Privacy policy

Who is responsible for your data

The data operator — the controller, in GDPR terms — is the company identified above. For any question about how we handle personal data, write to office@astanawood.kz. That is also the address for requests to access, correct or delete your data, and for withdrawing consent.

What we collect

The form on this site collects only what you type into it:

• your name;
• your work email address;
• your company name;
• your message.

If you email office@astanawood.kz directly — to attach drawings, for example — we receive whatever you choose to put in that message: a phone number, the products you are interested in, volumes, the destination country, and any attached files. How much you share is your decision.

The site sets no advertising or analytics cookies and does not track you across other websites. We do store one functional cookie — awt_lang — when you choose a site language. It holds only the language code you picked (ru, en or kk) for up to a year, so that your next visit opens in that language. It contains no personal data and is never shared. Our hosting provider keeps technical server logs (IP address, browser type, date and time of the request), which we need to keep the site available and secure.

Why we process it, and on what legal basis

We use the data from the form and from our correspondence to answer your enquiry, prepare a quotation and — if it leads to an order — enter into and perform a contract. The GDPR basis is Article 6(1)(b): steps taken at your request prior to entering into a contract. Under Kazakh law the basis is your consent, which you give when you submit the form.

We process the technical server logs on the basis of legitimate interest — Article 6(1)(f) GDPR — in keeping the site running and secure.

We do not use your data for marketing mailings, and we do not sell it or pass it to third parties for their own purposes.

How long we keep it

Correspondence about an enquiry that does not lead to an order is kept for 24 months from our last contact and then deleted. If we do become contracting parties, the documents and related data are kept for the periods required by Kazakh accounting and tax law. Technical server logs are kept for 12 months.

You can ask us to delete your data sooner — see "Your rights" below.

Who we share it with

We use a small number of service providers. They process the data on our instructions and may not use it for their own purposes:

• Web3Forms — the service that receives the website form and relays the enquiry to our inbox;
• our hosting provider, whose servers host the site and hold the technical logs; those servers are located in the Republic of Kazakhstan;
• our corporate email provider, which carries correspondence with office@astanawood.kz.

Each of these relationships is governed by a contract that includes data protection obligations. Beyond them, we disclose data only where the law or a decision of a competent authority requires it.

Transfers outside Kazakhstan

An enquiry submitted through the form passes through Web3Forms, which relays it to our inbox. Its servers are located outside the Republic of Kazakhstan. Our hosting and corporate email may likewise be operated by providers outside the country.

That is a cross-border transfer within the meaning of Article 16 of the Law "On Personal Data and its Protection": by submitting the form you consent to it, and we satisfy ourselves that the receiving party protects the data transferred. If you would rather not use the form, write to us directly at office@astanawood.kz.

For visitors in the European Union the opposite direction matters. The European Commission has not recognised Kazakhstan as providing an adequate level of data protection, so transfers of your data to us rely on the informed consent you give when you contact us.

Your rights

You have the right to:

• obtain confirmation that we process your data, and a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased, or its processing restricted;
• object to processing based on legitimate interest;
• receive your data in a machine-readable format and transmit it to another controller — the GDPR right to data portability;
• withdraw your consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to office@astanawood.kz. We respond within one month of receiving the request. There is no charge.

How to complain

If you believe we have infringed your rights, please tell us first — we will try to resolve it directly. You are also entitled to complain to a supervisory authority.

In Kazakhstan that is the Information Security Committee of the Ministry of Digital Development, Innovations and Aerospace Industry. In the European Union it is the data protection authority of the country where you live, where you work, or where the alleged infringement took place.

Changes to this policy

We may update this policy — for example if our service providers or the data we collect change. The current version is always on this page, and the date at the top shows when it last changed. We will flag any substantial change on the site.