Privacy Policy

The controller is TOO Steyer Engineering, Microdistrict Asa 41, 080004 Taraz, Republic of Kazakhstan, administration in Almaty. Managing director: Arnold Steyer. Email: office@steyer-engineering.com. Phone: +7 707 9979 525.

This notice covers personal data from this website, from enquiries, and from engineering and software work we do for clients. It does not cover systems that a client operates alone after handover.

We apply the Law of the Republic of Kazakhstan on Personal Data and Their Protection of 21 May 2013 (No. 94-V). Where the EU General Data Protection Regulation applies, because the person is in the EU or the processing is caught by it, we also follow that regulation. The principles are lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

Status: 30 September 2026.

From the enquiry form we receive the name, an email address or a phone number, the chosen service, the answers to the follow-up questions, and the message. The services you can choose are on-site and remote engineering, CAD and design, simulation and digital twin, project management and commissioning, building automation, software development, or another request. A hidden field is used only to filter automated submissions. We do not use it for anything else. The message is emailed to office@steyer-engineering.com.

If a contract follows, we also keep the organisation, role, correspondence, offer, order, invoices, and the technical project record needed to do the work.

On site or over a remote connection we may see names and contact details of the client's staff, access and safety records the plant requires, and technical data from controls, PLCs, and drawings. Remote access is limited to what the order allows.

When we build or maintain software, the client decides which personal data goes into that system. That can include staff, customers, or quality records in an ERP, CRM, quality system, portal, or shop. For that data the client remains the controller, unless the contract says otherwise.

The server that hosts the website can log connection data for technical reasons: IP address, time, requested address, and browser type. We do not use these logs to identify a visitor for marketing.

We do not ask for special categories of data, such as health data. Do not send them unless the job cannot be done without them and you have a legal basis to share them.

This website is aimed at companies. We do not knowingly collect data from children.

We use the data to answer the enquiry, prepare an offer, and perform the contract. The work can be engineering at the plant or over a remote connection, CAD, simulation and virtual commissioning, project management and commissioning, building automation, or software such as web applications, ERP, CRM, a quality system, a CAD viewer, or an integration.

We also use the data to issue invoices, keep the project record required by our ISO 9001:2015 system, protect the website and our accounts, meet legal duties, and, only with consent, understand how the website is used.

We do not sell personal data. We do not use it for advertising profiles.

Depending on the step, the basis is one of the following. Your consent, for analytics cookies and for any optional notice you accept. Steps before a contract and performance of the contract, for the enquiry, the offer, and the work. A legal obligation, for tax and accounting records. Our legitimate interests, for a secure website, for answering a business enquiry, and for keeping a project record, where those interests are not overridden by yours.

Where the processing is based on consent, you can withdraw it at any time with effect for the future. Withdrawal does not affect processing that was lawful before the withdrawal. Under the law of Kazakhstan, consent to the processing of personal data can also be withdrawn by a notice to us.

If you accept cookies, we store one cookie named se_prefs. It holds the language, the light or dark appearance, whether the intro is skipped on the next load, and whether you allowed analytics. If you refuse, or if you disable cookies in this notice, we do not store those settings.

After a first click, key press, or scroll, the Google Tag Manager container GTM-WLJN8TSG can load. Analytics cookies are set only after you accept. Until then, Google Consent Mode keeps analytics storage and advertising storage denied. We do not run ads from this website. Advertising storage, ad user data, and ad personalisation stay denied.

Google Ireland Limited and Google LLC in the United States process the analytics data under their own terms once the tag runs. That can include the IP address, pages, and device data. You can refuse in the banner, or disable cookies later in this notice. The site then does not load analytics.

Inside the company, people see personal data only if their work needs it. Managing director and the engineers on the job are the usual recipients.

Outside the company, recipients are the email path that carries the enquiry, the host of this website, and, after consent, Google for analytics as described in § 5. A subcontractor sees project data only if the order needs that person and the person is bound to confidentiality.

The company sits in Kazakhstan and works for clients in Europe and Central Asia. A transfer can therefore leave the country of the person concerned. Where the GDPR requires it, we use an adequacy decision or standard contractual clauses, or we rely on your consent for the analytics tag. Where the law of Kazakhstan requires a cross-border notice or consent, we follow that rule for the transfer in question.

An enquiry that does not become a contract is kept while we answer it and for a short period afterwards, in case you write again about the same job. It is then deleted, unless a legal hold applies.

Contract, invoice, and tax records are kept for the retention period required by the law of the Republic of Kazakhstan. Project records under ISO 9001:2015 are kept for the life of the contract and for the period the quality system requires after it ends.

The se_prefs cookie stays in the browser until you delete it or disable cookies here. Server logs are kept for the period the host needs for security, then deleted.

We limit access, use encrypted transport (HTTPS) for the website, keep backups of project data, and bind staff to confidentiality. No measure removes every risk of a breach.

You can ask whether we process data about you, and you can ask for a copy. You can ask for correction of inaccurate data. You can ask for deletion or for a restriction, where the law gives that right. Where the GDPR applies, you can ask for portability of data you provided, and you can object to processing that rests on legitimate interests.

You can withdraw consent as stated in § 4. You can complain to the competent authority of the Republic of Kazakhstan. Where the GDPR applies, you can complain to a supervisory authority in the EU, in particular in the member state where you live.

If we process personal data only on the instructions of a client, because the data sit in a system the client controls, send the request to that client as well. We will help the client answer it where our contract requires that.

Questions about this notice, and requests to exercise a right, go to office@steyer-engineering.com or to the postal address in § 1. There is no separate data protection officer. The managing director is the contact.

If we change this notice, the new text replaces the old one on this page. The date at the end of § 1 is the date of the current text. A change does not reduce rights you already have for data we already hold.