1. TERMS AND DEFINITIONS

1.1. Website Administration (hereinafter — “Operator” or “SHAI”) — authorized employees of the Website owner who organize and/or carry out the processing of personal data, and also determine the purposes and content of personal data processing.

1.2. Information Security Management System (ISMS) — part of the overall management system, based on business risk assessment, aimed at establishing, implementing, operating, monitoring, reviewing, maintaining and improving information security in accordance with the principles of ISO/IEC 27001.

1.3. Personal Data — data, including biometric data (including voice biometric data generated from audio recordings), relating to a specific or identifiable subject of personal data, recorded on electronic, paper and/or other physical media.

1.4. Processing of personal data – any action (operation) or set of actions (operations) performed with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction.

1.5. Confidentiality of personal data is a mandatory requirement to prevent its dissemination without the consent of the personal data subject or other legal grounds.

1.6. User (Data Subject) — a person who has access to the Website via the Internet and uses the Website.

1.7. Cookies — a small piece of data sent by a web server and stored on the User's device, which is transmitted to the web server each time the Website is accessed.

1.8. IP Address — a unique network address of a node in a computer network built on the IP protocol.

1.9. Cross-border Transfer of Personal Data — transfer of personal data by the Operator to the territory of a foreign state to a foreign individual or legal entity.

2. GENERAL PROVISIONS. PRINCIPLES OF PROCESSING

2.1. The User's use of the System constitutes his unconditional consent to this Policy and the terms of processing of his personal data.

2.2. In case of disagreement with the terms of the Policy, the User must immediately stop using the System.

2.3. The Operator processes personal data based on the following principles:

Legality, fairness and transparency.

Limitation of processing to predetermined and legitimate purposes.

Data minimization (collecting only the data that is necessary for the stated purposes).

Accuracy and relevance of data.

Storage restrictions in forms that allow identification of the subject for no longer than required for the purposes of processing.

Ensuring an adequate level of data security, including protection against unauthorized or unlawful processing, as well as against accidental loss, destruction or damage.

2.4. This Policy applies exclusively to the shai.pro Information System. The System does not control and is not responsible for third-party websites that the User may access via links available on shai.pro.

3. SUBJECT OF POLICY. COMPOSITION OF DATA

3.1. This Policy sets forth the Operator's obligations to maintain confidentiality and ensure the protection and confidentiality of personal data that the User provides when using the System.

3.2. Personal data permitted for processing is provided by the User voluntarily and may include:

Last name, first name, patronymic;

Email address;

Information provided by the User during registration, submission of a request, application, conclusion and performance of a contract, use of Platform Services;

Materials and content uploaded, submitted or created by the User when using Platform Services, including audio recordings, text materials, images, documents and other user content, which may contain personal data of the User and/or third parties;

Technical and other data necessary to ensure the functioning of the Website and Platform, identify the User, provide Services, process requests, fulfill contractual obligations, ensure security and improve the quality of Services, to the extent not exceeding the purposes of processing.

3.3. Technical information (browsing history, cookie data, IP addresses, browser and operating system types) is collected and processed in anonymized form for the purposes of analyzing and improving the Website's operation, ensuring its security and countering cyberattacks.

4. PURPOSES OF PERSONAL DATA PROCESSING

The Operator processes the User’s personal data for the following purposes:

4.1. Identification of the User within the framework of using the System services.

4.2. Providing the User with access to personalized resources and functionality of the System.

4.3. Establishing feedback with the User, including processing requests and applications.

4.4. Confirmation of the accuracy and completeness of the personal data provided.

4.5. Providing effective customer and technical support.

4.6. Informing the User, with his consent, about product updates, special offers, newsletters and other information.

4.7. Fulfilment of contractual and pre-contractual obligations to the User.

4.8. Compliance with the requirements of the current legislation of the Republic of Kazakhstan.

4.9. Ensuring the functioning of SHAI Platform Services, including processing of materials and data uploaded, submitted or created by the User, including audio recordings, text materials, images and documents, for the purposes of speech recognition, audio-to-text conversion, generation of text materials, preparation of summaries, analytics, structuring of information and providing the User with processing results in accordance with the functionality of the selected Service.

4.10. Processing of materials containing personal data of third parties, solely for the purpose of providing the User with the relevant SHAI Platform Services, provided that the User has the necessary legal grounds to provide such data to the Operator.

5. LEGAL BASIS AND PROCESSING TERMS

5.1. The processing of personal data is carried out on the basis of the User's consent provided in accordance with paragraph 2.1. of this Policy, as well as for the conclusion and execution of agreements to which the User is a party.

5.2. The processing period for personal data is determined by the achievement of the purposes for which they were collected, unless another period is provided for by the agreement or the current legislation of the Republic of Kazakhstan.

5.3. Upon expiration of the processing period, personal data shall be subject to destruction or depersonalization in accordance with the procedure established by the Operator’s internal procedures, which comply with the requirements of ISO/IEC 27001 and the legislation of the Republic of Kazakhstan.

6. TRANSFER OF PERSONAL DATA

6.1. The operator has the right to transfer personal data to third parties in the following cases:

The subject has expressed his consent to such actions.

The transfer is necessary to provide services or fulfill obligations to the User (for example, courier services, communication service providers).

The transfer is provided for by the legislation of the Republic of Kazakhstan in the established manner to authorized state bodies.

6.2. When transferring data to third parties, the Operator takes all reasonable contractual and organizational measures to ensure the confidentiality and security of the transferred personal data.

6.3. When using certain SHAI Platform Services, the Operator may engage third parties, including technology partners, providers of cloud infrastructure, software solutions, speech recognition services, data processing services and other sub-processors, whose infrastructure may be located outside the Republic of Kazakhstan.

Cross-border transfer of personal data is permitted only to the extent necessary to provide the relevant Service, with the User's consent and/or other legal basis and in compliance with the requirements of the legislation of the Republic of Kazakhstan.

Information about the categories of such third parties, the purposes of their engagement, the processing regime and the specifics of cross-border transfer is disclosed in this Policy, the Platform Terms of Use and/or other documents posted on the Operator's website.

In sovereign mode, processing and storage of personal data is carried out on infrastructure located in the Republic of Kazakhstan, without cross-border transfer, unless otherwise expressly agreed with the User in writing or in a separate contract.

7. PROTECTION MEASURES AND ISO/IEC 27001 COMPLIANCE

7.1. The Operator shall take the necessary and sufficient organizational and technical measures to protect the User's personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other illegal actions.

7.2. Protective measures include, but are not limited to:

Access management: Implementation of a policy for delimiting access rights to personal data.

Encryption: The use of cryptographic data protection tools during transmission over communication channels and, if necessary, storage.

Regular monitoring and risk analysis: within the framework of the ISMS functioning.

Incident Management: Having a procedure in place to respond to information security incidents involving personal data.

Training and information: Regular training for employees who have access to personal data.

Compliance assessment: Periodic internal audits and review of safeguards.

8. RIGHTS OF THE PERSONAL DATA SUBJECT

In accordance with the legislation of the Republic of Kazakhstan, the User has the right:

8.1. To receive information regarding the processing of his personal data.

8.2. To access, update and correct your personal data.

8.3. Revocation of consent to the processing of personal data. Revocation of consent may result in the inability to use certain System services.

8.4. To destroy your personal data and/or terminate its processing if the data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing.

To exercise their rights, the User may send a corresponding request to the Operator by email: info@shai.pro .

9. OBLIGATIONS AND RESPONSIBILITIES OF THE PARTIES

9.1. The User is obliged to: provide accurate data and update it in a timely manner.

9.2. The Operator undertakes to:

Use data solely for the purposes specified in Section 4 of the Policy.

Ensure the confidentiality of data and not disclose it to third parties without the consent of the User, except in cases provided by law.

Take all measures to protect data as provided by the Policy and legislation.

9.3. The Operator is liable for losses incurred by the User in connection with the unlawful use of his personal data, in accordance with the legislation of the Republic of Kazakhstan.

9.4. The Operator shall not be liable for the loss or disclosure of data if it became publicly known through no fault of its own, was received from a third party, or was disclosed with the consent of the User.

10. DISPUTE RESOLUTION

10.1. Before applying to the court, it is mandatory to submit a written claim.

10.2. The recipient of the claim shall, within 30 (thirty) calendar days from the date of its receipt, notify the applicant in writing of the results of the review.

10.3. If no agreement is reached, the dispute shall be resolved in court in accordance with the legislation of the Republic of Kazakhstan.

11. FINAL PROVISIONS

11.1. The Operator reserves the right to amend this Policy unilaterally. The new version shall take effect upon its posting on the System, unless otherwise provided in the new version.

11.2. All suggestions or questions regarding this Policy should be sent to: info@shai.pro

11.3. The current version of the Policy is posted on the page at: https://shai.pro/en/documents?tab=privacyPolicy.