Privacy and Personal Data Processing Policy
This Privacy and Personal Data Processing Policy (hereinafter — the “Policy”) defines the procedure, purposes, and principles of processing and protecting information about Users of the shainote.ai website (hereinafter — the “Site”). It has been developed in accordance with the requirements of the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” and follows the principles of the international standard ISO/IEC 27001.
1. TERMS AND DEFINITIONS
1.1. Site Administration (hereinafter — the “Operator” or “We”) – authorized employees of the Site owner who organize and/or carry out the processing of personal data, and who determine the purposes and content of personal data processing.
1.2. Information Security Management System (ISMS) – part of the overall management system, based on business risk assessment, aimed at establishing, implementing, operating, monitoring, reviewing, maintaining, and improving information security in accordance with the principles of ISO/IEC 27001.
1.3. Personal data – data, including biometric data (including voice biometric data generated from audio recordings), relating to a personal data subject who is identified or identifiable on the basis of such data, recorded on electronic, paper, and/or other tangible media.
1.4. Processing of personal data – any action (operation) or set of actions (operations) performed with personal data, including collection, recording, systematization, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction.
1.5. Confidentiality of personal data – a mandatory requirement to prevent the distribution of personal data without the consent of the personal data subject or another lawful ground.
1.6. User (Personal Data Subject) – a person who accesses the Site via the Internet and uses the Site and/or the functionality of the shainote.ai service.
1.7. Cookies – a small piece of data sent by a web server and stored on the User's device, which is transmitted to the web server upon each request to the Site.
1.8. IP address – a unique network address of a node in a computer network built on the IP protocol.
1.9. Cross-border transfer of personal data – the transfer by the Operator of personal data to the territory of a foreign state to a foreign individual or legal entity.
2. GENERAL PROVISIONS. PROCESSING PRINCIPLES
2.1. The User's use of the Site constitutes their unconditional consent to this Policy and to the terms of processing of their personal data.
2.2. In case of disagreement with the terms of the Policy, the User must immediately stop using the Site.
2.3. The Operator processes personal data based on the following principles:
- •Lawfulness, fairness, and transparency.
- •Limitation of processing to predetermined and lawful purposes.
- •Data minimization (collecting only the data necessary for the stated purposes).
- •Accuracy and relevance of data.
- •Storage limitation in a form that permits identification of the subject no longer than required by the purposes of processing.
- •Ensuring an adequate level of data security, including protection against unauthorized or unlawful processing, as well as against accidental loss, destruction, or damage.
2.4. This Policy applies to the shainote.ai website, as well as to the shainote.ai functionality and services available to the User through the Site. The Site does not control and is not responsible for third-party websites to which the User may navigate via links available on shainote.ai.
3. SUBJECT MATTER OF THE POLICY. DATA COMPOSITION
3.1. This Policy establishes the Operator's obligations regarding non-disclosure and ensuring the protection and confidentiality of personal data that the User provides when using the Site and shainote.ai services.
3.2. Depending on the shainote.ai forms and functions used by the User, the Operator may collect and process the following personal data of the User:
- •Last name, first name, patronymic — where provided by the User;
- •Contact phone number;
- •Email address;
- •Information provided by the User during registration, when submitting a request or application, concluding and performing a contract, and using shainote.ai services;
- •Materials and content uploaded, submitted, or created by the User when using shainote.ai, including audio recordings, text materials, images, documents, and other user content that may contain personal data of the User and/or third parties;
- •Technical and other data necessary to ensure the operation of the Site and shainote.ai services, User identification, provision of services, request processing, performance of contractual obligations, security, and improvement of service quality, to an extent not exceeding the purposes of processing.
3.3. Technical information (visit history, cookie data, IP addresses, browser and operating system types) is collected and processed in a depersonalized form for the purposes of analyzing and improving the operation of the Site, ensuring its security, and countering cyberattacks.
4. PURPOSES OF PERSONAL DATA PROCESSING
The Operator processes the User's personal data for the following purposes:
4.1. Identification of the User within the use of shainote.ai services.
4.2. Providing the User with access to personalized resources and shainote.ai functionality.
4.3. Establishing feedback with the User, including processing requests and applications.
4.4. Verifying the accuracy and completeness of the personal data provided.
4.5. Providing effective customer and technical support.
4.6. Informing the User, with their consent, about product updates, special offers, newsletters, and other information.
4.7. Fulfilling contractual and pre-contractual obligations to the User.
4.8. Complying with the requirements of the applicable legislation of the Republic of Kazakhstan.
4.9. Ensuring the operation of shainote.ai services, including the processing of materials and data uploaded, submitted, or created by the User, including audio recordings, text materials, images, and documents, for the purposes of speech recognition, audio-to-text conversion, text generation, summary preparation, analytics, information structuring, and providing the User with processing results in accordance with the shainote.ai functionality.
4.10. Processing of materials containing personal data of third parties solely for the purpose of providing the User with the relevant shainote.ai services, provided that the User holds the necessary legal grounds to provide such data to the Operator.
5. LEGAL GROUNDS AND PROCESSING PERIODS
5.1. Personal data is processed on the basis of the User's consent given in accordance with clause 2.1 of this Policy, as well as for the conclusion and performance of contracts to which the User is a party.
5.2. The period of personal data processing is determined by the achievement of the purposes for which the data was collected, unless a different period is provided by contract or the applicable legislation of the Republic of Kazakhstan.
5.3. Upon expiry of the processing period, personal data is subject to destruction or depersonalization in accordance with the Operator's internal procedures that comply with the requirements of ISO/IEC 27001 and the legislation of the Republic of Kazakhstan.
6. TRANSFER OF PERSONAL DATA
6.1. The Operator may transfer personal data to third parties in the following cases:
- •The subject has given their consent to such actions.
- •The transfer is necessary to provide services or fulfil obligations to the User (for example, to communication service providers, technology and infrastructure partners).
- •The transfer is provided for by the legislation of the Republic of Kazakhstan, in the established manner, to authorized state bodies.
6.2. When transferring data to third parties, the Operator takes all reasonable contractual and organizational measures to ensure the confidentiality and security of the personal data transferred.
6.3. When using certain shainote.ai services, the Operator may engage third parties, including technology partners, cloud infrastructure providers, software solution providers, speech recognition and data processing services, and other sub-processors whose infrastructure may be located outside the Republic of Kazakhstan.
Cross-border transfer of personal data is permitted only to the extent necessary to provide the relevant service, subject to the User's consent and/or another lawful ground, and in compliance with the requirements of the legislation of the Republic of Kazakhstan.
Information about the categories of such third parties, the purposes of engaging them, the processing regime, and the specifics of cross-border transfer is disclosed in this Policy, the shainote.ai Terms of Use, and/or other documents published on the Site.
6.4. In sovereign mode, the processing and storage of personal data are carried out on infrastructure located in the Republic of Kazakhstan, without cross-border transfer, unless otherwise expressly agreed with the User in writing or in a separate contract.
7. PROTECTION MEASURES AND ISO/IEC 27001 COMPLIANCE
7.1. The Operator takes the necessary and sufficient organizational and technical measures to protect the User's personal data against unlawful or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions.
7.2. Protection measures include, but are not limited to:
- •Access control: implementation of a policy for differentiating access rights to personal data.
- •Encryption: use of cryptographic data protection when data is transmitted over communication channels and, where necessary, stored.
- •Regular monitoring and risk analysis: within the operation of the ISMS.
- •Incident management: an established procedure for responding to information security incidents involving personal data.
- •Training and awareness: regular briefings for employees who have access to personal data.
- •Conformity assessment: periodic internal audits and review of protection measures.
8. RIGHTS OF THE PERSONAL DATA SUBJECT
In accordance with the legislation of the Republic of Kazakhstan, the User has the right:
8.1. To receive information concerning the processing of their personal data.
8.2. To access their personal data, and to have it clarified and corrected.
8.3. To withdraw consent to the processing of personal data. Withdrawal of consent may make the use of certain shainote.ai services impossible.
8.4. To have their personal data destroyed and/or its processing terminated if the data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing.
To exercise these rights, the User may send a corresponding request to the Operator's email address: info@shai.pro
9. OBLIGATIONS AND LIABILITY OF THE PARTIES
9.1. The User is obliged to: provide accurate data and update it in a timely manner.
9.2. The Operator undertakes to:
- •Use the data solely for the purposes specified in Section 4 of the Policy.
- •Ensure the confidentiality of the data and not disclose it to third parties without the User's consent, except in cases provided for by law.
- •Take all measures provided for by the Policy and legislation to protect the data.
9.3. The Operator is liable for losses incurred by the User in connection with the unlawful use of their personal data, in accordance with the legislation of the Republic of Kazakhstan.
9.4. The Operator is not liable for the loss or disclosure of data if it became publicly available through no fault of the Operator, was obtained from a third party, or was disclosed with the User's consent.
10. DISPUTE RESOLUTION
10.1. Before applying to a court, the submission of a written claim is mandatory.
10.2. The recipient of the claim shall notify the applicant in writing of the results of its consideration within 30 (thirty) calendar days from the date of its receipt.
10.3. If no agreement is reached, the dispute shall be resolved in court in accordance with the legislation of the Republic of Kazakhstan.
11. FINAL PROVISIONS
11.1. The Operator may unilaterally amend this Policy. The new version comes into force from the moment it is published on the Site, unless otherwise provided by the new version.
11.2. All suggestions or questions regarding this Policy should be sent to: info@shai.pro
11.3. The current version of the Policy is published on the shainote.ai website in the legal information section.
