Privacy Policy and Personal Data Processing

1. General Provisions
This Privacy Policy and Personal Data Processing Policy (hereinafter – the “Policy”) defines the procedure for collecting, using, transferring, and protecting users’ personal data processed by NexaXT in the course of providing chatbot development and maintenance services. NexaXT (hereinafter – the “Operator”) collects and processes users’ personal data exclusively with their consent and in accordance with the laws of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” No. 94-V dated 21 May 2013.

Use of the chatbot or other services provided by LLP “NEXA IKC TI” (BIN 230940021527), registered at 050013, Almaty, Bostandyk District, Seifullin Ave., Bldg. 617 (hereinafter – “NexaXT”), by a user constitutes the unconditional acceptance of the terms of this Policy. If the user does not agree with these terms, they must refrain from using the chatbot and related services.

2. Personal Data and Purpose of Collection
The Operator collects and processes only the personal data necessary to provide chatbot services and interact with the user. Such data may include:

• User identification data in the messenger (e.g., phone number or other unique identifier, as well as profile name, if available).

• The content of the user’s messages sent to the chatbot (text queries, attachments, and any other information voluntarily provided during communication).

• Technical data about interaction with the chatbot: timestamps of messages, information about the messenger used, usage statistics (e.g., number of interactions).

Data is collected directly from the user at the time they contact the chatbot. Users are requested not to provide excessive or irrelevant information unrelated to the purpose of communication – the Operator does not process personal data whose volume and content do not correspond to the stated purposes of processing. Users should also refrain from disclosing personal data of third parties in correspondence without sufficient legal grounds.

Purposes of processing personal data:

• Provision of chatbot services. Personal data is used to ensure the chatbot functions correctly, namely to receive the user’s request, process it using an AI model, and send a response.

• Feedback and support. Identification data and conversation history may be used to contact the user (e.g., if the client company decides to involve a live operator to resolve the request) and to improve service quality.

• Analytics and service improvement. The Operator and clients (chatbot customers) analyze user requests and behavior in aggregated form for product analytics and service improvement. This may include automated analysis of messages (e.g., to predict user preferences and increase the relevance of responses). Public reports (such as Power BI dashboards) use only aggregated statistical data without revealing users’ identities.

• Compliance with legal requirements. If necessary, personal data may be used to fulfill the Operator’s legal obligations (e.g., storing data for the legally required period, providing data upon lawful requests from government authorities).

The Operator does not process personal data for purposes incompatible with those listed above. Personal data processing is carried out lawfully, fairly, and transparently, strictly to the extent necessary to achieve specific, pre-defined, and legitimate purposes.

​

3. Legal Grounds for Processing
The legal basis for processing personal data is the user’s explicit consent, expressed by initiating communication with the chatbot and providing their data for the stated purposes of processing. In cases provided for by law or by separate agreements, the Operator may also rely on other legal grounds, such as the performance of a contract with the user or the legitimate interests of the Operator/client, provided such interests do not infringe upon the rights of the data subject.

By starting a conversation with the chatbot, the user confirms that they agree to the collection and processing of their personal data by the Operator and related parties in accordance with this Policy. The user has the right to withdraw their consent at any time by sending the Operator a corresponding request (see section on user rights). However, in such a case, the provision of the chatbot service may be discontinued.

4. Transfer of Personal Data to Third Parties
The Operator ensures the confidentiality of personal data and does not disclose it to third parties without proper grounds. Access to the data is granted only to authorized employees of the Operator, as well as to the company’s client (the legal entity that is the customer of the respective chatbot), to the extent necessary for servicing users. In the course of providing chatbot services, data may be transferred to a limited circle of third parties:

• Chatbot customer (NexaXT client). The client company for which the chatbot was created has access to the conversation data, as it is the owner of the database and is interested in servicing its own customer (the user). These data are used by the client in accordance with its agreement with the Operator and its own obligations to protect personal data.

• Response generation service (OpenAI ChatGPT). The text of the user’s message may be transmitted to an external AI service provider – the OpenAI system – via a secure API, for the purpose of generating a response. OpenAI may temporarily store anonymized request logs (for up to 30 days) for abuse monitoring, and such data are not used for AI model training. NexaXT has entered into the necessary agreements with this provider to protect the transmitted information.

• Hosting provider. Personal data is stored on a secure server hosted on the Yandex Cloud platform. The physical server may be located outside the Republic of Kazakhstan (for example, in the Russian Federation). This means that a cross-border transfer of personal data occurs. The Operator guarantees that such transfer is not carried out without the user’s consent and that all measures are taken to ensure data security. Storing data on servers outside Kazakhstan does not exempt the Operator from complying with Kazakhstani legislation.

• Analytics systems. Data analysis may involve services that process aggregated statistical information (e.g., Microsoft Power BI for visualizing summarized chatbot usage metrics). These systems do not receive personal data in open form – only anonymous or anonymized information is transmitted.

The transfer of personal data to third parties not listed above, or for purposes beyond those originally stated, is possible only with the user’s separate consent or in cases expressly provided for by law. In particular, the Operator may provide personal data to government authorities upon their substantiated request or in accordance with the requirements of the laws of the Republic of Kazakhstan. Transfer may also occur to protect the rights, property, or safety of the Operator, the client, or third parties if there are lawful grounds for doing so.

Please note that when using the chatbot, personal data may be transferred to and stored outside the country. In such cases, the Operator ensures that the receiving country provides adequate protection for the rights of data subjects, or obtains separate consent from the user for cross-border transfer, as required by law. By using the chatbot, the user consents to the possible cross-border transfer of their data to the third parties listed above, including to countries that do not provide equivalent legal protection for personal data (for example, transfers to the United States for processing by the OpenAI service). The Operator takes necessary steps to ensure that such recipients maintain the confidentiality and security of the data.

​

5. Data Retention Period
The Operator retains personal data no longer than is required to fulfill the purposes of processing set out in this Policy. Conversation history and related user data are typically stored for the duration of the contract between NexaXT and the client (the chatbot’s customer) or until the user withdraws their consent to data processing. Once the purposes of processing have been achieved, or if consent is withdrawn, the data will be deleted or anonymized, except where continued storage is required to comply with legal obligations (e.g., statutory archival retention periods) or to protect the legitimate interests of the Operator. The Operator regularly reviews stored personal data and deletes information that is no longer necessary.

6. Protection of Personal Data
The Operator takes all necessary organizational and technical measures to protect users’ personal and other data in accordance with the laws of the Republic of Kazakhstan. Such measures include: preventing unauthorized access to data, detecting and responding promptly to attempted breaches, protecting data from alteration, disclosure, copying, or destruction by unauthorized parties, and other measures required by regulatory acts of competent authorities. Access to users’ personal data within NexaXT is restricted to employees who need it to perform their job duties, and these employees are familiar with the applicable personal data protection laws. All employees and partners authorized to process data are bound by confidentiality obligations.

The Operator pays special attention to the security of the information systems used. Data transmission between the chatbot and the server is encrypted (via secure protocols), and data storage systems are protected by authentication and access control mechanisms. Despite these measures, no method of data transmission over the Internet or electronic storage can be completely secure; therefore, the Operator cannot guarantee absolute information security. However, we continually improve our security systems in line with best practices and the requirements of the authorized body of the Republic of Kazakhstan.

In the event of an incident involving unauthorized access to personal data, the Operator acts in accordance with established procedures: the incident will be contained, its consequences minimized, and, if required by law, the competent state authority will be notified within one business day of discovering the breach or unauthorized access. The user may also be notified if the incident poses risks to their rights and freedoms.

7. User Rights (Data Subject Rights)
A user whose data is processed in connection with the chatbot’s operation enjoys all rights granted under personal data protection laws. In particular, the user has the right to:

• Request information about the personal data processed by the Operator that relates to them. This includes the right to receive confirmation of processing, and information about the purposes, categories of data, sources, recipients, retention periods, etc.

• Require the correction or update of their personal data if it is inaccurate, outdated, or incomplete.

• Withdraw consent to the processing of personal data at any time by sending the Operator a written notice or email. Upon receiving such a withdrawal, the Operator will stop processing the user’s data (except where processing is required by law or other obligations, or where other legal grounds exist), and the data will be deleted if there is no legal reason for retaining it. Withdrawal of consent is not retroactive and does not affect the legality of processing carried out before the withdrawal.

• Request the deletion (erasure) of their personal data if it is no longer needed for the stated purposes or was processed unlawfully, as well as in other cases provided by law (the “right to be forgotten”). If deletion is technically difficult, the Operator may instead irreversibly anonymize the data.

• Request restriction of data processing where there are grounds for doing so (e.g., for the period of verifying the accuracy of the data or the lawfulness of processing). Under restriction, the data is only stored and not processed further without the user’s consent.

• Object to the processing of their personal data in certain cases provided by law – for example, when processing is based on the legitimate interest of the Operator or a third party, and the user has compelling reasons to object.

• Challenge the Operator’s actions in relation to data processing. If the user believes that their personal data rights have been violated, they may file a complaint directly with the Operator to resolve the matter. The user also has the right to contact the competent state authority – the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan (or another body responsible for personal data oversight) or the Prosecutor’s Office of the Republic of Kazakhstan. If violations are found, the Operator may be held liable, including administrative or other responsibility, as provided by law.

To exercise their rights, the user may send a written request to the Operator using the contact details provided in Section 9 of this Policy. The request must include the user’s full name, information confirming their identity (to prevent unauthorized third-party requests), and the substance of their request. The Operator will review the request and provide a response within a reasonable timeframe not exceeding 30 calendar days from receipt, unless otherwise required by law. If the user’s request is denied (in whole or in part), the response will include the reasons for refusal with reference to specific legal provisions.

Please note that withdrawing consent or requesting data deletion may result in the inability to continue providing certain services – for example, the chatbot may not be able to interact with the user without the necessary data. Nevertheless, the user may always stop using the chatbot, which will be deemed as withdrawal of consent for further data processing, except for retaining any previously collected information (which the Operator will delete upon request as described above).

​

8. Cookies and Similar Technologies
In the context of chatbot operation in messengers, cookies are generally not used, as interactions occur outside of a website. However, if the user visits NexaXT’s website (for example, to learn about services or view a public analytics dashboard), the site may use cookies and other tracking technologies. These are used to ensure the website functions, remember user preferences, conduct statistical research, and improve the user experience. The Cookie Policy (if applicable) is published separately on the relevant site. The user may disable cookies in their browser settings; however, some parts of the site may not function properly in that case.

9. Contact Information
For any questions regarding this Policy or the processing of your personal data, you can contact the Operator:

• Company: NexaXT (LLP “Nexa IKS Ti”, BIN 230940021527)

• Address: Kazakhstan, Almaty, Seifullin Avenue 617 – actual or registered company address

• Email: info@nexaxt.com (or another current email address for data subject requests)

• Phone: +7 (777) 320-00-71

The person responsible for organizing personal data processing at NexaXT is the Director. This person oversees internal compliance with the law and explains personal data handling rules to employees. User requests concerning personal data are handled by this responsible person.

10. Changes to the Policy
The Operator reserves the right to make changes and additions to this Privacy Policy. The current version of the Policy is available to users in an open source – on NexaXT’s official website or via a link provided in the chatbot interface. We recommend periodically reviewing the Policy to stay informed about the conditions under which your data is processed. In the event of significant changes (e.g., expansion of the data collected or processing purposes), the Operator may additionally inform users (via notice on the site or in the chat itself). Continuing to use the chatbot after publication of the updated Policy will signify the user’s agreement to the changes.

Date of last update of this Policy: March 19, 2025.

​

User Agreement (Terms of Use of the Chatbot)

This User Agreement (hereinafter – the “Agreement”) governs the terms and rules for using the AI chatbot provided by NexaXT on various messaging platforms (messengers). Any individual who starts interacting with the NexaXT chatbot (hereinafter – the “User”) thereby confirms that they have carefully read this Agreement and fully accept its terms. If you (the User) do not agree with any of the conditions listed below, please do not use the NexaXT chatbot.

1. Terms and Definitions

• Chatbot – a software service with artificial intelligence elements, developed by NexaXT and deployed in messengers (WhatsApp, Telegram, or another channel indicated in the description), which automatically processes user requests and provides responses. This chatbot may be integrated into the infrastructure of a customer – a third party (a NexaXT business client).

• Operator / Company – NexaXT, which provides chatbot development and maintenance services and has administrative rights over the service.

• Customer – an organization or entrepreneur that is a NexaXT client and on whose business infrastructure the chatbot is deployed. The Customer provides the chatbot to Users (its own clients) for interaction.

• User – any legally capable person who contacts the chatbot (e.g., by sending a message to the relevant number or account). For the purposes of this Agreement, a User also includes a person acting on behalf of a legal entity when interacting with the bot (e.g., an employee of an organization messaging the bot). It is assumed that the User has reached the minimum legal age to independently enter into agreements for using such services (16 years or older, or another minimum age established by applicable law). Persons under the age of 16 must not use the chatbot without permission and involvement of their legal guardians.

2. General Terms of Use
2.1. Safety and Responsibility. The chatbot provides automated responses using artificial intelligence (the OpenAI GPT model), trained on a large corpus of information. NexaXT strives to ensure the accuracy and usefulness of responses but does not guarantee their absolute correctness, relevance, or completeness. Responses are generated based on publicly available data and algorithms, without human participation in real time. Users should exercise reasonable caution when using information received from the bot. It is recommended to treat chatbot responses as reference information or a starting point, and, when necessary, verify important information via official sources or specialists.

2.2. No Professional Advice. Information provided by the chatbot is of a general nature. It does not constitute legal, medical, financial, or other professional advice. The User understands that the chatbot is a tool to facilitate access to information, but it does not replace consultation with qualified professionals on specific issues. No advice or data obtained from the chatbot should be used as the sole basis for making important decisions without additional verification. NexaXT is not liable if the User makes a decision or takes action based solely on the chatbot’s response and suffers loss or damage as a result. In particular, chatbot responses must not be considered as official recommendations or instructions, and all responsibility for their use lies with the User.

2.3. Limitation of Company Liability. The Operator provides the service “as is.” NexaXT and the chatbot’s Customer are not liable for any direct or indirect damages, loss of profit, loss of data, reputational harm, or other negative consequences incurred by the User in connection with the use of the chatbot or inability to use it, even if they were warned of the possibility of such consequences. This includes, but is not limited to: (a) errors, inaccuracies, or omissions in chatbot responses; (b) any disruptions in the chatbot’s operation, delays, or lack of responses due to technical malfunctions, internet connectivity issues, or failures of third-party platforms (messengers) or AI services; (c) undesirable consequences arising from actions taken by the User based on chatbot responses. The User assumes full risk related to using information received from the chatbot. The sole remedy for a User dissatisfied with the quality or content of the service is to stop using it.

​

2.4. User Conduct Rules.
When interacting with the chatbot, the User agrees to comply with applicable laws and generally accepted standards of courtesy. It is prohibited to use the chatbot for unlawful or dishonest purposes, including but not limited to:

• Sending messages containing illegal, harmful, offensive, extremist, pornographic, or otherwise rights-violating content (including intellectual property rights or the right to privacy);

• Attempting to gain unauthorized access to the chatbot’s functionality, its source code, or related systems;

• Intentionally misleading the chatbot or provoking it to generate responses that violate the law or these Rules (e.g., prompts related to prohibited content, fraud, incitement of hatred, etc.);

• Sending spam, advertisements, mass mailings, or other unsolicited materials via the chatbot without the Operator’s authorization;

• Impersonating another person or representing an organization falsely, misleading the bot or third parties about your identity.

NexaXT reserves the right, if the User violates these rules, to limit their access to the chatbot and to take other measures: warn the User, block further messages, and, in case of unlawful actions, inform the competent authorities. The User understands that their messages to the chatbot are not entirely private—they may be automatically screened for prohibited content and may be reviewed by authorized employees of the Operator or the Customer (see section 2.5) for moderation and security purposes.

2.5. Conversation Confidentiality.
While the User’s correspondence with the chatbot is not publicly posted, it is stored on NexaXT’s servers and is accessible to a limited group of persons: NexaXT itself (as the technical operator) and the relevant Customer of the chatbot (whose services the bot represents). These parties may review conversation history: first, to improve the quality of responses and resolve issues (e.g., train the bot on typical questions), and second, to connect a live operator to assist the User if needed. Please do not provide confidential information to the chatbot that you would not want to be potentially seen by someone other than the AI. In particular, do not send personal data—especially sensitive data (e.g., passport details, health information, bank details, passwords) or trade secrets—unless strictly necessary. NexaXT prioritizes user privacy but cannot guarantee that messages you send will never be seen by anyone other than the AI. By sending a message to the chatbot, the User understands and agrees that the message content may be processed, stored, and used to verify and improve service quality. The Operator applies measures to anonymize or mask personal data during such reviews where possible, and does not use private correspondence for other purposes without the User’s consent.

2.6. Personal Data Processing.
Use of the chatbot involves the provision and processing of your personal data (e.g., your messenger identifier, name or contact details contained in messages, and conversation content if it can identify you). The rules for processing and protecting such data are set out in NexaXT’s Privacy Policy (see section above). We confirm that personal data is processed in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection,” based on your consent and solely for purposes related to the chatbot’s operation. We do not use your data for unrelated marketing mailings or transfer it to third parties except as described in the Privacy Policy or required by law. By continuing to use the chatbot, the User confirms that they have read and agree with NexaXT’s Privacy Policy and that the processing of their personal data under those terms is understood and acceptable. If you do not agree with any provisions of the Policy, refrain from further interaction with the bot or contact us for clarification.

2.7. Intellectual Property.
All rights to the chatbot’s source code, knowledge base, response design, and other elements developed by NexaXT belong to NexaXT or are lawfully used. Responses generated by the bot may be based on publicly available information and do not constitute a copyrighted work of the Company or the User. However, the combination of the User’s questions and the bot’s answers (the conversation log) may be stored as part of NexaXT’s database. NexaXT confirms it does not claim ownership of the content of the User’s questions—you remain the owner of the information you provide about yourself or your ideas. At the same time, by using the service, the User grants NexaXT and the Customer a non-exclusive right to use the conversation content as necessary to provide the service (including processing the request, storage, analysis, etc.). This right is limited to purposes of operating and improving the chatbot. The Company will not use your messages for commercial purposes outside the provided service without separate agreement.

The User is prohibited from extracting the chatbot’s source code, modifying, decompiling it, reproducing, or commercially distributing information obtained from the bot without the Operator’s consent, except where such information is publicly available or independently obtained from other sources.

3. Disclaimer of Warranties

3.1. Service Quality.
NexaXT makes reasonable efforts to maintain the chatbot’s operability and relevance but does not guarantee that the service will meet the User’s expectations or operate continuously, error-free, and without delay. AI technology is constantly evolving, and the bot may sometimes provide incorrect or incomplete responses. The User accepts that any advice or information obtained via the chatbot is provided “as is,” without any express or implied warranties from the Company regarding accuracy or fitness for a particular purpose. NexaXT does not guarantee that certain functions or information will be available via the chatbot or that it will fully meet the User’s requests.

3.2. Force Majeure.
The Company is not liable for delays or failures in the chatbot’s operation caused by force majeure or circumstances beyond its control. Such circumstances include, but are not limited to, widespread internet outages, power outages, failures on the part of messengers or data center infrastructure, hacking attacks, epidemics, natural disasters, and government regulations making it impossible or illegal to continue providing the service.

4. Changes to Terms and Termination of Service

4.1. Changes to Terms.
This Agreement is a public document available to Users via a link (or through the bot interface). NexaXT reserves the right to amend the Agreement unilaterally, particularly when updating chatbot functionality, changing legal requirements, or for other reasons. The updated version of the Agreement takes effect upon publication at the specified address (unless otherwise stated). We recommend that Users regularly review the latest version of the terms. In the event of significant changes, we will make an effort to inform users (e.g., via a chat or website notice). Continued use of the chatbot after changes means the User agrees to the new version. If the User does not agree to the changes, they must stop using the service.

4.2. Term of Agreement.
This Agreement is deemed concluded when the User begins using the chatbot and remains in effect indefinitely while the User uses the service. The User may stop using the chatbot at any time by deleting the conversation and/or blocking the bot’s contact, without special notice to the Operator. NexaXT may, at its discretion, suspend or terminate the chatbot (entirely or for an individual user) at any time, including if the User has violated this Agreement or if the Customer’s contract term has expired and the service is no longer supported. Upon termination of the chatbot, personal data storage will be handled as described in the Privacy Policy (see section on data retention and deletion).

4.3. Governing Law and Disputes.
This Agreement is governed by the laws of the Republic of Kazakhstan. All disputes and disagreements related to its performance shall be resolved through negotiations between the User and the Company. If no agreement is reached, the dispute shall be submitted to the competent court at the Operator’s registered location, unless another jurisdiction is required by law. Before going to court, the User must send a written claim to the Operator; the Operator will review it within 30 working days and send a response. Failure to follow the pre-trial procedure may result in the claim being dismissed.

4.4. Severability.
If any provision of this Agreement is found to be invalid, unlawful, or unenforceable, it will not affect the validity of the remaining provisions. The invalid provision will be replaced (through interpretation or amendment) to preserve the original intent as closely as possible while complying with the law.

4.5. Other Terms.
Failure by NexaXT to exercise any rights or enforce any provisions in the event of a User’s breach does not constitute a waiver of such rights in the future. The User may not transfer their rights or obligations under this Agreement to third parties. The Company may assign its rights and obligations to any successor and may engage subcontractors to fulfill the Agreement, remaining responsible for their actions.

Last revised: March 19, 2025.
A User who starts using the chatbot after this date is deemed to have automatically accepted the terms of this version.

If you have any questions or suggestions regarding the chatbot’s operation or these terms, please contact us at info@nexaxt.com.
Thank you for using our service!