Company Consent to the Processing of Business Information and Communications

The Participant, acting through its authorised representative, hereby grants SteppeGate LLP, BIN 260140019690, consent to the processing of business information and communications created when using the Dalaway digital platform.

Capitalised terms have the meanings defined in section 2 of the Accession Agreement.

1. Subject matter of the consent

1.1. The Participant agrees that the Operator processes the Participant’s business information and communications created on the Platform for the purposes specified in section 3 of this Consent.

1.2. This Consent is a condition for granting access to Platform functionality. Without it, the Operator cannot ensure the detection of breaches of the Marketplace Rules, consideration of enquiries and disputes, or protection of Participants against circumvention of the Platform.

1.3. This Consent supplements and does not replace individuals’ consents to the processing of their personal data, which the Participant’s Users provide separately.

1.4. This Consent is provided by a separate checkbox, independent of the checkbox accepting the Agreement, Platform Use Rules, Marketplace Rules and Tariffs.

2. Objects of processing

2.1. The following are subject to processing:

1. the content of correspondence of the Participant’s Users on the Platform, before Agreement on Commercial Terms and within Transactions and service orders;
2. the content of Lots, Requests, Offers and other information published by the Participant;
3. Agreed Commercial Terms and amendments thereto;
4. details and electronic copies of Parties’ Contracts, Appendices and service agreements;
5. documents uploaded by the Participant’s Users, including accompanying goods, shipping and quality certification documents;
6. statuses of Transactions, Appendices, Trading Operations and service orders, and their change history;
7. activity logs of the Participant’s Users;
8. the Participant’s enquiries, claims, complaints and appeals, and materials relating to their consideration;

8-1) work email addresses and telephone numbers of the Participant’s employees specified by the Owner when inviting them, for sending invitations and granting access;

9. ratings given by the Participant’s Users for completed Transactions and the Participant’s responses to counterparties’ ratings. This subclause applies from activation of the relevant feature on the Platform.

2.2. This Consent covers information that may constitute the Participant’s trade secrets, to the extent necessary for the purposes of section 3.

2.3. The Participant confirms that it holds the rights to the information, documents and materials it posts and has grounds for transferring third-party data contained therein. This confirmation does not replace individuals’ personal consents.

2.3-1. When inviting an employee, the Participant confirms that it has a lawful basis for transferring that employee’s work contact details to the Operator and using them to send an invitation, including transfer to the transactional email provider in accordance with the Privacy Policy. At the Operator’s request, the Participant shall provide evidence of that basis. This Consent does not replace the employee’s consent where required by law.

3. Purposes of processing

3.1. Processing is carried out for the purposes of:

1. automated detection of indications of contact details being shared before Agreement on Commercial Terms and other indications of breaches of the Marketplace Rules;
2. consideration of enquiries, complaints, applications to cancel Transactions and disputes by the Operator’s authorised employees;
3. establishing circumstances relevant to applying the Marketplace Rules and settlements with the Operator, including indications of a Related Transaction and the occurrence of a Fee Event;
4. detecting and preventing circumvention of the Platform;
5. compiling an export of Transaction materials and providing it in accordance with section 6 of this Consent;
6. ensuring the Platform’s information security;
7. complying with the laws of the Republic of Kazakhstan and lawful requests of authorised bodies;

7-1) sending invitations to the Participant’s employees and arranging their connection to the corporate account;

8. creating De-identified Data and calculating Aggregated Indicators based on them in accordance with section 20 of the Accession Agreement. Publication and provision to third parties are permitted exclusively in the form of Aggregated Indicators that do not allow the Participant, its counterparties or the terms of an individual Transaction to be identified directly or indirectly. The Participant may object to the inclusion of data on its Transactions in such samples in accordance with clause 20.7 of the Agreement;
9. calculating the Participant’s performance indicators on the Platform based on ratings given by parties to completed Transactions and performance information, and displaying them in the Participant’s profile in accordance with clause 5.3 of the Platform Use Rules. This purpose applies from activation of the relevant feature.

3.2. This Consent does not authorise the use of the Participant’s materials in advertising or disclosure of the individual terms of its Transactions to unrelated persons. Exclusive rights to the Participant’s materials are not transferred to the Operator.

4. Automated analysis

4.1. The Operator uses automated tools to analyse messages and published information to detect the indications specified in subclause 1 of clause 3.1.

4.2. If an indication is detected, a warning is displayed to the User when sending a message or publishing information.

4.3. An automatically detected indication is grounds for a review, not a decision that a breach has occurred. An authorised employee of the Operator makes the decision in accordance with the Marketplace Rules.

4.4. The Operator does not disclose indicator thresholds, weightings or detection algorithms where disclosure could facilitate their circumvention. Information on the grounds for each breach decision, with a reference to the applicable provision, is always provided to the Participant.

5. Access by the Operator’s employees

5.1. The Operator’s authorised employees are granted access to the content of correspondence and documents only in connection with consideration of a specific enquiry, complaint, cancellation application, dispute or review, and to the extent relevant to the respective Transaction or service order.

5.2. Each instance of such access is logged, identifying the employee, date, time and enquiry under consideration.

5.3. Access is granted on a need-to-know basis in accordance with the Operator’s internal access matrix.

5.4. Blanket inspection of correspondence unrelated to a specific enquiry or review is not carried out.

6. Export of Transaction materials and disclosure to the other party

6.1. The Participant agrees that the Operator may provide the other party to a Transaction, as well as a court, arbitral tribunal, notary and authorised state bodies, with an export of data on the Transaction carried out between Participants, including correspondence between the parties to the Transaction, a chronology of actions, electronic documents, statuses and operation logs.

6.2. The export is provided to the extent relating exclusively to the relevant Transaction, within the time limit established by clause 19.1-1 of the Agreement.

6.3. When providing an export to one party, the Operator ensures that the other party can obtain an equivalent export at its request and notifies the other party of the provision within three business days, unless otherwise required by law or a binding order of an authorised body.

6.4. The Operator excludes from the export information unrelated to the relevant Transaction, data on third-party Participants and commercial terms of the Participant’s transactions with other counterparties, and masks such information.

6.5. The Operator is not a party to a dispute between Participants, does not provide a legal assessment of the data presented and is not responsible for Participants’ use of the export.

6.6. The procedure for compiling an export of Transaction materials is established in section 19 of the Agreement. The export is informational and technical in nature and does not constitute a legal opinion.

7. Extension of consent to Users

7.1. This Consent is given at Participant level and extends to all of its Users regardless of when they join the corporate account.

7.2. The Participant shall inform its Users of the contents of this Consent before granting them access to the Platform, in particular that the content of their business correspondence on the Platform is subject to automated analysis and may be viewed by the Operator’s authorised employees when considering enquiries and disputes.

7.3. Each User additionally provides their own consent to the processing of their personal data.

8. Duration and withdrawal

8.1. This Consent remains valid throughout the term of the Agreement and until expiry of the retention periods established by the Privacy Policy.

8.2. The Participant may withdraw this Consent by sending a notice to the Operator through the personal account or to hello@dalaway.kz.

8.3. Withdrawal of this Consent makes further use of the Platform impossible, since the Operator can no longer ensure the detection of breaches, consideration of enquiries and protection of Participants. Withdrawal is treated as the Participant’s termination of the Agreement in accordance with clause 23.5 of the Agreement; active Transactions are brought to Completion or cancellation.

8.4. Withdrawal does not extend to processing necessary to complete consideration already commenced of an enquiry, complaint, dispute or review; fulfil the Participant’s obligations to the Operator; establish, exercise and defend the Operator’s claims; or comply with legal requirements.