Legal
Privacy Policy
This Policy has been developed in accordance with the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan "On Personal Data and Their Protection", the Civil Code of the Republic of Kazakhstan, the Tax Code of the Republic of Kazakhstan, and other applicable regulatory legal acts.
Updated: July 28, 2026
1. Controller of Personal Data
The controller of personal data is:
An individual
Republic of Kazakhstan, Balkhash
E-mail: [email protected]
Website: stayin.kz
Hereinafter — the "Operator" or "We".
At the current stage, the StayInKZ platform operates in test mode and does not charge users and owners of accommodation facilities for using the service. Personal data is processed for the purposes described in this Policy, regardless of whether paid services are available on the platform.
The contact point for exercising the rights of personal data subjects is the Operator’s e-mail address indicated above. A separate telephone number for the Operator is not a mandatory element of the Policy where a working e-mail communication channel is available.
2. What Data We Collect
2.1. Data of guests (platform users). When using the site, we may collect:
- Identification data: name, phone number, e-mail address — upon registration or when filling out the request form.
- Request data: selected dates, number of guests, information provided in the booking request.
- Technical data: technical data, which may include the IP address, information about the device, browser, operating system, interface language, time of visit, and the user’s actions on the site.
- Cookie data: cookie files and similar tracking technologies (for details, see Section 7 and the Cookie Policy).
2.2. Data of Partners (Facility Owners)
When registering a facility, we collect:
- Name, IIN/BIN, contact phone number, e-mail address.
- The address and description of the accommodation facility, photographs, prices, and house rules.
- Payment details for settlements (upon the platform’s transition to a paid model).
2.3. Source of the Data
Personal data may be obtained:
- directly from the user;
- automatically when using the site;
- from the owner of the accommodation facility, where necessary to process a request.
3. Purposes of the Collection and Processing of Data
We process personal data solely for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and maintaining a user account | Consent of the personal data subject |
| Transmitting a guest’s request to the facility owner | Consent of the personal data subject, terms of the Terms of Service |
| Maintaining the balance and tracking requests within the service | Consent of the personal data subject |
| Responding to support inquiries | Consent of the personal data subject |
| Verification of the facility owner’s identity, fraud prevention (including for the purpose of contacting law enforcement authorities where there are indications of fraudulent activity) | Consent of the personal data subject, legitimate interest of the Operator |
| Ensuring the security of the platform, preventing fraud, and protecting the rights and legitimate interests of the Operator in cases provided for by the legislation of the Republic of Kazakhstan | Legislation of the Republic of Kazakhstan |
| Analytics and service improvement | Consent of the personal data subject (cookies) |
| Compliance with the requirements of the legislation of the Republic of Kazakhstan | Requirement of law |
3.1. Method of Processing
The processing of personal data is carried out both with the use of automation tools and without their use.
4. Transfer of Personal Data to Third Parties
4.1. Transfer to facility owners. When a booking request is made, the guest’s contact details (name, phone number) are transferred to the facility owner solely for the purpose of processing that specific request.
Important: data is transferred only with the guest’s explicit consent, expressed by checking the corresponding box when making the request.
The facility owner is required to use the data received solely to make contact regarding the specific request and has no right to transfer it to third parties.
4.2. Technical Contractors
Data may be processed by technical contractors that support the platform’s hosting, analytics, security, and technical support. Such contractors act solely on the instructions of the Operator and are required to comply with the requirements of the legislation of the Republic of Kazakhstan on personal data and its protection.
The processing of personal data by the contractor PS Cloud Services is carried out in accordance with the Personal Data Collection, Processing, and Protection Policy of "Internet Company PS" LLP.
List of contractors:
| Contractor | Country | Purpose | Data Transferred |
|---|---|---|---|
| PS Cloud Services ("Internet Company PS" LLP) | Republic of Kazakhstan | Hosting, data storage | All platform data |
| Yandex.Metrica ("Yandex" LLC) | Russia | Web analytics | Technical data, which may include the IP address, information about the device, browser, operating system, interface language, time of visit, and the user’s actions on the site |
| Google Analytics 4 (GA4) (Google LLC) | USA | Web analytics | Technical data, which may include the IP address, information about the device, browser, operating system, interface language, time of visit, and the user’s actions on the site |
4.3. Government Authorities
Data may be transferred to government authorities of the Republic of Kazakhstan in cases provided for by the legislation of the Republic of Kazakhstan.
4.4. Cross-Border Transfer
The primary user database is stored within the territory of the Republic of Kazakhstan. Primary data storage is carried out on PS Cloud Services servers located in the Republic of Kazakhstan.
Yandex.Metrica and Google Analytics 4 (GA4) may process technical data (cookies, technical data which may include the IP address) on servers located outside the Republic of Kazakhstan — in Russia and the USA, respectively. Such processing is carried out solely for analytical purposes and does not include users’ personal identification data (name, phone number, e-mail).
Cross-border transfer of personal data is carried out in the cases and in the manner provided for by the legislation of the Republic of Kazakhstan, including obtaining the consent of the personal data subject where such consent is required.
4.5. Responsibility of Facility Owners for Further Processing of Data
After a guest’s personal data has been transferred to the owner of an accommodation facility for the purpose of processing a specific request, the facility owner is solely responsible for any further processing of that data within the limits of the legislation of the Republic of Kazakhstan.
StayInKZ does not control the facility owner’s further processing of personal data after it has been lawfully transferred.
5. Data Retention Period
Personal data is retained for no longer than is required by the purposes of its processing, in accordance with the legislation of the Republic of Kazakhstan on personal data and its protection and the limitation periods established by the Civil Code of the Republic of Kazakhstan.
| Data Category | Retention Period | Basis |
|---|---|---|
| User (guest) account data | For the duration of the account’s existence + 3 years after deletion | Limitation period under the legislation of the Republic of Kazakhstan |
| Booking request data | For the duration of the account’s existence + 3 years from the last request | Limitation period under the legislation of the Republic of Kazakhstan |
| Partner (facility owner) data | For the duration of the use of the service + 3 years after the use ceases | Limitation period under the legislation of the Republic of Kazakhstan |
| Financial data and transactions (once paid services become available) | 5 years from the date of the transaction | Tax legislation of the Republic of Kazakhstan |
| Technical data (logs, IP) | 1 year | Technical necessity |
| Cookie data | In accordance with the type of cookie (Section 7) | User consent |
5.1. When the Retention Period Begins
Important: for as long as a user actively uses the platform, the purpose of processing the data continues to exist, and the data continues to be retained. The three-year period begins to run only after use of the platform ceases (account deletion, or a partner’s discontinued use of the service).
Upon expiry of the established periods, data is destroyed or anonymized, where further retention is permitted under the legislation of the Republic of Kazakhstan, in a manner that makes its further identification impossible.
6. Rights of Personal Data Subjects
In accordance with the legislation of the Republic of Kazakhstan on personal data and its protection, you have the right to:
- 6.1. Receive information about the processing of your personal data.
- 6.2. Request the correction of inaccurate or incomplete data.
- 6.3. Request the deletion of data where its retention is no longer necessary for the purposes of processing.
- 6.4. Withdraw your consent to the processing of data. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
- 6.5. Opt out of receiving marketing and informational messages at any time.
- 6.6. Change your cookie settings in your browser or through our cookie banner.
6.7. How to Exercise Your Rights
To exercise your rights, send a request to the following e-mail address: [email protected].
Inquiries are reviewed within the periods provided for by the legislation of the Republic of Kazakhstan, or within a reasonable time necessary for review. As an internal service standard, the Operator strives to respond within 5 (five) business days of receiving the request.
7. Cookies and Tracking Technologies
7.1. What cookies are. Cookies are small text files that are stored on your device when you visit a website.
7.2. What cookies we use:
| Type | Service | Purpose | Duration |
|---|---|---|---|
| Essential | stayin.kz | Authorization, security, operation of the site | Session / up to 1 year |
| Analytical | Yandex.Metrica | Visit statistics, anonymized behavioral data | Up to 1 year |
| Analytical | Google Analytics 4 (GA4) | Visit statistics, anonymized behavioral data | Up to 2 years |
| Functional | stayin.kz | Remembering language and interface settings | Up to 1 year |
7.3. Managing Cookies
You can disable cookies in your browser settings or through the banner on the site. Disabling essential cookies may affect the operation of the site.
Further details are also described in the separate Cookie Policy.
8. Data Protection
We apply organizational and technical measures to protect personal data in accordance with the requirements of the legislation of the Republic of Kazakhstan on personal data and its protection:
- Encryption of data in transit (HTTPS/TLS)
- Restriction of access to data (authorized personnel only)
- Regular backups
- Security monitoring
8.1. Security Limitations
No method of transmitting data over the internet is completely secure. In the event a security incident is detected, we will notify you within the periods established by the legislation of the Republic of Kazakhstan.
9. Legal Capacity and Data of Minors
By using the StayInKZ platform, the user confirms that they possess the legal capacity necessary to use the service and to enter into the corresponding transactions in accordance with the legislation of the Republic of Kazakhstan.
The minimum age for independent use of the platform is established by the Terms of Service and is 14 (fourteen) years, in accordance with Article 22 of the Civil Code of the Republic of Kazakhstan. The StayInKZ platform is not intended for independent use by persons younger than the stated age. We do not intentionally collect the personal data of such persons.
If you become aware that a person lacking the necessary legal capacity, or a minor, has provided us with their data without the consent of a legal representative, please notify us immediately at [email protected]. We will take steps to delete such data within the periods provided for by the legislation of the Republic of Kazakhstan, or within a reasonable time necessary for review.
10. Account Deletion
The user has the right to delete their account on the StayInKZ platform.
After an account is deleted, the retention period for personal data established by Section 5 of this Policy begins to run.
Upon expiry of the established retention period, data is destroyed or anonymized, where further retention is permitted under the legislation of the Republic of Kazakhstan.
11. Amendments to the Policy
We have the right to periodically update this Privacy Policy in connection with changes to the legislation of the Republic of Kazakhstan, changes to the Operator’s legal status (including registration as an individual entrepreneur), or changes to the terms of the platform’s operation.
In the event of material changes, we will notify users by posting the new version on the website and/or by sending a notification by e-mail.
The current version of the Policy is always available at: stayin.kz/privacy
Continued use of the platform after the amendments take effect constitutes acceptance of the new terms.
12. Contacts
For all questions related to the processing of personal data:
An individual
Republic of Kazakhstan, Balkhash
E-mail: [email protected]
Inquiries are reviewed within the periods provided for by the legislation of the Republic of Kazakhstan, or within a reasonable time necessary for review. As an internal service standard, the Operator strives to respond within 5 (five) business days.
This Privacy Policy is drafted in accordance with the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan "On Personal Data and Their Protection", the Civil Code of the Republic of Kazakhstan, the Tax Code of the Republic of Kazakhstan, and other applicable regulatory legal acts.