Version of 5 October 2026

Personal Data Processing Policy

This page says what data the form on avasolutions.studio collects, why it is needed, where it is stored and how to see, correct or delete it.

1. Operator

The personal data operator is Astronova LLP (Republic of Kazakhstan). The company works under the Ava Solutions brand.

Write to [email protected] with any question about your data.

2. What data we collect

We collect only what you enter in the form yourself and a small set of technical data:

• first and last name;
• email address;
• the company's name and industry, if you gave them;
• the number of people in the company, if you gave it;
• the text of your message;
• technical data of the submission: the page address and language, the date and time, the IP address, browser details;
• the consent record: the date, the time and the version of the consent text.

We do not ask for or process data about health or beliefs, or biometric data. Please do not put such data, or the personal data of other people, in your message.

3. Why the data is needed

• First and last name, email, company details and the text of the message: to consider the message, answer it and prepare a proposal.
• The IP address, browser details and the time of submission: to protect the form from spam and abuse.
• The consent record: to confirm that the consent was received.

The basis for processing under the law of the Republic of Kazakhstan is your consent (Articles 7 and 8 of the Law “On Personal Data and Their Protection”).

We do not use the form data for mailings or advertising, and we make no decisions about you automatically, without a person.

4. Where and how long the data is stored

Requests are stored in a database on a server of the hosting provider Railway Corporation (USA). The server is in the Netherlands.

A request is kept for 12 months from the day of the last message or of our reply, and is then deleted. If we have signed a contract, the periods of the contract and of the law apply.

5. Who receives the data

We do not sell the data or publish it in public sources. The form data is received by:

• Railway Corporation (USA): hosts the database with the requests on a server in the Netherlands;
• the Telegram messenger: it carries the notice of a new request to the operator, together with the content of the request.

This is a cross-border transfer: the form data leaves the Republic of Kazakhstan for the Netherlands and for the servers of Telegram. It is made with your consent.

Two more services work so that the site opens. Cloudflare, Inc. (USA) delivers and protects the pages of the site, and Google serves the fonts of Google Fonts. Both receive the visitor's IP address in the process. The content of the form does not pass through them.

6. How we protect the data

The data travels over a protected connection. Only those employees of the operator who need the requests to answer them have access. The form is protected from robots and from being sent too often.

7. Your rights

You have the right to:

• find out whether we hold your data and get information about it: we will answer within 3 business days;
• ask us to change or complete the data: we will do it within 1 business day;
• ask us to block or delete the data: we will do it within 1 business day;
• withdraw your consent: we will stop the processing within 15 business days;
• appeal against our actions and claim compensation for harm.

To use a right, write to [email protected] from the address you gave in the form. It is free.

A complaint can be lodged with the authorised body: the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan.

8. Browser storage and statistics

The site sets no advertising or tracking cookies. When you choose the language of the site, that choice is saved in your browser. Visits are counted by Cloudflare Web Analytics: without cookies and only in aggregate.

9. If EU law (GDPR) applies to you

This section concerns you if Regulation (EU) 2016/679 applies to the processing of your data.

• Controller: Astronova LLP, see section 1. No representative in the EU and no data protection officer have been appointed.
• Legal bases: answering your request and preparing a proposal: Article 6(1)(b) GDPR; if you write on behalf of a company: Article 6(1)(f), our legitimate interest in answering business enquiries. Protecting the form and confirming the consent: Article 6(1)(f). The consent box in the form is required by the law of Kazakhstan; for the purposes of the GDPR we do not rely on consent.
• Recipients: Railway Corporation, Telegram, Cloudflare, Inc. and Google, as described in section 5.
• Countries outside the EU: the request is stored on a server in the Netherlands, that is, in the EU. The operator is in Kazakhstan and works with the requests from there; there is no adequacy decision of the European Commission for Kazakhstan. The notice of a request passes through the servers of Telegram, and Cloudflare, Inc. and Google receive the IP address in the USA as well. Write to [email protected] to ask for information about the safeguards applied.
• Storage period: as in section 4.
• Rights: access to the data, rectification, erasure, restriction of processing, portability.
• Right to object: you can object at any time to processing that is based on our legitimate interest.
• Complaint: you have the right to turn to the data protection supervisory authority of the EU country where you live or work.
• Required fields: first and last name, email and the text of the message. Without them we cannot answer. The other fields are optional.
• Automated decisions: we make no decisions under Article 22 GDPR.

10. Consent to the collection and processing of personal data

By ticking the consent box in the form and pressing “Send”, you give your consent in the following wording.

I, who gave my first and last name in the form on avasolutions.studio, give Astronova LLP (Republic of Kazakhstan), hereinafter the Operator, my consent to the collection and processing of my personal data.

1. List of data: first and last name; email address; the company's name and industry; the number of people in the company; the text of my message; the page address and language, the date and time of submission, the IP address, browser details.
2. Purposes: to consider my message and answer it; to prepare a proposal; to protect the form from abuse; to confirm that this consent was received.
3. Term of the consent: 12 months from the day of my last message, or until the consent is withdrawn if that happens earlier.
4. Transfer to third parties: the Operator passes my data to Railway Corporation (storage of the database) and through the Telegram messenger (the notice of the request to the Operator).
5. Cross-border transfer: my data leaves the Republic of Kazakhstan: for the Netherlands and for the servers of Telegram.
6. Dissemination in public sources: the Operator does not disseminate my personal data.
7. Withdrawal of the consent: I can withdraw the consent by writing to [email protected], and the Operator will stop the processing within 15 business days.

The Operator keeps the date and time of the consent and the version of this text.

11. Changes to the policy

A new version is published on this page with its date. Requests already sent are governed by the version you agreed to. If the language versions differ, the Russian text prevails.