← Back to home

Personal Data Processing Policy

This policy explains what personal data Biznes Idei LLP (brand VBI) receives through the vbi.kz website, why and on what basis we use it, where and for how long we keep it, who we share it with, and how you can exercise your rights.

Version 1.0. Published and in force from 21 October 2026. Approved by order of Biznes Idei LLP dated 21.10.2026. This policy covers every language version of the site: vbi.kz, vbi.kz/kk/, vbi.kz/en/. The Russian and Kazakh versions are equally authoritative; this English version is provided for convenience.

1. Who processes your data

The owner and operator of the database and digital object containing personal data ("we", "the operator"):

By order of the operator, a person responsible for organising the processing of personal data has been appointed. This person monitors compliance with personal data law and handles requests from data subjects. You can reach them at privacy@vbi.kz or by phone at +7 776 999 32 00.

2. Legal basis

We process personal data under the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection” (the “Law”), the Digital Code of the Republic of Kazakhstan, the Rules for the Collection and Processing of Personal Data (Order No. 395/NK of 21 October 2020) and the Rules for Implementing Personal Data Protection Measures (Order No. 179/NK of 12 June 2023).

Our basis for processing is your consent (Articles 7 and 8 of the Law). Without consent, data is processed only in the cases expressly listed in Article 9 of the Law, for example on a lawful request from a state authority. Technical data in server logs and anti-spam records (section 3.3) is processed to the extent needed to protect the site and personal data, which the operator is obliged to ensure (Articles 20–22 of the Law). Matomo visit statistics (section 3.5) are collected without cookies and with an anonymised IP address, only on our server in Kazakhstan; their basis and how to opt out are described in section 3.5.

We collect only the data needed for the stated purposes (Article 7(8) and (9) of the Law) and do not use it for other purposes without fresh consent.

3. What data we process and why

3.1. Requests sent through the website form

• name — required;
• phone number — required;
• e-mail — optional;
• description of your project — optional (please do not include unnecessary information about yourself or other people);
• the language version of the site and the page the request was sent from — added automatically.

Purpose: to contact you about your request, discuss your project, prepare a proposal and, if you decide to work with us, conclude a contract.

3.2. Calls and WhatsApp messages

If you call us or message us on WhatsApp via a link on the site, we receive your phone number, your name (if you give it) and the content of the conversation. The purpose is the same: to reply to you. The site itself stores nothing when you tap the “Call” or “WhatsApp” links.

WhatsApp is a Meta service. Conversations there are processed under WhatsApp’s terms, including on servers outside Kazakhstan. If you prefer to avoid this, call us or use the form on the site.

3.3. Technical data needed to run and protect the site

• IP address, browser and device details (User-Agent), the referring page, and the date and time of the request — recorded in the hosting web server logs;
• when you submit the form — a hash of your IP address (not the address itself) and the time of submission. This record is kept in a service file on the hosting, outside the public part of the site, and is used only to block spam: no more than 5 requests per hour can be sent from one address.

Purpose: to keep the site running and secure and to protect the form from automated submissions. This data is not used to identify you.

3.4. Yandex Metrica and Google Analytics — only with your consent

If you click “Accept” in the cookie banner, Yandex Metrica and Google Analytics 4 are switched on. If you click “Decline” or make no choice, these services are not loaded.

The analytics services receive: cookie identifiers, device and browser type, screen size, approximate location based on IP address, traffic source, pages viewed, clicks, scrolling and time on site. Yandex Metrica’s Session Replay (Webvisor) records actions on the page; what you type into the form fields is not recorded.

We never send your name, phone, e-mail or request text to analytics services. After a successful submission, analytics receives only a “request sent” event with no content.

Purpose: to understand which pages are useful and improve the site.

3.5. Matomo visit statistics — no cookies

We keep overall visit statistics with Matomo, open-source web analytics software that we installed ourselves on the stats.vbi.kz subdomain of our server at ps.kz in Almaty. Only we process Matomo data: it is not shared with third parties and does not leave Kazakhstan.

Matomo is configured to collect as little as possible:

• it uses no cookies or browser local storage to count visits;
• the IP address is anonymised before it is stored: the last two bytes of IPv4 addresses are set to zero, and IPv6 addresses are also stored truncated; the approximate city and country are derived from the anonymised address;
• visits are told apart by a hash that changes every day, so your visits on different days are not linked;
• if your browser sends a “Do Not Track” signal, Matomo does not count you.

Matomo collects: pages viewed, the referring page, approximate city and country, device type, browser and operating system, screen size, time of visit, and a “request sent” marker without any of the request’s content.

Purpose: to measure traffic and see which pages are useful. Raw visit data is deleted automatically after 180 days; aggregated reports, which contain no personal data, are kept.

Basis. This data contains none of the personal data identifiers listed in Article 6 of the Law (full name taken together, IIN, facial image, facial biometric vector), the IP address is anonymised before storage, and the data is processed only by the operator and only in the Republic of Kazakhstan. Its scope is limited to the purpose of statistics (Article 7(8) and (9) of the Law). In our assessment these statistics cannot identify you, so Matomo runs without the cookie banner. If you do not want your visits counted, switch Matomo off for this browser with the switch below — counting stops immediately.

To remember your choice, Matomo stores a service cookie, mtm_consent_removed, in your browser and uses it for nothing else. If you clear cookies or use another browser or device, you need to opt out again.

3.6. Settings stored in your browser

The site keeps only service settings in your browser’s local storage: your language (vbi-lang), paused animation (vbi-motion) and your cookie banner choice (vbi-consent). These entries stay in your browser and are not sent to us.

3.7. What we do not do

• we do not collect IIN (individual identification numbers), copies of identity documents or biometric data;
• we do not make decisions with legal effects for you based solely on automated processing (Article 19-1 of the Law);
• we do not publish your data in publicly available sources;
• we do not sell data or share it for other companies’ marketing.

4. Retention periods

When the period ends, when the purpose is achieved or when you withdraw consent, we destroy or delete the data (Article 18 of the Law) unless the law requires us to keep it longer.

5. Where data is stored

The site and the form handler are hosted on servers of Internet Company PS LLP (ps.kz) in Almaty, Republic of Kazakhstan. Requests are delivered to the corporate mailbox info@vbi.kz on the same provider’s server in Almaty. Only a notice of a new request with no personal data — the site language and the time it arrived — is sent to a staff work mailbox. Matomo statistics are collected and stored on the stats.vbi.kz subdomain of the same server in Almaty, which we run ourselves.

This is how we comply with Article 12(2) of the Law, which requires personal data to be stored in a database and digital object located in the Republic of Kazakhstan.

6. Who we share data with

Web analytics data goes to Yandex and Google only after you click “Accept” in the cookie banner. Matomo data is not shared with anyone: the software runs on our server, and the hosting provider only keeps that server running. We do not share data with anyone else.

7. Cross-border transfer

A cross-border transfer is a transfer of personal data to the territory of a foreign state (Article 16 of the Law). It happens in two cases:

• Yandex Metrica and Google Analytics: visit data is transferred to the Russian Federation (Yandex) and the USA (Google) — only with your consent, given by clicking “Accept” in the cookie banner (Article 16(3)(1) of the Law);
• WhatsApp: if you choose this channel yourself.

The level of personal data protection in these countries may differ, and our ability to control processing by foreign services is limited by their terms. To avoid cross-border transfer, click “Decline” in the banner and contact us by phone or through the form.

Matomo statistics involve no cross-border transfer: they are collected and stored only on our server in the Republic of Kazakhstan.

Data you send through the form is not transferred abroad: it is stored and processed only in the Republic of Kazakhstan (section 5).

8. Cookies and similar technologies

Cookies are small files that a website or a service connected to it saves in your browser.

Yandex Metrica and Google Analytics cookies are set only after you click “Accept”. Matomo sets no cookies to count visits and runs without the banner; you can switch it off in section 3.5. You can change your mind at any time via the “Cookie settings” link at the bottom of the page. You can also delete cookies and block them in your browser settings.

9. Your rights and our response times

Under Article 24 of the Law and Article 41 of the Digital Code, you have the right to:

• know whether we hold your personal data and receive information about the purpose, sources and methods of collection and processing, the list of data, and the processing and retention periods;
• request that your data be changed or supplemented where you have supporting grounds;
• request blocking and/or anonymisation of your data if there is information that the conditions of its collection or processing were breached;
• request destruction or deletion of data collected or processed in breach of the law and in other cases established by law; request deletion, anonymisation or restriction of processing, subject to the exceptions in Article 41(4) of the Digital Code;
• withdraw consent to collection, processing, transfer to third parties and cross-border transfer;
• access your data free of charge;
• protect your rights, including claiming compensation for moral and material harm.

How to contact us: e-mail privacy@vbi.kz, write to Biznes Idei LLP, 115 Abay Avenue, Almaty, or call +7 776 999 32 00. Tell us how to address you and describe your request. To avoid disclosing data to someone else, we may ask you to confirm that the request comes from you, for example by replying from the same phone number or e-mail you used in your request. We reply in Kazakh or in the language of your request.

If you believe your rights have been violated, you may contact the authorised personal data protection body — the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan (Information Security Committee; 55/5 Mangilik El Avenue, Astana) — the local executive body of Almaty, or a court.

10. How to withdraw consent

• Consent to processing of your request data — e-mail privacy@vbi.kz, call us or send a letter. Within 15 working days we will stop processing and delete the data, or tell you the reasoned grounds on which we must keep it (for example a legal requirement or an unfulfilled contractual obligation — Article 8(2) of the Law).
• Consent to analytics cookies — click “Cookie settings” at the bottom of the page and choose “Decline”. The counters stop loading immediately; statistics already collected are kept by Yandex and Google as described in section 4.
• Matomo statistics — switch them off with the switch in section 3.5 of this page; Matomo also does not count browsers that send “Do Not Track”.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

11. How we protect your data

We take legal, organisational and technical measures under Articles 20–23 of the Law and the Rules for Implementing Personal Data Protection Measures:

• all pages and the form work only over HTTPS;
• the site and request data are stored on servers in the Republic of Kazakhstan;
• only employees on the approved list of persons with access to personal data can access the requests mailbox and the hosting control panel; sign-in is protected by personal passwords;
• the form is protected against spam and brute force; IP addresses are kept in the service file only as hashes and for no longer than 1 hour;
• visit statistics are kept by our own Matomo installation on our server in Kazakhstan — without cookies and with an anonymised IP address;
• Webvisor does not record what is typed into form fields, and request data is not sent to analytics services;
• the site is hosted by a provider in the Republic of Kazakhstan that maintains and updates the server software;
• employees with access to personal data are bound to keep it confidential.

12. If a data breach occurs

If we discover a personal data security breach, we notify the authorised body within one working day, giving the contact details of the person responsible for organising personal data processing and the measures taken (Article 25(2)(8) of the Law). Affected data subjects are notified, based on information from the authorised body, by the operator of the “digital government” — in their personal account on the digital government web portal, its mobile app or by text message. We will also try to inform you directly.

13. Children

The site is intended for business representatives and is not aimed at persons under 18. If you are under 18, do not submit the form yourself — ask a parent or other legal representative to do so. If we learn that we have received a minor’s data without the consent of their legal representative, we will delete it.

14. Changes to this policy

We publish each new version on this page with its date. If the purposes of processing, the data, the recipients change, or a new cross-border transfer appears, we will ask for your consent again where the law requires it.

15. Contact details

Biznes Idei LLP, BIN 220940037105, 115 Abay Avenue, Almaly District, Almaty, Republic of Kazakhstan. Phone: +7 776 999 32 00. E-mail for personal data matters: privacy@vbi.kz.

Appendix 1. Consent to personal data processing

By ticking the consent box and submitting the request form on vbi.kz, I freely, of my own will and in my own interest, consent to the collection and processing of my personal data on the following terms.

1. Owner and operator: Limited Liability Partnership “BIZNES IDEI”, BIN 220940037105, 115 Abay Avenue, Almaly District, Almaty, Republic of Kazakhstan.
2. Data subject: the person who entered their surname and/or first name in the “Name” field of the request form.
3. Data collected: surname and/or first name, phone number, e-mail (if provided), request text, language version and page of the site, date and time of submission, IP address in hashed form (kept for no more than 1 hour).
4. Purposes: replying to the request, discussing the project, preparing a proposal and concluding a contract; protecting the form from spam.
5. Actions with the data: collection, accumulation, storage, modification, supplementation, use, blocking, depersonalisation, anonymisation, destruction and deletion.
6. Transfer to third parties: only to Internet Company PS LLP (ps.kz, Republic of Kazakhstan), which hosts the site and mail, and to state authorities in cases provided by law. Data is not transferred to anyone else.
7. Cross-border transfer: none — the data is stored and processed in the Republic of Kazakhstan.
8. Publication in publicly available sources: none.
9. Term of consent: until the purposes of processing are achieved, but no longer than 12 months from the last contact; if a contract is concluded — for its term and the retention periods required by Kazakh law; or until consent is withdrawn.
10. Withdrawal: by e-mail to privacy@vbi.kz, by phone +7 776 999 32 00 or by letter to the operator’s address. The operator stops processing within 15 working days or sends a reasoned refusal (Article 8(7) of the Law).
11. Proof of consent: the operator keeps the date and time of the form submission and the version of this text.

Consent text version: 1.0 of 21.10.2026.

Appendix 2. List of personal data

The list of personal data necessary and sufficient for the operator’s tasks follows the form set by the Rules for Determining the List of Personal Data by the Owner and/or Operator (Order No. 199/NK of 21 June 2023) and is approved by order of Biznes Idei LLP dated 21.10.2026.