Privacy Policy

The Policy applies to visitors of https://x-labs.kz and to anyone who contacts us via the contact form, the brief form or the communication channels listed on the website: email, phone, WhatsApp and Telegram.

In this Policy, the personal data operator is referred to as “X-Labs.kz” / “we”. The website is informational and is dedicated to software development, automation and AI implementation services.

By submitting a request via a website form and ticking the consent box, you confirm that you have read the Policy and consent to the processing of the data you provide on the terms set out below. Using the website without submitting forms does not require separate consent to personal data processing, except for the technical processing needed to display pages and protect the website.

If you do not agree with the Policy, please do not fill in the forms or send us personal data. You may withdraw your consent at any time as described in Section 9.

We collect only the information you provide in the website forms, plus the minimum technical data required for the website to work and to prevent abuse. The fields listed below match the forms actually in use.

Contact form (“Contact X-Labs.kz”):

• name;
• email address;
• phone number — if provided;
• company name — if provided;
• message text.

Brief form (“Get a free project spec”):

• name;
• job title;
• company;
• email address;
• phone number;
• website or product name;
• request type;
• description of the business problem and the project;
• information about users;
• information about the current system;
• industry;
• desired timeline;
• budget range;
• preferred contact channel (email, call or messenger).

If you write to [email protected], call +7 707 524 88 88 or contact us via WhatsApp or Telegram, we process the data you share in the correspondence or conversation: your contact details and the content of your request.

Technical data. When you submit a request, your IP address may be used for rate limiting and to protect forms from spam. Standard HTTP request headers, including browser information, are processed by the web server when you access the website. This information is not used for marketing or behavioural analytics. The website does not support file uploads, and we do not accept attachments through the forms.

No third-party web analytics, advertising pixels or identifier-collection systems are connected to the website. We do not collect bank card data or request identity documents through the website.

Personal data is processed solely for the following purposes:

• receiving and reviewing enquiries, requests and briefs;
• contacting you via the details and channel you provided;
• clarifying the task, holding a preliminary discussion and preparing a solution outline / technical specification;
• pre-contract negotiations and, by mutual agreement, preparing a contract;
• ensuring website security and protecting forms from spam and automated submissions;
• complying with the laws of the Republic of Kazakhstan.

We do not use personal data to send advertising without separate consent and do not build marketing profiles of website visitors.

The main legal ground for processing data received through the website forms is the consent of the data subject. Consent is given voluntarily, in a specific form, by ticking the relevant box before submitting a request.

Technical data required to display the website and prevent abuse is processed because the service cannot operate securely without it.

If the parties sign a contract following an enquiry, further processing of data related to performing the contract may be based on that contract. Contract terms are agreed separately and are not replaced by this Policy.

Where expressly provided by the laws of the Republic of Kazakhstan, processing may take place without consent — to the extent and for the period required by law.

Personal data is stored on servers located in the Republic of Kazakhstan. We do not host the website's request database outside the Republic of Kazakhstan.

The retention period depends on the purpose of processing. Requests and related correspondence are kept for as long as needed to respond, negotiate and protect legitimate interests, but no longer than three years from the last interaction on the request, or until consent is withdrawn — unless there are other legal grounds for retention at that point.

Technical data used for rate limiting does not form a long-term archive of personal data and is used only briefly to protect the website.

Once the purpose of processing is achieved or consent is withdrawn, data is destroyed or anonymised within a reasonable time, except where retention is required by the laws of the Republic of Kazakhstan.

We do not share or sell personal data to third parties. Requests are accessible only to people who need them to respond and negotiate.

The exception is disclosure required by the laws of the Republic of Kazakhstan: at the request of a court, an authorised body, the prosecutor's office, investigative or other government bodies within their competence.

Personal data is not transferred across borders. Data received through the website is collected, processed and stored in the Republic of Kazakhstan.

We take organisational and technical measures proportionate to the nature of the data and the risks of processing it:

• limiting the number of people with access to requests;
• using a secure HTTPS connection for the website;
• checking forms for automated and repeated submissions;
• storing data on servers in the Republic of Kazakhstan;
• destroying data when retention periods expire or consent is withdrawn.

Details of our infrastructure and internal security procedures are not disclosed so as not to weaken protection. No measure offers an absolute guarantee, but we strive to maintain a level of protection that meets the requirements of the laws of the Republic of Kazakhstan.

Under the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, you have the right to:

• know whether we hold your personal data and receive information about its processing;
• request correction of inaccurate or incomplete data;
• withdraw your consent to processing;
• request deletion (destruction) of data if it is processed unlawfully or the purpose of processing has been achieved, and also when consent is withdrawn — in the absence of other legal grounds;
• request blocking of data while it is being verified if there is information that it is inaccurate or processed unlawfully;
• appeal the operator's actions (or inaction) to the authorised personal data protection body and to the courts.

To exercise these rights, send a request to [email protected]. Include your name, a contact for our reply and the substance of your request. If necessary, we may ask for information sufficient to identify you so that data is not disclosed to a third party.

You can also submit the same request by phone at +7 707 524 88 88 or via the WhatsApp and Telegram channels listed on the website. We review requests within a reasonable time, usually within thirty calendar days of receipt.

As of the effective date of this Policy, the website does not use third-party analytics, advertising networks or marketing cookies. We do not set advertising or analytics identifiers and do not share visit information with third parties.

Your theme preference (light or dark) is stored locally in your browser and is not sent to us as personal data. The site opens in the light theme by default and does not follow the operating system's color scheme.

The website's hosting infrastructure may process technical request data needed to deliver pages. If we add analytics or other tools that use cookies in the future, we will update this section and request consent where required.

The website is intended for business representatives and is not meant for people under 18. We do not knowingly collect personal data from minors. If we learn that data was received from a person under 18, we will delete it. If you believe such data has been shared with us, please write to [email protected].

We may update the Policy if the website forms, the data processed, legal requirements or our processes change. The current version is always published on this page with its effective date.

Continuing to use the website and submitting new requests after a new version is published means you accept the updated terms for subsequent processing. Requests submitted earlier are governed by the rules in force when they were received, unless the law requires otherwise.

For questions about personal data processing and exercising your rights, contact X-Labs.kz:

• website: https://x-labs.kz;
• email: [email protected];
• phone: +7 707 524 88 88;
• WhatsApp and Telegram — the channels listed on the website.

This Policy takes effect on September 30, 2026 and remains in force until a new version is published.