Privacy Policy

1. General Provisions

This Privacy Policy (the "Policy") has been prepared in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and Their Protection" and governs the collection, storage, and use of the personal data of users of the website uaqiqaqi.org.

An operator of a database containing personal data (the "operator") is a state authority, an individual and/or a legal entity that collects, processes, and protects personal data (Article 1 of Law of the Republic of Kazakhstan No. 94-V).

The Operator responsible for personal data processing is Individual Entrepreneur "KHIKAYA"(hereinafter — the "Operator").

A personal data subject (the "data subject") is an individual to whom the personal data relate (Article 1 of Law of the Republic of Kazakhstan No. 94-V).

Processing of personal data means any operation involving personal data, including collection, recording, systematisation, accumulation, storage, clarification, alteration, use, transfer, depersonalisation, blocking, deletion, and destruction.

Personal data are submitted through the Website forms only after the user has reviewed this Policy and has given consent to the collection and processing of personal data in a manner that enables the Operator to confirm that such consent was obtained.

The use of individual Website functions that do not require the provision of personal data does not, by itself, constitute consent to the processing of data that are not necessary for those functions.

2. Data Collected by the Operator

When a user registers or enrols in a course, the Operator collects the following personal data:

• First name and surname
• Email address
• Telegram username
• School name and city
• Year of graduation from school
• Password (stored in encrypted form as a bcrypt hash; the original password is not accessible to the Operator)

The Operator does not receive or store complete bank card details, including the full card number or security code. The payment system may provide the Operator with limited transaction information, including the transaction identifier, date, amount, status, and masked information concerning the payment method.

The Operator automatically receives technical data, including the IP address, browser type, and device information, as part of the standard operation of the hosting service (Vercel).

3. Purposes of Processing

• Creating and maintaining the student account
• Processing course enrolments and confirming payments
• Communicating with you regarding the course by email and Telegram
• Issuing and administering referral codes
• Issuing invoices and maintaining payment records
• Improving the quality of the services and the operation of the platform

4. Legal Grounds for Processing

• Consent of the personal data subject (Article 8 of Law of the Republic of Kazakhstan No. 94-V)
• Performance of a contract to which the data subject is a party
• The legitimate interests of the Operator, provided that the rights of data subjects are respected
• Compliance with the requirements of the legislation of the Republic of Kazakhstan

5. Data Retention

Personal data are retained for the period necessary to achieve the purposes for which they were collected and processed, to perform the contract, to consider requests and claims, and to comply with the requirements of the legislation of the Republic of Kazakhstan.

The retention period may vary depending on the category of data and the purpose of processing. Student account data are retained while the account is in use and, after use has ceased, for the period necessary for the Operator to perform its obligations and protect its lawful rights and interests.

Once the purposes of processing have been achieved or consent has been withdrawn, the personal data are destroyed or depersonalised unless their continued retention is required by law, by contract, or for the consideration of an existing dispute.

Data contained in backup copies are deleted in accordance with the established backup rotation cycle, provided that access to such data is restricted and the data cannot be used for any other purpose.

6. Disclosure of Data to Third Parties

The Operator does not sell users' personal data. Access to specific data may be provided to lecturers, mentors, and providers of information technology, payment, hosting, and other services, but only to the extent necessary for them to perform their respective functions.

7. Cross-Border Transfer of Data

The servers of Vercel and Neon are located outside the Republic of Kazakhstan, including in the United States and/or the European Union. By using the Website and submitting your data, you expressly consent to the cross-border transfer of your personal data to those providers. When selecting service providers, the Operator takes reasonable measures to assess the applicable conditions for processing and protecting personal data and limits the data transferred to the amount necessary for the provision of the relevant services.

8. Cookies

The Website uses the following cookies:

• studentToken — a session cookie used to authenticate a student in the student account. It contains an encrypted session identifier.
• locale — a cookie used to remember the selected Website language (RU/EN). It is retained for one year.

The Operator does not use third-party advertising or analytics cookies. You may disable cookies in your browser settings; however, doing so may prevent the student account from functioning properly.

9. Your Rights

Under Law of the Republic of Kazakhstan No. 94-V, you have the right to:

• Obtain information about which of your data are retained and how they are processed
• Request the correction of inaccurate or outdated data
• Request the deletion of your data
• Withdraw your consent by submitting a request to the Operator. Withdrawal of consent does not affect the lawfulness of processing carried out before the Operator received the withdrawal and does not terminate processing where such processing is permitted or required by law without the data subject's consent. Where the relevant data are necessary to provide a service, the Operator may discontinue the corresponding function or service.

To exercise any of these rights, send a request to mussilimov@gmail.com. The Operator endeavours to provide an initial response within 30 calendar days unless a shorter period is prescribed by law.

10. Data Security

The Operator implements reasonable technical and organisational measures to protect your data. Data are transmitted over an encrypted HTTPS connection; passwords are not stored in plain text and are protected using cryptographic hashing methods; and access to the database is restricted and secured. Nevertheless, no method of transmitting data over the internet is completely secure. If a personal data security breach is identified, the Operator takes the measures prescribed by law and provides the required notifications to personal data subjects and the competent authority in the cases, manner, and within the time limits established by the legislation of the Republic of Kazakhstan.

11. Minors

Minor users may provide personal data and use Website functions relating to entering into a contract, paying for services, or participating in an educational program only with the prior consent of a parent, guardian, or other legal representative where such consent is required by the legislation of the Republic of Kazakhstan.

When registering a minor user, the Operator may request the contact details of the minor's legal representative and confirmation that the required consent has been obtained.

Any person who provides the Operator with a minor's personal data confirms that they have the necessary authority and consent to make that disclosure.

If the Operator becomes aware that a minor's personal data were provided without the required consent of a legal representative, the Operator may restrict access to the student account, request evidence of consent, or discontinue processing and delete the data unless continued retention is required by law.

12. Amendments to the Policy

The Operator may amend this Policy at any time. The current version is always available at uaqiqaqi.org/privacy. If material amendments are made, the Operator will notify the data subject by email or via a notice on the Website. Continued use of the Website after amendments are published constitutes acceptance of the updated Policy.

13. Accuracy of Submitted Data

The user warrants that the personal data provided are accurate and undertakes to keep them up to date.

14. Liability for Third-Party Actions

The Operator is not liable for the actions of third parties that obtain access to information as a result of circumstances beyond the Operator's control, provided that the Operator has implemented the protective measures required by law.

15. Contact Details