Legal Information

GENERAL PERSONAL DATA PROCESSING POLICY

Version v.1.0 dated 15.09.2025

1. General Provisions

1.1.

This Personal Data Processing Policy (hereinafter – the Policy) defines the principles, purposes, scope of operations, and conditions for the processing of personal data by Pwron LLP (BIN 241040012133) (hereinafter – the Company).

1.2. Scope of Application (what the Policy regulates):

The Policy applies to all instances of personal data processing carried out by the Company, including when processing is performed:

1.2.1. during interaction with employees of clients and partners in the context of concluding and/or executing civil law contracts between the Company and the respective legal entity;

1.2.2. when concluding and executing civil law contracts directly with natural persons (work contracts, paid services, other transactions);

1.2.3. when conducting events by the Company (conferences, seminars, webinars, other public activities – offline and online), including registration, attendance tracking, communications, and post-event analytics;

1.2.4. when promoting the Company's products, works, and services in the market (marketing communications, targeting/retargeting, performance analytics);

1.2.5. when considering applications, appeals, and letters from natural persons (including complaints, claims, data subject requests) through all communication channels;

1.2.6. when using the gro.now Platform (hereinafter – the Platform): Website, Personal Account, bots/messengers, forms, API, and other interfaces;

1.2.7. when fulfilling the Company's legal obligations (accounting, taxes, reporting, compliance, responding to requests from authorized bodies);

1.2.8. when ensuring security, anti-fraud measures, and service quality, as well as for internal reporting and analytics (including on anonymized/aggregated data).

2. Terms and Roles (Who is Who and What is What)

1.3. What the Policy does not regulate (exclusions):

  • the processing of personal data of respondents (participants in surveys/research/activities) – a special document, the 'Policy on the Processing of Personal Data of Respondents,' applies;
  • the processing of personal data of employees (Company staff) and candidates – the Company's personnel/HR policies and local acts apply;
  • the processing of Cookie files – a special document, the 'Cookie Policy,' published on the Website, applies;
  • the processing of personal data on behalf of the Company's partners (see Section 11 for details) – a special Data Processing Agreement (DPA) applies, or in its absence, the Standard DPA published on the Website.

Definitions

  • 2.1. Company – Pwron LLP (BIN 241040012133), which is the owner and administrator of the Platform, as well as the personal data operator within the meaning of the legislation of the Republic of Kazakhstan.
  • 2.2. Platform — a set of websites, mobile applications, chatbots, API interfaces, electronic forms, software modules, and other digital services administered by the Company under the gro.now brand or other related brands, which provide for the collection, storage, use, and other operations with personal data, user interaction, registration, participation in surveys, events, and programs, as well as the provision of the Company's services.
  • 2.3. Website - the Company's main internet resource, located at https://gro.now/, as well as other domains/subdomains that provide access to the Platform's services.
  • 2.4. User – any natural person using the Platform, including visitors to the Website, registered and unregistered users, clients, partners, representatives of legal entities, as well as other persons interacting with the Company through the Platform's interfaces or by other means (including offline).
  • 2.5. Personal Account - a personalized section of the Platform that provides the User with access to the Company's functionality, including registration, management of their data and consents, receiving notifications, participating in events, and interacting with the Company's services.
  • 2.6. Account - a set of registration data and settings of the User that ensures their identification and authorization in the Company's system.
  • 2.7. External Account – a User's account with a third-party authentication provider (e.g., Google), through which access to the Platform is granted (SSO) without separate registration.
  • 2.8. Platform Interfaces – visual and technical means of User interaction with the Platform, including web pages, mobile applications, widgets, electronic forms, banners, chatbots, e-mail communications, and other digital channels.
  • 2.9. Company Services (Services) — functional capabilities of the Platform that enable the implementation of the Company's and the User's tasks, including conducting surveys, registering for and participating in events, providing rewards, sending notifications, processing applications, conducting marketing campaigns, and other services provided by the Company using the Platform.
  • 2.10. Event – a conference, seminar, webinar, presentation, promotional or other public event (online or offline), organized by the Company independently or jointly with partners, for the purposes of promotion, communication, training, or research.
  • 2.11. Respondent – a natural person participating in surveys, interviews, tests, analytical studies, or other activities of the Company. The processing of respondents' personal data is regulated by a separate Policy on the Processing of Personal Data of Respondents.
  • 2.12. Marketing Communications – actions by the Company aimed at informing Users about products, services, events, discounts, offers, or promotions of the Company, including mailings via email, SMS, messengers, push notifications, and other forms of communication, carried out on the basis of the User's consent or other legal grounds.
  • 2.13. Inquiry (Data Subject Request) — a written or electronic application from a natural person sent to the Company regarding the processing of their personal data, including a request for access, rectification, erasure, restriction of processing, withdrawal of consent, or filing a complaint.
  • 2.14. Feedback Form – an electronic form on the Website or in the Platform's interfaces used by Users to send inquiries, feedback, complaints, or applications, as well as to exercise their rights as a data subject.
  • 2.15. Personal Data (PD) — any information relating to a directly or indirectly identified natural person (data subject), including information identifying their personality, contact details, data on the use of the Platform, participation in events, and other information relating to the User.
  • 2.16. Processing of Personal Data – any action (operation) or set of actions (operations) performed with or without the use of automated means, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), use, transfer (provision, distribution, access), anonymization, blocking, erasure, and destruction of personal data.
  • 2.17. Personal Data Operator (Operator) — the Company, which independently or jointly with other persons organizes and (or) carries out the processing of personal data, as well as determines the purposes of processing, the composition of data, and the actions (operations) performed with them.
  • 2.18. Processor – a natural or legal person who processes personal data on behalf of the Company on the basis of a contract or other legal grounds, ensuring the confidentiality and security of such data.
  • 2.19. Cookie files (Cookies) – small text files saved on the User's device when visiting the Website, used for the functioning of the Platform, analyzing its use, personalizing content, and marketing communications. Detailed rules for the use of cookies are described in a separate Cookie Policy.
  • 2.20. Personal Data Security – the state of protection of personal data in which their confidentiality, integrity, availability, and accountability of processing are ensured using necessary organizational and technical measures.
  • 2.21. Calendar Integration – a service of a third-party meeting scheduling provider (e.g., Calendly), through which a User/client schedules a consultation with the Company; information about the time slot and contact details are synchronized with the Platform.

3. Principles and Purposes of Personal Data Processing

3.1. Main Principles of Processing.

  • 3.1.1. Lawfulness and Fairness – processing is carried out on legal grounds and within the stated purposes;
  • 3.1.2. Purpose Limitation – the collection and use of personal data are limited to achieving specific, predetermined, and legitimate purposes;
  • 3.1.3. Minimization – only data that is necessary for the specified purposes is processed;
  • 3.1.4. Accuracy and Relevance — personal data is maintained in an accurate and up-to-date state, and is rectified upon the data subject's request if necessary;
  • 3.1.5. Storage Limitation – data is stored for no longer than is required for the purposes of processing or to comply with legal requirements;
  • 3.1.6. Confidentiality and Security – the Company ensures the protection of personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions;
  • 3.1.7. Accountability of Processing – the Company ensures the ability to documentarily confirm the fact of obtaining consent, data sources, legal bases, periods, and results of processing.

3.2. Purposes of Personal Data Processing.

The Company processes personal data for the following purposes:

1) Conclusion and Execution of Contracts

  • conclusion, amendment, and termination of civil law contracts with natural persons, individual entrepreneurs, as well as with legal entities whose representatives and employees interact with the Company;
  • conducting negotiations, exchanging documents, issuing invoices, acts, and other related operations;
  • fulfillment of obligations regarding payment, taxation, reporting, and accounting;
  • sending notifications and other information related to the execution of contracts;
  • To simplify registration/login, the Company may use authentication through an external account (Google SSO); the identifiers and basic profile data received from the provider are used exclusively for creating/linking an Account and ensuring access security.


2) Interaction with Employees of Clients and Partners

  • conducting business correspondence, agreeing on cooperation terms, organizing meetings and communications;
  • providing access to the Platform's services, exchanging documents and files, managing access rights;
  • ensuring the identification and control of the actions of authorized representatives.


3) Conducting Events (online and offline)

  • registering participants, creating lists, and issuing passes;
  • informing about the program, sending organizational notifications and materials;
  • photo and video recording (with consent or if the event has public status);
  • subsequent distribution of summaries, analytics, and invitations to future events;
  • ensuring security, tracking attendance, and enforcing participation rules.


4) Promotion of Products, Works, and Services

  • informing Users and partners about new services, promotions, offers, updates, and events of the Company;
  • personalizing content and improving interaction with the Platform;
  • conducting analytics and evaluating the effectiveness of communications (on anonymized data or with consent);
  • sending advertising and marketing messages within the limits established by law and the User's consents.


5) Consideration of Inquiries, Applications, and Requests

  • registering, recording, and processing written and electronic inquiries from natural persons;
  • providing responses, decisions, and clarifications;
  • exercising the rights of data subjects (access, rectification, erasure, restriction of processing, withdrawal of consent);
  • For scheduling consultations, the Company uses calendar integrations (e.g., Calendly) to book a time slot, send reminders, and conduct communications regarding the meeting.


6) Fulfillment of Obligations Established by Law

  • providing information to authorized bodies in cases provided for by law;
  • maintaining accounting, tax, statistical, and management records;
  • storing documents for the periods established by law.


7) Ensuring Security and Preventing Abuse

  • monitoring technical events, logging system actions, preventing fraud and security breaches;
  • protecting the rights, property, and legitimate interests of the Company and Users;
  • ensuring the accountability of processing and compliance with legal requirements.

4. Categories of Data Subjects and Composition of Personal Data

4.1. Categories of Personal Data Subjects
The Company processes the personal data of the following categories of natural persons:

  • 4.1.1. Platform Users – persons using the Website, Personal Account, chatbots, registration forms, and other interfaces of the Company;
  • 4.1.2. Natural persons who have concluded civil law contracts with the Company – contractors, consultants, performers, and other persons acting independently as parties to contracts;
  • 4.1.3. Representatives and employees of clients, partners, suppliers, and other counterparties – persons interacting with the Company during the execution or conclusion of contracts on behalf of their organizations;
  • 4.1.4. Participants in Company events – persons registering for and participating in conferences, seminars, webinars, and other public events;
  • 4.1.5. Persons who have sent inquiries, applications, and requests – natural persons who have contacted the Company through feedback forms, email, postal channels, messengers, and other means of communication;
  • 4.1.6. Subscribers and recipients of marketing communications – persons who have given consent to receive notifications about the Company's products, promotions, events, or news;
  • 4.1.7. Other persons whose personal data may be obtained by the Company on legal grounds (e.g., contact persons in correspondence, guarantors, witnesses, etc.).


4.2. Special Categories of Subjects:

  • 4.2.1. The personal data of respondents (participants in surveys, research, analytical campaigns) are regulated by a separate Policy on the Processing of Personal Data of Respondents.
  • 4.2.2. The personal data of employees and candidates are regulated by the Company's internal personnel policies.
  • 4.2.3. The automatic collection of Cookies from visitors to the Website and other digital resources of the Company is regulated by the Cookie Policy.


4.3. Categories of Processed Personal Data
Depending on the purpose of processing and the category of the subject, the Company may process the following data:

  • 4.3.1. Identification Data: last name, first name, patronymic (if any), date of birth, citizenship, gender, data from an identity document (in cases where required by law or contract).
  • 4.3.2. Contact Data: email address, phone numbers, postal address, links to profiles in messengers or social networks (if provided during interaction).
  • 4.3.3. Data for Contractual and Financial Relations: contract details, IIN (or its equivalent in other countries, e.g., TIN), bank account number, information on payments, acts, invoices, tax documents.
  • 4.3.4. Professional Activity Data: position, organization, employer's name, business correspondence, information on official powers and contacts.
  • 4.3.5. Data Collected During Participation in Events: registration forms, attendance information, photographs and video recordings (with consent or if the event is public), survey results, responses in feedback forms, participation preferences.
  • 4.3.6. Inquiry and Correspondence Data: texts of messages, complaints, reviews, attached documents, addressees, and history of interaction with the Company.
  • 4.3.7. Data Processed for Marketing Purposes: history of interaction with communications (opens, clicks, unsubscribes), interest categories, cookie and SDK data, advertising identifiers of devices, data from analytical systems.
  • 4.3.8. Anonymized and Aggregated Data: statistical and analytical information that does not allow for the identification of a specific natural person.
  • 4.3.9. Data from Authentication Providers (SSO, e.g., Google): name (display name), email address, user identifier with the provider, avatar/icon (if available), technical authorization information (including tokens/metadata — to the extent necessary for login and security).
  • 4.3.10. Data from Meeting Scheduling Services (e.g., Calendly): name, email address, selected time slot, time zone, comment/question for the meeting (if filled out), technical metadata of the meeting (link, duration, reminders).


4.4. Sources of Personal Data
Personal data may be obtained by the Company:

  • 4.4.1. directly from data subjects — during registration, filling out forms, participating in events, subscribing to newsletters, contacting through communication channels, concluding a contract;
  • 4.4.2. from clients, partners, and counterparties — regarding the contact details of their employees and representatives necessary for the execution of contracts;
  • 4.4.3. from publicly available sources – if the person has independently placed information about themselves in the public domain and has not prohibited its use;
  • 4.4.4. from state and commercial registers, if necessary to verify information within the framework of a contract or legitimate interest;
  • 4.4.5. In addition to the sources listed above, the Company receives personal data from third-party resources if the User has knowingly initiated such interaction:

    • from an authentication provider (e.g., Google) — when logging in through an external account;
    • from a calendar service (e.g., Calendly) — when booking a consultation. The volume of imported data is limited to the selected purpose (login/booking) and the minimum necessary fields; access to additional data/scopes is not requested without separate notification/consent.


4.5. Sensitive and Special Categories of Data
The Company does not request or process special categories of personal data (biometric, medical, information on racial origin, political views, religious beliefs, etc.), except in cases expressly provided for by law and accompanied by the separate consent of the data subject.

4.6. Combination and Interrelation of Data
The Company may combine data obtained from different sources if it is necessary to achieve the processing purposes specified in Section 3, while observing the principles of minimization, proportionality, and storage limitation.

5. Legal Bases for Personal Data Processing

5.1. General Bases.

The Company processes personal data on one or more of the following legal bases provided for by the legislation of the Republic of Kazakhstan:

  • 5.1.1. performance of a contract or taking steps at the initiative of the data subject prior to entering into a contract;
  • 5.1.2. consent of the data subject for one or more specific processing purposes;
  • 5.1.3. fulfillment of obligations imposed on the Company by law (tax/accounting, responding to lawful requests from authorities, etc.);
  • 5.1.4. legitimate interest of the Company or third parties, while maintaining a balance with the interests and rights of the data subject;
  • 5.1.5. protection of the rights and legitimate interests of the data subject or other persons (including the establishment, exercise, or defense of legal claims).

5.2. Linking Purposes (Sec. 3) with Legal Bases:

  • 5.2.1. Contracts with natural persons (conclusion/performance, settlements, document flow, notifications) — basis: performance of a contract; additionally: compliance with the law (accounting/taxes), protection of rights.
  • 5.2.2. Interaction with employees of clients/partners (business correspondence, access management, document exchange) – basis: legitimate interest of the Company and the respective legal entity (B2B communications, ensuring contract performance), with data minimization and transparency.
  • 5.2.3. Events (online/offline) (registration, communication, badges/passes, attendance tracking) – basis: contract (offer/registration) and legitimate interest (event organization, security). Photo/video – with consent or based on the public nature of the event in compliance with legal requirements.
  • 5.2.4. Marketing and promotion (news, promotions, personalization, advertising mailings) – basis: consent; analytics on anonymized data — legitimate interest.
  • 5.2.5. Consideration of inquiries/applications – basis: compliance with the law (exercise of subjects' rights), legitimate interest (maintaining a register of inquiries), if necessary – protection of rights.
  • 5.2.6. Security, anti-fraud, logging — basis: legitimate interest (security of services, prevention of abuse), as well as protection of rights.
  • 5.2.7. Compliance with legal requirements (requests from authorities, document retention) — basis: compliance with the law.
  • 5.2.8. Login via Google (SSO) – basis: legitimate interest (convenient and secure access) and/or performance of a contract (creating/maintaining an Account). For obtaining non-mandatory profile attributes — consent.
  • 5.2.9. Booking a consultation via Calendly — basis: performance of a contract/pre-contractual actions (scheduling a meeting), meeting notifications — legitimate interest (operational communication).

5.3-5.9. Legitimate Interest, Consent, and Other Aspects

  • 5.3. Legitimate Interest: Balancing Test. Before processing on this basis, the Company conducts a balancing test (purpose → necessity → impact on the subject → mitigation measures). Examples of permissible cases: storing business correspondence and contact details of B2B counterparty representatives; technical logs for investigating security incidents; basic product analytics on aggregated/anonymized data; prevention of abuse (anti-spam, anti-fraud). Mitigation measures: field minimization, limited retention periods, role-based access, pseudonymization/anonymization, clear objection mechanisms (where applicable).
  • 5.4. Consent of the Data Subject.
    5.4.1. Consent is used where it is explicitly required by law or the nature of the processing (marketing, certain categories, disproportionately new purposes, etc.).
    5.4.2. Consent is given specifically and informedly through the Platform's interfaces (checkbox/button/form/reply message/Personal Account) or in writing.
    5.4.3. Consent can be withdrawn at any time through available channels; after withdrawal, processing for the corresponding purpose ceases if there is no other basis.
    5.4.4. Detailed methods for obtaining/withdrawing consents and their recording are disclosed in a separate section 'Data Subject Consent' (will be provided later in the text).
  • 5.5. Special Categories/Sensitive Data. The Company does not process special categories of personal data, except in cases expressly provided for by law and/or with the separate explicit consent of the data subject and sufficient protective measures.
  • 5.6. Minors. If actions involving the data of a minor are required, the Company requests the consent of their legal representative or acts in another manner provided for by applicable law.
  • 5.7. Combination of Bases. Several bases may apply to one purpose (e.g., performance of a contract + compliance with the law; legitimate interest + protection of rights). The Company documents the applied bases and their relationship.
  • 5.8. Accountability and Record of Processing. The Company maintains up-to-date records of processing operations (registers), including purposes, categories of data and subjects, legal bases, recipients, retention periods, security measures, and cross-border transfers; upon request from authorized bodies, it provides necessary information within the limits of the law.
  • 5.9. Minimization of OAuth/Scopes. When integrating SSO/calendars, the Company requests the minimum necessary permissions and does not access the content of the User's email, calendar, or contacts unless it is explicitly necessary and approved by the User through a separate action/consent.

6. Data Retention and Deletion Periods

6.1. General Principles.

The Company stores personal data for no longer than is necessary for the purposes specified in Section 3, or for the period established by law. The period is calculated: (a) from the date of collection/receipt; (b) from the date of the last significant interaction with the subject; or (c) from the date of termination of the relevant contract/project – whichever occurs later, unless otherwise provided in Appendix No. 1 (Table of Processing Periods).

6.2. Events Triggering the Start of Retention Periods (triggers):

  • conclusion/termination of a contract;
  • fulfillment of mutual obligations (payment, acts, closing documents);
  • withdrawal of consent (for the relevant purpose);
  • end of an event/campaign and completion of related mailings;
  • closure of an inquiry/request (complaint/claim);
  • expiration of the statute of limitations/tax audit period, if applicable.

6.3-6.7. Standard Periods and Other Provisions

6.3. Standard Periods by Processing Category (defaults):
Exact periods are recorded in Appendix No. 1. If a different period is specified in the Appendix, it shall apply.
  • 6.3.1. Contracts with natural persons; employees of clients/partners (B2B communications). Contract data, settlement data, business correspondence, identification and contact data – up to 5 years after the termination of the contract/last operation, or longer if required for tax/accounting purposes and protection of rights (see Appendix No. 1).
  • 6.3.2. Events (online/offline). Registration data, organizational correspondence – up to 1 year after the event, unless consent for longer communication has been obtained. Photo/video materials – according to consents or within the public status of the event, usually up to 3 years, unless otherwise withdrawn.
  • 6.3.3. Marketing Communications. Contact data and subscription settings – until unsubscribe/ withdrawal of consent; technical campaign metrics at the profile level – up to 12 months; aggregated/anonymized analytics – without limitation, if re-identification is excluded.
  • 6.3.4. Inquiries, complaints, requests. Texts of inquiries, decisions, correspondence – up to 3 years from the date of closing the inquiry, longer if necessary for the protection of rights.
  • 6.3.5. Technical and Security Logs. Event logs, IP addresses, device identifiers – from 6 to 24 months depending on the criticality of the service and security risks (specified in Appendix No. 1).


6.4. Legal Hold.
If data is required for the protection of rights/dispute resolution/fulfillment of a legal requirement, the Company temporarily suspends the deletion of the relevant data sets until the completion of the verification/process/periods, after which deletion resumes.

6.5. Deletion, Anonymization, and Archiving.

  • 6.5.1. Upon expiration of the retention period, data is deleted or anonymized (pseudonymization/aggregation), if permitted by law.
  • 6.5.2. Archive copies and backup backups: physical deletion may take additional time according to the technological cycle; access to data in backups is restricted and is only permitted for recovery/audit/security purposes.
  • 6.5.3. Upon withdrawal of consent, data processed solely on that basis will cease to be processed and will be deleted/anonymized, unless there is another basis for retention (law/contract/protection of rights).


6.6. Consistency with the Retention Schedule.
Details on data sets (category of subject → purpose → legal basis → period → start/end trigger → action upon completion) are provided in Appendix No. 1. In case of discrepancies, the periods from Appendix No. 1 shall apply.

6.7. Data Actuality and Accuracy.
The Company takes reasonable measures to keep data up-to-date (upon subject requests and through internal procedures), and also restricts access to outdated data and deletes it upon achieving the purposes/expiration of the period.

7. Data Subject Consent: Obtaining, Recording, Managing, and Withdrawing

7.1-7.4.

  • 7.1. When Consent is Required. Consent is requested if the processing does not fall under other legal bases (Sec. 5), including for: (a) marketing communications; (b) photo/video recording at events (unless a public exception applies by law); (c) certain types of analytics/personalization not necessary for providing the service; (d) new purposes incompatible with the original ones.
  • 7.2. Principles of Obtaining Consent. (a) a free, specific, informed, and unambiguous expression of will; (b) given separately from general terms and conditions; (c) formulated in simple and clear language; (d) accompanied by links to this Policy and relevant documents (Cookie Policy, event terms, etc.).
  • 7.3. Methods of Providing Consent via the Platform and Offline. The Company accepts consent expressed by one of the following actions (the interfaces contain text/links to the terms and purpose of consent):
    7.3.1. Web/Mobile Interface: checking a checkbox, clicking a 'Consent/Accept/Subscribe' button, submitting a form with an explicit mark;
    7.3.2. Personal Account: enabling the corresponding toggle switch in the consent settings;
    7.3.3. Chatbot/Messengers/SMS/E-mail: sending a keyword/command specified in the consent request (e.g., 'AGREE');
    7.3.4. QR/Event Landing Page: marking consent in the registration form; visiting premises where a sign about photo/video recording is displayed at the entrance;
    7.3.5. Written/Electronically Signed Consent: using the Company's template or a form established by law.
  • 7.4. Recording of Consent (Consent Log). The Company keeps a record of consents given and withdrawn, retaining at least the following attributes: date/time; channel (web/app/bot/e-mail/SMS/offline); action (checkbox/click/message/signature); user/account identifier (if any); version of documents (Policies/consents/notifications); IP/UA (for online); consent purpose tag (for which purpose). The record retention period is at least the duration of the consent + the statute of limitations.

7.5-7.13.

  • 7.5. Layered Information. Before the consent action, a brief description of the purpose and key consequences is provided + a link to the full text. For events – through the registration form/participation terms; for marketing – in the subscription form.
  • 7.6. Separate Settings by Channel. The User can consent/refuse separately for different types of communications (e-mail, SMS, messengers, push), by topics (product news/events/promotions), and by types of analytics/personalization if they are not necessary for the service.
  • 7.7. Withdrawal of Consent and Objection to Processing. Consent can be withdrawn at any time: in the Personal Account (by disabling the corresponding toggle switch); via the 'Unsubscribe' link in messages/mailings; by a reply message in the same channel (e-mail/SMS/bot); through the feedback form on the Website; in writing to the Company's address.
  • 7.8. After withdrawal, the Company ceases processing for the corresponding purpose, unless there is another basis (contract/law/protection of rights). The fact of withdrawal is recorded in the consent log. The User also has the right to object to processing based on legitimate interest; in this case, the Company will restrict processing unless it can demonstrate the priority of its legitimate interest and/or the need to protect rights.
  • 7.9. Consent for Minors. If the consent of a minor is required, it is provided by a legal representative or in the manner prescribed by applicable law. The Company may request documents confirming authority.
  • 7.10. Validity Period and Renewal of Consent. Consent is valid until it is withdrawn or until the purpose of processing is achieved/the terms are changed. In case of a significant change in the purpose/process of processing, the Company will re-request consent or offer to update the settings.
  • 7.11. Consent Forms for Special Cases. For photo/video at non-public events, publication of reviews/case studies, transfer of contacts to partners, and for the use of data beyond the minimum necessary volume, the Company uses separate short consent forms specifying the purpose, term, and right of withdrawal.
  • 7.12. Respondents – Separate Policy. Consents related to participation in research/surveys/payment of remuneration to respondents are described and recorded in the Policy on the Processing of Personal Data of Respondents; this Policy applies subsidiarily.
  • 7.13. Managing External Connections. The User can disable login via an external account and/or revoke permissions granted to the provider (e.g., in Google settings). Revoking permissions with the provider stops future synchronization but does not delete data already received by the Company; to delete/disable the Account, a request should be submitted according to the procedure in Section 10. For Calendly, the User can cancel/reschedule the slot using the service's tools; data on past meetings are processed according to the rules of Section 6 (retention periods) and can be deleted upon request.

8. Recipients of PD, Commissioned Processing, and Cross-Border Transfer

8.1. Categories of Recipients (Third Parties).
Within the purposes specified in Section 3, personal data may be provided to the following categories of recipients:

  • 8.1.1. Counterparties for the performance of contracts and orders – clients, partners, suppliers, payment organizations/aggregators, banks, insurance and postal operators, courier services.
  • 8.1.2. IT providers and infrastructure – data centers, cloud and hosting providers, providers of electronic signature/authentication, video conferencing services, mailing and communication services, CRM/Helpdesk, logging and monitoring systems.
  • 8.1.3. Marketing and analytics – mailing platforms, advertising platforms, web analytics and A/B testing tools, cookie/SDK providers (to the extent and under the conditions of User consents/settings).
  • 8.1.4. Event organizers and partners – venues, technical contractors, speakers/co-organizers (under the conditions necessary for registration, access, security, and post-event communications).
  • 8.1.5. Legal and financial consultants – auditors, lawyers, notaries, collectors (where lawful), mediators/arbitrators.
  • 8.1.6. State bodies and other persons – in cases and to the extent provided by law or a court decision.
  • 8.1.7. Other recipients – in case of corporate changes (merger, sale of assets, reorganization), provided that the successor maintains an equivalent level of protection.
  • 8.1.8. Authentication providers (e.g., Google) – to the extent necessary for login and security;
  • 8.1.9. Meeting scheduling services (e.g., Calendly) – for scheduling slots, reminders, and communications about the meeting.


8.2. Commissioned Processing (Processors).

  • 8.2.1. The Company may commission the processing of personal data to processors on the basis of a contract. Such a contract provides for: processing only on the documented instructions of the Company; confidentiality and security measures (including encryption/pseudonymization if necessary); a prohibition on subcontracting without approval and an obligation to disclose the list of sub-processors; assistance in fulfilling the rights of subjects and responding to incidents; audit/assessment of compliance upon the Company's request; deletion/return of data upon completion of services.
  • 8.2.2. Integrated providers (Google, Calendly) act as independent operators for processing on their side and/or as processors in relation to the data they receive/transfer through documented integrations.


8.3. Joint and Independent Controllers.
If a certain processing is carried out jointly with a partner and the parties jointly determine the purposes and means of processing, the parties formalize the distribution of roles and responsibilities (who is responsible for notifications, responses to subject requests, security, etc.). In other cases, partners act as independent operators and process data according to their own policies; when transferring data to such partners, the Company informs the User to the extent of applicable law.

8.4. Minimization and 'Not for Sale' Principle.
The Company does not 'sell' personal data in the commercial sense. Any transfer is carried out on the principle of the minimum necessary volume for the stated purpose (need-to-know).

8.5. Public Posting of Materials.
The publication of photos/videos/reviews/case studies that allow for the identification of a person is carried out with the corresponding consent or on grounds permitted by law for public events. Withdrawal of consent entails the cessation of further use of the materials and, where possible, their removal from platforms managed by the Company.

8.6. Cross-Border Transfer.

  • 8.6.1. The transfer of personal data to other states is permitted if one of the conditions provided for by applicable law is met (e.g., an adequate level of protection in the recipient country; consent of the data subject; contractual and other legal mechanisms ensuring equivalent protection).
  • 8.6.2. Before the transfer, the Company conducts an assessment of cross-border risks (jurisdiction of the recipient, nature of the data, purpose and duration of processing, technical and organizational measures) and ensures documentary guarantees from the recipient.
  • 8.6.3. If a requirement for localization/storage in the territory of a certain state applies to certain categories of data, the Company complies with such requirements (e.g., placing copies in data centers of the relevant jurisdiction) and restricts foreign access by technical means.
  • 8.6.4. The list of countries/categories of recipients for cross-border transfers is provided upon the data subject's request, if such disclosure is permissible from a security point of view.
  • 8.6.5. When using Google/Calendly, processing and/or storage of data outside the Republic of Kazakhstan is possible; the Company applies the legal transfer mechanisms provided for by law and informs Users through this Policy and/or interfaces.


8.7. Requests from Government Bodies.
The Company considers requests from government bodies/courts only within the limits of the law, verifies competence and scope, and, where possible, informs the data subjects (if not prohibited). The Company keeps a record of such requests and the volume of disclosed information.

8.8. Transparency for Users.
In the Platform's interfaces and/or in the Appendix to the Policy, the Company provides:

  • a description of the key categories of recipients by purpose;
  • links to separate documents (e.g., Cookie Policy – list of SDK/cookie providers by category);
  • mechanisms for managing transfers that depend on consents (Personal Account settings/cookie banner).


8.9. Restriction of Unauthorized Exchange.
Any exchange of personal data with third parties outside the scope of this Policy or without proper legal grounds is prohibited. Employees and contractors of the Company are responsible for violating the established procedure.

9. Personal Data Security: Protective Measures and Incident Response

  • 9.1. General Security Principles. The Company ensures the confidentiality, integrity, availability, and accountability of personal data processing, taking into account the risks, nature, scope, and context of the processing. Security measures are reviewed at least once a year and upon significant changes to the Platform.
  • 9.2. Organizational Measures.
    9.2.1. distribution of roles and responsibilities (process owners, administrators, information security officers are appointed by order);
    9.2.2. access control policy (least privilege access, role-based segregation, regular review of rights);
    9.2.3. NDAs and confidentiality obligations for employees and contractors;
    9.2.4. training and knowledge testing on information security/data protection upon hiring and annually;
    9.2.5. on-boarding/off-boarding procedures: issuance/revocation of access, return of media, closure of accounts;
    9.2.6. register of processing operations, register of processors and cross-border transfers;
    9.2.7. change management and data protection impact assessment (DPIA) for new/significantly changed processes.
  • 9.3. Technical Measures.
    9.3.1. Encryption: in transit – TLS for all external and internal network interactions; at rest – encryption of data and backups; key management – in a dedicated module/service, with rotation and access segregation.
    9.3.2. Authentication and Session Management: MFA for admin access, password complexity policy, limited lifetime of tokens/sessions, protection against brute-force attacks.
    9.3.3. Segmentation and Isolation: separation of environments (prod/stage/dev), network ACLs, WAF, API protection (rate-limiting, throttling, signatures/scopes).
    9.3.4. Logging and Monitoring: centralized logs (access, admin actions, configuration changes), immutable audit trails for critical operations; log retention according to the periods in Appendix No. 1; event correlation (SIEM).
    9.3.5. Anti-fraud and Abuse Protection: anomaly detection, protection against bot traffic, checks for credential leaks, CAPTCHA (only where necessary).
    9.3.6. Vulnerability Management: regular scans, bug bounty/pen-tests according to a plan, SLAs for fixing vulnerabilities based on criticality level.
    9.3.7. Backup and Recovery (BCP/DRP): regular backups, recovery tests, geo-redundancy, access control to backups.
    9.3.8. Data Protection on Endpoints (endpoint/DLP): encryption of work devices, mobile device management (MDM), prohibition of unauthorized copies of PD, control of data output.
    9.3.9. Supplier Security: technical and contractual requirements for processors (see Sec. 8), periodic compliance audits.
    9.3.10. For SSO/calendar integrations, the following are applied: short-lived tokens, limited scopes, secure storage of secrets, periodic key rotation, and logging of login/booking attempts.
  • 9.4. Minimization and Pseudonymization. The Company uses the minimum necessary volume of data for each purpose. Where possible, data is pseudonymized/anonymized; access to the links between 'identifier ↔ identity' is restricted to a narrow circle of persons on a need-to-know basis.
  • 9.5. Data Access and Administration. All admin actions are performed from named accounts with MFA and are logged. Privileged operations require additional confirmation and/or the 'four-eyes' principle for particularly sensitive actions (e.g., exporting large arrays of PD).
  • 9.6. Storage, Media, and Destruction. Physical and virtual media containing PD are protected from unauthorized access; upon expiration of retention periods, they are destroyed/erased according to approved procedures; a separate deletion cycle applies to backups (see Sec. 6).
  • 9.7. Incident Response.
    continuous monitoring of security events and feedback channels; classification of incidents and assignment of a responsible team; localization, elimination of causes, restoration of services, subsequent analysis (post-mortem); documentation and storage of investigation materials in a secure environment.
  • 9.8. Notifications of Incidents and Data Breaches. Upon detection of a security breach that poses a risk to the rights and freedoms of data subjects, the Company: assesses the scale and consequences; if necessary, notifies the data subjects and (if required by law) the competent authorities within a reasonable time, providing available information about the nature of the incident, the affected data, the measures taken, and recommendations to the subjects; if necessary, provides further information as it becomes available.
  • 9.9. Testing and Audit. The Company conducts regular checks on the effectiveness of protective measures (internal audits, pen-tests, log reviews), records the results, and a plan for corrective actions. Key findings are taken into account when updating this Policy and internal regulations.
  • 9.10. Prohibition of Unauthorized Actions. Any exports, copying, transfer, or other actions with PD outside of registered processes and without appropriate legal grounds are prohibited and entail disciplinary and other liability under the law and contracts.

10. Rights of Data Subjects and Procedure for Their Exercise

10.1. List of Rights.

The personal data subject (hereinafter – the Subject) has the right to:

10.1.1. obtain information about the processing of their personal data (purposes, bases, sources, categories, recipients, retention periods, protective measures);

10.1.2. obtain a copy of their personal data processed by the Company;

10.1.3. rectify inaccurate or incomplete personal data;

10.1.4. erase personal data if they are no longer needed for the purposes of processing, consent has been withdrawn, or the processing is unlawful (except in cases where retention is required by law/for the protection of rights);

10.1.5. restrict processing (temporary 'freezing' of certain operations) when contesting the accuracy of the data, the lawfulness, or the necessity of processing;

10.1.6. object to processing based on the Company's legitimate interest – we will cease such processing unless we can demonstrate the priority of our legitimate grounds or the need for the protection of rights/claims/lawsuits;

10.1.7. port data in a structured, machine-readable format, if they were provided by the Subject and are processed on the basis of consent or a contract and using automation;

10.1.8. withdraw consent at any time – for the corresponding purpose of processing;

10.1.9. appeal the actions/inaction of the Company to a competent authority or court.

10.2 - 10.5.

10.2. Channels for Submitting Inquiries. An inquiry can be sent:

  • through the Personal Account;
  • through the feedback form on the Website;
  • to the Company's e-mail address indicated on the Website or in the contract under which the personal data is processed;
  • through a chatbot (if available);
  • by postal mail to the Company's address.
  • For offline events, special desks/QR forms may be available.


10.3. Identity Verification and Representation. The Company has the right to request reasonable information to verify identity (minimum necessary attributes/documents). A request through a representative must be accompanied by a document confirming their authority. If there are doubts about identification, the Company has the right to refuse to provide data until confirmation is received.

10.4. Response Times and Format.

  • 10.4.1. Acknowledgment of receipt – without undue delay (usually within 3 working days).
  • 10.4.2. Substantive response – within 30 calendar days from the date of receipt of a valid request. For complex or voluminous requests, the period may be extended, of which the Company will notify with reasons.
  • 10.4.3. The response is provided free of charge and in electronic form (via a secure channel) or in another format at the Subject's request, if technically possible and secure.


10.5. Limitations and Exclusions. The Company may fully/partially reject a request if:

  • 10.5.1. disclosure infringes on the rights and freedoms of others (confidentiality, trade secrets, IS measures);
  • 10.5.2. processing and storage are mandatory by law (taxes, accounting, requirements of authorities, statutes of limitation) or necessary for the protection of the rights of the Company/third parties;
  • 10.5.3. the request is manifestly unfounded or excessive (repeated unreasonably often, requires disproportionate resources); in these cases, the Company may propose a reasonable limitation of the scope or charge a moderate fee for administrative costs, notifying of the reasons.

11. The Company's Role as a Processor for Partner Data and DPA

11.1. Scope of Application. In cases where a partner (a client-legal entity or individual entrepreneur), acting as a personal data operator, transfers personal data of its employees and/or clients to the Company for the provision of services, the Company acts as a Processor, not as an operator. The partner-operator is responsible for the purposes and legal bases of the processing.

11.2. Basis and Instruction. The Company processes such personal data exclusively on the documented instructions of the operator, to the extent and for the purposes necessary for the provision of the relevant services, in compliance with the principles of minimization and security.

11.3. Data Processing Agreement (DPA).
11.3.1. For the specified processing, a separate Data Protection and Processing Agreement (DPA) is concluded with the operator.
11.3.2. If an individual DPA is not concluded, the Company's Standard DPA, posted on the Website, applies and is considered incorporated into the relevant contract (by reference/incorporation) from the moment the services begin to be used.

11.4. The Company's Obligations as a Processor. The Company, acting as a processor:
11.4.1. does not engage sub-processors without approval in the manner established by the DPA; maintains and provides upon request a list of sub-processors;
11.4.2. ensures confidentiality and applies appropriate organizational and technical protective measures (see Sec. 9), including encryption/pseudonymization if necessary;
11.4.3. assists the operator in fulfilling obligations to data subjects (access/rectification/erasure/restriction/objection/portability) – upon the operator's request and instructions;
11.4.4. notifies the operator of security incidents affecting the data in the manner and timeframes established by the DPA;
11.4.5. handles cross-border transfers and localization requirements only on the operator's instructions and with the guarantees provided for in the DPA;
11.4.6. maintains necessary records of processing and provides the operator with reasonable information/results of audits of compliance with security measures and DPA terms;
11.4.7. upon completion of the provision of services, returns or deletes/anonymizes the data at the operator's choice, taking into account the technological cycles of backups (see Sec. 6).

11.5. Priority of Documents. In case of discrepancies between this Policy and the applicable DPA, the DPA shall prevail.

11.6. Communication with Data Subjects. Requests from subjects addressed to the Company as a processor are forwarded to the operator; the Company does not respond substantively without the operator's instructions, unless otherwise expressly provided for by the DPA or law.

11.7. Place of Processing and Localization. The place of storage/processing and localization/access requirements are established in the DPA/operator's instructions. The Company ensures their technical and contractual compliance.

12. Final Provisions

12.1. Hierarchy and Interrelation of Documents. This Policy is general. Specific issues are addressed in separate documents:
  • Policy on the Processing of Personal Data of Employees and Affiliated Persons;
  • Policy on the Processing of Personal Data of Respondents – for persons participating in research/surveys;
  • Cookie Policy – for the processing of cookie files, SDKs, and online identifiers;
  • other special provisions (event terms, consent forms, etc.).
In case of conflict, the special document for the relevant category shall prevail; in the uncovered part, this Policy applies.

12.2. Applicable Law. The legislation of the Republic of Kazakhstan applies to this Policy and relations concerning the processing of personal data, unless otherwise expressly follows from mandatory norms and/or the place of service provision/location of the data subject.

12.3. Language and Interpretation. The Policy may be provided in several languages; in case of discrepancies, the Russian text shall be decisive. Terms are used in the meaning specified in Section 2.

12.4. Policy Updates and Notifications. The Company reviews the Policy upon changes in services, technologies, legal requirements, or based on the results of audits/inquiries.
12.4.1. Non-substantive changes (editorial clarifications) are published without separate notification.
12.4.2. Substantive changes (new purposes/data categories, expansion of recipients, cross-border transfers, changes in retention periods) — are notified in advance in the Platform's interfaces and/or by e-mail, as a rule, no later than 3 calendar days before they take effect. Continued use of the Platform after publication means acceptance of the new version; for processing that requires new consent, the Company will request it separately. An archive of versions is kept for at least 3 years and is provided upon request.

12.5. Contacts for Questions and Subject Requests. For inquiries regarding the processing of personal data and the exercise of rights (Section 10), the following channels are available:
  • Personal Account → 'Data and Privacy' / 'Profile Settings';
  • Feedback form on the Website;
  • E-mail: hi@gro.now (subject: 'Data Subject Request');
  • Postal address of the Company: Republic of Kazakhstan, Almaty, Bostandyk district, Satpayev str., 90/54, apt. 5, postal code 050000;
  • (optional) chatbot – 'Data Request' section.
The Company has the right to request information to verify the identity of the applicant.

12.6. Validity of Provisions. If any provision is recognized as invalid/unenforceable, this does not affect the validity of the other provisions. The invalid provision is replaced by a provision that is as close as possible to its purpose and essence.

13. Date and Entry into Force.

Policy Version: v1.0 dated 15.09.2025. The Policy is effective from the moment of publication, unless otherwise specified.

Appendix No. 1 to the General Policy on Personal Data Processing. Version v.1.0 dated 15.09.2025. Table of Personal Data Processing Periods and Actions upon Completion

Subject Cat.Data SetPurpose (Sec. 3)Basis (Sec. 5)Retention PeriodStart TriggerEnd TriggerAction upon CompletionLegal HoldSystem/OwnerNotes
NP - party to a contractIdentif., contact, contractual, settlement(1) Contracts with NPContract; Law; Protection of Rightsup to 5 years after terminationSigning of contractClosing documents/ terminationDeletion/ archive for accountingYes, in case of dispute/auditCRM/AccountingPayment data – per tax accounting requirements
Client/partner employee (B2B)Name, position, work contacts, business correspondence(2) B2B interactionLegitimate Interestup to 5 years after last transaction/comm.First contact/transactionEnd of relationship/no activity for 24 mos.Deletion/ anonymizationYesCRM/MailMinimize personal contacts, use work contacts
Event participantReg. data, org. correspondence(3) Events (registration/admission)Contract (offer)/Leg. Interestup to 1 year after the eventRegistrationDate of eventDeletion/ anonymizationYes (incidents)Event PlatformPost-event mailings only with consent
Photo/video of participantImage/video(3) Events (media)Consent / public exceptionup to 3 years or until withdrawalShooting/consentWithdrawal/expiration of termCease use; delete from managed platformsYesMedia ArchiveUpon withdrawal – delete via controlled channels
Marketing subscriberContacts, subscription settings(4) MarketingConsentuntil withdrawal; metrics – up to 12 mos.Subscription / consentUnsubscribe/ withdrawalCease mailings; clear metrics by deadlinesNoESP/CRMThematic/channel consents
Applicant/DSRText of inquiry, attached files, correspondence(5) Consideration of inquiriesLaw; Leg. Interest; Protection of Rightsup to 3 years after closureRegistration of inquiryClosure of inquiryArchive for 12 mos., then deletionYes (disputes)HelpdeskFor complaints – may be stored longer (protection of rights)
Tech. journals/logsIP, UA, events, admin logs(7) Security/ anti-fraudLeg. Interest; Protection of Rights6-24 mos. (by criticality)Record generationExpiration of periodDeletion/aggregationYesSIEM/LogCritical actions – immutable trails
Account/PAReg. data, settings, consents(1)(5)(7) Services/DSR/securityContract; Law; Leg. Interestwhile account is active + 12 mos.RegistrationAccount deletionDeletion/ anonymization; consent log – by termYesIAM/IDPSeparate storage of consent logs