Legal

Privacy policy

Applies to the English version of the site (contact.work). Last updated: November 10, 2026. See also our terms of use.

1. Introduction

1.1. This policy describes how we process information, including personal data, when you use the English version of the website at contact.work (the “Site”).

1.2. The controller of personal data processed through the Site is CONTACT.WORK LLP, a limited liability partnership registered in Kazakhstan and operating under the CONTACT.WORK brand (the “Operator” or “we”).

Registered address: 5 Dostyq St., Astana, 020000, Kazakhstan.

The Operator decides why and how personal data collected through the Site is processed and is responsible for that processing under this policy.

Questions about the Site and data processing: email sale@contact.work or message us on Telegram (@ContactWorkAIBot).

1.3. By using the Site, including submitting forms or turning on optional features (chat, widgets), you confirm that you have read this policy. If you do not agree with it, please do not submit personal data through the Site and, where technically possible, do not use optional features such as the live chat.

1.4. The Operator processes personal data in accordance with applicable data protection law, including the law of the Republic of Kazakhstan, the GDPR and the UK GDPR where they apply, and US state privacy laws where they apply (including the California Consumer Privacy Act as amended by the California Privacy Rights Act), as well as applicable rules on marketing communications. Section 11 describes additional rights of California residents, and section 12 describes additional information for people in the United Kingdom.

2. Data we may process

2.1. Inquiry data you enter yourself in the Site forms (including the Demo and proposal form): name, phone number, email address, company name, business field and industry, number of agents, message text, the proposal sections you choose and the cost estimate from the pricing calculator, and any other information you choose to include in your message. To confirm your email address, the Operator sends a one-time code to it.

2.2. Marketing list data (collected only if you check the separate box agreeing to receive marketing messages): name, email address, and the date and fact of consent. This data is stored separately from inquiry data and used only to send you the Operator’s news and offers.

2.3. Technical and de-identified data: IP address, browser and device type, date and time of the request, the page requested, referrer, identifiers set by analytics tools, cookies and similar technologies, and parameters passed in the query string (including your search query when you use on-site search).

2.4. Proof of consent: when you submit a form, the Operator records the fact and circumstances of your consent – the date and time of submission, the sender’s IP address, the Site page the form was sent from, and technical information about the browser. This record is kept as evidence that consent was given knowingly and may be provided to a competent authority on request.

2.5. Data processed when you contact us through third-party services (messaging apps, social networks, and similar platforms) is also governed by those platforms’ policies in addition to this policy.

5. Disclosure and processors

5.1. Data from the contact form is sent over a secure connection to the sendmail.contact.work server, which delivers the message to the Operator’s responsible staff. Chat messages sent through the Site are processed on infrastructure we operate for the contact.work service.

5.2. The Operator may engage contractors (hosting, IT services, analytics, communications) to process personal data, requiring confidentiality and security to the extent needed for the purposes of processing. The marketing subscriber list is stored separately from inquiry logs and is available only to staff responsible for marketing emails and for handling consent withdrawal requests.

5.3. Depending on the technical setup at a given time, our infrastructure or that of our processors may be located in different countries. Where applicable law requires it, international transfers are made on a permitted legal basis. For security reasons, this policy does not name specific server locations; you can request reasonable information by writing to sale@contact.work.

6. Retention

6.1. Personal data from inquiries (name, phone number, email address, message text) is kept for 3 (three) years from the date of the inquiry. This period matches the general limitation period for civil claims and is needed to resolve possible disputes about the Operator’s reply or the commercial terms offered. After that, the data is deleted or de-identified.

6.2. Marketing list data (email, name, date of consent) is kept until you withdraw consent to marketing emails. After withdrawal, the data is removed from the active marketing list within one business day (emails stop), and proof of the earlier consent (dates, IP address, consent wording) is kept for another 3 (three) years from the withdrawal date in case of claims that past emails were sent unlawfully.

6.3. De-identified statistics may be kept longer than the periods above in a form that does not identify you.

6.4. If applicable law sets other mandatory retention periods (for example, accounting or tax requirements when a contract is signed), those periods apply.

7. How we protect data

The Operator takes organizational and technical measures, proportionate to the risks, to prevent unauthorized access to personal data and its loss or alteration. These include sending data over a secure connection (HTTPS/TLS), limiting access to the inquiry database and the marketing list to staff whose duties require it, keeping software up to date, and controlling access to the server infrastructure.

8. Your rights

8.1. General rights. Depending on applicable law, you have the right to:

To exercise these rights, email sale@contact.work with the subject line “Personal data” or call the phone number in section 1.2 of this policy. The Operator replies within 30 days of receiving your request.

8.2. Withdrawing consent to marketing emails. If you checked the additional box agreeing to receive marketing messages and want to unsubscribe, you can do so in any of these ways:

If you withdraw through the form on the Site or the link in an email, we stop sending emails within one business day; if you withdraw by email, within a few business days of receiving your message. Withdrawing consent to marketing emails does not affect your ability to submit new inquiries through the Site and does not cancel our reply to an inquiry you submitted earlier.

ask us to confirm whether we process your personal data and to tell you what data we hold, where it came from, and why we process it;
ask us to correct, restrict, or delete your personal data (subject to retention required by law);
withdraw consent you gave earlier;
file a complaint with a competent data protection authority or go to court.
fill in the form on the unsubscribe page – enter the email address the messages came to and click “Unsubscribe”; emails stop within one business day;
click the “unsubscribe” link in any marketing email you received;
email sale@contact.work with the subject line “Unsubscribe”, giving the email address the messages came to.

9. Children, automated decisions, accuracy of data, and third-party services

9.1. The Site is not intended to collect personal data from children under 13 (or under the higher age set by your local law) without the consent of a parent or legal guardian. If you are under that age, do not submit personal data without a parent or other legal guardian. If the Operator learns that it has collected a minor’s data without a proper basis, it will take steps to delete that data as far as technically and legally possible.

9.2. When you use the Site, the Operator does not make decisions that produce legal effects for you or otherwise significantly affect your rights and freedoms based solely on automated processing of personal data.

9.3. By submitting data through forms and other Site channels, you confirm that you do so voluntarily and aim to provide accurate information needed to handle your request. If you provide data about other people, you confirm that you have a legal basis to share it. The Operator is not required to verify all information independently; to the extent permitted by law, you are responsible for the consequences of providing inaccurate or unlawful information.

9.4. Third-party tools (including Google Analytics, Google Maps, and other widgets) run under their operators’ rules. The Operator does not guarantee that they work without interruption or that they are complete or current, does not control changes to those parties’ policies, and is not liable for losses caused by outages, changes in functionality, or actions of those services’ operators, except where mandatory law provides otherwise.

9.5. This policy describes our general practices as of the publication date and does not rule out separate notices, consents, or agreements where a different procedure applies to a specific service or project. If this policy conflicts with mandatory provisions of applicable law, the law prevails.

10. Changes to this policy

10.1. The Operator may update this policy. The current version is always available at contact.work/legal/privacy/. We recommend checking the “Last updated” date at the top of the document for material changes.

10.2. If we make changes that significantly affect your rights, the Operator posts a notice on the Site’s home page for at least 30 days from the date the changes take effect.

11. Your California privacy rights (CCPA/CPRA)

11.1. This section applies to residents of California and supplements the rest of this policy to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), applies to the Operator. Terms such as “personal information”, “sell”, and “share” have the meanings given to them in the CCPA.

11.2. Categories of personal information we collect. In the past 12 months, the Site has collected the following categories of personal information, as described in section 2: identifiers (name, email address, phone number, IP address, and online identifiers set by cookies and analytics tools); professional information (company name, business field and industry, number of agents); commercial information (the proposal sections you choose and the cost estimate from the pricing calculator); internet or other electronic network activity (browser and device type, pages requested, referrer, on-site search queries, and, only after you choose “Accept all” in the cookie banner, Google Analytics data about your visits); and records of consent (date and time, IP address, page, and browser information when you submit a form).

11.3. Sources, purposes, disclosure, and retention. We collect this information from you directly (forms, email, chat), from your browser or device, and, for analytics, through Google Analytics. We use it for the purposes listed in section 3: to handle and reply to your inquiries, to send marketing emails only with your separate consent, to keep records of consent, to keep the Site running and secure and measure its use, and to comply with the law. We disclose it for these business purposes to service providers and contractors (hosting, IT services, email delivery, communications, and analytics) as described in section 5. Each category is kept for the periods set out in section 6.

11.4. Do Not Sell or Share My Personal Information. We do not sell personal information, and we do not share it for cross-context behavioral advertising. The Site does not use advertising or retargeting cookies. Google Analytics is used only to measure traffic and how the Site works, and it loads only after you choose “Accept all” in the cookie banner; if you choose “Reject all”, it is not loaded. If your browser sends a Global Privacy Control (GPC) signal, we treat it as “Reject all” and do not load Google Analytics. You can change your choice or withdraw analytics consent at any time with the “Cookie settings” link at the bottom of every page. We have no actual knowledge of selling or sharing personal information of consumers under 16 years of age.

11.5. Sensitive personal information. We do not intend to collect sensitive personal information (as defined in the CCPA) through the Site, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit its use. Please do not include such information in form messages.

11.6. Your rights. Subject to exceptions in the CCPA, California residents have the right to: know what personal information we have collected about them, its categories and sources, the purposes of collection, and the categories of third parties to whom we disclose it, and to receive a copy of the specific pieces of personal information; ask us to delete personal information we collected from them; ask us to correct inaccurate personal information; opt out of the sale or sharing of personal information (although we do not sell or share it); and limit the use and disclosure of sensitive personal information (although we do not collect it through the Site).

11.7. Non-discrimination. We will not discriminate against you for exercising any of your CCPA rights, for example by denying you a reply to an inquiry or offering you different prices or terms.

11.8. How to submit a request. Email sale@contact.work with the subject line “California privacy request”, stating which right you want to exercise and the email address or phone number you used to contact us, or call the phone number in section 1.2. To protect your information, we verify your request by matching the information you provide with the information we hold – usually by sending a one-time code or a confirmation request to the email address or phone number you used to contact us. We may ask for additional information if needed to verify your identity, and we use it only for verification.

11.9. Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide your signed written permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney under California law.

11.10. Response time. We confirm receipt of a request to know, delete, or correct within 10 business days and respond within 45 calendar days of receiving it. If we need more time (up to another 45 days), we will tell you the reason within the first 45 days. If we cannot fully comply with a request, we will explain why.

12. If you are in the United Kingdom

12.1. This section applies if you are in the United Kingdom and supplements the rest of this policy. Where we process your personal data in connection with offering services to you in the UK or monitoring your behavior on the Site in the UK, we do so in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (“PECR”).

12.2. Lawful bases. We rely on the following lawful bases under the UK GDPR: consent (marketing emails and analytics cookies); steps taken at your request before entering into a contract (replying to your inquiry, including with a proposal); legitimate interests (keeping the Site running and secure, keeping proof of consents, and de-identified statistics), balanced against your interests and rights; and compliance with legal obligations.

12.3. Your rights. Under the UK GDPR, you have the right to: access your personal data and receive a copy of it; have inaccurate data rectified; have your data erased; restrict processing; receive data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability); object to processing based on legitimate interests, and object at any time to processing for direct marketing; and withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. To exercise these rights, use the contact details in section 8.1. We reply within one month of receiving your request; for complex or numerous requests, this period may be extended by up to two further months, and we will tell you if that happens.

12.4. Cookies (PECR). Strictly necessary storage (for example, your color theme and language settings) is used without consent because the Site needs it to work. Non-essential cookies, including Google Analytics, are set only after you choose “Accept all” in the cookie banner; if you choose “Reject all” or make no choice, they are not set. You can withdraw consent as described in section 11.4.

12.5. International transfers. The Operator is established in Kazakhstan, and our infrastructure or that of our processors may be located outside the UK (see section 5.3). Where personal data is transferred from the UK to a country that is not covered by UK adequacy regulations, we use a transfer mechanism permitted by UK law, such as the International Data Transfer Agreement (IDTA) issued by the Information Commissioner or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required. You can request more information about these safeguards by writing to sale@contact.work.

12.6. Complaints. If you are not satisfied with how we handle your personal data, please contact us first at sale@contact.work so we can try to resolve the issue. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk.