1. Operator and scope
The operator is Institute of Intellectual Technologies LLP, BIN 150240025180. Privacy requests may be sent to info@zti.kz. This Policy applies to Clever PGP, the website, forum, registration, payment confirmation, installer downloads, and the update service.
2. Local software processing
Selected files and disks are encrypted and decrypted locally on the computer. During normal use, we do not receive file contents, encryption passwords, keys, lists of personal documents, or decrypted data. Do not submit such information to the forum, reports, or support messages.
3. Data processed by the website
- Account: email, password hash (not the password itself), ID, role, status, and registration, payment, sign-in, and password-change dates.
- Registration confirmation: payer name, order number, transaction number, amount, and confirmation time obtained from a payment-provider message.
- Forum: questions, answers, language, dates, reports, moderator actions, and the administration log.
- Security and downloads: a random download identifier, request counters and timestamps, and one-way HMAC hashes derived from IP address, User-Agent, and client signals. Raw IP addresses may appear in standard web-server logs.
- Preferences: selected language and necessary session identifiers.
4. Purposes and grounds
Data is used to create and protect accounts, confirm payment, reset passwords, publish and moderate the forum, provide installers and updates, prevent brute force and artificial download inflation, maintain required records, and answer requests. Grounds include verifiable consent, provision of the requested service and performance of obligations, legal requirements, and protection of the service and users where permitted by law.
5. Public forum
Questions and answers are public and may be indexed by search engines. An abbreviated name such as “Almas O.” is normally displayed instead of the full name. Member ID, role, language, and publication time may also be visible. Email, transaction number, and payer full name are not public. Do not publish another person’s personal or confidential data.
6. Cookies
Only necessary and functional cookies are used: cleverpgp_lang stores language for up to 1 year; cleverpgp_download_id stores a random download-protection and statistics identifier for up to 2 years; cleverpgp_download_session stores a download session for up to 30 minutes; and cleverpgp_forum stores an authenticated forum session for up to 30 days. There are no advertising cookies or advertising profiles. Blocking cookies may prevent sign-in, downloading, or language persistence.
7. Recipients and external services
- Non-public data is accessible only to authorised administrators and technical hosting, database, and email providers to the extent required for operation.
- The payment provider processes payment independently; we receive the data needed to confirm registration and maintain records.
- WhatsApp, GitHub, and the payment service open only when you choose to use them. The external service’s rules then apply, and cross-border processing may occur.
- Data may be disclosed to a public authority or another recipient where required by law or necessary to protect rights and safety.
- We do not sell or rent personal data.
8. Retention
Account and related records are retained while the account is active and while needed for the stated purposes, dispute resolution, security, accounting, and other mandatory periods. Payment records may outlast the account where required by law. Public posts are retained for discussion integrity but may be deleted or anonymised after a justified request. Web-server log retention depends on hosting settings. When the purposes end, data is deleted, anonymised, or retained only to the extent required by law.
9. Data protection
We use HTTPS, password hashing, attempt limits, CSRF protection, cookies with HttpOnly and SameSite, role-based access, abbreviated public names, and administrator action logging. No system is absolutely secure; if an incident occurs, we take action and comply with applicable notification duties.
10. User rights
Depending on applicable law, you may request information about processing, access, correction, restriction, deletion or anonymisation, withdraw consent, object to processing, and challenge our actions. Send the request from the account email to info@zti.kz. We may verify identity to protect the account. Withdrawal does not affect prior lawful processing and does not require deletion of records retained by law or an outstanding obligation.
The principal applicable law is the Law of the Republic of Kazakhstan on Personal Data and their Protection. Official legal text.
11. Minors
The service is not intended for independent registration by a person who cannot provide valid consent or enter the relevant agreement under applicable law. A legal representative must participate in such cases. Contact us if a child’s data was submitted without the required authority.
12. Changes and contact
If processing changes materially, we will update this page and request fresh consent where required. The current version is always available at this page’s permanent address.