ВсеМастераKZPrivacy Policy
This Policy governs the processing and protection of personal data when using the website, mobile application, and related functions of the VseMasteraKZ service (the “Service”).
1. Data Controller
The owner and controller of the personal data database is JOBX LLP, Business Identification Number (BIN) 130740015336, address: 290 Bratyev Zhubanovykh Street, Building 2, Aktobe, Aktobe Region, Republic of Kazakhstan (the “Controller”).
Requests concerning personal data, access, correction, withdrawal of consent, and deletion may be submitted through the support form.
2. Legal grounds and consent
Data is processed on the basis of verifiable user consent, for entering into and performing the agreement for access to the Service, to comply with the laws of the Republic of Kazakhstan, and in other cases permitted by law.
Before registration, the user must review this Policy. Acceptance is confirmed by an affirmative action in the interface. Separate consent is requested for the Individual Identification Number (IIN), precise geolocation, public disclosure, transfers to third parties or abroad, and optional communications where required by law.
Consent remains valid until the processing purposes are achieved, the lawful retention period expires, or consent is withdrawn. Refusing optional data does not restrict functions that do not require it.
3. Data we process
- phone number, first and last name, date of birth, gender, role, city, and language;
- registration, session, device, and account-security information;
- IIN and a minimized verification result, only for the selected function and with separate consent;
- professional profile, experience, services, qualifications, documents, avatar, and portfolio;
- orders, responses, selected professional, price, statuses, action history, reviews, and replies;
- address, landmarks, and coordinates required for the relevant function;
- complaints, disputes, appeals, support requests, and attached evidence;
- push token, notification settings, and delivery information;
- IP address, request time and identifier, app version, technical errors, and security events.
Precise addresses, coordinates, phone numbers, IINs, documents, session data, and internal moderation decisions are not public.
4. Purposes of processing
- registration, authentication, and account protection;
- profiles, orders, responses, and selection of a professional;
- customer and professional interaction;
- document and qualification verification;
- reviews, ratings, complaints, disputes, and appeals;
- moderation, fraud prevention, and safety;
- service notifications and support;
- legal compliance and protection of users’ and the Controller’s rights;
- de-identified service quality and stability analytics.
The Controller does not sell personal data and does not collect data excessive for the stated purposes.
5. Sources and other users
Data is received from the user, from another party to the relevant order, automatically from the app and infrastructure, and from verification services and technical vendors within the selected function.
Another party to an order receives only information needed to choose, communicate, perform the order, leave a review, or resolve a dispute. Users must not use received information for advertising, spam, order resale, or a third-party database.
6. Vendors and external services
The Service may use providers of server infrastructure, object storage, backups, SMS, email, push notifications, geocoding, translation, infrastructure protection, and AI moderation.
Functions may use Cloud Services Kazakhstan, S3-compatible cloud storage, Firebase Cloud Messaging, Yandex Cloud, Cloudflare, Alibaba Cloud/DashScope, and the State Revenue Committee portal of Kazakhstan for a user-selected IIN verification. Only the data required for a specific operation is transferred.
Information may also be disclosed to public authorities, courts, and other authorized persons where and as required by law.
7. Storage in Kazakhstan and cross-border transfers
The primary operational database for accounts, orders, and Service events is hosted on server infrastructure in the Republic of Kazakhstan.
Some functions use foreign infrastructure. Uploaded files may be stored in the ru-central1 region in the Russian Federation. Notifications, translation, geocoding, infrastructure protection, and AI moderation may also involve processing outside Kazakhstan.
Cross-border transfers occur only for the stated function, with the required consent or another lawful basis, and in compliance with Article 16 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection.”
8. Automated moderation
The Service may automatically check text and images to remove contact information, translate content, detect prohibited material, route complaints, and moderate content. Data is minimized where possible before external processing.
A user may appeal a result that materially affects their rights through the appeal function or the support form.
9. Retention
Active-account data is retained while the Service is used. Verification codes and temporary data are retained for a short technical period; sessions are retained until expiry or revocation.
Orders, reviews, complaints, disputes, and security events may be retained after completion or account deletion in the minimum form needed for legal compliance, dispute resolution, and fraud prevention. Data is deleted or de-identified when identification is no longer needed.
Files are deleted when the retention purpose ends. Backups are kept in a limited rotation; deleted data is not restored to active use and disappears as backups are overwritten on schedule.
10. User rights
Users may obtain information about whether and how their data is processed, including purposes, sources, categories, retention periods, and recipients; request correction, blocking, de-identification, or deletion; withdraw consent; stop optional communications; and challenge the Controller’s actions.
Submit requests through the support form. The Controller may verify account ownership to protect data. Never send a password or one-time code.
After consent is withdrawn, the Controller stops processing within fifteen business days unless processing is required by law or an outstanding obligation, or provides a reasoned refusal.
11. Account deletion
Deletion is initiated in the app settings. The unified customer/professional account is deactivated, sessions are revoked, and data that is no longer needed is deleted or de-identified. Data required for law, disputes, and safety is blocked from ordinary use and minimized.
See Account and data deletion for the detailed procedure.
12. Security and incidents
The Controller uses access controls, encrypted connections, session controls, administrative audit logs, attempt limits, backups, and other organizational and technical safeguards.
If a security breach occurs, the Controller records the incident, limits its impact, provides notices required by law, and takes steps to prevent recurrence.
13. Age, website, and changes
The Service is intended for people aged 18 or older. Legal pages store only the selected language on the device and do not use it for advertising tracking.
The Controller will notify users in the app of material changes to purposes, data categories, recipients, or foreign transfers. Where new consent is required, the relevant processing begins only after consent is obtained.
14. Controller details
JOBX LLP
BIN 130740015336
290 Bratyev Zhubanovykh Street, Building 2, Aktobe, Aktobe Region, Republic of Kazakhstan
Contact: support form