1. Who processes the data
The personal-data operator is ИП SDK, IIN 770210403190. Operator address: микрорайон Мамыр-1, дом 29/6, кв./офис 14 Алматы Алматы, Алматы 050026 Казахстан.
The site is intended for users who independently request information and consultation about mortgage programs in Kazakhstan.
2. What data may be processed
- contact details entered by the user: surname and given name, patronymic if applicable, phone, and optional email;
- answers about purchase purpose, city, budget, down payment, income, and other parameters needed for preliminary matching;
- service details about the request and correspondence: referral source, submission page, time, processing status, technical identifier, and service-message history;
- de-identified technical visit data, only after separate analytics consent.
Do not send an IIN, identity-document scans, bank-card details, passwords, or other information through public forms or messengers unless the operator expressly requests it through a secure process.
3. Why the data and messages are needed
- receive and process the request;
- contact the user through their chosen method, including phone, email, or WhatsApp;
- send service confirmations, reminders, links, and answers relating to the requested assessment or consultation;
- prepare preliminary matching and a consultation;
- maintain the operation, security, and quality of the site;
- evaluate the user journey and improve pages, only when the user has enabled analytics.
Service messages relate only to the user's request. The operator may send marketing messages about products, services, or special offers only with separate consent. A user may opt out at any time by replying “STOP” in WhatsApp or writing to aray@eciin.kz.
4. How processing is performed and who may receive data
Within the stated purposes, data may be collected, recorded, organized, stored, corrected, used, de-identified, blocked, and deleted.
To handle requests, communicate, and support systems, the operator may engage authorized CRM, hosting, telephony, and official messaging providers, including WhatsApp Business and Wazzup, and provide only the minimum contact and service data required. Disclosure to third parties and cross-border processing, where used, are performed with the user's consent or another basis permitted by law.
The primary request database and encrypted backups are hosted on infrastructure in the Republic of Kazakhstan. Questionnaire answers and financial information are not provided to messaging providers. Data is not sold, published, or distributed in publicly accessible sources.
5. Analytics and cookies
Google Analytics 4, Google Tag Manager, Yandex Metrica, and Meta Pixel are enabled only if configured by the site owner and the user selects “Allow analytics.” Their scripts are not loaded before consent. Webvisor is disabled.
Meta Pixel is used to measure advertising effectiveness: after consent it may receive a page-view event and, after the server accepts an application, a Lead event. ECIIN does not add a name, phone, email, application reference, internal lead identifier, or questionnaire answers to these event parameters; advertising links use only safe UTM codes without personal data.
After consent, Meta Pixel may process the open page address, advertising campaign or click context, and its own cookies or advertising identifiers under Meta's rules. This feature does not persist fbclid in the ECIIN database. ECIIN's own events do not contain a full URL with parameters. Search queries are reviewed through official Google Search Console and Yandex Webmaster reports rather than request data.
6. Retention and security
Request data, contact details, and related records are retained for no more than three years from submission. Scheduled deletion from active systems begins no later than 14 calendar days before that deadline. Data, including copies held by authorized processors, is deleted or de-identified unless longer retention is required by the laws of the Republic of Kazakhstan or to handle a stated dispute. Encrypted backups are automatically deleted no later than 14 calendar days after creation.
Access controls, secure connections, backups, and other proportionate organizational and technical measures are used. Absolute security of data transmission over the internet cannot be guaranteed.
7. User rights, withdrawal, and message opt-out
A user may request information about processing, correction, blocking, or deletion of data, and may withdraw consent within the limits allowed by applicable requirements and the operator's obligations.
Requests and withdrawals are accepted at aray@eciin.kz. Provide your surname and given name and the phone number or email used in the request. The operator stops processing within 15 business days or sends a reasoned response within the same period if retention or processing is required by the laws of the Republic of Kazakhstan.
To stop marketing messages in WhatsApp, reply “STOP.” This does not cancel an open request; service messages may be stopped separately by the same reply or by emailing the operator.
8. Changes to this document
The current version is published on this page with its update date. If a change materially affects processing, the operator requests fresh consent where required.