Esta es la edición vigente, publicada en el servicio en api.wameup.com/legal/privacy: el mismo texto que el usuario acepta al registrarse. El documento no tiene traducción al español; se muestra la traducción al inglés con fines informativos. Si difiere del texto en ruso, prevalece el texto en ruso.
WameUp Privacy Policy
About this translation. This is an English translation of the document
above, provided for information. If the Russian and English texts differ,
the Russian text above prevails.
The number and date of the current edition are shown at the bottom of the
publication page. This document covers the personal data of Service users:
owners and employees of organisations. Processing of the data of these
organisations' customers is governed by Annex No. 1 to the offer; section 10
summarises it for customers' information.
1. Who processes the data
The owner of the database containing the personal data of Service users is:
Individual Entrepreneur WameUp
BIN/IIN: 861113402404
Address: Republic of Kazakhstan, Almaty, Seifullin str. 416/3, office 59
Phone: +7 705 357 8555
Email: info@wameup.com
This document is the data subject's consent within the meaning of Article 8 of
the Law of the Republic of Kazakhstan "On Personal Data and Their Protection"
No. 94-V. Registering an account and ticking "I have read and accept the terms"
means consent to the processing of personal data on the terms of this
document.
2. What data is collected
- first and last name;
- email address;
- phone number;
- name, BIN and address of the organisation, bank details;
- information about plan payments;
- technical sign-in data: IP address, time and result of the sign-in attempt.
3. Purposes of processing
- creating and maintaining the account, signing in to the panel;
- providing access to the Service on the terms of the plan;
- invoicing and accepting payment;
- sending notices about the operation of the Service and changes to documents;
- protecting the account from unauthorised access;
- performing obligations required by law.
The data is not used for marketing mailings without a separate consent given
explicitly and separately from this document.
4. Term of consent
The consent is valid for the period of use of the Service and for five years
after the account is deleted, for the information that the Contractor must keep
under tax and accounting law. Other data is deleted when the account is
deleted. The consent may be withdrawn at any time.
The Contractor deletes the account and the Organisation in the cases set out in
clause 4.9 of the offer: for non-payment — 14 calendar days after the creation
of an Organisation that has never been paid for, or 3 months after a paid
Organisation's Unit ran out — with notice 3 days before deletion, and, if the
email address has not been confirmed, 72 hours after registration without
notice. Deletion is also carried out at the User's request and on grounds
expressly provided by law.
After an account is deleted, the Contractor keeps an irreversible fingerprint
of the email address (a cryptographic hash) so as not to credit welcome Unit
again (clause 4.5 of the offer). The address cannot be recovered from the
fingerprint, and it is used for no other purpose.
5. Who receives the data
- the hosting provider in the territory of the Republic of Kazakhstan;
- the payment service provider, to the extent needed for payment;
- the email delivery provider: the address and the text of the notice;
- authorised state bodies, on grounds provided by law.
User data is not disclosed in publicly available sources.
6. Transfer outside the Republic of Kazakhstan
The database with users' personal data is located in the territory of the
Republic of Kazakhstan. The Service's program code runs on a provider's
computing infrastructure located outside the Republic of Kazakhstan: data
passes through it in transit, to the extent of the current request and without
being stored. Certain service functions, namely email delivery and payment
processing, may be performed by providers located outside the Republic of
Kazakhstan. By accepting this document, the user agrees to such transfer to
the extent of section 5 (Art. 16(3)(1) of the Law).
7. User rights
The user has the right to:
- know what data about them is processed, for what purpose and how;
- demand that it be changed, blocked or deleted;
- object to automated processing of their personal data and receive a
- substantive reply within three working days;
- withdraw this consent.
Requests are sent to info@wameup.com. The procedure for requesting deletion is
also summarised at wameup.com/data-deletion; if they differ, this document
prevails. Processing stops within fifteen working days of receipt of the
withdrawal, except where the law requires the data to be kept longer.
Withdrawing consent makes further use of the Service impossible.
Separately from withdrawal, a one working day term applies: within one
working day, data is changed or supplemented on the basis of supporting
documents, or destroyed if it cannot be changed; blocked on receipt of
information that the conditions of its collection and processing were
violated; destroyed when such a violation is confirmed; and unblocked if the
violation is not confirmed.
Person responsible for organising the processing of personal data:
Alimbekov A. R., alimbekov.ardak@gmail.com.
8. Protection
Passwords are stored as an irreversible salted hash. Email addresses and access
keys are stored encrypted. Employee access is role-based and granted on a
need-to-know basis; employees are bound by a non-disclosure obligation.
Person responsible for personal data protection: Individual Entrepreneur
WameUp, info@wameup.com.
9. Incident notification
If unauthorised access to users' personal data is detected, the authorised
body and the affected users are notified within one working day of detection.
10. Data of organisations' customers
Organisations connect their own channels to the Service: WhatsApp Business (the
Meta platform), Telegram, the storefront and the web widget. The Contractor
processes the data of customers who contact these channels on behalf of the
organisation (Annex No. 1 to the offer): the organisation owns the database
and the Contractor acts as its operator. This section is provided for
information and is not the customer's consent: the organisation obtains the
customer's consent under its own policy: the customer receives a link to it and
gives permission to process the data at the first order, appointment or booking
and at the first request to speak to the organisation's staff.
What data: name, phone number and chat identifier in the messenger, including
those received from Meta via the WhatsApp Business Platform; message text,
transcripts of voice messages and images sent by the customer (the audio
recordings and images themselves are not stored); order, appointment or
booking details (section 3 of Annex No. 1).
Purposes: replying to the customer on behalf of the organisation, placing an
order, appointment or booking, sending notifications about them, and keeping
the Service working and secure (section 2 of Annex No. 1). The Contractor does
not use this data for its own purposes, including advertising (clause 1.2 of
Annex No. 1).
Recipients: the channel operator (Meta Platforms Ireland Ltd., Telegram
Messenger) and the providers listed in section 6 of Annex No. 1, including
outside the Republic of Kazakhstan.
Retention: the data is kept until the purposes of processing are achieved or
until consent is withdrawn. When the organisation's account is deleted, the
data is deleted, and backup copies within no more than 30 calendar days
(section 10 of Annex No. 1).
How to delete. The customer sends a request to the organisation they were
messaging, or to the Contractor at info@wameup.com, stating their phone number
or messenger username and the name of the organisation. A request received by
the Contractor is passed to the organisation within one working day; on its
instruction the data is deleted within five working days (clause 9.2 of Annex
No. 1). Processing stops no later than fifteen working days after receipt of
the withdrawal of consent (Art. 8(7) of the Law). Only data that must be kept
by law or to perform an outstanding obligation is retained, with all other
processing blocked (clauses 9.3 and 10.4 of Annex No. 1).