1. General provisions
This Privacy and Personal Data Processing Policy (the “Policy”) applies to synterra.kz, its language versions, contact forms, equipment cart, communications with visitors, and other SYNTERRA PLATFORM digital channels that link to this Policy.
The Policy has been prepared with regard to the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 “On Personal Data and Their Protection,” other applicable laws of Kazakhstan, and the technologies actually used on the website.
You may use the website without providing optional data. Google Analytics loads only after you provide separate consent. Refusing analytics does not restrict access to the website’s essential functions.
2. Personal data operator
The owner and/or operator of personal data within the scope described in this Policy is:
3. Scope and allocation of roles
For data relating to website visitors, applicants, representatives of prospective customers, and people who contact SYNTERRA PLATFORM directly, Richman Group LLP determines the purposes and means of processing and acts as the owner and/or operator.
Where a customer uses a SYNTERRA PLATFORM product to process data concerning its employees, customers, counterparties, or other individuals, that customer will normally determine the purposes and content of processing, while Richman Group LLP processes data on the customer’s behalf under the contract, product settings, and documented instructions. A contract, data-processing agreement, or product-specific rules may further govern such processing.
This Policy does not replace specific contractual provisions that regulate a particular processing activity in greater detail. Mandatory law and agreed specific terms prevail in the event of conflict.
4. Categories and sources of data
Depending on how you interact with us, we may process:
- identity and contact information: first and last name, job title, organisation, city, telephone number, email address, and preferred contact channel;
- enquiry information: request content, selected products or equipment, comments, correspondence history, and the date and outcome of communications;
- contractual information: customer and representative details, documents and information required to enter into and perform a contract, invoice, and comply with record-keeping requirements;
- technical information: IP address, browser type and version, device and operating system, visited URL, referrer, date and time of a request, and server security or diagnostic logs;
- local-storage information: cookie choice, equipment-cart contents, language selection, and other browser settings stored on the device;
- analytics information: page-view and interaction events collected by Google Analytics only after consent;
- other information: details you voluntarily include in a communication or provide for contract performance.
Sources include the individual or their representative, an employer or counterparty in the context of a business relationship, the user’s browser and device, server logs, and—after consent—the analytics provider.
We do not ask users to send special-category data, biometric or health information, political or religious views, or identity-document copies through public forms unless required by law or a separate protected process.
5. Purposes and legal grounds
We process data only for specific, predetermined, and lawful purposes, including:
- responding to requests, providing consultations or product demonstrations, and preparing commercial offers;
- operating the equipment cart and processing orders;
- entering into, performing, amending, and terminating contracts;
- providing licences, technical support, updates, and service notifications;
- maintaining website security, preventing abuse, diagnosing errors, and protecting legal rights;
- maintaining accounting, tax, and other mandatory records;
- improving website structure and content using aggregated analytics—only with consent;
- complying with lawful government requests and statutory obligations.
The legal grounds are the individual’s consent, taking steps at the individual’s request and performing a contract, compliance with legal obligations, and other grounds expressly permitted by the laws of Kazakhstan. Where separate consent is required, processing does not begin until that consent has been obtained.
6. Processing operations
Processing may include collection, receipt, recording, organisation, accumulation, storage, correction, alteration, supplementation, use, transfer to authorised recipients, depersonalisation, blocking, deletion, and destruction. Processing may be automated or non-automated.
We do not make decisions producing legal effects for website visitors solely through automated analytics, and we do not sell personal data.
8. Recipients and service providers
Access is limited to what is necessary for the relevant purpose and may be provided to:
- authorised Richman Group LLP personnel and contractors bound by confidentiality;
- hosting, communications, support, backup, and infrastructure providers on a limited contractual basis;
- Google, solely for analytics after the user’s consent;
- banks, payment, accounting, and professional advisers where required for a transaction or by law;
- government authorities and other persons where disclosure is legally mandatory or necessary to protect lawful rights.
When you follow links to WhatsApp, Telegram, Instagram, map services, or other external platforms, you initiate contact with the relevant provider, which processes data under its own policies.
9. Storage location and cross-border transfers
Primary databases and SYNTERRA PLATFORM product customer data are located in Kazakhstan to the extent required by the contract and applicable law. The architecture of a particular enterprise product may be defined in a separate customer agreement.
External providers including Google Analytics, WhatsApp, Telegram, and Instagram may process information outside Kazakhstan. Analytics data is sent to Google only after express consent. Cross-border transfers are made where there is an applicable legal basis and in accordance with Article 16 of the Kazakhstan Law “On Personal Data and Their Protection.”
10. Retention, deletion, and depersonalisation
We retain data only for as long as necessary for the stated purposes, unless a longer period is required by law, contract, dispute resolution, or the protection of legal rights. As a general rule:
- prospective-customer enquiries and related correspondence: up to 3 years after the last substantive contact;
- equipment-order information: up to 3 years after completion, closure, or the end of communications;
- contract, accounting, and tax records: for periods required by Kazakhstan law;
- support requests: up to 3 years after closure unless the contract provides otherwise;
- security and diagnostic logs: normally up to 12 months, or until an incident investigation and applicable claim periods have ended;
- analytics data and cookies: within the Google Analytics property settings, user consent, and Google’s applicable periods.
When the purpose has been achieved, data is deleted, destroyed, or depersonalised unless continued retention is legally required. Backups are removed through scheduled rotation and are isolated from ordinary use until deletion.
11. Personal data security
We apply proportionate legal, organisational, and technical safeguards, including access controls, least-privilege principles, activity logging, backups, protected transmission channels, software updates, vulnerability management, contractual confidentiality obligations, and incident-response procedures.
No transmission or storage method is absolutely secure. If an incident occurs, we take measures to contain its effects, restore protection, and comply with applicable legal duties.
12. Rights of the personal data subject
Subject to the conditions and limits established by Kazakhstan law, you may:
- obtain confirmation of processing and information about its purposes, sources, methods, categories, and retention periods;
- request correction or supplementation of inaccurate data where supported by appropriate grounds;
- request blocking and/or depersonalisation where processing conditions have been violated;
- request deletion or destruction of data processed unlawfully and in other cases established by law;
- withdraw consent where withdrawal does not conflict with law or prevent the performance of an outstanding obligation;
- seek protection from the competent authority or a court and claim compensation where lawful grounds exist.
To exercise your rights, email sales@synterra.kz with the subject “Personal data,” or write to the operator’s registered address. Include your name, reply contact, request details, and information sufficient to locate the relevant data. We may request reasonable proof of identity and representative authority to avoid disclosing data to an unauthorised person.
Requests are handled within the procedure and periods required by law. If a request cannot be fulfilled in full, we will explain the applicable restriction unless doing so is prohibited by law.
13. Children’s data
The SYNTERRA PLATFORM website and products are primarily intended for businesses and adult representatives of organisations. We do not knowingly collect children’s data through the website. A legal representative who believes a child submitted data without valid consent should contact us so that we can review and, where appropriate, delete it.
14. Changes to this Policy
We may update the Policy when laws, services, or processing practices change. The current version is published on this page with its effective date. Material changes affecting processing purposes or user rights will be communicated by reasonably available means; where renewed consent is required, the relevant processing will not start until consent is obtained.
The Russian version is the primary version for consistent legal interpretation. Kazakh and English translations are provided for convenience; this does not limit the status of the state language or any rights under Kazakhstan law.
15. Contacts and requests
The official law is available through the Adilet legal information system: Law of the Republic of Kazakhstan “On Personal Data and Their Protection”.