Policy on Cookies and Similar Technologies
The Russian text prevails. Kazakh and English translations are provided for convenience.
1. General Provisions
1.1. This Policy describes the cookies and similar technologies used on the dalaway.kz website (the “Website”) and the Dalaway digital platform at app.dalaway.kz (the “Platform”), their purposes and how visitors control them.
1.2. The Operator of the website and Platform is SteppeGate LLP, BIN 260140019690.
1.3. This Policy supplements the Privacy and Personal Data Processing Policy. Where information obtained through the listed technologies constitutes personal data, the Privacy Policy applies to it.
1.4. This Policy applies to website visitors and Platform Users whether or not they have an account.
2. Cookies and Similar Technologies
2.1. A cookie is a small file stored by a visitor’s browser at a website’s request and sent back on subsequent requests.
2.2. Similar technologies include on-device browser storage (localStorage, sessionStorage), session identifiers, pixels and web beacons, and device identifiers in a mobile application.
2.3. This Policy applies to all the technologies listed, regardless of their names. Some information specified in section 4 is stored in local browser storage rather than cookies; this does not affect the applicable legal regime.
2.4. First-party and third-party technologies. First-party technologies are set by the Operator’s domains: dalaway.kz, app.dalaway.kz, api.dalaway.kz. Third-party technologies are set by the domains of providers engaged by the Operator and are listed in section 4.
3. Categories and Legal Regime
3.1. Categories:
| Category | Purpose | Regime |
|---|---|---|
| Strictly necessary | Authentication, session maintenance, file access control, security, saving the visitor’s choice in the consent panel and the selected Website language | Set without consent: logging in and operating the Platform are impossible without them |
| Functional | Saving the interface settings selected by the User | Set after login in connection with performance of the Agreement |
| Entries made before an account is created | Record of deferred review of a legal document | Created before login and before account creation. The regime is described in section 3-1 |
| Analytics | Visit statistics, performance measurement and detection of display errors | Used only on the informational pages of the Dalaway website and only with visitor consent under section 5 |
| Advertising and targeting | — | Not used. The Operator does not display third-party advertising, transfer information to advertising networks or create advertising profiles. Transmission of information to analytics providers’ advertising systems is disabled in the settings of the relevant services |
3.2. Before login, the Operator does not set cookies or write information to local browser storage, except for: entries listed in section 3-1; the entry recording the visitor’s choice in the consent panel (dalaway-cookie-choice) and the Website language entry (dalaway-locale), listed in section 4 as strictly necessary, without which the visitor’s choice cannot be implemented and the Website cannot be shown in the language selected; the Platform browser session marker (dalaway_browser_session); and analytics entries set after consent under section 5.
3.2-1. Analytics technologies are used only on the informational pages of the Dalaway website. Third-party counters, analytics scripts, visitor activity recording and click heatmap tools are not loaded on registration, login or access recovery pages, or within the Platform.
3.3. Strictly necessary technologies cannot be refused: without them, login and delivery of files accessible only to the User do not work. Refusing them is equivalent to declining to use the Platform.
3.4. The User may delete functional entries at any time through the browser. Deletion resets the interface to its default settings. It does not restrict access to Platform functionality. Logging out deletes authorisation data but does not automatically delete all interface settings.
3-1. Entries Created Before Account Creation
3-1.1. Time of consent. Consent to the collection and processing of personal data is given through a separate action before the verification code request button is pressed. Sending a code to the email address provided by the visitor constitutes transfer of that address to the transactional email provider located outside the Republic of Kazakhstan and takes place only after consent is given. Without the checkbox being selected, the server rejects the code request and the address is not transferred to the provider.
3-1.2. The Consent text and this Policy are available before that time. Consent given at the final registration step is insufficient for an earlier code transmission. Requesting another code under the same consent does not require renewed acceptance of unchanged text.
3-1.3. The record of deferred review contains no personal data, is not linked to an account on the Operator’s side, and is retained until the tab session ends. It does not constitute acceptance of a document: mandatory documents are accepted through a separate action.
4. List of Technologies Used
The list reflects the technologies actually used on the publication date and is kept up to date.
4.1. Website dalaway.kz
Strictly necessary
| Name | Storage location | Purpose | Data | Period |
|---|---|---|---|---|
| dalaway-cookie-choice | Browser local storage, dalaway.kz | Saving the visitor’s choice in the consent panel. Created without consent because the choice cannot be implemented without it | Selected categories, date and time of the choice, Policy version number | 12 months; requested again when a new version of the Policy is published |
| dalaway-locale | Cookie, dalaway.kz, path /, SameSite=Lax, Secure |
Showing the Website in the language selected by the visitor | Language code | 12 months |
Analytics — set only after consent
| Provider | Tool | Purpose | Data | Where processed | Provider policy |
|---|---|---|---|---|---|
| Google Analytics | Statistics on visits and behaviour on pages | Browser identifier, network address, addresses of pages viewed, device and browser type, approximate region | Outside the Republic of Kazakhstan | policies.google.com/privacy | |
| Google Tag Manager | Managing the loading of analytics tools | Technical information about tools being loaded | Outside the Republic of Kazakhstan | policies.google.com/privacy | |
| Yandex LLC | Yandex Metrica | Visit statistics, performance measurement and detection of display errors | Browser identifier, network address, addresses of pages viewed, device and browser type, approximate region, clicks on external links | Outside the Republic of Kazakhstan | yandex.ru/legal/confidential |
Yandex Metrica sets entries with the _ym prefix in cookies and browser storage, including _ym_uid, _ym_d and _ym_isad. Their periods are set by the provider. If the visitor declines analytics or withdraws consent, the Website deletes all entries with the _ym prefix.
If a tool sets several entries, all are included in the list. The Operator keeps the list up to date and updates it when the set of tools used changes.
Visitor activity recording, session replay and click heatmap tools are not used. Advertising networks and pixels are not loaded.
4.2. Platform app.dalaway.kz
Strictly necessary
| Name | Storage location | Purpose | Data | Period |
|---|---|---|---|---|
| dalaway-access-token | Cookie, HttpOnly, Secure; host api.dalaway.kz only; path /v1/files/resolve; SameSite=Lax |
Confirming the User’s entitlement to receive a protected file | Access token | 1 hour or until logout |
| dalaway_browser_session | Cookie, app.dalaway.kz, path /, SameSite=Strict, Secure |
Browser session marker: if it is absent, saved tokens are deleted and the login does not survive closing the browser | Technical flag, contains no personal data | Until the browser is closed |
| accessToken | Browser local storage | User authentication and authorisation | Access token | 1 hour; deleted on logout and when the browser is closed |
| refreshToken | Browser local storage | Extending the session without re-entering the password | Refresh token | The session ends after 2 hours of inactivity and no later than 12 hours after login; deleted on logout and when the browser is closed |
Functional — created after login
| Name | Storage location | Purpose | Data | Period |
|---|---|---|---|---|
| dalaway.locale | Browser local storage | Interface language | Language code | Until deleted by the User |
| dalaway.activeOrganizationId | Browser local storage | Selected company | Company identifier | Until logout |
| dalaway.tradeMode:⟨user and company identifiers⟩ | Browser local storage | Active work section (selling / buying) | Section identifier | Until deleted by the User |
| dalaway.sidebar.expanded | Browser local storage | Sidebar state | “Expanded / collapsed” flag | Until deleted by the User |
| dalaway.dealFee.expanded | Browser local storage | State of the Fee block in a Transaction | “Expanded / collapsed” flag | Until deleted by the User |
| dalaway.market.viewCurrency | Browser local storage | Currency in which prices are shown in the marketplace | Currency code | Until deleted by the User |
| dalaway.notificationCenter.v2 | Browser local storage | Tab and filter of the notification centre | Tab code, “unread only” flag | Until deleted by the User |
Tab session entries
| Name | Storage location | Purpose | Data | Period |
|---|---|---|---|---|
| dlw:legal-gate-dismissed | Browser session storage | Record of deferred review of a legal document | Document code and version number | Until the tab is closed |
| dlw:legal-gate-recoveries | Browser session storage | Counter of repeated displays of the consent window | Number | Until the tab is closed |
| sessionUserChanged | Browser session storage | Warning that another user has logged in in another tab | Flag | Until the next page load |
Analytics and third-party technologies are not used within the Platform.
4.3. The current version of the list is published at this Policy’s address. Before any analytics technology is enabled, the list is updated and consent is requested under section 5.
5. Consent to Analytics Technologies
5.1. This section applies to the analytics technologies listed in section 4. It does not affect consent to personal data processing given before requesting a verification code (section 3-1), or other consents provided for in the Operator’s documents.
5.1-1. This section applies only to the informational pages of the Dalaway website.
5.2. On the first visit, a choice panel is displayed containing a brief description of the categories, names of the tools used, an indication that collected information may be processed outside the Republic of Kazakhstan, a link to this Policy and three equivalent actions: “Accept All”, “Necessary Only” and access to category settings.
5.2-1. No analytics technology is loaded before the visitor makes a choice. Before that choice, no analytics scripts or tag manager are executed and no requests are sent to providers’ servers. A panel displayed after such tools have loaded does not constitute consent.
5.3. Accept and reject buttons are equally accessible and appear on the first screen of the banner.
5.4. Silence, closing the panel and continuing to browse do not constitute consent and are equivalent to selecting “Necessary Only”. Only strictly necessary technologies are set before the visitor’s choice.
5.5. The visitor’s choice is saved for twelve months, after which it is requested again.
5.6. The choice may be changed at any time under section 6. Changes apply prospectively; previously set files in disabled categories are deleted.
5.7. The visitor’s choice is stored in their browser in the dalaway-cookie-choice entry with the date, time, selected categories and version number of this Policy. The choice is not transmitted to the Operator’s servers.
5.8. Withdrawal of consent applies prospectively. Information collected before withdrawal is processed under the relevant providers’ policies. The Operator considers requests for deletion in respect of processing it carries out itself and coordinates with the engaged provider. Requests are sent to privacy@dalaway.kz.
6. Settings Panel and Browser Controls
6.1. Cookie Settings. The “Cookie Settings” link appears at the bottom of every Website page and opens the choice panel under section 5. Analytics technologies are not used within the Platform, and the choice panel is not displayed there.
6.2. Visitors may also manage cookies and local browser storage through their browser by blocking them, deleting saved entries and setting notifications. Deleting website data may end the current session and reset interface settings. Blocking strictly necessary technologies makes login impossible.
7. Data Obtained Through the Listed Technologies
7.1. All the information listed in section 4 is processed: access and refresh tokens, interface settings selected by the User, the visitor’s saved choice in the consent panel, the selected Website language, the record of deferred review and, where the visitor consents to analytics technologies, the browser identifier, network address, addresses of pages viewed, device and browser type and approximate region.
7.2. Tokens relate to the User’s account and, to that extent, constitute personal data. Their processing is legally based on performance of the Accession Agreement and the Consent to the Collection and Processing of Personal Data.
7.3. Interface settings contain only technical identifiers of the account and the company and are used solely in the User’s browser. The record of deferred review contains no personal data.
7.4. Retention periods are specified in section 4 and do not exceed those established in section 13 of the Privacy Policy.
7.5. Profiling, tracking behaviour across websites and creating advertising profiles are not carried out.
8. Transfer to Third Parties
8.1. Information obtained through the analytics technologies listed in section 4 is transferred to their providers specified in that section and only after the visitor’s consent. The information transferred and each provider’s policy are specified in the list in section 4.
8.1-1. Information obtained through strictly necessary and functional technologies and through entries made before account creation is not transferred to third parties.
8.2. Where a service provider using its own storage technologies is engaged, the categories of recipients and, for cross-border transfers, the countries where they are located are specified in sections 10 and 11 of the Privacy Policy, and the list in section 4 of this Policy is updated before use begins.
8.3. The Operator does not sell or transfer this information to advertising networks, data brokers or other third parties for their own purposes.
9. Visitor Rights
9.1. A visitor who is a personal data subject has the rights established in section 17 of the Privacy Policy, including the rights to information about processing, to its blocking and to withdrawal of consent.
9.2. Requests are sent to privacy@dalaway.kz.
10. Changes to This Policy
10.1. Changes are published at this Policy’s address with the publication date and effective date.
10.2. Changes introducing analytics technologies trigger section 5 and require the visitor’s choice to be requested before their use begins.
10.3. Each version is retained in the archive at a permanent address.