Privacy Policy

Last updated: 2 October 2026

Individual Entrepreneur “CEH360” (IIN 930511050673; “we”) processes personal data in accordance with this Privacy Policy (the “Policy”). The Policy applies to the ceh360.kz website (the “Website”) and to the CEH360° account portals (the “Service”), and covers Website visitors, persons who have submitted requests, and users of the Service. Individual entrepreneurs and organizations that use the Service are referred to as “Clients”.

This Policy applies together with the Terms of Use and the Consent to the Processing of Personal Data.

1. Data We Collect and Its Sources

Website requests. Name, phone number, city (if you allowed your location to be determined; exact coordinates are not stored), Website language and page, referral source. A supply request also includes: the surname, first name and patronymic, or the name of the organization or individual entrepreneur on whose behalf the request is submitted; the surname and first name of the contact person; an additional phone number; email address; the address, dates and details of the supply; a comment.

Service account. Phone number, surname and first name, email address, organization and role in it, records of sign-ins, actions in the Service and acceptance of documents.

Inquiries. Information you provide to us by phone, by email or via messaging apps.

Technical data. IP address, browser and device information, date and time of requests, cookies (Section 10).

We receive data from you, and also from a Client or a person who submitted a request if they named you as their employee or contact person. We process data both with and without the use of automation tools. We do not request identity document data, bank card data or other information that is not needed for the purposes listed in Section 2.

2. Purposes of Processing

to accept a request, contact you, prepare a quote and provide services;
to generate labels and documents for a supply request and send them to you;
to verify your phone number, provide access to the Service and ensure its operation;
to perform the agreement with the Client and keep records;
to confirm acceptance of documents and consents given, and to protect the parties' rights in disputes;
to protect the Website and the Service from abuse and unauthorized access;
to assess Website traffic in aggregate form and improve the Website;
to comply with legal requirements.

We send only service messages about requests and work in the Service. We do not send marketing communications.

3. Legal Basis for Processing

We process personal data with your consent, which you give in a form on the Website or when signing in or registering in the Service, and without consent only in cases established by the legislation of the Republic of Kazakhstan.

If your data was provided to us by a Client or a person who submitted a request, they confirm that they obtained your consent to such transfer. Data placed by Clients (Section 4) is processed by us on their instructions.

4. Data Placed by Clients

Clients place information about their employees and counterparties in the Service. When a marketplace store is connected, the Service receives order data, including the buyer's name, phone number and delivery address.

We process this data on the Client's instructions and solely to provide services to the Client: order picking, labeling, shipping and record-keeping. We do not use it for our own purposes. The Client is responsible for the lawfulness of obtaining such data and transferring it to us.

If you are a buyer or an employee of a Client, please contact the Client. If such a request reaches us, we will forward it to the Client and help prepare a response.

5. Recipients

We share personal data with:

service providers that provide data storage, communications, the work messaging app in which our staff handle requests, SMS code delivery, email, protection of the Website and the Service against automated requests and network attacks, and web analytics;
logistics partners, delivery services and marketplaces — where necessary to fulfill a supply or an order;
the Client whose workspace you have been granted access to — to the extent necessary for working together;
government authorities — in cases established by law.

Each recipient receives only the data necessary for its function. We do not sell personal data and do not disseminate it in publicly available sources.

6. Storage Location and Cross-Border Transfer

Personal data is stored in the Republic of Kazakhstan.

Name, phone number and other contact details are transferred outside the Republic of Kazakhstan only with your consent and to the extent necessary for the relevant function: to the work messaging app in which our staff handle requests (the name, phone number and city from a request), to service providers that deliver SMS and email or protect the Website and the Service against network attacks, and to logistics partners handling supplies to other countries. Web analytics, embedded map and automated-request protection services receive technical data without contact details and may process it outside the Republic of Kazakhstan.

Buyer data from marketplace orders is transferred only to the marketplace, delivery services, logistics partners and service providers that ensure the operation and protection of the Service — to the extent necessary to fulfill the order.

7. Retention Periods

requests that did not result in a business relationship — no longer than 24 months from the request date;
data of Clients and their representatives — for the duration of the business relationship and thereafter for the periods established by law;
account data — while the account is active; after its deletion, records of sign-ins and acceptance of documents are kept for no longer than three years to protect the parties' rights;
technical logs — no longer than 180 days;
buyer data from orders — for the period necessary to fulfill the order and keep records, or for another period as instructed by the Client.

When the period expires, data is deleted or anonymized unless the law requires it to be kept longer.

8. Data Protection

We take legal, organizational and technical measures to protect personal data against unauthorized access, alteration, dissemination and loss. Access to data is granted only to employees and service providers who need it for their work and are bound by confidentiality obligations. We notify the authorized body of personal data security breaches in the manner and within the time limits established by law.

The Website and the Service automatically detect suspicious activity and may temporarily restrict form submission or sign-in. If a restriction has been applied in error, write to hello@ceh360.kz — we will review your objection within the time limits established by law and inform you of the outcome.

9. Your Rights

You have the right to:

know whether we process your personal data, and receive information about the purposes, sources, methods, list of data, and the periods of its processing and storage;
request that your data be amended or supplemented;
request that your data be deleted or anonymized, or that its processing be restricted, except where the law requires it to be kept;
request that your data be blocked if the conditions of its processing have been violated;
withdraw your consent to processing, including to transfer to third parties and cross-border transfer;
object to automated processing (Section 8);
protect your rights, including by applying to the authorized personal data protection body or to a court, and claim compensation for harm.

Send your request to hello@ceh360.kz. We may ask you to confirm that the request was sent by you. We respond within the time limits established by the legislation of the Republic of Kazakhstan.

After consent is withdrawn, processing stops within 15 business days from the date the withdrawal is received, unless its continuation is required by law or to perform an outstanding obligation. Withdrawal of consent to the processing of account data means termination of access to the Service.

The Website uses its own cookies and browser storage to function properly, to remember your choice in the cookie notice and to record which page a request came from. The Service uses only cookies necessary for sign-in and saving settings.

If you clicked “Accept” in the cookie notice, the Website uses the Google Analytics and Yandex Metrica web analytics services. They receive technical data: IP address, device and browser information, pages viewed and actions on them, including recordings of on-page actions. We configure these services so that they do not receive form field contents or contact details. If you chose “Necessary only”, these services are not loaded. Learn more: how Google uses information from sites that use its services.

An external service that protects against automated requests receives technical browser and device data on the Website pages and when you sign in to the Service, and checks it when forms are submitted. The embedded map is loaded from a third-party map service, which receives technical browser and device data.

You can change your analytics choice at any time via the “Cookie settings” link at the bottom of the page. You can also install the Google Analytics Opt-out Browser Add-on and the Yandex Metrica opt-out add-on, or block cookies in your browser settings.

11. Age

The Website and the Service are intended for entrepreneurs and organizations and are not designed for persons under 18.

12. Changes to the Policy and Language

We update the Policy when the categories of data, the purposes of processing or legal requirements change. The new version is published on this page with its date. We notify users in advance of material changes via the Service or by email. If the changes require new consent, we will request it before processing begins on the new terms.

The Policy is published in Russian, Kazakh and English. In case of any discrepancy, the Russian text prevails.

13. Contact

Individual Entrepreneur “CEH360” · hello@ceh360.kz · +7 707 762 87 92, 24/7