Privacy Policy of the Small Chat Corporate Messenger
Procedure for the collection, processing and protection of personal data in the “Small Chat” corporate messenger of the SMALL Group of Companies. Any of the companies of the group is hereinafter referred to as the “Company”.
Small Chat is the internal corporate messenger of the SMALL Group of Companies (the “Messenger”).
SMALL Group of Companies (the “SMALL Group”) means the aggregate of separate legal entities participating in the use of the Messenger. The group itself is not a separate employer, proprietor or operator of personal data.
The full list of member companies forming part of the SMALL Group, including the legal entity that is the Messenger Owner, their BINs, roles and contacts is set out in Appendix No. 1. Each member is hereinafter also referred to as the Company in respect of the processing carried out by it. The Messenger Owner simultaneously acts as the Employer Organisation in respect of its own employees.
The Messenger is intended for the work-related interaction of employees of all legal entities of the SMALL Group. An individual account is created for each employee. The Policy also applies to the data of former employees within the limits of lawful retention and to other natural persons whose information has been lawfully included in work messages and attachments. Access to the Messenger is not granted to external users.
1. Purpose and Scope of the Policy
1.1. This Policy (the “Policy”) establishes the rules for the handling of personal data and confidential information by employees of the SMALL Group (the “Employees”) when using the Messenger (the Small Chat mobile applications for iOS and Android, the desktop application, the web version and its server part which serves them).
1.2. The Policy applies to employees, to former employees in respect of retained data, to natural persons under civil law contracts (if any), to invited users, and to other natural persons whose data has been lawfully included in messages, attachments and other materials of the Messenger. Information about a legal entity does not in itself constitute personal data; however, information about its representatives may constitute such data.
1.3. The Policy is in effect as a transitional document within the Messenger until it is replaced or incorporated into the general system of corporate policies. Its transitional nature does not release anyone from the applicable requirements of legislation. The Policy does not govern processing outside the Messenger, including in the corporate portal and other corporate systems, nor video surveillance, customer loyalty programmes and paper HR archives, and does not replace the documents required for them. Separate documents apply to the corporate portal and other systems; placing a link to the Messenger in the portal or a link to the portal in the Messenger does not extend the Policy to those systems.
1.4. The legal basis consists of the Law of the Republic of Kazakhstan No. 94-V dated 21 May 2013 “On Personal Data and Their Protection” (hereinafter the “Law”), the Labour Code of the Republic of Kazakhstan and applicable regulatory legal acts. In the event of a conflict, the mandatory requirement of legislation shall apply. Familiarisation with the Policy does not constitute a waiver of rights or a universal consent to processing.
2. Who Processes Data and in What Capacity
2.1. Employer Organisation means each legal entity of the group that is in an employment relationship with the employees being connected. It determines, within the limits of its powers, the work-related purposes of the use of the Messenger by its employees, the information transferred for the creation of accounts, the composition of users, the work hubs and channels and the necessary access rights. The Employer Organisation ensures the lawfulness of the transfer of data to the Messenger Operator and to other recipients, the accuracy of such data, its timely updating and the familiarisation of employees with the Policy. In respect of the collection, processing and protection of data carried out by it, it performs the obligations of an operator under the Law. Connection to the Messenger does not in itself make it the proprietor of the shared digital object.
2.2. The owner and operator of the Messenger is “Skif Trade” LLP, BIN 020340002288 (hereinafter the “Messenger Operator”). Small Chat belongs to the Messenger Operator, and it ensures the creation and maintenance of accounts, as well as the functioning, administration, technical support and protection of the shared digital object containing personal data. Within the limits of the operations it carries out, it performs the obligations of an operator under subparagraph 10) of Article 1 of the Law. The rights of possession, use and disposal of the said digital object and the status of its proprietor under subparagraph 9) of Article 1 of the Law are established in the documents on the ownership of the object and in the inter-company agreement. Ownership of the software does not imply an unlimited right to use the personal data contained therein.
2.3. The interaction of the Messenger Operator with each Employer Organisation is formalised by an inter-company agreement or by accession to a single agreement. Such agreement determines the rights to the digital object, the purposes, data and operations, the procedure for transferring lists of employees and confirming the legal basis, instructions for the creation and termination of accounts, the access matrix, retention periods, protection measures, the engagement of contractors, actions in the event of incidents, the fulfilment of data subject requests and the deletion of data upon a company’s exit from the system. The agreement does not replace the consent of the data subject where such consent is required and does not eliminate the obligations of each party established by the Law.
2.4. Each Employer Organisation and the Messenger Operator appoint a person responsible for organising the processing of personal data. IT departments and administrators act on behalf of their legal entity and within the limits of the powers granted. A single point of receipt of requests acts in the interests of all members without altering their independent obligations and the time limits for fulfilling requests.
2.5. The Messenger Operator processes data for the purposes of providing, supporting and protecting Small Chat, fulfilling the lawful instructions of Employer Organisations and the mandatory requirements of legislation. It does not use the content of correspondence for advertising, the sale of data, the training of external artificial intelligence models or other independent incompatible purposes. Automated processing necessary for the delivery of messages, search within the limits of access rights and the storage of messages is permitted within the limits established by this Policy. Viewing of content by authorised specialists is governed by Section 5 of the Policy.
2.6. A common brand, the affiliation of companies, the existence of an account or the technical ability to view do not constitute an independent basis for access to personal data. Inter-company exchange is permitted only for a specified work-related purpose, on a proper basis and to the minimum extent necessary.
2.7. The relevant company acting as employer determines the work-related purposes of the processing of personal data, and the Proprietor bears the obligations of an operator in accordance with its actual functions. The internal IT department of the Proprietor acts on behalf of its legal entity and does not become an independent operator solely by virtue of its technical role.
Only data necessary for predetermined purposes is processed. The list is set out below. The presence of a category in the list does not mean that it is mandatorily collected from every user; profile fields and functions of the Messenger are limited to its intended purpose.
The sources are the data subject themselves, their employer, authorised users in the course of work interaction, corporate systems connected to the Messenger and technical events. A person transferring the data of another individual must have a legal basis for doing so. The receiving member also verifies the lawfulness of its own processing.
Messages and attachments may contain the data of other persons. The User must not post excessive information, passwords, secret keys or materials to which access does not correspond to the composition of the channel’s recipients. Medical information, identity documents, bank details, IINs and other high-risk data are permitted in the Messenger only under an exchange procedure specially authorised by the Company and to the extent necessary. The independent addition of information by a user does not make its further use unlimited.
3. What Personal Data We Process
3.1. Account
Username, first name and surname, email address, avatar link, department affiliation, activity status. In addition, the service information of the profile may contain a telephone number and job title — these are obtained from the organisation’s HR system, are not filled in by the user and cannot be edited in the profile interface. The password is stored only in the form of an irreversible hash (bcrypt) — it is impossible to recover the original password.
The data is received from the Employer Organisation and not from the user: through the organisation’s single sign-on system (the account is created automatically upon first sign-in) or by automatic import from its HR system — first name, surname, work email, employee identifier, department. There is no self-registration in the service.
The Messenger is not used for the sale of personal data, advertising profiling, the transfer of work correspondence for the training of external artificial intelligence models or other incompatible purposes. A new purpose, function or integration requires a prior assessment, an update of the register and, where necessary, a new consent.
3.2. Content of Correspondence
Message text, replies, reactions, mentions, threads, pinned messages, drafts, attached files and images together with their names and sizes, read receipts.
The content of messages is stored on the server in unencrypted form. The service has no end-to-end encryption (whereby the content is inaccessible even to the server), and we do not claim otherwise: it is incompatible with search across correspondence and with server-side delivery of notifications, both of which are present in the product. Protection is based on access control and infrastructure protection, not on the cryptographic impossibility of reading data on the server.
3.3. Sign-in and Device Data
Upon each sign-in, the following are stored: IP address, user-agent string, device type, operating system, browser, session start and end time. For the delivery of notifications, the device identifier, platform, application version and the push token issued by the notification service are stored.
3.4. Activity Log
Significant actions (sign-in, failed sign-in attempt, change of rights, operations with hubs and channels) are recorded in the log together with the initiator’s identifier, IP address and user-agent. The log is immutable and is retained for 12 months.
3.5. Technical Logs and Error Reports
Server diagnostic logs and crash reports. They contain the user’s email address upon sign-in, the user identifier, and the IP address in the event of an internal error.
In the web version, the interface session is recorded upon an error. The text of correspondence and the content of input fields are masked in such a recording, and images are not recorded — only the screen structure and the sequence of actions are stored.
3.6. Usage Data
Events de-identified as to content: the fact of sending a message (with the channel type, without text), receipt of a notification, use of search.
3.7. What We Do Not Collect
Geolocation, contact list, microphone recordings, health data, payment data. The application does not request the corresponding permissions.
Access to the camera and gallery is requested only at the moment when the user personally chooses to send a photograph or file, and is used solely for that purpose.
4. Why We Process Data
| Purpose | What we process |
|---|---|
| Provision of the service: message delivery, files, threads | Account, content of correspondence, read receipts |
| Authentication and account protection | Sign-in data, sessions, IP, user-agent |
| Notifications of new messages | Push tokens, event information (Section 6) |
| Access control: who is in which hub and channel | Membership, roles |
| Security, incident investigation, resolution of disputed situations | Activity log |
| Operability and troubleshooting | Technical logs, error reports |
| Product improvement | Usage data |
Legal Grounds for the Processing of Personal Data
Collection and processing are carried out with the consent of the data subject, given in writing upon the conclusion of the Employment Contract with the employer. Employment relations are not used as a universal substitute for the basis required by Articles 7–9 of the Law.
Before transferring information for the creation of an account, the Employer Organisation verifies whether the employee’s existing consent covers the collection and processing of data in Small Chat by the Messenger Operator, the maintenance of a shared work directory, the necessary exchange between the companies of the group and, where applicable, external and cross-border transfers. Any missing scope is formalised by an additional consent prior to the relevant processing. The verification is carried out before the list of employees is uploaded, including in the case of automatic import; the creation of a non-activated account already involves the processing of data.
Consent is given in writing. The consent for Small Chat specifies the relevant Employer Organisation and the Messenger Operator. The issuance of an account, the first sign-in, silence, familiarisation with the Policy or acceptance of the user agreement do not in themselves replace consent. A separate consent for each sign-in or message is not required if the operation is covered by a proper basis.
The Employer Organisation reports changes of job title, department and powers. A transfer to another legal entity of the SMALL Group requires a separate instruction, verification of the basis for the transfer and a review of rights. Previous rights are not retained automatically. When working for several members, powers are accounted for separately. Retention of a single identifier is permitted only with correct access control. The creation of an account grants rights to all hubs and channels.
5. To Whom Data Is Transferred
We do not sell data and do not transfer it for advertising. Transfer takes place only to the extent necessary for the operation of the functions listed below.
| Recipient | What it receives | When |
|---|---|---|
| Google (Firebase Cloud Messaging) | Push notification: the device address token and the content of the notification — see Section 6 | When push delivery is enabled. Currently disabled by default |
| Apple (APNs) | The same notification — Google transfers it to Apple for iOS devices | Same as above |
| Browser notification delivery services (Google, Mozilla, Apple) | A notification without the message text — only the fact of the event and the sender’s name | When working in a browser with notifications enabled |
| Analytics service | User identifier and usage events. | When analytics is enabled |
| Error collection service | Diagnostic data: user identifier, IP in the event of an internal error, request body. | Upon a failure |
| Organisation’s single sign-on system | Credentials upon sign-in | If the organisation has enabled single sign-on |
| External systems connected by the organisation through bots | The full text of messages of the channels in which the bot is a member | If the organisation or the bot owner has configured the transfer |
A bot added to a channel of the Messenger obtains access to the content of messages of the relevant channel and may transfer such content to an external network address specified by the bot owner. In this regard, technical means provide for a prohibition on transfer to internal network addresses and for the signing of outgoing requests.
The external recipient of information is selected by the Messenger Operator. The Messenger Operator is responsible for the lawfulness of such transfer, the existence of the necessary legal grounds and its proper documentation, including obtaining the necessary consents and concluding the relevant agreements in the cases provided for by applicable legislation.
Each relevant Company undertakes to ensure that employees’ consents to the collection and processing of their personal data, including cross-border transfer, are obtained upon the conclusion of the employment contract. Such consents must cover the transfer of personal data to Google and Apple for the purposes of processing and delivering notifications.
The Messenger Operator undertakes to provide, upon the User’s written request, a list of third parties to whom personal data is transferred, indicating their full legal names, the countries of data processing and the details of the contracts governing the processing and protection of personal data, and to notify the User of changes to the said list before the commencement of data transfer to new recipients.
The Messenger Operator undertakes to ensure that database servers and file storage containing confidential information and personal data are located in compliance with the requirements of applicable legislation, including the requirements for the localisation of personal data. The engagement of cloud providers does not release the Messenger Operator from the performance of the said obligation.
6. Notifications — What Exactly Is Sent in Them
Notifications are optional. Refusing permission for notifications does not restrict the operation of the application: messages are received, counters are updated and all functionality is retained. The permission may be withdrawn in the operating system settings at any time.
What is sent through Google and Apple. The transport to their servers is protected, but the content of the notification is accessible to them: the APNs and FCM protocols do not provide for end-to-end encryption of notifications.
7. Retention Periods
| What | Period |
|---|---|
| Messages and files | For as long as the channel exists and until they are deleted by the author or an administrator. The Messenger Operator undertakes to ensure the permanent deletion of messages deleted by the user and of the files associated with them from the Messenger servers, including databases and file storage, upon the user’s written request. |
| Account | For as long as the Company uses the service. The Messenger Operator undertakes to ensure the permanent deletion of the account from the Messenger servers, including databases and file storage, upon written notice from the HR department following the termination of the employment relationship with the employee. |
| Sessions | A session is valid for 7 days, with no more than 10 sessions at a time. The Messenger Operator undertakes to ensure the permanent deletion of a session and the files associated with it from the Messenger servers upon the user’s written request. |
| Device push tokens | 30 days of device inactivity, or immediately upon signing out of the account |
| Activity log | 12 months |
| In-app notifications | 30 days after being read or dismissed |
| Drafts | 7 days without changes |
| Technical logs and error reports | Technical logs and error reports are retained for 3 (three) months and, upon expiry thereof, are irrevocably deleted. |
8. User Rights
- To find out what data is held about them. The profile and the list of sessions and devices are available in the application. Export of all data as a single file is currently not available; a request is submitted in the manner provided for by Section 12 of the Policy.
- To rectify data. First name, surname and username are changed in the application. Data imported from the organisation’s HR system is rectified in that system — we only receive it.
- To terminate sessions. The user may terminate any of their sessions on any device; in doing so, the push tokens of that device are deleted.
- To opt out of notifications. Section 6.
- To object to processing for diagnostic and analytical purposes.
9. Data Protection
- Connections between the applications and the server are protected by TLS.
- Passwords are stored as a bcrypt hash and cannot be recovered.
- Access to hubs and channels is controlled: a private hub is not visible to anyone who is not a member of it; a private channel is accessible only to those added to it by name.
- Actions involving access rights are recorded in an immutable log.
- Data on the device is protected.
- There is no end-to-end encryption of correspondence (Section 3.2).
10. Children
The service is intended for use within an organisation and is not designed for persons under 18 years of age. We do not knowingly collect data of children.
11. Changes
The Messenger Owner is entitled to unilaterally amend this Policy by publishing its new version in the Messenger. Amendments enter into force from the moment of publication, unless a later date is provided for in the new version. Separate notification of the Company and Users is not required, except where such notification is mandatory by virtue of the legislation of the Republic of Kazakhstan. The User shall independently familiarise himself or herself with the current version of the Policy. Continued use of the Service after publication of a new version is deemed acceptance thereof, except for amendments for which legislation requires the User’s separate consent.
12. Contacts
The Messenger Owner is “Skif Trade” LLP, BIN 020340002288, registered address: Kazakhstan, Almaty city, Bostandyk district, T. Katayev street, building 189, postal code 050000.
Requests regarding the use of the Messenger shall be sent to the e-mail address: chat@small.kz.
Complaints about user content and user actions shall be sent to the e-mail address: chat@small.kz or via the feedback form: https://chat.small.kz/support. The request should indicate the essence of the violation, information enabling identification of the relevant material or user, and contact details for a response. Where available, supporting materials shall be attached.
Complaints are considered by authorised representatives of the Messenger Owner. The initial assessment of a complaint and notification of the applicant of the measures taken or of the need for an additional review are carried out within 24 hours from its receipt. If an additional review is required, a reasoned response is sent no later than 5 working days from the date of receipt of the complaint. Requests for which other mandatory time limits are provided for by the legislation of the Republic of Kazakhstan are considered within the respective time limits.
Appendix No. 1
List of companies forming part of the SMALL Group of Companies:
“Skif Sauda” LLP, BIN 991140005177
“Skif Trade” LLP, BIN 020340002288
“Skif Food” LLP, BIN 241040019180
“Tai-Man Food” LLP, BIN 100640003363
“Skif Line” LLP, BIN 241240026349
“Skif MAG” LLP, BIN 210340024655
“Skif Trade Security” LLP, BIN 040640006384