Consent to the Collection and Processing of Personal Data

I, the personal data subject, acting freely, of my own will and in my own interests, hereby grant SteppeGate LLP, BIN 260140019690, the owner and operator of the database containing personal data, consent to collect and process my personal data in connection with use of the Dalaway digital platform.

I give this Consent after reading the Privacy and Personal Data Processing Policy published at https://dalaway.kz/legal/privacy.

1. List of personal data

The Consent covers:

1. last name, first name and patronymic, if any;
2. email address and telephone number, and their verification markers;
3. account identifier and profile settings;
4. profile image, if uploaded by me;
5. authentication information: password in a protected transformed form, session information, one-time verification codes;
6. the name of the organisation in whose interests I act, my position and the role assigned to me on the Platform, the scope of my authority, invitation information and the history of granting and revoking access;
7. information and documents necessary to confirm my authority, where applicable;
8. data I create when working with Lots, Requests, Offers, Transactions, correspondence, Parties’ Contracts, Appendices, Trading Operations and the Services Centre, including message content;
9. information on actions I have performed, status changes and uploaded documents;
10. the device’s network address, dates and times of actions, session, device and browser information, online presence and last login information, activity and security logs;
11. information contained in my support enquiries, claims, complaints, appeals and materials relating to their consideration, insofar as they relate to me;
12. information obtained from publicly available sources and state registers when verifying the organisation in whose interests I act and my authority;
13. ratings of performance of obligations given by me for completed Transactions, and the texts of such ratings and responses thereto. This subclause applies from activation of the relevant feature on the Platform.

2. Purposes of processing

Consent is given for the purposes of:

1. creating, authenticating and protecting my account, including sending a verification code to the email address I provide;
2. granting me access to the corporate account and Platform functionality;
3. verifying the organisation in whose interests I act and confirming my authority;
4. ensuring operation of the Platform’s trading functionality, Transactions, Appendices, Trading Operations and Services Centre, and supporting performance of contracts between Participants;
5. providing the parties to a Transaction with necessary information and documents, including disclosure of representative information to the Transaction counterparty;
6. automated analysis of my messages and information I publish for indications of sharing contact details before Agreement on Commercial Terms and other breaches of the Marketplace Rules;
7. granting the Operator’s authorised employees access to the content of Transaction correspondence and documents when considering enquiries, complaints, disputes and reviews provided for in the Agreement and Marketplace Rules;
8. compiling an export of Transaction materials in accordance with the procedure established by the Accession Agreement;
9. sending service and legally significant notices and providing technical support;
10. ensuring information security and detecting and preventing circumvention of the Platform;
11. calculating the Fee and preparing related settlement and accounting documents;
12. complying with the laws of the Republic of Kazakhstan;
13. establishing, exercising and defending the Operator’s claims;
14. creating De-identified Data and calculating Aggregated Indicators based on them. Publication is permitted exclusively in the form of Aggregated Indicators that cannot identify me, the organisation in whose interests I act or the terms of an individual Transaction;
15. displaying my online presence and last login information to other Users interacting with me within a Transaction, correspondence or a Services Centre order. This purpose applies from activation of the relevant feature; this information does not become publicly available;
16. collecting my ratings of a counterparty’s performance of obligations under completed Transactions, using them to calculate performance indicators for the organisation in whose interests I act, and displaying such indicators in its profile. This purpose applies from activation of the relevant feature. My last name, first name and position are not published when displaying ratings and indicators.

Processing for purposes not specified in this section is not carried out.

3. Actions involving personal data

The Consent covers collection, recording, systematisation, accumulation, storage, updating, retrieval, use, granting access, transfer in cases provided for by this Consent, masking, hashing, de-identification, anonymisation, blocking, deletion and destruction of personal data, to the extent necessary for the specified purposes.

4. Automated processing

I have been informed that some processing is performed by automated means to generate notices, preliminary calculations and indications referred to an employee of the Operator for review. Under this version, an automatically detected indication does not in itself establish a breach or entail a contractual restriction of trading functionality.

Decisions establishing a breach, the existence of a Related Transaction, recalculation of the Fee and contractual restriction of trading functionality are made by an authorised employee of the Operator. If a fully automated decision capable of independently changing my rights or legitimate interests is introduced in the future, the Operator will provide the necessary information and request separate consent before its launch, if required by law.

5. Transfer to third parties and entrusting processing

I have been informed that the Operator may grant access to my personal data to:

1. other Users and Participants, to the extent necessary for a particular Transaction, contract, operation or service order;
2. infrastructure and technical service providers, under a data processing agreement specifying the purposes, data categories, duration and protection requirements;
3. banks, payment and accounting organisations, to the extent necessary for settlements and accounting;
4. a court, arbitral tribunal, notary and authorised state bodies, in the cases and manner prescribed by law.

Current categories of recipients are specified in the Privacy Policy. Expanding the range of recipients beyond those specified in the Policy requires obtaining my consent anew.

6. Cross-border transfer

6.1. Transactional email provider. I authorise cross-border transfer of my email address and necessary message information — a one-time verification code or link, name if used in the message, language and technical sending parameters — to the Brevo service, provided by Sendinblue, a simplified joint-stock company, French Republic, for sending verification codes and service messages. Processing takes place on the provider’s infrastructure within European Union member states: the French Republic, the Federal Republic of Germany and the Kingdom of Belgium. Information about messages and delivery events is retained in the provider’s logs. The password is not transferred to the provider.

I have been informed that sending a verification code to the address I provide constitutes transfer of that address to the transactional email provider and takes place only after this Consent is given. An invitation email is sent to an employee before they give this Consent, on the instructions of the Participant that has confirmed a lawful basis for that transfer under the Company Consent; the invitee gives personal consents on first login.

6.2. Transaction counterparty. I authorise disclosure to the Transaction counterparty and its authorised persons of information about me as the organisation’s representative: last name, first name and patronymic, if any, position, work email address and work telephone number, and information about me contained in Transaction documents and correspondence, to the extent necessary to agree, document and perform the relevant Transaction. Copies of identity documents and Participant verification materials are not transferred to the counterparty. If the counterparty is located outside the Republic of Kazakhstan, such disclosure constitutes a cross-border transfer; the counterparty’s country of location is displayed to me before disclosure.

6.3. Transfer of information beyond the scope specified in clauses 6.1 and 6.2, or transfer to other recipients, to other countries or for other purposes, is not authorised by this Consent and requires obtaining my consent anew.

7. Public dissemination

My personal contact details and my image are not disseminated in publicly available sources. The Operator does not publish them on the basis of my registration.

Other Participants are shown corporate information about the business entity in whose interests I act, to the extent marked as public in the interface, its “Verified” status and its performance indicators on the Platform, including indicators calculated from ratings of completed Transactions. Its name, identification number, contacts and description are disclosed to the other party after Agreement on Commercial Terms; until then, the profile is de-identified. The scope of displayed information and the persons to whom it is displayed are determined by the interface. Information entered in fields marked as public in the interface may also be displayed in an open Participant directory from activation of the relevant feature on the Platform. Information in fields not marked as public is not displayed in that directory. The indicators relate to the business entity; my last name, first name and position are not published as part of them or when displaying ratings.

This Consent does not authorise advertising messages; separate consent is provided for them (D-12).

8. Duration

The Consent remains valid while I use my account and thereafter within the retention periods established in section 13 of the Privacy Policy, or until I withdraw it.

For incomplete registration, the Consent remains valid until the purpose of verifying the email address and protecting against abuse ceases.

9. Withdrawal of consent

I may withdraw this Consent by sending a request from the verified email address specified in my account to privacy@dalaway.kz, or through the personal account.

If an account has not been created or its creation has not been completed, a withdrawal request is sent to privacy@dalaway.kz specifying the contact used when giving consent or the enquiry identifier. The Operator may carry out a proportionate check that the request originates from the subject of the relevant data and does not require other information for this purpose.

The Operator ceases processing based exclusively on consent within the time limits prescribed by the laws of the Republic of Kazakhstan.

I have been informed that, after withdrawal of consent, processing continues to the extent necessary to comply with mandatory legal requirements, including accounting and tax records; perform an outstanding obligation; establish, exercise and defend the Operator’s claims; or complete consideration already commenced of an enquiry, complaint or dispute, or an investigation of a security incident. This list is exhaustive. If the request cannot be fulfilled, a reasoned response is sent to me.

Withdrawal of consent may make provision of Platform functionality impossible.

10. Method of giving and recording consent

Selecting the checkbox and clicking the continue button is the method of giving this Consent that allows its receipt to be confirmed. The checkbox is not preselected; opening the document text via the link does not change the checkbox. The presence of the mandatory checkmark is verified both in the interface and on the server. Without the checkmark, the verification code request is rejected and the email address is not transferred to the transactional email provider.

Requesting another verification code under the same Consent does not require renewed acceptance of unchanged text.

The consent record retained by the Operator contains:

1. the name and business identification number of the Operator, SteppeGate LLP, BIN 260140019690, the owner and operator of the database containing personal data;
2. my last name, first name and patronymic, if any, the contact I provided and its verification status at the time of giving consent, and the account identifier, if any, or the registration session identifier if the account has not yet been created;
3. the list of personal data and purposes under sections 1 and 2;
4. the duration under section 8;
5. information on transfer to third parties under section 5;
6. information on cross-border transfer under section 6, specifying the recipient and countries of processing;
7. information on the presence or absence of public dissemination under section 7 and its scope;
8. the document code, version number and checksum of the text of this Consent;
9. the language in which the text was displayed;
10. the date, time, device network address and confirmation method.

The information in subclauses 3–7 is entered in the record as specific values, rather than a general reference to this document.

The record is created at the moment consent is given, before the verification code is sent. Subsequent verification of the contact is recorded in a separate linked record; the original consent record is not changed. The contents of the record comply with Article 8 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”.