Deus CRM Light

Personal Data Processing Policy and Consent to Processing

Effective date: 27 October 2026

1. General Provisions

1.1. This document sets out the procedure and conditions for the processing of personal data by IE "DeusCode" (an individual entrepreneur registered in the Republic of Kazakhstan, Almaty; the "Operator") in connection with the DeusCRMLight (DCL) CRM system available at https://deuscrm.online, in the Telegram bot @deuscrmlight_bot, in the Telegram Mini App and via the API (the "Service"), and contains the text of the consent to the processing of personal data.

1.2. This document has been prepared in accordance with Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection" dated 21 May 2013 (the "Law"), the Law of the Republic of Kazakhstan "On Informatization" and the Civil Code of the Republic of Kazakhstan. For data subjects in the EU/EEA, Regulation (EU) 2016/679 (GDPR) is also taken into account.

1.3. By ticking the consent box for this document at registration, the user confirms having read it and gives consent to the processing of personal data on the terms of Section 10.

1.4. Definitions:

  • User: an individual aged 18 or over who is registered in the Service, including an employee added by the account owner.
  • Account owner: an independent professional or a company (acting through an authorized representative) that has created an account in the Service.
  • Client data: personal data of clients, counterparties and other individuals that users enter into the Service manually, by import or through integrations.
  • Personal data operator (controller): a person who determines the purposes and means of processing personal data, including the owner and/or operator of a database containing personal data within the meaning of the Law.
  • Processor: a person who processes personal data on behalf of and in the interests of the operator.
  • Processing: collection and actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalization, blocking and destruction of personal data.

2. Roles of the Operator and the Account Owner

2.1. With respect to the personal data of users, IE "DeusCode" is the operator.

2.2. With respect to client data, the account owner is the operator (controller): it decides whose data is entered into the Service, to what extent and for what purposes it is used. IE "DeusCode" acts as the processor of client data.

2.3. By accepting this document, the account owner instructs the Operator to process client data to the extent and for the purposes necessary to provide the Service, and authorizes the engagement of the providers listed in Section 6.

3. Purposes of Processing

3.1. Users' personal data is processed to register and maintain accounts, provide the features of the Service, send notifications, operate integrations, manage plans and payments, handle requests, ensure security, carry out aggregated web analytics (subject to separate consent) and comply with the law.

3.2. Client data is processed solely to provide the Service to the account owner: storage, display, search, modification, export, generation of analytics and notifications, operation of integrations, backup and security. The Operator does not use client data for its own purposes.

4. Personal Data Processed

4.1. Users' data: email address, name, password hash (the password itself is not stored), interface language, time zone, company name and role in the account; technical data (IP address, user agent, sign-in time, session data and the activity log kept for security purposes); the Telegram user ID and chat ID, if the user has linked the bot; browser push subscription data (endpoint and keys); cookie data in accordance with the Cookie Policy; payment details received from payment providers (without bank card data).

4.2. Client data: full name, phone numbers, email addresses, messenger accounts, notes, deals, tasks, call data from IP telephony providers (numbers, duration, links to call recordings) and any other data that the user enters into the Service or transfers to it through integrations.

5. Processing Operations

5.1. The Operator collects, accumulates, stores, modifies, supplements, uses, transfers (including across borders) to the persons listed in Section 6, depersonalizes, blocks and destroys personal data.

5.2. Processing is carried out using automated means. The Operator does not make personal data available in publicly accessible sources and does not make decisions that produce legal effects for the data subject based solely on automated processing.

6. Transfers and Cross-Border Transfers

6.1. To operate the Service, personal data is transferred to the following providers:

  • Vercel Inc. (USA): application hosting and, with consent to analytics, Vercel Web Analytics;
  • Neon (cloud PostgreSQL database, servers in the EU and the USA): data storage;
  • Resend: email delivery;
  • Telegram: notifications and the Mini App, if the user has linked the bot;
  • browser push notification services (Google, Apple, Mozilla): delivery of push notifications, if the user has allowed them.

6.2. The list of payment providers will be published in this document once they are connected.

6.3. These providers process data outside the Republic of Kazakhstan, including in the USA and EU member states. This is a cross-border transfer, including to countries that may not ensure the protection of personal data at the level provided by the law of the Republic of Kazakhstan. It is carried out on the basis of the consent set out in Section 10.

7. Processing and Retention Periods

  • Account data and client data are kept while the account is active, including in read-only mode.
  • After the account is deleted, the data is deleted within 30 days, and from backups within no more than 30 additional days.
  • Security logs are kept for up to 12 months.
  • Payment records are kept for the periods required by law.
  • The user may export their data in the interface at any time (CSV and JSON export).

8. Obligations of the Account Owner

8.1. When entering client data and employee data into the Service, the account owner undertakes to:

  • have a lawful basis for processing such data, including obtaining the data subjects' consent in the form required by applicable law, covering processing by processors and cross-border transfer outside the Republic of Kazakhstan;
  • inform data subjects about the processing of their data where required by law;
  • enter only data that has been lawfully obtained and is necessary for its purposes, and not enter special categories of personal data without a lawful basis;
  • warn the other party that a telephone conversation is being recorded where required by law;
  • handle requests from its clients as data subjects and use the features of the Service to modify, export and delete their data;
  • grant employees only the access they need and ensure that they comply with the law.

8.2. The Operator does not verify whether consents or other grounds for processing client data exist. The account owner is responsible for the lawfulness of such processing.

9. Obligations of the Operator as Processor

With respect to client data, the Operator:

  • processes it only on the instructions of the account owner and only to provide the Service;
  • keeps it confidential and allows its personnel to access it only to the extent necessary for support, security and operation of the Service;
  • applies protective measures: encrypted connections (HTTPS, HSTS), password hashing with Argon2id, two-factor protection of administrative access, access control by role and by company, an activity log and backups;
  • engages only the providers listed in Section 6 and gives notice of changes to them by updating this document;
  • where possible, assists the account owner in responding to requests from data subjects;
  • notifies the account owner without undue delay of security incidents affecting its data that come to the Operator's attention;
  • deletes client data after the account is deleted within the periods set out in Section 7.

10. Consent to the Processing of Personal Data

By registering in the Service and ticking the consent box, I, acting freely, of my own will and in my own interest, confirm that I am at least 18 years old and give IE "DeusCode" (Republic of Kazakhstan, Almaty, info@deuscode.tech) my consent to the collection and processing of my personal data listed in clause 4.1, for the purposes listed in clause 3.1, by means of the operations listed in Section 5, including its cross-border transfer to the persons listed in Section 6, including to the USA and EU member states, as well as to countries that may not ensure the protection of personal data.

If I register an account on behalf of a company or add employees and client data to the Service, I confirm my authority and accept the obligations set out in Section 8.

This consent is valid until it is withdrawn or until the account is deleted, subject to the retention periods set out in Section 7. I have been informed of my right to withdraw this consent in the manner described in Section 11.

11. Withdrawal of Consent

11.1. You can withdraw your consent by sending an email to info@deuscode.tech from the email address linked to your account. Consent to analytics can be withdrawn via the "Cookie settings" link in the website footer.

11.2. Upon receiving the withdrawal, the Operator stops processing within the time limits set by law, except where the withdrawal would contradict the laws of the Republic of Kazakhstan or there is an unfulfilled obligation, and except where the law permits processing without consent.

11.3. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Since the Service cannot be provided without processing registration data, withdrawing consent to its processing results in the deletion of the account. We recommend exporting your data in advance.

12. Data Subject Rights and Contact

12.1. The rights of data subjects (including rights under the GDPR for users in the EU/EEA) and how to exercise them are described in the Privacy Policy.

12.2. All requests relating to personal data should be sent to info@deuscode.tech. The Operator's details are provided in invoices and on request at info@deuscode.tech.

12.3. The Operator may amend this document. The new version is published at /legal/personal-data together with its effective date. If the changes extend the purposes of processing or the list of data processed, the Operator will request new consent.