Privacy policy
Last updated: September 29, 2026.
This policy explains how Orion System LLP, trading as OrionM2M (“we”, “us”), processes personal data when you visit orion-m2m.com or contact us through it. How we use cookies and browser storage is described in detail in the Cookie policy.
Who is responsible
Orion System LLP, a limited liability partnership registered in the Republic of Kazakhstan under business identification number (BIN) 161040011108, 67B Mametova St., Almaty 050004, Kazakhstan, is the controller of the personal data described here.
For any question about your personal data, write to info@orion-m2m.com.
What data we process and why
Requests you send us
When you use Request a quote, the partner application or the contact form, we receive the details you enter in the form (your name, email address, phone number, company, country and message, and in the partner application also your website and the markets you work in), together with the campaign data described below. We use them to answer you, prepare a quote and discuss cooperation.
The forms are provided by our CRM system, Bitrix24, operated for us by 1C-Bitrix Kazakhstan LLP, and requests are stored in our CRM in data centers in Kazakhstan. A form is loaded only when you move the pointer over, focus or tap its button. From that moment, the Bitrix24 form script keeps in your browser the campaign parameters of your visit (utm parameters and gclid), the address of the referring page (for 28 days) and up to five pages you viewed on this site, with the time and the beginning of each page heading (with no expiry; the list is cleared when a new visit from a campaign link or from another website begins). When you submit a request, the script sends this data to our CRM together with the full address of the page, whether you use a mobile device and, if the Google Analytics cookie is present, the Google Analytics client identifier. This happens regardless of your Analytics and Advertising choice; see Request forms in the Cookie policy.
Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering business inquiries (Article 6(1)(f) GDPR).
Emails and messenger messages
When you write to us by email, WhatsApp or Telegram, we receive your message and the contact details that come with it (for WhatsApp, your phone number; for Telegram, your name, username and profile picture), and we use them to reply. Messages to our WhatsApp number and to our Telegram bot @orionm2m_support_bot are delivered to our CRM system and stored there; WhatsApp messages reach it through the WhatsApp Business connector of edna Kazakhstan LLP. Before a manager replies, the Telegram bot may ask you for your contact details. When you open a WhatsApp or Telegram link on this site, the link may pass on the code of the advertising campaign that brought you here (“direct” if there was none):
- a WhatsApp link adds a short reference to the text of your message: the campaign code and the page on which you clicked the link. You can delete it before sending;
- a link to our Telegram bot passes the campaign code to the bot when you press Start. This code cannot be edited.
Legal basis: our legitimate interest in answering business inquiries (Article 6(1)(f) GDPR).
Campaign data
When you visit the site, it records where the visit came from, so that we know which campaigns and countries bring requests. This covers:
- the campaign parameters of the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the location code added to ad links;
- ad click identifiers added by advertising platforms (gclid, gbraid and wbraid from Google, msclkid from Microsoft, li_fat_id from LinkedIn);
- the landing page address without its parameters and the address of the referring site (domain only);
- the time zone of your device;
- the Google Analytics client identifier, if the Google Analytics cookie is present and you have allowed Analytics or are outside the consent zone;
- the source of your first visit, with its date, and the campaign parameters of your latest visit from a campaign link;
- technical markers: which of our sites the request came from and whether any value had to be shortened.
The campaign parameters, ad click identifiers, landing page, referring site and first visit source are stored in your browser under the name orion_attr for 90 days from your latest visit from a campaign link; the time zone and the Google Analytics client identifier are read when you open a form. This data reaches us only together with a request you submit, along with your Advertising consent status, or in the reference of a WhatsApp or Telegram link described above (the campaign code and, for WhatsApp, the page address). If your device’s time zone is in the consent zone described in the Cookie policy and you have not allowed Advertising, nothing is stored in your browser: the data of the current page is kept only in the memory of the open page and is lost when you leave it, but it is still sent if you submit a request or open a messenger link on that page.
Legal basis: your consent where it is required (Article 6(1)(a) GDPR); otherwise our legitimate interest in measuring the results of our advertising (Article 6(1)(f) GDPR).
Analytics
We use Google Analytics 4 to understand how the site is used: pages viewed, the site you came from, device and browser type, approximate location, and events such as a submitted request or a click on a contact link (with the channel: email, phone, WhatsApp or Telegram). When you use a request form, the Bitrix24 form script also reports to Google Analytics that you started filling in the form, which fields you completed (by field name, not their content) and that you submitted it.
If your device’s time zone is in the consent zone, Google Analytics is loaded only after you allow Analytics. Elsewhere, it is loaded after your first interaction with the page or 4 seconds after the page has loaded. For visitors whom Google locates in the EU, the EEA, the United Kingdom, Switzerland or Turkey, Google’s consent settings also default to denied until you allow them; if Google Analytics is loaded for such a visitor because the device’s time zone is outside the consent zone, it sends Google measurements without setting or reading Analytics cookies. Event-level Google Analytics data is kept for 14 months, and user-level data for 14 months from your latest activity (the data retention settings of our Google Analytics property); aggregated reports are not affected by this period.
Legal basis: your consent in the consent zone (Article 6(1)(a) GDPR); outside it, our legitimate interest in improving the site (Article 6(1)(f) GDPR).
Map on the Contacts page
The Contacts page shows an embedded Google map of our office. When the map is shown, your browser loads it from Google and sends Google your IP address, browser data and the address of the Contacts page, including any parameters in it; Google may set its own cookies. Outside the consent zone described in the Cookie policy, the map is loaded when it appears on your screen, whatever you chose in Cookie settings; in the consent zone, only after you click Show map. Without the map, the page still gives our address and a link to Google Maps.
Legal basis: your consent by clicking Show map in the consent zone (Article 6(1)(a) GDPR); outside it, our legitimate interest in showing where our office is (Article 6(1)(f) GDPR).
Server logs
Our website is hosted by Hetzner Online GmbH on servers in Germany. The web server records technical data of each request: IP address, date and time, the page requested with any parameters in its address (for example campaign parameters), the response status and size, the referring page and the browser identification string. We use these logs to operate the site and protect it from abuse, and delete them after 14 days.
Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
Who receives your data
Service providers that process personal data on our behalf:
- Hetzner Online GmbH (Germany): hosting of this website and its server logs, on servers in Germany.
- 1C-Bitrix Kazakhstan LLP (Bitrix24): our CRM system, which provides the request forms and stores requests and the WhatsApp and Telegram messages sent to us, in data centers in Kazakhstan.
- edna Kazakhstan LLP (Kazakhstan): delivers messages sent to our WhatsApp number to our CRM system.
- Google (Google Workspace): our email service.
- Google (Google Analytics 4): visit statistics. Data may be transferred to Google LLC in the United States.
Services that process personal data for their own purposes, under their own privacy policies:
- Google (Google Maps): the map on the Contacts page, when it is shown.
- Google (Google Analytics data sharing): under the data sharing settings of our Google Analytics account, Google may use Analytics data to improve its products and services, for modeling and benchmarking, and for technical support and account advice.
- WhatsApp (Meta) and Telegram: when you write to us through them.
International transfers
We are based in Kazakhstan, outside the EU and the EEA. When you send us a request or a message, you send your data directly to us in Kazakhstan, and our CRM system stores it in data centers in Kazakhstan. Our website is hosted in Germany. WhatsApp messages reach us through WhatsApp (Meta) and the connector of edna Kazakhstan LLP in Kazakhstan. Google may process data in the United States: Google LLC is certified under the EU-U.S. Data Privacy Framework, including the UK Extension and the Swiss-U.S. Data Privacy Framework, and relies on standard contractual clauses where the framework does not apply. There is no adequacy decision of the European Commission for Kazakhstan.
How long we keep data
| Data | Retention period |
|---|---|
| Requests and correspondence | As long as we are in contact with you about your request or a business relationship follows from it, and afterwards for the periods the law of Kazakhstan requires for business records |
| Event-level Google Analytics data | 14 months |
| User-level Google Analytics data | 14 months from your latest activity |
Campaign data in your browser (orion_attr) |
90 days from your latest visit from a campaign link |
Data of the Bitrix24 form script in your browser (b24_crm_guest_*) |
campaign parameters and referring page: 28 days; pages viewed and visit traces: no expiry, the last five entries; the visitor identifier set after you submit a form has no expiry |
Your cookie choice (orion_consent) |
Up to 180 days; some browsers delete it sooner |
| Server logs | 14 days |
Your rights
If GDPR applies to you, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict the processing of your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing carried out before: for Analytics and Advertising, using the Cookie settings button at the bottom of every page; for consent given in a request form, by writing to info@orion-m2m.com. A click on Show map applies only to the page you are on and is not remembered;
- lodge a complaint with the data protection authority of the country where you live or work, or where you believe the infringement took place.
To exercise your rights, write to info@orion-m2m.com. We reply within one month.
Automated decisions
We do not make decisions about you based solely on automated processing. Requests are answered by our staff.
Changes to this policy
When we change this policy, we publish the new version on this page with a new date.