Privacy Policy

This Personal Data Processing Policy has been drawn up in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and Its Protection" (hereinafter — the "Personal Data Law") and defines the procedure for processing personal data and the security measures taken by LLP "Paloma365" (hereinafter — the "Operator"). Official text of the Law: https://adilet.zan.kz/rus/docs/Z1300000094

The Operator considers the observance of the rights and freedoms of individuals in the processing of their personal data, including the protection of the right to privacy, to be its foremost goal and a condition of its activities.

This Policy applies to all information that the Operator may receive about visitors to the website https://paloma365.com, as well as through interaction with forms, applications and other communication channels available on the website.

For users from CIS countries, this Policy applies to the extent permitted by applicable law, with the Republic of Kazakhstan being the primary (priority) jurisdiction.

Data minimisation: The Operator collects only the data necessary for the operation of the website, handling enquiries and providing the Paloma365 service. The Operator does not collect "excess" data unrelated to these purposes.

Purpose limitation: personal data is processed only for pre-determined and lawful purposes specified in this Policy and is not used for other purposes without a lawful basis.

Transparency: the user is informed of the types of data collected, the purposes of processing, the categories of cookies and the ability to choose (consent/decline) via the consent banner.

No hidden identification methods: the Operator does not use hidden identification methods (fingerprinting), does not embed scripts executing unverified code from third-party sources and does not sell personal data.

Personal data — any information relating to an identified or identifiable user of the website https://paloma365.com.

Processing of personal data — any action (operation) or set of actions performed on personal data, including collection, recording, organisation, accumulation, storage, clarification, use, transfer (provision of access), anonymisation, blocking, deletion and destruction.

Automated processing — processing of personal data using computing technology.

Anonymisation — actions as a result of which it is impossible to determine the association of personal data with a specific user without the use of additional information.

Cross-border transfer — transfer of personal data to the territory of a foreign state to a foreign natural or legal person.

The Operator has the right to process the user's personal data where a lawful basis exists (consent, performance of a contract, requirements of the legislation of the Republic of Kazakhstan, legitimate interest — within permissible limits).

The Operator is obliged to take legal, organisational and technical measures to protect personal data from unlawful access, alteration, destruction, blocking, copying and other unlawful actions.

The Operator is obliged to provide the user, upon request, with information concerning the processing of personal data, within the requirements of the legislation of the Republic of Kazakhstan.

The user has the right to receive information about the processing of their personal data, to request the clarification, blocking or destruction of personal data in the cases and manner provided for by the legislation of the Republic of Kazakhstan.

The user has the right to withdraw consent to the processing of personal data in cases where processing is based on consent.

The user is obliged to provide accurate information and to promptly notify the Operator of any changes (where data correction is required).

Data provided directly by the user: name (if provided), email address, phone number (if provided), content of enquiries/messages, and other data voluntarily entered by the user into forms on the website or sent by email.

Technical and anonymised data: IP address, browser and device information, page visit data, referral sources, actions on the website; this data may be collected using cookies and web analytics tools.

The Operator does not process special (sensitive) categories of personal data (for example, information about racial/ethnic origin, political views, religious beliefs or intimate life) unless the user voluntarily provides such information in the text of an enquiry. In such a case, the Operator treats such information as excessive and not required for service purposes.

Handling enquiries and applications: clarifying the details of a user's request, contacting the user, and providing consultations on Paloma365 products and services.

Service delivery and user support: granting access to services, providing support, and informing users of the status of their enquiries.

Improving the website and service quality: analysing anonymised data about user actions on the website to improve the interface, content quality and operational stability.

Informational communications: the Operator may send the user notifications about new features and services where the user has given consent or where this is permitted by applicable law. The user may opt out of such communications by sending an email to info@paloma365.com with the subject line "Unsubscribe from notifications".

Personal Data Law of the Republic of Kazakhstan (official source: https://adilet.zan.kz/rus/docs/Z1300000094).

User consent: The Operator processes personal data when the user independently fills in/submits forms on the website or sends data by email, expressing consent to this Policy.

Performance of a contract: processing of personal data may be necessary for the conclusion and performance of a contract (public offer) for the provision of services.

Legitimate interest: ensuring website security, preventing abuse and maintaining correct operation of the service — within limits permitted by law and without infringing the user's rights.

The website uses a consent banner (cookie banner) that allows the user to select cookie categories: necessary, analytics and advertising.

By default (before the user makes a selection), analytics and advertising cookies are disabled, and analytics/advertising tags operate in a mode restricted by consent settings. The mechanism is implemented via Google Consent Mode (official documentation: https://developers.google.com/tag-platform/security/guides/consent).

When the user clicks "Accept/Confirm" or selects cookie categories, the settings are updated and the corresponding cookie categories may be activated. When clicking "Decline/Reject", analytics and advertising cookies remain disabled.

A detailed list of cookies, their purpose, retention periods and links to official sources are provided in the Cookie Policy on the Paloma365 website.

Additionally, the user can manage cookies through browser settings (deletion, blocking, restricting third parties). In the EU and countries where similar requirements apply, ePrivacy standards apply (official text of the directive: https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng).

Third-party cookies are used exclusively with the User's consent given via the cookie banner on the website. Data processing using such cookies is carried out in accordance with the applicable legislation of the Republic of Kazakhstan, as well as in accordance with generally accepted international data protection standards, including the principles of the General Data Protection Regulation (GDPR) and the ePrivacy Directive.

Third-party cookies are governed by the privacy policies of the respective service providers, and the Operator does not control the processing of data by such third parties beyond the purposes stated in this Policy.

Analytics: Google Analytics (Google privacy policy: https://policies.google.com/privacy) and/or Yandex Metrica (Yandex privacy policy: https://yandex.ru/legal/confidential; GDPR information: https://yandex.com/support/metrica/ru/general/gdpr).

Advertising and performance measurement (subject to user consent): Google Ads, Meta (Facebook), TikTok, LinkedIn — to the extent necessary for measuring conversions and the effectiveness of advertising campaigns.

Embedded content (where present on pages): for example, YouTube videos, which may set functional cookies for correct playback.

The Operator ensures the safety of personal data and takes measures to prevent access by unauthorised persons.

The Operator does not transfer personal data to third parties except: (a) cases provided for by the legislation of the Republic of Kazakhstan; (b) cases where the user has given consent; (c) cases where transfer is necessary for the operation of the service (for example, to infrastructure providers and analytics/advertising services subject to consent).

Personal data retention periods are determined by the purposes of processing and the requirements of applicable law. Data is not retained longer than necessary to achieve the processing purposes, unless a different period is established by law or contract.

The user may withdraw consent to the processing of personal data by sending an email to info@paloma365.com with the subject line "Withdrawal of consent to personal data processing".

Where cross-border transfer of personal data is required, the Operator takes measures aimed at ensuring an adequate level of personal data protection in accordance with the legislation of the Republic of Kazakhstan and general international standards.

Cross-border transfer may be carried out where a lawful basis exists (consent, performance of a contract, or other grounds provided for by applicable law).

For matters relating to personal data processing, the user may contact the Operator by email: info@paloma365.com.

In your request, please include: (a) full name (if applicable); (b) contact email; (c) the nature of the enquiry; (d) where necessary — links to website pages or a description of the situation.

The Operator reserves the right to make changes to this Policy. The current version of the Policy is published on the website and remains in force indefinitely until replaced by a new edition.

This Policy is the baseline policy for the Republic of Kazakhstan and applies to users from CIS countries to the extent permitted by applicable law.