Policy on Cookies and Similar Technologies
The Russian text prevails. Kazakh and English translations are provided for convenience.
1. General Provisions
1.1. This Policy describes the cookies and similar technologies used on the Dalaway website and digital platform (the “Platform”), their purposes and how visitors control them.
1.2. The Operator of the website and Platform is SteppeGate LLP, BIN 260140019690.
1.3. This Policy supplements the Privacy and Personal Data Processing Policy. Where information obtained through the listed technologies constitutes personal data, the Privacy Policy applies to it.
1.4. This Policy applies to website visitors and Platform Users whether or not they have an account.
2. Cookies and Similar Technologies
2.1. A cookie is a small file stored by a visitor's browser at a website's request and sent back on subsequent requests.
2.2. Similar technologies include on-device browser storage (localStorage, sessionStorage), session identifiers, pixels and web beacons, and device identifiers in a mobile application.
2.3. This Policy applies to all the technologies listed, regardless of their names. Some information specified in section 4 is stored in local browser storage rather than cookies; this does not affect the applicable legal regime.
2.4. First-party and third-party technologies. First-party technologies are set by the Platform's domain. Third-party technologies are set by the domains of service providers engaged by the Operator.
2.5. The lifetime of a storage entry and the validity period of the token it contains may differ. An entry may remain in the browser after the token expires; such a token does not grant access.
3. Categories and Legal Regime
3.1. Categories:
| Category | Purpose | Regime |
|---|---|---|
| Strictly necessary | Authentication, session maintenance, file access control and security | Set without consent: logging in and operating the Platform are impossible without them |
| Functional | Saving the interface settings selected by the User | Set after login in connection with performance of the Agreement |
| Entries made before an account is created | Saving entries in the registration form and the record of deferred review | Created before login and before account creation. The regime is described in section 3-1 |
| Analytics | Visit statistics, performance measurement and detection of display errors | Used only on the informational pages of the Dalaway website and only with visitor consent obtained under section 5. Not used on registration, login or access recovery pages, or within the Platform |
| Advertising and targeting | — | Not used. The Operator does not display third-party advertising, transfer information to advertising networks or create advertising profiles. Transmission of information to analytics providers' advertising systems is disabled in the settings of the relevant services |
3.2. Before login, the Operator does not set cookies or write information to local browser storage, except for: entries listed in section 3-1; the entry saving the visitor's selection in the consent panel (dalaway-cookie-choice), listed in section 4 as strictly necessary, without which the visitor's choice cannot be implemented; and analytics entries set after consent is obtained under section 5.
3.2-1. Analytics technologies are used only on the informational pages of the Dalaway website. Third-party counters, analytics scripts, visitor activity recording and click heatmap tools are not loaded on registration, login or access recovery pages, or within the Platform. Platform usage statistics are maintained using the Operator's own tools without transferring information to third parties.
3.3. Strictly necessary technologies cannot be refused: without them, login and delivery of files accessible only to the User do not work. Refusing them is equivalent to declining to use the Platform.
3.4. The User may delete functional entries at any time through the browser. Deletion resets the interface to its default settings. It does not restrict access to Platform functionality. Logging out deletes authorisation data but does not automatically delete all interface settings.
3-1. Entries Created Before Account Creation
3-1.1. Two entries are created in browser session storage before an account is created: a draft registration form and a record of deferred review of a legal document. Both are described in section 4.
3-1.2. Draft registration form. Information entered in the registration form is temporarily saved in session storage in the browser on the visitor's device to restore the form when the page is refreshed. The password is not saved in the draft. Draft information is not transmitted to the Operator's servers before the form is submitted.
3-1.3. The draft is deleted after successful submission of the form and when the tab session ends. The visitor may delete it at any time by closing the tab or clearing website data through the browser.
3-1.4. Time of consent. Consent to the collection and processing of personal data is given through a separate action before the verification code request button is pressed. Sending a code to the email address provided by the visitor constitutes transfer of that address to the transactional email provider located outside the Republic of Kazakhstan and takes place only after consent is given. Without the checkbox being selected, the server rejects the code request and the address is not transferred to the provider.
3-1.5. The Consent text and this Policy are available before that time. Consent given at the final registration step is insufficient for an earlier code transmission. Requesting another code under the same consent does not require renewed acceptance of unchanged text.
3-1.6. The record of deferred review contains no personal data, is not linked to an account on the Operator's side, and is retained until the tab session ends. It does not constitute acceptance of a document: mandatory documents are accepted through a separate action.
3-1.7. This section describes the actual behaviour of pages available before account creation. The technical nature of an entry is not in itself a ground for processing personal data and does not exempt it from this section's requirements.
4. List of Technologies Used
4.1. The list reflects the technologies actually used on the publication date and is kept up to date.
Strictly necessary
| Name | Storage location | Purpose | Data | Period |
|---|---|---|---|---|
| ⟨cookie name⟩ | Cookie, HttpOnly, Secure; domain ⟨domain⟩, path ⟨path⟩, SameSite ⟨value⟩ | Confirming the User's entitlement to receive a protected file | Access token | 1 hour or until logout |
| dalaway-cookie-choice | Browser local storage | Saving the visitor's selection in the consent panel so that it need not be requested on every visit. Created before login and without consent because the visitor's choice cannot be implemented without it | Selected categories, date and time of the choice, version number of this Policy | 12 months |
| accessToken | Browser local storage | User authentication and authorisation | Access token | 1 hour or until logout |
| refreshToken | Browser local storage | Extending the session without re-entering the password | Refresh token | 30 days or until logout |
Functional — created after login
| Name | Storage location | Purpose | Data | Period |
|---|---|---|---|---|
| dalaway-locale | Browser local storage | Selected interface language | Language code | Until deleted by the User |
| dalaway.tradeMode | Browser local storage | Active work section | Section identifier | Until deleted by the User |
| dalaway.sidebar.expanded | Browser local storage | Sidebar state | “Expanded / collapsed” flag | Until deleted by the User |
Entries made before account creation — created before login
| Name | Storage location | Purpose | Data | Period |
|---|---|---|---|---|
| Draft registration form | Browser session storage | Restoring the form when the page is refreshed before submission | Information entered by the visitor in the registration form, including personal data. The password is not saved. Not transmitted to the Operator's servers before form submission | After successful form submission or when the tab session ends |
| Record of deferred review | Browser session storage | Hiding the invitation to review a legal document until the end of the current session | Document code and version number. Contains no personal data | Until the tab session ends |
Analytics — set only after consent and only on the informational pages of the website
| Provider | Tool | Purpose | Data | Provider policy |
|---|---|---|---|---|
| Google Analytics | Statistics on visits and behaviour on pages | Browser identifier, network address, addresses of pages viewed, device and browser type, approximate region | policies.google.com/privacy | |
| Google Tag Manager | Managing the loading of analytics tools | Technical information about tools being loaded | policies.google.com/privacy | |
| Yandex | Yandex Metrica | Visit statistics, performance measurement and detection of display errors | Browser identifier, network address, addresses of pages viewed, device and browser type, approximate region | yandex.ru/legal/confidential |
If a tool sets several entries, all are included in the list. The Operator keeps the list up to date and updates it when the set of tools used changes.
Visitor activity recording, session replay and click heatmap tools are not used. Advertising networks and pixels are not loaded.
4.2. The current version of the list is published at this Policy's address. Before any analytics technology is enabled, the list is updated and consent is requested under section 5.
5. Consent to Analytics Technologies
5.1. This section applies to the analytics technologies listed in section 4. It does not affect consent to personal data processing given before requesting a verification code (section 3-1), or other consents provided for in the Operator's documents.
5.1-1. This section applies only to the informational pages of the Dalaway website. Analytics technologies are not used on registration, login or access recovery pages, or within the Platform, and consent under this section is not requested there.
5.2. On the first visit, a choice panel is displayed containing a brief description of the categories, names of the tools used, an indication that collected information may be processed outside the Republic of Kazakhstan, a link to this Policy and three equivalent actions: “Accept All”, “Necessary Only” and access to category settings.
5.2-1. No analytics technology is loaded before the visitor makes a choice. Before that choice, no analytics scripts or tag manager are executed and no requests are sent to providers' servers. A panel displayed after such tools have loaded does not constitute consent.
5.3. Accept and reject buttons are equally accessible and appear on the first screen of the banner.
5.4. Silence, closing the panel and continuing to browse do not constitute consent and are equivalent to selecting “Necessary Only”. Only strictly necessary technologies are set before the visitor's choice.
5.5. The visitor's choice is saved for twelve months, after which it is requested again.
5.6. The choice may be changed at any time under section 6. Changes apply prospectively; previously set files in disabled categories are deleted.
5.7. The Operator records the choice, specifying its date and time, the selected categories, the version number of this Policy and the visitor's identifier.
5.8. Withdrawal of consent applies prospectively. Information collected before withdrawal is processed under the relevant providers' policies. The Operator considers requests for deletion in respect of processing it carries out itself and coordinates with the engaged provider. Requests are sent to privacy@dalaway.kz.
6. Settings Panel and Browser Controls
6.1. Cookie Settings. The “Cookie Settings” link appears at the bottom of every website and Platform page and opens the choice panel described in section 5. It shows the visitor's current choice, the categories in section 3 and a link to the list of entries in section 4.
6.2. Visitors may also manage cookies and local browser storage through their browser by blocking them, deleting saved entries and setting notifications. Deleting website data may end the current session and reset interface settings. Blocking strictly necessary technologies makes login impossible.
7. Data Obtained Through the Listed Technologies
7.1. All the information listed in section 4 is processed: access and refresh tokens, interface settings selected by the User, the visitor's saved choice in the consent panel, the draft registration form, the record of deferred review and, where the visitor consents to analytics technologies, the browser identifier, network address, addresses of pages viewed, device and browser type and approximate region.
7.2. Tokens relate to the User's account and, to that extent, constitute personal data. Their processing is legally based on performance of the Accession Agreement and the Consent to the Collection and Processing of Personal Data.
7.3. Interface settings and the record of deferred review contain no personal data and are not linked to an account on the Operator's side.
7.3-1. The draft registration form contains information entered by the visitor, including personal data. The storage procedure, time of consent and deletion procedure are established in section 3-1.
7.4. Retention periods are specified in section 4 and do not exceed those established in section 13 of the Privacy Policy.
7.5. Profiling, tracking behaviour across websites and creating advertising profiles are not carried out.
8. Transfer to Third Parties
8.1. Information obtained through the analytics technologies listed in section 4 is transferred to their providers specified in that section and only after the visitor's consent. The information transferred and each provider's policy are specified in the list in section 4.
8.1-1. Information obtained through strictly necessary and functional technologies and through entries made before account creation is not transferred to third parties.
8.1-2. Third-party technologies are not used within the Platform or on registration, login or access recovery pages, and information obtained on those pages is not transferred to analytics providers.
8.2. Where a service provider using its own storage technologies is engaged, the categories of recipients and, for cross-border transfers, the countries where they are located are specified in sections 10 and 11 of the Privacy Policy, and the list in section 4 of this Policy is updated before use begins.
8.3. The Operator does not sell or transfer this information to advertising networks, data brokers or other third parties for their own purposes.
9. Visitor Rights
9.1. A visitor who is a personal data subject has the rights established in section 17 of the Privacy Policy, including the rights to information about processing, to its blocking and to withdrawal of consent.
9.2. Requests are sent to privacy@dalaway.kz.
10. Changes to This Policy
10.1. Changes are published at this Policy's address with the publication date and effective date.
10.2. Changes introducing analytics technologies trigger section 5 and require the visitor's choice to be requested before their use begins.
10.3. Each version is retained in the archive at a permanent address.