1. General Provisions
1.1. This Policy on the Collection, Processing and Protection of Personal Data (the “Policy”) sets out the terms and procedure for the collection, accumulation, storage, use, transfer and destruction of personal data by Volmax Group LLP (the “Company” or the “Operator”) with respect to users of the GeoStatus service, including the website https://geostatus.net and the GeoStatus mobile applications for Android and iOS (collectively, the “Service”).
1.2. This Policy has been developed in strict compliance with Law of the Republic of Kazakhstan No. 94-V dated May 21, 2013 “On Personal Data and Its Protection” (the “Law”), the Law of the Republic of Kazakhstan “On Informatization” and other regulatory legal acts of the Republic of Kazakhstan in the field of information security.
1.3. This Policy applies to all information relating to an identified or identifiable individual (personal data subject) that the Company may obtain while such individual uses the Service.
2. Localization of Databases in the Republic of Kazakhstan
2.1. In strict compliance with Clause 2 of Article 12 of the Law, the Company collects, accumulates and primarily stores Users’ personal data in electronic databases whose server equipment is physically located in the territory of the Republic of Kazakhstan.
3. Distinction of Roles: Owner and Operator (B2B Model)
3.1. The Company acts as the Owner and Operator of the personal data of individuals who register on the Website on their own, submit consultation requests or send inquiries through the Service’s online forms.
3.2. Where the Service is used for corporate purposes by legal entities or individual entrepreneurs (the “Clients”) for time tracking and monitoring of field personnel:
- The Client (employer) acts as the Owner of the personal data database of its employees and bears full responsibility for the lawfulness of data collection, for determining the set of additional fields it configures in electronic forms, and for obtaining the employees’ prior lawful consent to the transfer of their data, geolocation and photo reports to the Service in accordance with labor legislation and Article 8 of the Law;
- The Company acts as the Operator, processing employees’ personal data solely on behalf of the Client for the purpose of providing the Service’s functionality.
4. Personal Data Processed
4.1. In the course of using the Service, the following categories of data are processed:
- Identification and contact data: last name, first name, patronymic (if any), contact phone number, email address, name of the employing organization, job title;
- Geolocation and telematics data: precise geographic coordinates of the mobile device (GPS/GLONASS/LBS), movement history, speed, geofence and site visit records, and detection of the use of fake coordinates (Fake GPS). Geolocation data is collected only during the active work shift of the employee in the Mobile Application;
- Technical and session metadata: IP address, device type and model, operating system, application version, session dates and times, cookies and web analytics data;
- Work content and reports: photo and video reports (“Before/After”), text comments, electronic certificates of completed work created by employees during field assignments;
- Custom and configurable fields in electronic forms: The Client may configure and add additional fields to the Service’s electronic forms, questionnaires, checklists and work assignments on its own. The composition, scope and categories of data collected through such configurable forms are determined by the Client independently and under its full responsibility as the Database Owner.
5. Purposes of Collecting and Processing Personal Data
5.1. Personal data is processed solely for specific, predetermined purposes:
- Registration and authentication of User and Client accounts in the Service;
- Provision of the Service’s core functionality: coordination of field teams, automated time tracking, work order dispatching and heavy equipment monitoring;
- Performance of service agreements and license agreements between the Company and Clients;
- Notifying Users of task statuses, system updates and critical security events (via SMS, email and push notifications);
- Ensuring the information security of the Service, detecting anti-fraud incidents and preventing unauthorized access;
- Fulfillment of obligations imposed on the Company by the legislation of the Republic of Kazakhstan.
6.1. In accordance with Article 8 of the Law, personal data is collected and processed with the prior consent of the personal data subject.
6.2. Pursuant to Subclause 4 of Clause 1 of Article 8 of the Law, the subject’s consent is deemed duly given in electronic form with the use of protective measures:
- by ticking an electronic checkbox in web forms on the Website when registering or submitting data;
- by granting the mobile device operating system permissions when installing and launching the Mobile Application (including access to background geolocation and the camera).
7. Transfer of Data to Third Parties and Cross-Border Transfer
7.1. The Company does not sell or transfer personal data to third parties for commercial purposes.
7.2. Data may be transferred strictly in the following cases:
- Engagement of authorized partners (sub-operators): data center hosting providers in the Republic of Kazakhstan and SMS gateway operators for sending service codes, provided that they assume legal obligations to protect data and keep it confidential;
- Provision of data in response to reasoned lawful requests from courts, law enforcement and authorized bodies of the Republic of Kazakhstan in the manner prescribed by law;
- Technical delivery of push notifications through operating system service platforms (Google Firebase Cloud Messaging, Apple APNs), which is deemed a cross-border transfer of technical device identifiers to secure communication nodes, to which the User consents.
8. Retention Periods, Data Retention Rules and Destruction
8.1. The retention period for personal data is determined by the date on which the purposes of its collection and processing are achieved, unless other periods are provided for by the legislation of the Republic of Kazakhstan or by contract.
8.2. In accordance with the Service’s rules, the following periods apply:
- Operational telematics data (GPS track history, raw coordinates, shift photo and video reports) is retained for the paid subscription period and for 1 (one) calendar month after termination of service to allow the Client to export the data, after which it is permanently deleted from the servers;
- Account data and financial documents are retained for the periods established by the tax and archival legislation of the Republic of Kazakhstan (up to 5 years).
8.3. Upon receipt of a lawful withdrawal of consent, personal data shall be destroyed within a period not exceeding 10 (ten) business days in accordance with Subclause 5 of Clause 1 of Article 24 of the Law.
9. Rights of the User as a Personal Data Subject
9.1. In accordance with Article 24 of the Law, the User has the right to:
- Know whether the Company holds their personal data and receive information on the terms of its processing;
- Require the Company to clarify, amend or supplement their personal data where there are supporting grounds;
- Require the blocking or destruction of data if it is found to have been collected unlawfully or if further processing is no longer necessary;
- Withdraw consent to the collection and processing of data by sending a written request by email to: info@geostatus.net;
- Protect their lawful rights and interests before the authorized personal data protection body (the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan) or in court.
10. Security and Data Breach Notification Procedure
10.1. The Company takes a set of necessary legal, organizational and technical measures to protect personal information in accordance with Article 22 of the Law and the Unified Requirements in the Field of ICT and Information Security of the Republic of Kazakhstan.
10.2. In the event of a security incident resulting in unauthorized access to or leakage of personal data, the Company undertakes to notify the authorized body (the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan) and the affected subjects within 1 (one) business day from the date the incident is discovered in accordance with Article 22-1 of the Law.
11. Amendments to the Policy and Governing Law
11.1. The Company may unilaterally amend this Policy. The new version takes effect upon its publication on the Website with the date of revision indicated.
11.2. This Policy and all relations between the User and the Company are governed by the substantive and procedural law of the Republic of Kazakhstan.