Personal Data Collection, Processing and Protection Policy

This Policy sets out how personal data of users of the OWI Studio website at owi.studio is collected, processed, stored and protected.

The owner and operator of the database and digital object containing personal data is:

Individual Entrepreneur Ruslan Radikovich Sadykov (IE “Otherwise”)
Individual Identification Number: 980730351412
Brand: OWI Studio
Website: owi.studio
Email: hello@owi.studio

Hereinafter referred to as the Operator or OWI Studio.

OWI Studio collects, processes and protects personal data in accordance with the laws of the Republic of Kazakhstan, including Law No. 94-V of the Republic of Kazakhstan dated 21 May 2013 “On Personal Data and Their Protection” and Digital Code No. 255-VIII of the Republic of Kazakhstan dated 9 January 2026.

This Policy applies to data received through owi.studio, the general project enquiry form, specialised briefs and technical tools used by the website, as well as business contacts received through individual B2B communication or relevant publicly available professional sources under section 10.

For the purposes of this Policy:

• a general enquiry is an enquiry submitted through the general project discussion form;
• a specialised brief is a Design Support, Product Discovery or UX/UI brief submitted through the corresponding form on the website.

This Policy does not govern data processing by third-party websites and services after a user follows an external link to them.

When completing the general project enquiry form, a user may provide OWI Studio with:

• surname, first name and patronymic, if applicable;
• company or project name;
• telephone number;
• email address;
• Telegram username or profile link;
• a description of the project, task or proposed cooperation;
• information the user voluntarily includes in the enquiry;
• documents, presentations, images and other files voluntarily attached to the form;
• information contained in the attached files.

Required fields are marked in the form.

When completing a specialised brief, a user provides:

• surname, first name and patronymic, if applicable;
• job title;
• a username, number or other contact in Telegram, Max or WhatsApp;
• email address;
• information about the company, product or brand;
• answers about the current situation, tasks, scope, platforms, materials, team and expected outcome;
• information about the budget, timing, decision-making process and how the user learned about OWI Studio;
• other information the user voluntarily enters in the brief’s free-text fields.

The following technical and evidentiary information may also be processed when the website is used and a general enquiry or specialised brief is submitted:

• form-submission date and time;
• address of the page from which the form is submitted;
• information required to protect the website and form from spam and unauthorised access;
• the fact that consent to personal data collection and processing was granted;
• the date and time when consent was granted;
• the Consent identifier 2026-08-26-v4 in effect when the form was submitted;
• this Policy identifier 2026-08-26-v5 in effect when the form was submitted.

For a specialised brief, OWI Studio additionally records the form type and version, a random unique submission identifier, the first-page path, UTM parameters and only the hostname of an external referrer, without its full URL, path or query string.

Minimal operational metadata and one-way HMAC search values produced with a secret key are created for search and protection against duplicate or automated submissions. Full IP addresses and user agents are not recorded in general enquiries, specialised briefs or first-party analytics. For rate limiting, an IP address is used only while its HMAC is calculated; only the HMAC value is kept in the rate-limit table and is deleted approximately two days later, subject to the next cleanup cycle.

A minimal security audit log may contain the internal submission identifier, form type, event, identifier of the staff member who performed the action and event time, without user contact details or form answers.

The website separately processes the following data for its own technical analytics:

• a random temporary visit identifier created by the browser and stored only in the current tab’s `sessionStorage`;
• the visited page path without a query string;
• event date and time;
• the first page path of the visit;
• source and medium;
• the `source`, `medium`, `campaign`, `content` and `term` UTM parameters where present in the link;
• the external referring domain without the full URL or query string;
• whether the general form or a specialised brief was opened and successfully submitted.

The analytics tables do not store IP addresses, user agents, names, email addresses, telephone numbers, Telegram details, form contents, files, permanent user identifiers or fingerprints.

After a general enquiry is submitted, OWI Studio’s internal CRM creates a lead. It may record Inbound direction, source and channel, UTM attribution, campaign, company, contact, S1–S5 segment, status, owner, next action and its date. Actual communication may add notes, replies, meetings and proposals; once a task is qualified, a deal, stage, value, currency and outcome may be recorded.

A specialised brief is stored in separate server-side storage. Submitting it does not automatically create a lead in the internal CRM. If the parties proceed to discuss cooperation after the brief is reviewed, the subsequent communication may be processed separately on the basis of consent, an agreement or another lawful ground.

OWI Studio does not request a user’s Individual Identification Number, identity-document details, banking details, health information or other personal data not required to discuss a project.

Users should not attach identity documents, banking or medical documents, or other documents containing information that is not needed to review the enquiry.

Users should not enter or attach excessive personal data, identity-document details, banking or medical information, or other information that is not needed to review an enquiry or brief.

If a user voluntarily provides another person’s personal data, including in brief answers or attached documents, the user must have a lawful basis for providing it to OWI Studio.

Personal data should not be included in UTM tags or other link parameters.

Data received through the general project enquiry form is used to:

• receive and review an enquiry;
• contact the user using the details provided;
• discuss a project, product, service or other task;
• clarify the task, scope, timing, budget and other terms of potential cooperation;
• assess whether a project can be delivered;
• prepare a proposal, estimate, presentation, quotation or draft agreement;
• conduct correspondence and negotiations regarding the enquiry;
• maintain one internal record of leads, contacts, companies, campaigns and deals;
• continue or resume discussion of the same enquiry or potential cooperation;
• enter into and perform an agreement if the parties agree to cooperate;
• record the granting or withdrawal of consent;
• secure the website;
• protect the form from spam, abuse and unauthorised access;
• comply with the laws of the Republic of Kazakhstan.

Data from a specialised brief is used to:

• receive and review the brief;
• assess whether the task fits OWI Studio’s services and expertise;
• understand the context, goals, composition, scope, priorities and constraints of the work;
• assess expected timing, capacity, working format and preliminary cost;
• prepare questions, recommendations or a proposal;
• contact the user using the details provided;
• record the granting or withdrawal of consent;
• protect the form from spam, abuse and unauthorised access;
• comply with the laws of the Republic of Kazakhstan.

Technical data may be used to:

• operate the website correctly;
• identify and resolve technical errors;
• protect the form from automated submissions and abuse;
• count visits and page views;
• assess traffic sources, UTM campaigns and conversion to opening and submitting the general form or a specialised brief.

Contact details provided through the general form or a specialised brief are not used for mass promotional or newsletter mailings solely because the form was submitted.

OWI Studio may continue individual communication concerning the submitted enquiry or previously discussed potential cooperation within the processing period stated in this Policy.

If OWI Studio later introduces a separate news subscription, recurring promotional email or another independent marketing channel, a separate consent mechanism will be used where required by law.

The primary ground for collecting and processing personal data provided through the general form or a specialised brief is the user’s consent.

Before submitting the form, the user reviews this Policy and the Consent to Personal Data Collection and Processing and confirms consent by actively selecting the relevant checkbox.

The checkbox is not selected in advance.

The form cannot be submitted without the required consent.

OWI Studio records the information required to evidence consent, including the user’s full name, form type and version, submission date and time, the fact of consent, the identifier of this Policy and the identifier of the Consent accepted by the user.

An optional local draft of a specialised brief is created only after the user explicitly enables this feature. No draft is saved to `localStorage` without that action.

If the enquiry results in a contractual relationship between the user, the organisation they represent and OWI Studio, certain data may also be processed to enter into and perform that agreement and to comply with the laws of the Republic of Kazakhstan.

Personal data processing may include:

• collection;
• recording;
• organisation;
• accumulation;
• storage;
• correction and updating;
• use;
• provision of access to the extent required;
• limited access by the hosting provider and authorised persons in the cases described in this Policy;
• restriction;
• deletion;
• destruction.

Processing may be automated or manual.

OWI Studio processes only the data required for the purposes set out in this Policy.

Enquiry data is not sold or disclosed to an unlimited group of persons.

Data received through the general form and related materials is retained for no more than 12 months from the user’s last communication with OWI Studio regarding the enquiry or potential cooperation.

Last communication means an actual interaction between the user and OWI Studio, such as correspondence, a call, a meeting or another continuation of the discussion.

Internal review of an enquiry, a status change or another OWI Studio action without the user’s involvement does not extend the retention period.

A submitted specialised brief is retained in separate server-side storage for no more than 12 months from its submission. Internal review or a status change does not extend this period.

An optional local draft of a specialised brief remains current for up to 30 days. It is physically removed from `localStorage` the next time the form is opened after 30 days have elapsed, when draft saving is disabled, after successful submission or when browser data is cleared. If the user does not open the form again or clear browser data, OWI Studio cannot remotely delete that local copy.

Data may be deleted earlier:

• once the processing purposes have been achieved;
• after consent is withdrawn, unless another lawful basis applies;
• if OWI Studio decides not to continue discussion and further storage is unnecessary;
• if data was received in error;
• if further processing is no longer required.

If an agreement is entered into, data required for contract performance, accounting, tax or other mandatory records may be retained for the periods prescribed by the laws of the Republic of Kazakhstan.

Minimal analytics sessions and events are retained for 180 days and are then deleted automatically. UTM-link definitions may be retained longer because they do not contain visitor data.

Minimal security audit logs are retained for no more than 12 months from the relevant event. After the enquiry or brief itself is deleted, this limited operational trace may remain until the end of that period for security and to evidence the completed action.

OWI Studio’s server-side database and digital object containing personal data are located in server infrastructure in the Republic of Kazakhstan.

General enquiries are kept in the primary database and linked to the internal CRM. Specialised briefs are kept in separate server-side storage and are not automatically linked to the CRM.

Files attached to enquiries and backup copies are stored in infrastructure located in the Republic of Kazakhstan in compliance with its personal data storage and protection requirements.

The specific server or cloud infrastructure provider may change, provided that the laws of the Republic of Kazakhstan and OWI Studio’s data-protection requirements continue to be met.

When a form is submitted, the website does not send the contents of a general enquiry or specialised brief, contact details, CRM data or attachments to email, Telegram, external CRM services, analytics systems, advertising systems or other external APIs.

An optional specialised-brief draft is stored only in the browser’s `localStorage` on the user’s device. It is not transferred to OWI Studio’s server-side database until the brief is submitted.

OWI Studio may provide access to personal data only to the extent required to host and maintain the website or comply with law.

Such parties and services may include:

• the server, database, file-storage and backup provider located in the Republic of Kazakhstan;
• authorised technical contractors where access is required to maintain the website and is subject to confidentiality;
• public authorities and other persons where disclosure is required by the laws of the Republic of Kazakhstan.

Third parties receive only the information required for the relevant task.

OWI Studio does not sell enquiry databases or provide personal data to an unlimited group of persons.

After the general form is submitted, the enquiry is saved in OWI Studio’s primary database and automatically linked to a record in the internal CRM.

After a specialised brief is submitted, it is saved in separate server-side storage and does not automatically create a lead in the internal CRM.

On submission, neither form distributes its contents by email, Telegram or any other external service.

Authorised OWI Studio personnel review general enquiries and specialised briefs only in the authenticated, protected area of the website.

The terms for processing contacts received outside the website form are set out in section 10 of this Policy.

If the user and OWI Studio later choose Telegram, email, telephone or another channel for further communication, that correspondence is processed through the selected channel separately from the website form.

This section applies when a person:

• contacts OWI Studio through Telegram, email, LinkedIn or another business channel;
• represents a company in discussions with OWI Studio;
• publishes business contact details in a publicly available professional profile, company website, contractor directory, tender document or comparable relevant source.

OWI Studio may record a person’s name, role, company, business phone, email or Telegram, a source link, individual communication history, a proposed or confirmed task, lead source and campaign, S1–S5 segment, owner, next action, lead and deal status, proposal, deal value and outcome.

OWI Studio does not scrape personal data in bulk or build databases by non-targeted extraction from publicly available sources. A specific source link or description and the processing basis are recorded in the CRM for a contact taken from a publicly available professional source.

Personal data lawfully published in a publicly available source is collected and processed again with a reference to that source in accordance with Article 7(5) of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”. If this basis cannot be confirmed, the data is not used without the data subject’s consent or another basis provided by the laws of the Republic of Kazakhstan.

Data is used for individual B2B communication, responding to enquiries, qualification, proposal preparation, negotiations and recording outcomes.

Publication of a contact on the internet does not by itself constitute unrestricted consent to any mailing. OWI Studio does not use this data for mass automated messaging and stops individual outreach after an objection.

Data is stored in OWI Studio’s internal CRM in protected infrastructure in the Republic of Kazakhstan. Contacts, notes and commercial communications are encrypted in the database. No external CRM or advertising platform is used for this database.

An unanswered outbound record is deleted within 3 months, unless another lawful basis arises. Following actual communication, potential-cooperation data is retained for no more than 12 months after the last communication, unless an agreement or law requires a different period.

A person may object, ask for the source, or request correction or deletion at any time through:

• email: hello@owi.studio;
• Telegram: @owistudio;
• telephone: +7 706 736 67 30.

OWI Studio records a “do not contact” flag after an objection. A minimal suppression record may be retained only to prevent renewed contact and meet legal requirements.

The website does not make a cross-border transfer of personal data contained in a general form or specialised brief when it is submitted.

A user’s independent use of an external link is not an automatic transfer of the enquiry or brief by the website. If the user chooses an external service for further communication, sending messages and files through it may result in processing outside the Republic of Kazakhstan under the service owner’s rules. OWI Studio uses such an external channel to transfer data abroad only when it has been selected by the user and the cross-border transfer conditions under the laws of the Republic of Kazakhstan are met.

Submitting a general enquiry or specialised brief through the website is not consent to make a user’s personal data publicly available.

On the basis of an enquiry or brief, OWI Studio does not publish:

• the user’s full name;
• telephone number;
• email address;
• Telegram details;
• the enquiry or brief;
• correspondence;
• attached documents;
• confidential project materials;
• a testimonial in the user’s name;
• information about the cooperation as a public client case study.

If OWI Studio plans to publish a case study, testimonial, client information or other materials after cooperation begins, such use is governed separately by an agreement or additional approval from the relevant party.

The website uses `localStorage` for the selected language and necessary interface settings. A specialised brief may also be stored there as an optional local draft, but only after the user explicitly enables this feature. The draft does not store the consent checkbox state, the fact of consent, or the identifiers of this Policy and the Consent.

The local draft is not transferred to OWI Studio until the form is submitted. It remains current for up to 30 days and is physically removed the next time the form is opened after that period, when the feature is disabled, after successful submission or when browser data is cleared. OWI Studio cannot remotely delete the draft from the device if the user does not return to the form or clear browser data.

Analytics uses only a random current-tab identifier in `sessionStorage`; the browser-side identifier disappears when the tab is closed. Analytics does not use cookies or a permanent ClientID.

The first-party analytics records the `page_view` and `brief_open` events, `brief_submit` for a successfully submitted general form and `brief_submitted` for a successfully submitted specialised brief, only in OWI Studio infrastructure in Kazakhstan. The website does not load Google Analytics, Yandex Metrica, external analytics SDKs, advertising pixels or marketing trackers. Fonts, images and video are loaded from owi.studio unless the user independently follows an external link.

The OWI Studio website may link to:

• social networks;
• Telegram;
• media publications;
• presentations;
• Notion;
• YouTube;
• Vimeo;
• partner websites;
• other third-party resources.

After a user independently follows an external link, the relevant service owner processes data under its own rules and policies.

OWI Studio does not determine how a third-party service processes data after the user leaves owi.studio.

OWI Studio takes organisational and technical measures to protect personal data from unlawful or accidental access, alteration, disclosure, loss and destruction.

The contents and contact details of general enquiries and specialised briefs are encrypted by the application before they are written to the server-side database. The encryption key is stored separately from the encrypted data. This describes a safeguard that is actually used and is not a claim that a certified cryptographic protection tool is used.

Depending on the infrastructure used, these measures include:

• limiting the persons who can access enquiries;
• assigning access rights;
• authentication for internal interfaces;
• secure HTTPS connections;
• restricted direct access to databases;
• retaining only the minimal operational metadata and one-way HMAC values needed for search and rate limiting;
• restricting public access to attached files;
• secure storage of credentials and technical secrets;
• logging of necessary events;
• timely revocation of access that is no longer required;
• deletion after the retention period;
• other safeguards required by the laws of the Republic of Kazakhstan and the infrastructure in use.

OWI Studio does not place passwords, access tokens or other technical secrets in the public area of the website.

In accordance with the laws of the Republic of Kazakhstan, a user has the right to:

• learn whether OWI Studio holds personal data relating to them;
• receive information about the purposes and methods of processing;
• learn which data is processed and its retention period;
• request correction or completion of inaccurate or incomplete data;
• request restriction where legal grounds exist;
• request deletion or destruction where legal grounds exist;
• withdraw consent where this does not conflict with the laws of the Republic of Kazakhstan and no outstanding obligation applies;
• refuse consent to public dissemination of their data;
• protect their rights and lawful interests by the means provided by law.

To withdraw consent or request information, correction or deletion, a user may contact OWI Studio through:

• email: hello@owi.studio;
• Telegram: @owistudio;
• telephone: +7 706 736 67 30.

The request should include information that allows OWI Studio to identify the relevant enquiry or brief and confirm that the data belongs to the user, such as:

• full name;
• the telephone number or Telegram details used in the form;
• the approximate submission date;
• where available, the brief type or company or project name.

OWI Studio may request additional information where required to verify the requester’s identity and prevent deletion or alteration at the request of an unauthorised person.

In response to a verified request about the existence and processing of personal data, OWI Studio provides the information or sends a reasoned refusal no later than 3 working days after receiving the request.

After receiving a withdrawal, OWI Studio stops processing and deletes the relevant data within 15 working days, or sends a reasoned refusal within the same period if retention or processing is required by law or an outstanding obligation.

A withdrawal sent to OWI Studio does not delete a local specialised-brief draft from the user’s device. The user can remove it by disabling draft saving, clearing the website’s browser data or reopening the form after 30 days have elapsed.

OWI Studio may update this Policy if any of the following change:

• the laws of the Republic of Kazakhstan;
• the data collected through the website;
• the website functionality;
• the technical services used;
• data storage or processing procedures.

The current version is always available at:

owi.studio/privacy

The effective revision date appears at the beginning of the document.

Individual Entrepreneur Ruslan Radikovich Sadykov
IE “Otherwise”
Individual Identification Number: 980730351412
Brand: OWI Studio
Website: owi.studio
Email: hello@owi.studio