Privacy Policy

1. Who is responsible

ИП Nurzhan Ismailova, operator of ApaThai, Elif Towers, Maulenova Street 46, Almaty 050004, Kazakhstan. Email: [email protected], phone: +7 706 6072 707. Please send any privacy questions to this email address.

2. What data we process

• Online booking: name, phone number, email address, treatment, date and time, therapist and any notes you add. We use them to arrange and confirm your appointment and to reach you if anything changes.
• Contact by phone, email or WhatsApp: whatever you send us.
• Visiting the website: technical data such as IP address, browser and time. Our servers and Cloudflare need them to deliver the site and protect it from attacks.
• Statistics and ad measurement with Google Analytics and Google Ads: on the German pages and for visitors from the EU, the EEA, the UK and Switzerland only if you agree in the cookie notice; for everyone else they are on, and you can switch them off under “Cookie settings”.

3. Service providers and embedded content

• Hostinger International Ltd. (Cyprus): hosting of the website and database, sending booking emails.
• Cloudflare, Inc. (USA): delivery and protection of the website, cookie-free visitor statistics (Cloudflare Web Analytics).
• Google: Google Analytics and Google Ads (see section 4), the map on the contact page (Google Maps), the video on the home page (YouTube, loads only after a click).
• Meta: Instagram posts on the home page; WhatsApp if you message us there.
• 2GIS: reviews on the home page.

Google ads: If you come to us through a Google ad, we store its click ID (gclid) in our own cookie for 90 days and with your booking. After your paid visit we report this ID, the amount, the time and your email address and phone number to Google Ads once, both irreversibly hashed with SHA-256 beforehand. This tells us which ads lead to real visits. Without an ad click, nothing is sent.

Embedded content loads directly from the provider’s servers, which receive your IP address. We do not sell personal data.

4. Cookies and consent

Whether we ask first depends on where you visit from. On the German pages, and when your device is set to a time zone in the EU, the EEA, the UK or Switzerland, Google cookies are set only after you agree in the cookie notice. For all other visitors Google Analytics and Google Ads load without asking. Your choice is stored in your browser. You can change it at any time under “Cookie settings” at the bottom of every page; if you decline or withdraw consent, we delete the Google cookies and the services no longer load.

5. Google Business Profile and Google APIs

Our management application connects to ApaThai’s Google Business Profile through Google OAuth (scope “business.manage”). An ApaThai staff member signs in with the Google account that manages this profile. The application:

• reads the account and location of the business profile,
• reads the reviews of ApaThai (reviewer name as shown on Google, star rating, text, date) and shows them in the management application and on apathai.com,
• sends our list of services to the business profile.

Storage: We store the access key (refresh token) and the reviews in our database. Only our server uses the key, for these requests; it never reaches the browser or any third party.

Protection: All connections to Google and to our website are encrypted (HTTPS/TLS). The database can only be reached from the website’s server. Only ApaThai staff with a personal account and two-factor sign-in (authenticator app or passkey) can open the management application.

Use: We use data from Google APIs only to show the reviews in the management application and on apathai.com and to keep our list of services in the profile up to date. We do not sell it, do not transfer it to data brokers or other third parties, and do not use it for advertising or ad targeting, for creditworthiness or lending decisions, or to develop, improve or train AI or machine-learning models.

ApaThai’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion: We keep reviews for as long as we display them. If ApaThai removes the connection in the management application, the stored key is deleted immediately; access can also be revoked in the Google account at myaccount.google.com/permissions. To have a review or any other Google data deleted from our systems, write to [email protected] and we will delete it promptly.

6. How long we keep data

We keep booking data for three years and then delete it, unless the law requires us to keep it longer. Messages are kept as long as we need them for your request.

7. Legal basis

We process your data under the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”. For visitors from the EU the GDPR also applies: booking data to perform the contract (Art. 6(1)(b)), statistics and ad measurement only with consent (Art. 6(1)(a)), protection of the website based on our legitimate interest (Art. 6(1)(f)).

8. Your rights

You can ask what data we hold about you, have it corrected or deleted, and withdraw consent at any time. Write to [email protected]. You can also complain to a data protection authority.

9. Changes

If the way we process data changes, we update this policy. The version on this page applies.