Privacy Policy

1. General Provisions

1.1. This Privacy Policy (the "Policy") describes what data is processed when you use the website idm-online.org, the cloud service platform cms.idm-online.org and the IDM-Online mobile application (together, the "Service"), as well as the purposes, legal bases and conditions of such processing.

1.2. The operator of the Service and the owner of the database containing personal data is PROMANALITIKA Limited Liability Partnership (BIN 210240005209), 60 Auezov Street, Almalinsky District, Almaty, 050008, Republic of Kazakhstan (the "Operator", "we").

1.3. The Policy is drafted in accordance with the Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Its Protection" dated May 21, 2013, and applicable app store requirements (Apple App Store, Google Play).

1.4. By using the Service, you confirm that you have read this Policy. Consent to the processing of personal data is given by checking the relevant box in a form, by submitting a request, or in any other manner provided by law.

2. What Data Is Processed

2.1. Role-based credentials. Access to the platform is provided through role-based accounts issued to the customer organization ("User" and "Reliability Manager" roles per workshop/division, plus an organization-level role with access to all divisions). Individual accounts are not created for each employee, and no account registration takes place inside the application. The customer organization itself distributes access to the role-based accounts among its personnel.

2.2. Notification recipients' contact data: email addresses (and, where necessary, name and job title) of the customer organization's employees that the organization's authorized representative (Reliability Manager) adds to the Service's notification mailing list. By providing such data, the customer organization warrants that it has a legal basis (including the data subjects' consent) for its transfer and processing.

2.3. Website feedback form data: name, phone number, email address, organization name and the content of the request submitted via the idm-online.org website.

2.4. Equipment data (industrial telemetry): vibration, rotation speed, temperature and other equipment measurements, equipment names and specifications, analytics results. This data is generally non-personal and belongs to the customer organization.

2.5. Technical data: IP address, device and OS type, application version, session identifiers, activity logs, and cookies when using the web version.

2.6. Support communications: the content of correspondence with the Operator.

2.7. We do not process special (sensitive) categories of personal data, do not use data for advertising or profiling, and do not sell personal data to third parties.

3. Purposes and Legal Bases of Processing

3.1. Data is processed for the following purposes:

• issuing role-based accounts to the customer organization and authentication;
• providing Service features: equipment condition monitoring and analytics;
• sending service notifications about changes, deviations and anomalies in equipment condition to the email addresses added to the mailing list by the customer organization;
• handling requests submitted via the website and communicating with the requester;
• technical support of users;
• security, fraud prevention and prevention of unauthorized access;
• performance of contractual obligations towards the customer organization;
• compliance with the laws of the Republic of Kazakhstan.

3.2. Legal bases for processing: (a) the data subject's consent; (b) the necessity to perform a contract with the customer organization; (c) legal obligations under the laws of the Republic of Kazakhstan.

4. Cookies and Third-Party Services

4.1. The idm-online.org website uses cookies and similar technologies to operate the website, remember the selected language and analyze traffic. You may restrict or disable cookies in your browser settings; this may affect certain website features.

4.2. To protect forms from automated submissions, the website uses Google reCAPTCHA (Google LLC). When it operates, Google may process technical data of your device in accordance with Google's privacy policy.

4.3. The IDM-Online mobile application does not use advertising identifiers and does not track users for advertising purposes, including within the meaning of the Apple App Store rules.

5. Data Recipients

5.1. Access to data may be granted only to:

• authorized personnel of the Operator, to the extent necessary to perform their duties;
• infrastructure providers (hosting, backup) acting on the Operator's instructions under confidentiality obligations;
• public authorities — solely where expressly required by the laws of the Republic of Kazakhstan.

5.2. Customer organization data (including equipment telemetry) is available to persons using the role-based accounts issued to that organization, subject to configured access rights.

5.3. Personal data is not transferred to third parties for marketing purposes and is not sold.

6. Storage Location and Retention Periods

6.1. Data is processed on servers providing an adequate level of protection. Any cross-border transfer complies with Article 16 of the Law of the Republic of Kazakhstan "On Personal Data and Its Protection".

6.2. Retention periods: role-based account data and mailing lists — for the term of the contract with the customer organization; website request data — up to 3 years from the date of the request; logs — up to 12 months; accounting and tax records — for the periods prescribed by the laws of the Republic of Kazakhstan.

6.3. Upon expiry of the retention periods, data is deleted or de-identified.

7. User Rights and Data Deletion

7.1. A personal data subject has the right to: obtain information about the processing of their data; request rectification or correction; request blocking or deletion; withdraw consent; and lodge a complaint with the competent authority or a court.

7.2. Role-based accounts are issued to the customer organization and are deleted (blocked) upon request of its authorized representative sent to the email address specified in Section 9. The request must state the organization's name and BIN, the logins of the accounts to be deleted, and the requester's name and position. Accounts are blocked immediately after the request is confirmed; data is deleted from active systems within 30 calendar days, and from backups within the next rotation cycle (no more than 90 days).

7.3. Removal of an email address from the notification mailing list is performed by the organization's Reliability Manager or upon the data subject's request sent from that address to the Operator's contact email. The address is removed from the mailing list within 3 business days.

7.4. Requests of personal data subjects are handled within the time limits established by the laws of the Republic of Kazakhstan.

8. Data Protection

8.1. The Operator applies legal, organizational and technical data protection measures, including: encrypted connections (HTTPS/TLS); hashed password storage; role-based access control; regular backups; access logging; limiting the number of persons with access to data and binding them by confidentiality obligations.

8.2. Access to the platform is provided only through the issued role-based credentials. The customer organization is responsible for keeping the credentials confidential within the organization.

9. Changes and Contacts

9.1. The Operator may update this Policy. The new version is published on this page with its version date and takes effect upon publication unless stated otherwise. Material changes are additionally communicated to customer organizations.

9.2. Contacts for personal data matters:

PROMANALITIKA LLP, BIN 210240005209
60 Auezov Street, Almaty, 050008, Republic of Kazakhstan
E-mail: info@promanalitika.kz
Technical support: dev@idm-online.org
Phone: +7 (727) 350-58-68