Esta es la edición vigente, publicada en el servicio en api.wameup.com/legal/dpa: el mismo texto que el usuario acepta al registrarse. El documento no tiene traducción al español; se muestra la traducción al inglés con fines informativos. Si difiere del texto en ruso, prevalece el texto en ruso.

Annex No. 1 to the Public Offer

Personal Data Processing Agreement

About this translation. This is an English translation of the document
above, provided for information. If the Russian and English texts differ,
the Russian text above prevails.

The number and date of the current edition are shown at the bottom of the
publication page. This agreement is concluded at the same time as the offer is
accepted and forms an integral part of it.

1. Parties and roles

1.1. The User is the owner of the database containing the personal data of
its Customers (Art. 1 of the Law of the Republic of Kazakhstan "On Personal
Data and Their Protection" No. 94-V, the "Law").

1.2. The Contractor is the operator that collects, processes and protects
this data on the User's instructions. The Contractor does not determine the
purposes of processing and does not use the data of the User's Customers for
its own purposes.

1.3. This agreement sets out the grounds and conditions on which the User
instructs the Contractor to process the personal data of the User's Customers
and allocates the Parties' obligations in such processing. This agreement
does not replace the data subject's consent where such consent is required
by the law of the Republic of Kazakhstan.

2. Subject of the instruction

2.1. The Contractor processes personal data only to the extent necessary
for the Service to work and only for the following purposes:

1) receiving and conducting correspondence with the User's Customers in the
connected channels;
2) placing orders, appointments and bookings;
3) sending notifications and reminders to the User's Customers;
4) technical support of the User at the User's request;
5) keeping the Service working and secure;
6) monitoring the User's compliance with subclauses 6) and 7) of clause 7.1 of
the offer.

2.2. Any other purpose requires a separate written instruction from the User.

2.3. Monitoring under subclause 6) of clause 2.1. The Organisation's
catalogue and correspondence are checked automatically for signs of activity
prohibited by subclauses 6) and 7) of clause 7.1 of the offer. The automatic
check only flags the Organisation for review: the decision to block it under
clause 7.3 of the offer is taken by an employee of the Contractor. Information
obtained during monitoring is used only for that decision and to respond to a
lawful request of an authorised body.

3. Categories of data and data subjects

3.1. Data subjects are the User's Customers who contact the User through the
connected channels.

3.2. Data processed:

3.3. The Contractor does not process biometric data, health data, data on
criminal records, or political and religious beliefs. Transcribing a voice
message (clause 3.4) is not biometric processing: what is said is extracted
from the recording, not features of the voice, and no voice identification is
performed.

3.4. Voice messages are accepted and transcribed. The recording is
converted to text in order to understand the request; transcription is
performed by a provider from the list in clause 6.3a or by the automatic
speech recognition service of the cloud infrastructure provider. Only what
is said is extracted from the recording.

The Contractor does not store the audio recording: it is held in memory
while the turn is processed, is not kept after the transcript is obtained, and
never reaches the database or the logs; only the text remains there. The
recording is passed to the provider solely for transcription and is not used
by it for any other purpose.

Voice identification and other biometric processing are not performed under
any circumstances.

3.5. Images are processed for the sole purpose of recognising the subject of
the request: a product, service, label, article number or other feature by
which the Customer can be matched with a catalogue item. Features of a
person's appearance are not extracted from the image, identification by
appearance is not performed, and a description of appearance is not used for
any purpose. The image is not stored: the file is held in memory during
the dialogue turn and is not kept after the reply is formed.

3.6. The User may not use the Service to process special categories and other
sensitive personal data, including biometric data, images of identity
documents, health data and data on criminal records, unless such processing is
expressly provided for by the Service and backed by a lawful basis and
protective measures. The Service is not designed for such processing and does
not recognise a person by appearance or voice.

4. Operations with the data

4.1. The Contractor may perform: collection, accumulation, storage, alteration,
supplementation, use, blocking and destruction.

4.2. Disclosure of personal data by the Contractor is not permitted
(Art. 11(1) of the Law), except transfer to the recipients listed in section 6
and cases expressly provided by law.

5. Place of storage

5.1. The database containing the personal data of the User's Customers is
located in the territory of the Republic of Kazakhstan (Art. 12(2) of the
Law).

5.2. Placing the database outside the territory of the Republic of Kazakhstan
is not permitted. Changing the infrastructure provider or the location of the
database within the territory of the Republic of Kazakhstan is permitted
subject to the requirements of law and notice to the User within a reasonable
time, and for a planned change at least 30 calendar days in advance.

6. Engaged parties and cross-border transfer

6.1. To operate the Service, the Contractor engages the following parties:

6.2. Transfer outside the Republic of Kazakhstan is made on the basis of the
data subject's consent (Art. 16(3)(1) of the Law). Obtaining such consent is
the responsibility of the User as the database owner; the Contractor provides
the technical means and document templates that allow consent to be obtained
and recorded, including recording the edition of the document the data
subject saw.

The Contractor may not process personal data beyond the purposes and scope
provided by this agreement and the data subject's consent.

6.3. Data passed to model providers is used solely to form a reply in the
current dialogue.

6.3a. List of providers of automated processing services. The Contractor
uses one of the following providers:

As of the date of this edition, DeepSeek is used for Organisations working on
the Contractor's key. The Contractor may switch to any other provider from
the list above: such a switch does not widen the range of recipients or the
list of countries stated in the data subject's consent and therefore does not
require new consent; clause 6.5 applies only when going beyond this list.

If an Organisation works on its own key, the User chooses the provider from
the same list and is responsible for reflecting that choice in its documents
for Customers.

6.4. The Contractor notifies the User of a change to the list in clause 6.1 at
least 15 calendar days in advance by publishing a new edition.

6.5. If a change in the list of recipients or in the nature of the cross-border
transfer affects the terms of the data subject's consent, the User must obtain
new consent before the corresponding processing begins. The Contractor
provides the technical means to obtain consent again.

7. Protective measures

7.1. The Contractor applies:

1) encryption of personal data at rest: name, phone number, address, message
content, notes and chat identifiers are stored encrypted;
2) isolation of Organisations' data from each other on every database query;
3) transmission over secure channels (TLS);
4) role-based access for employees;
5) access logs kept without the full text of correspondence;
6) destruction of data once the purpose of processing is achieved.

7.2. Employees of the Contractor may access the personal data of the User's
Customers only to fix a technical fault, at the User's request, or at the
request of an authorised body. Employees who obtain access must keep it
confidential (Art. 11(2) of the Law) under a signed non-disclosure
undertaking.

7.3. Person responsible for organising the processing of personal data on the
Contractor's side (Art. 25(2)(10) of the Law): Alimbekov A. R.,
alimbekov.ardak@gmail.com. General requests are still accepted at
info@wameup.com.

7.4. The User, as the database owner, appoints such a person on its side and
states their contact details in its own policy, if it is a legal entity.

7.5. The Contractor registers and keeps records of the information named in
subclauses 3)–6) of clause 4 of Article 8 of the Law (term of consent,
transfer to third parties, cross-border transfer, disclosure): for each
Customer, the editions of the documents in force at the time consent was
obtained, the time of notice and the time of consent are kept, and the
recipients and territories are set out in section 6 of this agreement.

8. Incident response

8.1. On detecting unauthorised access to, loss of or alteration of personal
data, the Contractor:

1) within one working day of detection notifies the User and provides the
information it needs to perform its obligations under law;
1-1) from the moment a personal data security breach is detected, notifies the
authorised body for personal data protection of a breach in the
Contractor's infrastructure, stating the contact details of the person
named in clause 7.3 (Art. 25(2)(8) of the Law). The User, as the database
owner, notifies the authorised body of breaches on its side;
2) informs the User of the data affected, the range of data subjects, the
known cause and the measures taken;
3) assists the User in notifying the affected Customers.

8.2. The notice to the User is sent to the email address given at
registration.

9. Rights of data subjects

9.1. Requests from the User's Customers to change or delete data or to
withdraw consent are received and handled by the User.

9.2. At the User's request, the Contractor provides an export of a specific
Customer's data or deletes it within 5 working days. Processing stops no later
than 15 working days after receipt of the withdrawal of consent (Art. 8(7) of
the Law).

9.3. Data that the User must keep by law (tax and accounting records) is kept
for the period required by law, with other processing blocked.

9.4. The User keeps up to date the information on the purposes of processing,
the list of personal data, the recipients and the terms of data subjects'
consent. The User may not instruct the Contractor to perform processing not
provided for by the current edition of its policy and/or the data subject's
consent.

10. Retention and return

10.1. Data is kept until the purposes of processing are achieved or until the
data subject withdraws consent.

10.2. On termination of the agreement and deletion of the account, the
Contractor deletes the personal data of the User's Customers that is no longer
needed to perform the agreement or to meet legal requirements: correspondence,
orders, appointments, bookings, uploaded images, derived search indexes,
caches, queues, temporary files and log entries containing personal data.
Backup copies are destroyed within no more than 30 calendar days.

10.3. Before the account is deleted, the User may obtain an export of its
data.

10.4. Data subject to mandatory retention by law or needed to perform an
outstanding obligation is kept to the corresponding extent and used solely for
that purpose; other processing is blocked.

11. Liability

11.1. The Contractor is liable for breach of the protective measures
(section 7) and for processing beyond the instruction (section 2).

11.2. The User is liable for having a lawful basis for processing, for
obtaining its Customers' consent and for the accuracy of the details published
in its documents.

Edición n.º 13 del 2026-10-19