Oknow Privacy Policy
Draft awaiting legal review, not the terms currently in force. Items in square brackets will be completed before publication.
The support@oknow.online address mentioned in the text does not work yet.
Version dated [publication date]. Applies to Oknow Client, Oknow Pro and Oknow web pages.
1. General provisions
1.1. This Policy describes personal data processing in Oknow. The service owner is an individual, a citizen of the Republic of Kazakhstan [owner's full name].
1.2. This Policy applies to Oknow Client, Oknow Pro and web pages accessed through personal links: booking /l/, consent and opt-out /c/, another time /r/, and waitlist /w/.
1.3. Oknow Client is intended for finding specialists, making bookings, receiving flash slot offers and joining the waitlist. Oknow Pro is intended for specialists and salons: managing profiles, services, schedules, free slots, client databases and offer messaging.
1.4. The roles of Oknow and the specialist in data processing are described in section 3.
1.5. Legal framework: Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 «On Personal Data and Their Protection», as amended in 2026, Digital Code of the Republic of Kazakhstan, Civil Code of the Republic of Kazakhstan and Law of the Republic of Kazakhstan «On Advertising». The laws of the Republic of Kazakhstan apply.
1.6. This Policy is linked to the Oknow Terms of Use and the Agreement for Specialists: [link to the Terms of Use], [link to the Agreement for Specialists].
1.7. This Policy does not replace consent to data processing. Consent is obtained through separate documents and actions: [links to consent documents].
2. Terms
2.1. Personal data means information about you that is processed in Oknow. The data processed depends on the features used and is listed in section 4.
2.2. Personal data subject means a Client or Pro user, a client in a specialist's database or a visitor to a page accessed through a personal link.
2.3. Operator means the person who processes personal data in the relevant role under section 3.
2.4. Specialist means a specialist or salon that uses Oknow Pro. A specialist may be an individual, an individual entrepreneur or a limited liability partnership. Their name or business name is shown on the consent page.
2.5. Processing on instructions means Oknow's processing of a client database for a specialist: storage, use of database features, preparation of offers and fulfilment of client requests.
2.6. Client in a specialist's database means a person whose data the specialist has entered into their database or imported from a file. This client may not have an Oknow account.
2.7. Personal link means a link to a page for a specific client action. The rules for consent and opt-out links are set out in section 6.
2.8. Data processing includes collection, storage, use, transfer to the listed recipients, correction, deletion and anonymisation.
3. Roles of Oknow and the specialist
3.1. The owner of Oknow is the owner and operator of Client and Pro account data and platform data: sign-in details, profile data, service activity, notifications and consent to Oknow marketing.
3.2. The specialist is the owner and operator of their client database. Oknow stores and processes it on the specialist's instructions.
3.3. The database is accessible only to the relevant business. Oknow does not sell it, transfer it to other specialists or use it for other specialists or its own marketing.
3.4. In a salon, only the business owner can access a client's full phone number and export the database and consent log in CSV format. Employees see a masked number. Database access and exports are recorded in the audit log.
3.5. Only the business owner sends personal messages through their own messaging app. They send them themselves, from their own number, using text prepared by Oknow.
3.6. Oknow fulfils requests from clients in specialists' databases as a processor under section 13.
4. Data processed
4.1. The data processed depends on the features used.
| Group | Data | When processed |
|---|---|---|
| Oknow Client users | Identifier, email, name, profile phone number; visit history, bookings, cancellations, waitlist, favourites, subscriptions and consent | When signing in, completing a profile, making a booking and using Client |
| Oknow Pro users | Sign-in and profile data; specialist, owner or employee role; information about services, schedules and slots | When signing in and using Pro |
| Clients in a specialist's database | Name in the specialist's records, phone number, visit history: dates, services and amounts; selected channels; records of consent, opt-outs and messages sent | When data is entered or imported, the database is managed and offers are prepared |
| Visitors to linked pages | Information about a booking or another action; name and phone number if entered; consent or opt-out records; IP address and browser when consent is confirmed | When using the page |
| Oknow marketing recipients | Email, push token, language, city and categories of interest, if provided | When Oknow marketing is enabled separately |
| Technical data | Push token, language, IP address and browser when consent is confirmed through a link; consent and audit logs | When the relevant features are used |
| Search and geolocation | Search history; geolocation while the app is open | With separate consent to use searches and system permission for geolocation |
| Data request applicants | Name, reply contact details, request content and information to verify identity | When making a request under section 13 |
4.2. When you first sign in through Google or Apple, your identifier, email and name are processed. Apple may provide a private relay email address. Email sign-in uses a one-time six-digit code valid for 10 minutes.
4.3. Sign-in does not use a password or SMS codes. The phone number is a profile field. It is required before the first booking and is not verified by a code. You must provide only your own number.
4.4. You can make a booking through a specialist's personal link without an account. If the displayed number belongs to you, you proceed to booking. If it is not your number, you enter your own name and phone number.
4.5. The consent log records consent given, opt-outs and messages sent, the date and time, the text version, the confirmation method and the selected channel. When consent is confirmed through a link, the IP address and browser are also stored.
4.6. Phone numbers of clients in databases are encrypted. In records and technical logs, phone numbers are stored only in masked form: +7 7 * 12 34.
5. Purposes and grounds for processing
5.1. The data relevant to each purpose is used.
| Purpose | Data | Grounds |
|---|---|---|
| Sign-in and account operation | Identifier, email, name, profile data, sign-in code | Performance of the contract with the user—the accepted Terms; consent given by clicking “Continue” |
| Finding and booking a specialist | Profile, phone number, selected services and time, bookings and cancellations | Performance of the contract and consent given by clicking “Continue”; without an account—consent on the booking page and fulfilment of the booking |
| Service notifications | Contact details, booking information and notification channel | Performance of the contract |
| Waitlist operation | Contact details and request for a time | Performance of the contract |
| Managing the specialist's database | Name, phone number, visit history | For Oknow—the specialist's instructions |
| Offers from a specific specialist | Name, phone number, visit history, channels and consent log | Separate consent given to that specialist |
| Oknow marketing | Email, push token, language, city and specified categories | Separate consent to Oknow marketing |
| Use of your searches | Search history | Separate “Use my searches” consent |
| Use of geolocation | Geolocation while the app is open | Separate system permission |
| Fulfilling data requests | Name, reply contact details, request content and information to verify identity | Law |
| Evidence of consent and database actions | Logs of consent, opt-outs, messages sent, access and exports | The legal duty to prove consent and the protection of rights |
| Transfer to authorised state authorities | Data within the scope of a lawful request | Law |
5.2. To join the waitlist, you submit a request for a time. One message is sent when a slot becomes available.
5.3. The specialist sees cancellation history when managing bookings.
5.4. Search history is used for Oknow marketing only with separate “Use my searches” consent. Enabling Oknow marketing does not replace this consent.
6. Consent and notifications
6.1. Oknow separates service notifications about bookings, offers from a specific specialist and Oknow marketing. A choice in one area does not replace a choice in another.
6.2. Service notifications are sent in connection with a booking: confirmation, reminders one day and two hours before the booking, cancellation and rescheduling. They do not require marketing consent. They cannot be disabled, but the channel can be changed.
6.3. Offers from the specialist may include free slots, discounted flash slots and reminders to repeat a service based on visit history. They do not include third-party advertising.
6.4. After import, clients have “No consent” status and receive no offers. You give consent yourself through the specialist's personal one-time link. The link is valid for 30 days. No options are preselected.
6.5. The specialist provides the link through a QR code during a visit, one personal service message without discounts, or SMS from Oknow. You select each channel separately: SMS from Oknow, personal messages from the specialist or push notifications in Client.
6.6. Consent is linked to your number and a specific specialist, rather than to an account. It remains valid until withdrawn, but for no longer than 24 months without visits to that specialist. Offers then stop automatically.
6.7. Each specialist may send no more than one message every seven days. All Oknow specialists together may send no more than three messages per week to one number. Quiet hours: 21:00–09:00 Astana time.
6.8. Each offer contains the specialist's name, a personal booking link and a permanent “Stop offers” link. This link lets you opt out of offers from that specialist or all specialists. The scope of the opt-out is shown before it is applied.
6.9. Replying STOP to SMS from Oknow stops offers from all specialists for that number. If you write “stop” to a specialist in a messaging app, they must record the opt-out in your client record. The “Withdraw” action is also available in your Client profile.
6.10. After an opt-out, preparation of new offers stops immediately. Messages already sent are not recalled. Consent can be given again only through a new one-time link from that specialist for the same number.
6.11. The permanent opt-out link, the app and an email code cannot be used to give consent again. A match between an unverified account phone number and a number in a database does not prove ownership of the number.
6.12. Previously collected consent is transferred from a file only for rows containing a consent date and channel. The specialist specifies the source: a paper document, contract or correspondence. They also confirm that they retain the evidence. A visit date is not treated as a consent date. At the request of Oknow or an authorised authority, the specialist must provide evidence within five working days.
6.13. Oknow marketing is disabled by default. You enable it through a separate action: the “Oknow marketing” toggle in your profile. The channels are push notifications and the account email. Oknow does not send marketing SMS.
6.14. Oknow marketing includes promotions, service news and selections of flash slots from different specialists by city or category. Quiet hours: 21:00–09:00 Astana time. Opting out through the toggle or the link in each email takes effect immediately. It does not change service notifications or consent given to specialists.
6.15. Geolocation and use of searches are authorised separately. Geolocation is used only while the app is open. The search history retention period is stated in section 10.
7. Automated processing
7.1. The “who's due” feature automatically assesses visit history. The name, phone number and history of visits to the relevant specialist are used to select offer recipients.
7.2. Before sending, a check identifies who will receive the offer and who is excluded: because of missing consent, an opt-out, the seven-day limit or inclusion in the control group. The specialist is also shown the sending cost.
7.3. The control group is selected randomly using a technical hash. By default, it includes about 15% of candidates. Its members do not receive the offer on that occasion. There are no other consequences. Automated assessment and recipient selection have no legal effects on the client.
7.4. You have the right to object to a decision made solely by automated means. The request procedure and review period are set out in section 13.
7.5. AI analysis of correspondence and the WhatsApp Business API are not used.
8. Where and how data is stored
8.1. Oknow servers and databases are located in the Republic of Kazakhstan. Backups are encrypted and are also stored in Kazakhstan.
8.2. Backups are made daily. They are kept for seven days. Deleted data is removed from backups during rotation, within seven days at the latest.
8.3. Phone number encryption and masking are described in section 4. Access and export restrictions are described in section 3.
8.4. Storage of the main database in Kazakhstan does not exclude transfers of specific data to recipients outside Kazakhstan under section 9.
9. Transfers to third parties and outside Kazakhstan
9.1. Transfers depend on the selected sign-in method, channel and consent.
| Recipient | Country | Data transferred | Condition |
|---|---|---|---|
| Expo Push, Google FCM, Apple APNs | USA | Device push token, notification text, language | If you enable push notifications in the app |
| Google, Apple—sign-in | USA | Identifier, email and name at first sign-in; Apple may provide a relay email address | If you select the relevant sign-in method |
| Email provider [email provider name] | USA; may be replaced with a provider in Kazakhstan | Email address and email text: sign-in code, service or marketing email | For email sign-in and service emails; marketing emails require separate consent |
| Kazakhstan SMS provider [SMS provider name] | Kazakhstan | Phone number and SMS text | Booking notifications; offers with SMS consent; number verification under section 13 |
9.2. One email provider is used for service and marketing emails. A contract with the SMS provider has not yet been signed.
9.3. For offers from the specialist, the SMS provider receives data only if SMS is selected. Push services receive data only if push notifications are selected. The specialist sends personal messages themselves through their own WhatsApp or Telegram under clause 3.5.
9.4. Data is transferred to state authorities within the scope of a lawful request under Kazakhstan law. Recipients outside Kazakhstan are limited to those listed in the table.
10. Retention periods
10.1. The following periods apply to specific data.
| Data | Period or rule |
|---|---|
| Account data | While the account is active; upon deletion—30 days for restoration |
| Sign-in codes | 10 minutes |
| Search history | 14 days |
| xlsx/csv import files | Seven days |
| Text of sent messages | 90 days |
| Audit log | Three years |
| Consent log | For the full consent period and three years after withdrawal |
| Backups | Seven days; deletion procedure—clause 8.2 |
| Consent to offers from the specialist | Until withdrawn, but for no longer than 24 months without visits to that specialist |
| Consent to Oknow marketing | Until withdrawn or the account is deleted |
| Client in a database with no visits for 24 months | Notification to the specialist and anonymisation three months later are planned |
10.2. The consent log is retained after withdrawal as evidence of consent and opt-out.
10.3. Stopping offers after 24 months without visits does not mean that the entire client record is deleted immediately. Anonymisation three months after notifying the specialist is planned.
10.4. Deletion of the import file after seven days applies to the uploaded file. The imported client database is retained under the rules for the specialist's database.
11. Account deletion
11.1. Before deleting your Client account, you can download your data. Deletion is confirmed by a code sent to the account email.
11.2. Subscriptions, the waitlist and favourites are deleted immediately and permanently. Upcoming bookings are cancelled, and specialists are notified. You are signed out on all devices.
11.3. Within 30 days, you can restore the account using the same sign-in method. Your profile, visit history and consent will be restored. Cancelled bookings, subscriptions, the waitlist and favourites will not be restored.
11.4. After 30 days, the account is permanently deleted. Visits remain in specialists' databases without your name and phone number to keep records of services provided. The periods in section 10 apply to logs.
11.5. The business owner deletes the business in Pro settings, with confirmation by a code sent by email, or by a request to support@oknow.online. Before deletion, the database can be exported under clause 3.4.
11.6. The business can be restored within 30 days. After that, the business and client database are deleted, except for consent and audit logs. These are retained for the periods in section 10.
11.7. An employee account is deleted under the Client account deletion rules. Business records remain with the business.
12. Your rights
12.1. You have the right to access your data and receive a copy, including through the “Download my data” feature.
12.2. You have the right to request correction and deletion of data, withdraw consent and object to a decision made solely by automated means. Ways to withdraw marketing consent are set out in section 6. The request procedure is set out in section 13.
12.3. You have the right to complain to the authorised personal data protection authority [name as of the version date] or to a court.
12.4. Oknow fulfils requests within its role as an operator or processor. Liability for breaches of processing rules is determined by Kazakhstan law.
13. How to submit a request
13.1. Use the app's features to export data, delete data and manage consent, or email support@oknow.online.
13.2. Provide your name, reply contact details and the specific request. For an account, identity is verified by a code sent to the account email. For a number without an account, verification uses a personal link sent by SMS to that number or confirmation with the specialist during a visit.
13.3. A match between the phone number in an account and the phone number in a specialist's client record does not by itself confirm ownership of the number.
13.4. Request fulfilment periods:
| Action | Period |
|---|---|
| Response to a personal data request | Within 15 working days |
| Stopping advertising and offers after withdrawal | Immediately |
| Stopping processing based on withdrawn consent | Within 15 working days at the latest |
| Review of an objection to an automated decision | Three working days |
13.5. A client in a specialist's database may contact Oknow directly. Oknow fulfils the request as a processor across all databases. It notifies specialists that deletion has taken place without disclosing the reasons.
13.6. After consent is withdrawn, the log continues to be retained under section 10.
14. Data protection and incidents
14.1. Data protection measures include encryption of phone numbers of clients in databases and backups, role-based access, masking and logging under sections 3, 4 and 8.
14.2. You can report a personal data incident to support@oknow.online.
14.3. In the event of a data breach, Oknow notifies the authorised authority and affected persons within the periods required by law. Affected persons receive a notification in the app, by email or by SMS.
14.4. Oknow notifies the specialist of an incident affecting their database within one working day after discovery at the latest.
14.5. The owner of Oknow is responsible for personal data processing.
15. Cookies and web pages
15.1. Web pages use only technically necessary cookies for signing in to the web panel and selecting a language.
15.2. There are no advertising or analytics cookies, pixels, advertising trackers or third-party analytics.
15.3. You can disable cookies in your browser, but sign-in on web pages may stop working.
15.4. Data stored when consent is confirmed through a link is listed in clause 4.5. The rules for consent and opt-out links are set out in section 6.
16. Children
16.1. The service is intended for persons aged 18 or over (to be checked by a lawyer).
16.2. A parent or legal representative may make a booking for a child using their own account and phone number. No data about the child is collected beyond the name in the booking.
17. Changes to this Policy
17.1. The version date is stated at the beginning of this Policy. Previous versions are retained and provided on request.
17.2. Oknow notifies users of changes in the app and by email at least 14 days before they take effect. Corrections that do not adversely affect users take effect on publication.
17.3. If you disagree with the changes, you can delete your account before they take effect. Continued use after that date means acceptance of the changes.
17.4. A new version of this Policy does not change consent to offers from the specialist or Oknow marketing. A new version of the consent text requires new consent.
17.5. Disputes and complaints are handled under Kazakhstan law. A response to a dispute submission is sent within 15 working days.
18. Contacts
18.1. Oknow owner, operator of account and platform data, and person responsible for processing: an individual, a citizen of the Republic of Kazakhstan [owner's full name].
18.2. Individual Identification Number: [Individual Identification Number].
18.3. Correspondence address: [correspondence address].
18.4. Personal data and support contact: support@oknow.online (the address is a placeholder until the domain is registered; to be checked by a lawyer before publication).
18.5. The relevant specialist is the owner and operator of the client database. Their name or business name is shown on the consent page. Requests to Oknow are accepted under section 13.