PRIVACY POLICY
Personal Data Protection · Version of 05.10.2026

═══════════════════════════════════════════════════════════════════

1. GENERAL PROVISIONS

1.1. This Privacy Policy (the "Policy") defines the procedure for
collecting, processing, storing, and protecting personal data of
users of the PALS service (the "Service"), located at https://pals.kz/.

1.2. The personal data operator is "MADA Consult" Limited Liability
Partnership (BIN 230440002423), registered under the laws of the
Republic of Kazakhstan (the "Company", "Operator").

1.3. Use of the Service constitutes the User's consent to this
Policy. If you do not agree with the Policy, please do not use
the Service.

1.4. This Policy is developed in accordance with the Law of the
Republic of Kazakhstan "On Personal Data and Their Protection"
dated 21 May 2013, No. 94-V.


2. DEFINITIONS

2.1. Personal data — information relating to a specifically
identified or identifiable subject of personal data.

2.2. Processing of personal data — actions aimed at collecting,
accumulating, storing, modifying, supplementing, using,
distributing, depersonalizing, blocking, and destroying personal
data.

2.3. Subject of personal data (User) — an individual to whom the
personal data relates.

2.4. Confidentiality of personal data — mandatory observance by
persons with access to personal data of the requirement not to
disclose to third parties or distribute personal data without the
subject's consent.


3. WHAT DATA WE COLLECT

3.1. During registration and use of the Service, we may collect
the following data:

Data provided by the User:
  - Full name (first name, last name);
  - email address;
  - phone number;
  - company name;
  - position;
  - password (hashed).

Data collected automatically:
  - IP address;
  - browser type and version;
  - device type and operating system;
  - date and time of visit;
  - pages viewed in the Service;
  - actions in the Service (activity log);
  - cookies and similar technologies.

Payment data:
  - billing details;
  - payment history.

Data uploaded to the Service:
  - business data and metrics;
  - data of the User's company employees (when added to the team);
  - other data entered by the User;
  - data obtained from external platforms via API integrations
    (Meta Graph API, Google Ads API).


4. DATA RECEIVED FROM META (FACEBOOK/INSTAGRAM/WHATSAPP)

4.1. When connecting the User's Meta Business Manager to the
Service, the Operator receives access to the following data via
Meta Graph API (v25.0) with the Business Manager owner's
permission:

Advertising data (scopes: ads_read, business_management):
  - list of ad accounts and their currency;
  - daily campaign metrics: spend, impressions, clicks, leads
    (without personal data of the audience);
  - names of campaigns, ad sets, creatives.

Lead Ads (scopes: leads_retrieval, pages_manage_metadata,
pages_show_list, pages_read_engagement):
  - content of lead forms filled out by potential customers via
    the owner's advertising: name, phone, email, and custom fields
    independently defined by the owner in the form;
  - lead form data is transferred exclusively to the owner's CRM
    system (AmoCRM, Bitrix24, or Kommo) connected to the Service;
  - the Service does not use lead contact data for its own
    marketing, does not transfer them to third parties, and does
    not use them for model training.

WhatsApp Business (scopes: whatsapp_business_management,
whatsapp_business_messaging):
  - WhatsApp Business Account identifiers and phone numbers;
  - messages sent by the owner to their clients via template
    messages (incoming messages from clients are not read by the
    Service);
  - daily volume less than 100 messages per WaBa.

4.2. Meta tokens are stored encrypted, are accessible only to the
Service, are transmitted over HTTPS and are not shown to users.
Data retention period — until the owner revokes access through
Meta Business Manager settings (Business Manager → Settings →
Business Integrations).


5. DELETION OF META DATA

5.1. When the Service is removed from the User's Meta Business
Manager:
  - Meta automatically sends a data-deletion callback to the Service;
  - within 24 hours, all Meta tokens, cached advertising metrics,
    and lead data are irreversibly deleted from the Service's
    systems;
  - the deletion status can be verified by the link returned by
    the Service in response to Meta's request (format:
    https://pals.kz/api/v1/meta/data-deletion-status?code=...);
  - manual data deletion can be requested via email
    privacy@pals.kz. The request is processed within 7 business
    days.


6. DATA RECEIVED FROM GOOGLE ADS

6.1. When connecting Google Ads via OAuth, the Service receives
access to the following data (scope
https://www.googleapis.com/auth/adwords):
  - list of ad accounts (customers:listAccessibleCustomers);
  - campaign metrics: spend, impressions, clicks, conversions
    (customers/{id}/googleAds:searchStream);
  - names of campaigns and ad groups.

6.2. The Service uses the Google Ads API only to read reports: for
campaigns, ad groups and ads — cost, impressions, clicks,
conversions, names and status. The Service does not create,
modify, pause or delete campaigns, ads, keywords or budgets, and
does not change bids. Access can be revoked in the Google account
(https://myaccount.google.com/permissions) or by request to
privacy@pals.kz. See section 6A for details.


6A. GOOGLE USER DATA

What we access. When you connect Google Ads, PALS requests the
scope https://www.googleapis.com/auth/adwords and reads: the list
of Google Ads accounts accessible to you
(customers:listAccessibleCustomers); performance data — cost,
impressions, clicks and conversions, and the names and status of
campaigns, ad groups and ads.

How we use it. Only to show you your own advertising performance
in PALS. No other purpose.

Limited Use. PALS's use and transfer to any other app of
information received from Google APIs will adhere to the Google
API Services User Data Policy, including the Limited Use
requirements. In particular:

  - we use Google user data only to provide the user-facing features
    described in this section;
  - we do not transfer it to third parties except as necessary to
    provide those features, to comply with applicable law, or as part
    of a merger, acquisition or sale of assets with notice to users;
  - we do not use it for advertising, including retargeting,
    personalized or interest-based advertising;
  - we do not sell it;
  - no human reads it except with your explicit consent for specific
    data, for security purposes, to comply with applicable law, or
    when the data is aggregated and anonymized for internal
    operations;
  - we do not use it to develop, improve or train generalized AI
    and/or ML models.

Sharing. Each customer sees only their own company's data.
Infrastructure providers (hosting) process data on our behalf only
and do not use it for their own purposes.

Storage and protection. Access and refresh tokens are stored
encrypted. Data is transmitted over HTTPS/TLS. Access is
restricted to authorized staff.

Retention and deletion. We keep Google Ads data while your account
is connected. You can disconnect Google Ads in PALS (Integrations)
or revoke access at https://myaccount.google.com/permissions;
after that PALS stops accessing your Google Ads account. To have
stored tokens and Google Ads data deleted, email privacy@pals.kz —
we delete them within 30 days, except data we are required to keep
by law.

Contact. privacy@pals.kz.


7. PURPOSES OF DATA PROCESSING

7.1. We process personal data for the following purposes:
  - providing access to the Service and its functionality;
  - creating and managing an account;
  - processing payments and issuing invoices;
  - technical support and maintenance;
  - notifications about the Service;
  - improving the quality of the Service;
  - ensuring the security of the Service;
  - compliance with legal requirements;
  - marketing communications (with the User's consent).


8. LEGAL GROUNDS FOR PROCESSING

8.1. Processing of personal data is carried out on the following
grounds:
  - consent of the personal data subject;
  - performance of a contract with the personal data subject;
  - legitimate interests of the Operator (subject to non-violation
    of the subject's rights);
  - compliance with the legal requirements of the RK.


9. TRANSFER OF DATA TO THIRD PARTIES

9.1. We do not sell or transfer personal data to third parties
for their own purposes.

9.2. We may transfer data to the following categories of
recipients:
  - Service providers: hosting providers, cloud platforms,
    payment systems, banks, analytics services (in depersonalized
    form), technical support services;
  - Integrated systems: data from Meta Lead Ads is transferred
    directly to the CRM system (AmoCRM, Bitrix24, Kommo)
    connected by the User themselves;
  - Government authorities: upon official request in accordance
    with the legislation of the RK.

9.3. When transferring data to third parties, we ensure their
compliance with confidentiality and data security requirements.


10. CROSS-BORDER TRANSFER

10.1. Personal data may be stored and processed on servers
located outside the Republic of Kazakhstan.

10.2. When transferring data cross-border, we ensure an adequate
level of protection in accordance with the requirements of the
legislation of the RK.


11. DATA STORAGE

11.1. Personal data is stored for the period necessary to achieve
the purposes of processing, but not less than the term of the
contract and the storage periods established by law.

11.2. After the User stops using the Service, the User's personal
data is stored for 3 (three) years for the purposes of possible
resumption of relations and compliance with legal requirements.

11.3. Storage periods for data obtained via Meta and Google API
integrations are regulated by sections 4, 5, and 6 of this Policy.

11.4. Upon expiration of the storage period, data is destroyed or
depersonalized.


12. DATA PROTECTION

12.1. We apply organizational and technical measures to protect
personal data:
  - data encryption during transmission (SSL/TLS);
  - password hashing; encrypted storage of authorization tokens with
    restricted access;
  - access control to data;
  - regular backups;
  - security monitoring;
  - staff training.

12.2. Despite the measures taken, we cannot guarantee absolute
security of data during transmission over the Internet.


13. USER RIGHTS

13.1. The User has the right to:
  - receive information about the processing of their personal data;
  - access their personal data;
  - request correction of inaccurate data;
  - request deletion of data (in the absence of legal grounds for
    storage);
  - withdraw consent to data processing;
  - request the termination of data processing;
  - file a complaint with the authorized body.

13.2. To exercise their rights, the User can contact us via the
contacts listed in section 17.

13.3. We consider requests within 15 business days (except for
manual deletion of Meta data specified in clause 5.1).


14. COOKIES

14.1. The Service uses cookies to ensure the operation of the
Service, save User preferences, analyze usage, and improve
security.

14.2. Types of cookies used: necessary (for Service operation),
functional (for saving preferences), analytical (for improving
the Service).

14.3. The User can disable cookies in browser settings, which may
limit the functionality of the Service.


15. DATA OF MINORS

15.1. The Service is not intended for persons under 18 years of
age. We do not knowingly collect personal data of minors. If we
become aware of such data collection, it will be immediately
deleted.


16. CHANGES TO THE POLICY

16.1. The Company has the right to amend this Policy. The new
version takes effect from the moment of its posting on the Site.
Continued use of the Service after the Policy changes means
agreement with the new version.


17. CONTACT INFORMATION

For questions regarding confidentiality and personal data
processing: privacy@pals.kz

Operator details:
  "MADA Consult" Limited Liability Partnership
  Person responsible for personal data processing
  E-mail: madaconsulting4@gmail.com
  Phone: +7 702 972 6931
  Website: https://pals.kz/


18. AUTHORIZED BODY

On matters of personal data protection, the User has the right to
contact the authorized body — the Information Security Committee
of the Ministry of Digital Development, Innovations and Aerospace
Industry of the Republic of Kazakhstan.

═══════════════════════════════════════════════════════════════════
© 2026 PALS. "MADA Consult" LLP · BIN 230440002423