Privacy Policy and Consent to Personal Data Processing

Your data is processed by IE Talent Craft, an individual entrepreneur (IE) registered in Kazakhstan. IIN (individual identification number): 801020300158. Address: 73A Tole Bi St., office 312, Almaty, Kazakhstan. Email: support@hr-bot.pro. Telegram: @hrbot_pro_bot.

Under Kazakh law, we are the owner and operator of your personal data. We follow the Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection”, referred to below as the Law.

This policy covers only the hr-bot.pro website, in Russian and English, and messages you send us through the @hrbot_pro_bot bot on Telegram. It does not cover the product itself, the HR-Bot for Telegram and Slack. Employee answers in the bot are stored in the HR-Bot cloud in a data center in Kazakhstan or on the client company’s servers. How they are processed is set by the contract with the client company.

Data reaches us in three ways: through the request form, through the @hrbot_pro_bot bot on Telegram and through Yandex Metrica.

In the “Request a demo”, “Free access” or “Custom scenario” form, you enter:

• your name;
• your work email;
• your company name;
• your phone number or Telegram username (optional);
• your task (optional; this field appears only in the “Custom scenario” form).

In the “Your task” field, you describe in your own words which process you want to move into the messenger. A description of the process is all we need: there is no need to include your colleagues’ names or contacts.

The website adds to the request:

• the request type: demo, free access or custom scenario;
• the page language;
• the address of the page you sent the form from.

There is also technical data:

• The sender’s IP address. The server uses it to limit the number of requests from one address and protect the form from spam. It is kept only in the server’s memory for about 10 minutes and then erased. We don’t write it down or send it anywhere.
• Web server logs: IP address, page address, browser details (user agent) and request time. The hosting keeps them as standard technical logs, as it does for any website.

Visit data. While you browse the website, Yandex Metrica collects statistics: IP address, which pages you open and where you came from, your device and browser, clicks, scrolling and link clicks. To do this, it stores cookies in your browser. Metrica works even if you don’t submit the form. See “Cookies and analytics” for details.

We don’t ask for your IIN, ID documents, photos, health information or other sensitive data. Please don’t enter them in the form.

If you write to us directly by email, we receive only what you send and use it to reply.

Messaging us on Telegram. On Telegram, you reach us through the @hrbot_pro_bot bot. The bot copies your messages (text, photos, files, voice messages) to a private group of IE Talent Craft staff on Telegram and sends you the staff’s replies. Each person has their own topic in the group. At the start of the topic, the bot shows the staff your Telegram profile: name, @username (all active ones), Telegram ID, app language, whether you have Telegram Premium and what your bio says. If you came to the bot from a link on the website, the staff also see where from, for example the footer of the English version. We need all this to reply to you.

On the website’s server, the bot keeps only what the conversation can’t work without: your Telegram ID, name and @username, the number of your topic in the group, the time of your last message, service flags (for example, whether you are blocked) and a link between the numbers of your messages and of their copies in the group, which lets a staff reply reach you. The messages themselves are not kept on the server: they stay in the group on Telegram. We keep the conversation while it’s needed and delete it at your request; see “How long we keep the data”.

We use the form data to:

• reply to your request;
• arrange and run a demo;
• give you free access to HR-Bot;
• estimate and discuss with you how to adapt HR-Bot to your task;
• talk with you about the product: answer questions, send pricing and terms.

The legal basis is your consent (Articles 7 and 8 of the Law). Without it, we don’t process the form data. We won’t use it for other purposes without new consent.

We don’t sign you up for marketing emails. We may send you a newsletter only if you separately agree to it.

IP addresses on our server and logs keep the website running and protect it from spam and attacks. We don’t use them for anything else.

Yandex Metrica data lets us see visit statistics and make the website easier to use. See “Cookies and analytics” for details.

We don’t sell your data or use it for advertising. Decisions on requests are made by people, not by software.

The note under the form button says: “By pressing the button, you consent to the processing of your personal data and accept the privacy policy.” When you press “Send request”, “Get access” or “Send your task”, you give your consent on the terms below. The Law allows consent to be given this way as long as it can be confirmed (Article 8(1) of the Law). The confirmation is the request itself: it contains your data and the date and time it was sent.

Terms of the consent:

• Who processes the data: IE Talent Craft, IIN 801020300158.
• Whose data: yours, as the person whose name and email are in the request.
• What data: name, work email, company name, phone number or Telegram username and task (if you provided them), request type, page language and page address.
• Why: for the purposes listed in “Why we need the data and on what legal basis”.
• What we do with the data: receive, store, use, correct, pass to Telegram and the hosting provider, block, delete and destroy it.
• Transfer to third parties: yes, to Telegram and the hosting provider, only to deliver and store the request. To anyone else only when the law requires it.
• Cross-border transfer: yes. The request goes to Telegram’s servers outside Kazakhstan.
• Publication in public sources: no. We don’t publish your data.
• Term: the consent is valid while the data is needed for the purposes listed in “Why we need the data and on what legal basis”, but no longer than 12 months after our last contact with you. If you withdraw it, it ends earlier.

If you don’t agree, please don’t submit the form: we can’t accept a request without consent.

This consent covers only the request. For Yandex Metrica, which collects visit statistics, see “Cookies and analytics”.

How a request travels:

1. You submit the form. The data goes to the website’s server over a secure connection (HTTPS).
2. The server forwards the request as a message to a private Telegram channel of IE Talent Craft through the Telegram Bot API, also over HTTPS.
3. The website’s server does not save the request in a database.
4. We reply by email or on Telegram, whichever suits you, and continue the conversation there.

Cross-border transfer. Telegram’s servers are outside Kazakhstan. The request is sent to them and stored there until we delete it. This is a cross-border transfer of personal data (Article 16 of the Law). We make it on the basis of your consent. Telegram decides which country the data is stored in. How Telegram protects it is described in Telegram’s privacy policy.

Messages to the bot also go through Telegram: the copies of your messages in the staff group are stored on Telegram’s servers outside Kazakhstan until we delete them. The bot itself runs on the website’s server and keeps there only the service records listed in “What data we receive”, without message texts.

Yandex Metrica data takes a different route. Your browser sends it directly to Yandex’s servers; it never reaches our server. These servers are outside Kazakhstan, so Metrica data also goes abroad. Yandex decides where exactly to store it. See “Cookies and analytics” for details.

• IE Talent Craft staff. Only they have access to the channel with requests and to the group with messages from the bot.
• Telegram. It delivers and stores the request. Your conversation with the bot also goes through Telegram, and its copies in the staff group are stored there. We use Telegram only for that.
• The hosting provider whose servers run the website and the bot. The request passes through its equipment, and the web server logs and the bot’s records are stored with it.
• Yandex (YANDEX LLC, Russia). We count visits with its Yandex Metrica service. Yandex collects and stores Metrica data on its servers and shows us reports.
• Government authorities, only when the law directly requires it, for example at a court’s request.

We don’t share your data with anyone else: we don’t sell it or give it to ad networks or partners.

• Your request and our correspondence are kept while we discuss a demo, access or a custom scenario with you. We delete them no later than 12 months after our last contact with you.
• Your conversation with the @hrbot_pro_bot bot (your topic in the staff group and the bot’s records on the server) is kept while it’s needed to reply to you and continue the conversation, but no longer than 12 months after our last contact with you. At your request, we delete it sooner.
• If you become a client, your data is then processed under the contract with your company.
• If you withdraw consent, we delete your data within 15 working days.
• The IP address used for spam protection stays in the server’s memory for about 10 minutes and is erased automatically.
• Web server logs are kept by the hosting provider for as long as its rules provide.
• Yandex Metrica data is kept by Yandex under its own rules. The Yandex Metrica Terms of Use set no retention period. The Yandex Privacy Policy says data is kept as long as needed for the purpose it was collected for, or as long as the law requires. Session Replay (Webvisor) recordings are kept for 15 days, according to the Metrica help. Metrica cookies stay in your browser for up to a year; you can delete them in your browser settings.

Deleting a request means erasing the message with it from the Telegram channel and the emails with your data from our mailbox. Deleting a conversation with the bot means deleting your topic in the staff group and the bot’s records about you on the server. Your own chat with the bot stays with you; you can delete it in Telegram. If the law requires us to keep some data longer, we keep it only as long as the law requires and only for that reason.

Under Article 24 of the Law and Article 41 of the Digital Code of the Republic of Kazakhstan, you can:

• find out whether we hold your data: what data, where it came from, why and how we process it, and how long we keep it;
• ask us to correct or complete your data;
• ask us to block your data if you believe we broke the terms of processing;
• ask us to delete your data or anonymize it so that it can no longer identify you;
• withdraw your consent, fully or only for transfers to third parties and abroad;
• protect your rights, including claiming compensation for harm.

How to contact us. Write to support@hr-bot.pro from the address you gave in the request, or message @hrbot_pro_bot on Telegram. If we can’t tell that the request really comes from you, we’ll ask you to confirm it, so that we don’t hand your data to a stranger. It’s free of charge.

Deadlines set by law:

• information about your data: within 3 working days;
• correcting or completing your data: within 1 working day;
• blocking or deleting data processed in breach of the law: within 1 working day;
• withdrawal of consent: within 15 working days.

If we refuse, we explain why within the same deadlines.

Where to complain. To the authority responsible for personal data protection, currently the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan; to the local executive authority (akimat); or to a court. But please write to us first: it’s usually the quickest way to fix the problem.

Write to support@hr-bot.pro or message @hrbot_pro_bot on Telegram, for example: “I withdraw my consent to the processing of my personal data.” Include the email address you used in the request.

Within 15 working days we will stop processing and delete your data. We can refuse only if the law requires us to keep the data or there is an unfulfilled obligation between us (Article 8(2) of the Law). In that case, we’ll explain why within the same period.

You can withdraw consent only for the transfer to Telegram. But requests from the website are stored only in the Telegram channel, so in practice this means we delete your request.

After you withdraw consent, we won’t be able to continue talking about a demo, access or a custom scenario. If you change your mind, just send a new request.

To opt out of Yandex Metrica, you don’t need to write to us. See “Cookies and analytics” for how to do it.

Visits to the website are counted by Yandex Metrica, a service of the Russian company YANDEX LLC. There are no other counters, ad pixels or trackers on the website. The website’s fonts, images and scripts are served from our own server. Apart from it, your browser connects only to Yandex Metrica’s servers.

Cookies. Metrica stores cookies whose names start with “_ym_” in your browser, plus similar entries in localStorage. The main one holds an anonymous browser ID that lets Metrica tell one visitor from another. Others hold the date of your first visit and technical flags. The longest-lived of these cookies last a year. The full list is in the Metrica help.

What Metrica collects:

• IP address;
• which pages you open and where you came to the website from;
• your device, operating system and browser;
• clicks, scrolling and link clicks, including links to other websites.

Session Replay (Webvisor). This is part of Metrica. It records how a person uses a page: where the cursor moves, what they click, how they scroll. It does not record what you type in the form fields: the recording shows asterisks instead. Your email address on the “Request sent” screen is hidden in the recording too.

Why. This shows us how many people visit the website and where they come from, which pages they read and where they get stuck. We use it to improve the website.

Where the data is stored. Your browser sends it directly to Yandex’s servers outside Kazakhstan. Yandex decides which country to store it in. Its privacy policy names a location only for data of Russian citizens: databases in Russia (clause 7.3).

How to opt out. You can limit data collection:

• block cookies in your browser settings or delete saved ones, so Metrica won’t recognize your browser on your next visit;
• turn on a tracker blocker: many of them block requests to Metrica;
• install the official Yandex add-on, Yandex Metrica Blocker, for Chrome or Firefox. It stops Metrica cookies from being stored and limits the data sent to Metrica.

The website keeps working as usual.

How Yandex processes Metrica data is described in the Yandex Metrica Terms of Use and the Yandex Privacy Policy.

• The website runs over HTTPS, so form data is sent encrypted. The server forwards it to Telegram over HTTPS as well.
• The website’s server does not keep requests in a database.
• The @hrbot_pro_bot bot keeps only service records for the conversation on the server, without message texts.
• The channel with requests and the group with messages from the bot are private: only IE Talent Craft staff have access to them.
• IP addresses on our server are kept in memory for about 10 minutes and are not written down anywhere.
• Yandex Metrica’s Session Replay doesn’t record what you type in the form fields and hides your email address on the “Request sent” screen.
• We collect the minimum: only name, email and company name are required.

If a data breach happens, we will report it to the authorized body within one working day, as the law requires. If the breach affects your data, we will also let you know.

We update this policy when the website or the law changes. The version date is shown at the top of the page. If we change what data we collect, why, or who we pass it to, we publish the new version before the changes take effect. If something new requires your consent, we will ask for it separately.

This policy is available in Russian and English. If the two versions differ, the Russian version prevails.

Send questions about personal data to support@hr-bot.pro or @hrbot_pro_bot on Telegram. Postal address: IE Talent Craft, 73A Tole Bi St., office 312, Almaty, Kazakhstan.