SANDALUCI

Consent to the collection and processing of personal data

Version consent-2026-11.1 · November 2026

Translation for convenience. The Russian and Kazakh versions of this document are the legally binding ones.

By ticking the box in a form on sandaluci.com, I, the data subject who has given my name in the form, freely, of my own will and in my own interest give my consent under Articles 7, 8 and 16 of the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V "On Personal Data and Their Protection":

1. Owner and operator

Sandaluci LLP (ТОО «Sandaluci»), BIN 191040011689, address: 193g Zhangeldin St., Almaty 050018, Republic of Kazakhstan; e-mail for requests: info@sandaluci.com.

2. Data covered

Name (and surname, if given); phone number; e-mail address (if given); company name, city, type and stage of the venue, role in the project (if given); the text of the message and attached files (floor plans, project links); information about where the visit came from (utm tags, ad click identifiers) and technical data of the submission (IP address, date and time, browser).

3. Purposes

Replying to the enquiry; calculating the cost and preparing a commercial offer; contacting me by phone, WhatsApp and e-mail about the enquiry; concluding and performing a contract; measuring advertising effectiveness (only hashed data are passed to advertising systems, see item 5).

4. Actions

Collection, accumulation, storage, modification, supplementing, use, anonymisation, blocking, transfer (including cross-border), destruction and deletion, with and without automated means. Enquiries are pre-sorted automatically by urgency; a manager makes the decision on each enquiry.

5. Transfer to third parties

Yes, only to processors that keep the site running and provide communication:

  • Vercel Inc. (USA) — website hosting and processing of the form submission;
  • Resend, Inc. (USA) / Amazon Web Services (Japan) — delivery of enquiry notifications;
  • Google LLC (USA) — corporate mail (Gmail) and the enquiry table (Google Sheets);
  • Supabase (USA) — enquiry database;
  • Meta Platforms (USA, Ireland) — advertising measurement: phone, e-mail and name are passed only as a SHA-256 hash (Meta uses it to match the enquiry to an account; a hash remains personal data); and WhatsApp correspondence, if you write to us there;
  • Yandex LLC (Russia), Google LLC (USA), OpenAI (USA) — analytics and advertising measurement services named in the Privacy Policy; they run unless you decline in the cookie notice.

Data is not sold and is not disclosed in publicly available sources.

6. Cross-border transfer

Yes, to the USA, Ireland, Japan and Russia, within the scope set out in item 5. The main data store is located in the Republic of Kazakhstan (a CRM system on servers in Kazakhstan).

7. Disclosure in publicly available sources

None.

8. Validity period

Until the purposes of processing are achieved, but no longer than 3 (three) years from the date of the last contact. If a contract is concluded, for the term of the contract and the document retention period set by the law of the Republic of Kazakhstan.

9. Withdrawal of consent

Consent may be withdrawn at any time by writing to info@sandaluci.com or to the operator's address. Processing stops within 15 working days, except where it is required by law or an obligation remains unperformed (Article 8 of the Law).

10. Confirmation

I confirm that I have read the Privacy Policy, that I understand my rights (Article 24 of the Law), and that I pass on data of third parties (for example, in a floor plan) with their consent.