarily provided by the user through forms on the Website

5.2. Automatically Collected Data

The following technical data is automatically collected when visiting the Website:

• Device IP address
• Browser type and version
• Operating system type and version
• Browser language settings
• Date and time of Website visit
• Referral source
• Pages viewed on the Website
• Visit duration
• Actions on the Website (clicks, scrolling)
• Device screen resolution
• Cookies and similar technology data

6. Purposes of Personal Data Processing

The Company processes personal data exclusively for the following purposes:

• Processing user inquiries and requests
• Providing information about Company products and services
• Preparing and sending commercial proposals
• Concluding and executing contracts with clients
• Providing technical support and service maintenance
• Improving service quality and customer experience
• Conducting marketing research and analysis
• Sending informational and promotional materials (with consent)
• Ensuring security and fraud protection
• Maintaining Website traffic statistics
• Complying with the legislation of the Republic of Kazakhstan
• Protecting the rights and legitimate interests of the Company

Personal data is processed only for the stated purposes. If processing for other purposes is required, the Company will request additional consent from the personal data subject.

7. Legal Basis for Processing

Personal data processing is carried out on the following legal grounds:

• Consent of the personal data subject to the processing of their personal data (Article 7 of the Law "On Personal Data and Their Protection")
• Execution of a contract to which the personal data subject is a party, or taking measures to conclude a contract
• Fulfillment of obligations imposed on the Company by the legislation of the Republic of Kazakhstan
• Protection of life, health, and other vital interests of the personal data subject
• Conducting legitimate business activities of the Company while respecting the rights of the personal data subject

8. Consent to Personal Data Processing

Consent to personal data processing is expressed by the user through conclusive actions: using the Website, filling out feedback forms, sending requests through the Website.

In cases provided by law, consent may be requested in written form or in the form of an electronic document signed with an electronic digital signature.

The personal data subject has the right to withdraw consent to personal data processing by sending a corresponding request to [email protected]. Withdrawal of consent does not affect the legality of processing carried out prior to its withdrawal.

In case of consent withdrawal, the Company ceases personal data processing, except in cases where processing is necessary for compliance with legal requirements or protection of the Company's legitimate interests.

9. Transfer of Personal Data to Third Parties

The Company may transfer personal data to third parties in the following cases:

• To Company affiliates and partners for purposes stated in this Policy
• To service providers processing data on behalf of the Company (hosting, IT support, analytics)
• To state authorities of the Republic of Kazakhstan at their lawful request
• In cases provided by the legislation of the Republic of Kazakhstan
• To protect the rights and legitimate interests of the Company in court

The Company does not sell, rent, or transfer personal data to third parties for their commercial use without the consent of the personal data subject.

When transferring personal data to third parties, the Company ensures conclusion of appropriate agreements containing obligations on confidentiality and personal data protection.

10. Cross-Border Transfer of Personal Data

Cross-border transfer of personal data is carried out in compliance with the requirements of Article 16 of the Law "On Personal Data and Their Protection":

• To the territory of member states of the Eurasian Economic Union
• To the territory of states providing adequate protection of personal data
• With written consent of the personal data subject
• In other cases provided by the legislation of the Republic of Kazakhstan

In cross-border transfer, the Company takes necessary measures to ensure protection of personal data in accordance with the legislation of the Republic of Kazakhstan.

11. Personal Data Retention Periods

Personal data is stored for the period necessary to achieve the purposes of its processing, but not longer than the period established by the legislation of the Republic of Kazakhstan.

Criteria for determining the retention period: purpose of processing, contract duration, legal requirements, statute of limitations.

Upon expiration of the retention period or withdrawal of consent, personal data is destroyed or anonymized within 30 (thirty) business days.

Personal data may be retained for archival purposes in accordance with archival legislation requirements.

12. Personal Data Protection Measures

The Company takes necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, and distribution:

• Use of secure data transmission protocols (HTTPS/TLS)
• Encryption of personal data during storage and transmission
• Restricted access to personal data by authorized personnel
• Maintaining records of access to personal data
• Regular data backup
• Use of certified information protection tools
• Regular security audits
• Staff training on personal data handling rules
• Physical protection of server equipment
• Monitoring and detection of information security incidents

In case of personal data breach, the Company notifies the authorized body and personal data subjects in the manner and within the time limits established by the legislation of the Republic of Kazakhstan.

13. Rights of Personal Data Subjects

In accordance with the legislation of the Republic of Kazakhstan, the personal data subject has the right to:

• Know about the Company's possession of their personal data and receive information about it
• Access their personal data
• Request modification and supplementation of their personal data if incomplete or inaccurate
• Request blocking of their personal data
• Request destruction of their personal data
• Withdraw consent to personal data processing
• Appeal actions or inaction of the Company to the authorized body or court
• Protect their rights and legitimate interests, including compensation for damages and/or moral harm in court

To exercise their rights, the personal data subject may send a request to the email address [email protected] or to the Company's postal address.

The Company processes requests from personal data subjects within 15 (fifteen) business days from the date of receipt of the request.

The personal data subject has the right to apply for protection of their rights to the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan or to court.

14. Cookies and Similar Technologies

The Website uses cookies — small text files that are saved on the user's device when visiting the Website.

14.1. Types of Cookies Used

• Necessary cookies: ensure basic Website functionality and cannot be disabled
• Functional cookies: store user preferences (language, region)
• Analytical cookies: help analyze Website usage for improvement
• Marketing cookies: used to display relevant advertising (with consent)

The user can manage cookies through their browser settings, including complete refusal to use them.

Disabling cookies may affect Website functionality and quality of user experience.

15. Web Analytics

The Website uses web analytics services to collect traffic statistics and analyze user behavior.

Web analytics data is used exclusively to improve the Website and does not allow identification of a specific user.

The user can opt out of web analytics data collection using appropriate browser settings or special extensions.

16. Personal Data of Minors

The Website is not intended for persons under 18 years of age. The Company does not knowingly collect personal data of children.

• If we become aware of the collection of a child's personal data, we will immediately delete such data
• Parents or legal representatives may contact us to delete a child's data
• Processing of minors' personal data is carried out only with the consent of their legal representatives

If you believe we have received personal data of a minor, please contact us at [email protected].

17. Links to Third-Party Resources

The Website may contain links to third-party websites. This Policy does not apply to such third-party resources.

The Company is not responsible for the privacy policy, content, and practices of third-party websites. We recommend reviewing the privacy policy of each resource you visit.

18. Changes to Privacy Policy

The Company reserves the right to modify this Policy at any time without prior notice.

The current version of the Policy is posted on this page with the date of last update. For significant changes, the Company may notify users by posting a corresponding notice on the Website.

We recommend periodically reviewing this Policy to familiarize yourself with the current terms of personal data processing.

19. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Kazakhstan.

All disputes arising in connection with this Policy shall be resolved in accordance with the legislation of the Republic of Kazakhstan in courts at the Company's location.

20. Contact Information

For all questions related to personal data processing, please contact:

We undertake to review your request and provide a response within 15 (fifteen) business days.