Nova CRM Privacy Policy (Republic of Kazakhstan)

1. General

This Policy takes into account Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On Personal Data and Its Protection" (Law No. 94-V) and describes how the Nova CRM SaaS platform processes personal data of customers in the Republic of Kazakhstan and of those customers' clients.

The entity defining the purposes of account data processing: [OPEN — legal entity pending OA-002].

2. Data we process

• Customer account data: e-mail address, name, sign-in data, session

history.

• Data of the Customer's clients arriving through connected channels

(Telegram, VK, web chat widget, and others): name, contact details, message content, conversation metadata. This data is processed on the Customer's instructions: the Customer acts as the owner and/or operator of the corresponding personal data database under Law No. 94-V and is responsible for the lawfulness of collection and for obtaining its clients' consents.

• Technical information: IP address, device and browser data, event logs.
• Payment data is handled directly by payment providers; Nova CRM does

not store full card details.

3. Purposes and grounds

Performance of the contract (offer), invoicing, support, service status notifications, security and fraud prevention, and compliance with legal requirements. Data of the Customer's clients is processed solely to provide the service to the Customer.

4. Cross-border transfer and data location

The Nova CRM primary database (system of record) is hosted in a region of the Russian Federation, that is, outside the Republic of Kazakhstan. Transferring data from the Republic of Kazakhstan to the Russian Federation is a cross-border transfer under Article 16 of Law No. 94-V; the Russian Federation is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, which ensures personal data protection.

For certain channels that operate through client sessions rather than official APIs, message intake and routing technically pass through infrastructure nodes in other countries. A Customer connecting such a channel consents to the transfer of its clients' data to the extent necessary for the channel to work. The inbound message buffer on the connector node is not encrypted at rest — a limitation disclosed to the Customer explicitly, not an oversight.

5. Retention

Project data is retained for 90 days after the project enters the suspended or canceled status and is then irreversibly deleted.

6. Data subject rights

A data subject has the right to know about the existence and content of their data, to demand its correction and completion, blocking and destruction where processing is unlawful, and to withdraw consent in the cases provided by Law No. 94-V. Requests go to privacy@zaipulayev.eu. Requests about the Customer's clients' data are forwarded to the Customer as the party defining the purposes of processing.

7. Security measures

TLS in transit, encryption at rest for sensitive data categories except for the explicitly disclosed exception (section 4), role-based access control, and audit of privileged actions.

8. Cookies

Only technically necessary cookies for authentication and session persistence are used. No third-party analytics, advertising, or tracking cookies; the Policy will be updated in advance if any are introduced.

9. Changes to this Policy

Changes are published on the website with a new effective date; for material changes Customers are additionally notified through the dashboard at least 14 days in advance.