Privacy Policy for the Processing of Personal Data by LLP "Fenomen School"

1. Terms

The following terms are used in this Policy in the following meanings:

• The meaning of terms not defined in this Policy shall be determined in accordance with the legislation of the Republic of Kazakhstan.

2. Principles of Personal Data Processing

2.1. Personal data processing by the Operator shall be carried out both with and without the use of automated means, in accordance with the following principles:

2.1.1. Personal data shall be processed on a lawful and fair basis;

2.1.2. The processing of personal data shall be limited to the achievement of specific, pre-defined, and legitimate purposes;

2.1.3. The processing of Personal Data that is incompatible with the purposes of their collection is not allowed;

2.1.4. The merging of databases containing Personal Data, the processing of which is carried out for purposes that are incompatible with one another, is not allowed;

2.1.5. Only Personal Data that meets the purposes of their processing shall be subject to processing;

2.1.6. The content and volume of processed Personal Data shall correspond to the stated purposes of processing;

2.1.7. The processed Personal Data shall not be excessive in relation to the stated purposes of processing;

2.1.8. When processing Personal Data, their accuracy, sufficiency, and relevance in relation to the purposes of processing shall be ensured;

2.1.9. Personal Data shall be stored in a form that allows the User (personal data subject) to be identified, no longer than is required for the purposes of personal data processing, and they shall be destroyed upon achievement of the processing purposes or in the event that such purposes are no longer necessary or attainable.

2.1.10. Personal Data must be processed in ways that ensure their security, using appropriate technical and organizational measures.

2.2. The processing of Personal Data of minor Users is carried out with the consent of their parents (legal representatives) in accordance with the requirements of the legislation of the Republic of Kazakhstan and international standards, including the Children’s Online Privacy Protection Act (COPPA).

3. Composition of Processed Personal Data and Purposes of Processing

3.1. Personal Data is processed by the Operator for the following purposes:

3.1.1. Ensuring access to the Application and its individual features:

• Categories of processed Personal Data: Personal Data not classified as special or biometric;
• Methods of processing and storage of Personal Data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, transfer (provision, access), anonymization, blocking, deletion, destruction;
• Period of processing and storage of Personal Data: until the purposes of Personal Data processing are achieved;
• Procedure for destruction of Personal Data: deletion of Personal Data from electronic and/or physical media or destruction of physical media containing Personal Data.

3.1.2. Promotion of the Operator’s goods, works, and services:

• List of processed Personal Data: full name, email address, contact phone number, gender;
• Categories of processed Personal Data: Personal Data not classified as special or biometric;
• Period of processing and storage of Personal Data: until the purposes of Personal Data processing are achieved;
• Methods of processing and storage of Personal Data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, transfer (provision, access), anonymization, blocking, deletion, destruction.

3.1.3. For statistical and research purposes:

• List of processed Personal Data: full name, date of birth, email address, contact phone number;
• Categories of processed Personal Data: Personal Data not classified as special or biometric;
• Period of processing and storage of Personal Data: until the purposes of Personal Data processing are achieved;
• Methods of processing and storage of Personal Data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, transfer (provision, access), anonymization, blocking, deletion, destruction.

4. Conditions for Processing Personal Data

4.1. The Operator is entitled to process Personal Data in the following cases:

4.1.1. upon receiving the User’s consent to the processing of their Personal Data;

4.1.2. for the purpose of entering into and performing a contract to which the Data Subject is a party, beneficiary, or guarantor;

4.1.3. for statistical and research purposes, except for the purposes specified in Law No. 94-V, provided that the Personal Data is anonymized;

4.1.4. where other grounds stipulated by the legislation of the Republic of Kazakhstan allow the processing of Personal Data without the User’s consent.

4.2. Personal Data may be transferred to the Operator’s partners for the fulfillment of obligations under the contract between the Operator and the Users. In all other cases, Personal Data is transferred to the Operator’s partners only with the User’s consent to the processing of their Personal Data.

4.3. The Operator does not process Personal Data belonging to special categories, including data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health status, sex life, or membership in public associations, as well as biometric Personal Data, except in cases expressly provided for by the legislation of the Republic of Kazakhstan.

5. Rights of the User

5.1. The User has the following rights in relation to their Personal Data:

5.1.1. To freely, voluntarily, and in their own interest decide whether to provide their Personal Data to the Operator or third parties, and to give consent to its processing;

5.1.2. To withdraw their consent to the processing of Personal Data by submitting the relevant notice to the Operator;

5.1.3. To receive information from the Operator regarding the processing of their Personal Data by submitting a corresponding request;

5.1.4. To request the Operator to clarify, block, or delete Personal Data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purposes of processing;

5.1.5. To demand the cessation of processing of their Personal Data for the purpose of promoting goods, works, or services by direct contact using communication means;

5.1.6. To appeal the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects or in court;

5.1.7. To exercise other rights provided by the legislation of the Republic of Kazakhstan.

5.2. To exercise the rights specified in this Policy, the User must send a corresponding request (demand, notice) to the address of the Operator or to the Operator’s email address specified in Section 10 of this Policy. The request (demand, notice) must contain the information required by Law No. 94-V.

6. Rights and Obligations of the Operator

6.1. The Operator undertakes to process Personal Data in accordance with the legislation of the Republic of Kazakhstan and the Operator’s internal regulations.

6.2. With regard to the User’s Personal Data, the Operator undertakes to maintain confidentiality, except as provided by the legislation of the Republic of Kazakhstan.

6.3. The Operator shall take the necessary and sufficient measures to ensure the fulfillment of its obligations under the laws of the Republic of Kazakhstan. The Operator independently determines the scope and list of such measures.

6.4. The Operator is obliged to provide the User or their representative with information regarding the processing of Personal Data relating to the respective User and to grant access to such Personal Data free of charge in the manner and within the timeframes established by the legislation of the Republic of Kazakhstan.

6.5. If unlawful processing of Personal Data is identified, the Operator must cease such processing. If it is not possible to ensure the lawful processing of Personal Data, the Operator must destroy or ensure the destruction of such Personal Data in the manner and within the timeframes established by the legislation of the Republic of Kazakhstan.

6.6. If inaccurate Personal Data is identified, the Operator must block or ensure the blocking of such Personal Data and correct or ensure its correction in the manner and within the timeframes established by the legislation of the Republic of Kazakhstan.

6.7. The Operator performs other obligations as provided by the legislation of the Republic of Kazakhstan.

6.8. The Operator is entitled to transfer the User’s Personal Data to third parties with the User’s consent.

6.9. The Operator is entitled to transfer the User’s Personal Data to third parties without the User’s consent in the following cases:

6.9.1. The transfer is necessary for the use of the Application by Users, performance of the agreement for the use of the Website, or performance of other agreements between the Operator and the Users;

6.9.2. The transfer is carried out to public authorities, including investigative and law enforcement bodies or local government authorities, upon their duly justified request in accordance with the legislation of the Republic of Kazakhstan;

6.9.3. In other cases expressly provided for by the legislation of the Republic of Kazakhstan.

7. Cross-Border Transfer of Personal Data

7.1. The Operator is entitled to carry out cross-border transfers of the User’s Personal Data to the territories of foreign countries that ensure adequate protection of the rights of personal data subjects, except where such transfer is prohibited or restricted for the purposes of protecting the constitutional order of the Republic of Kazakhstan, morality, public health, rights and legitimate interests of citizens, national defense, or state security.

8. Personal Data Security

8.1. The Operator applies measures to ensure the security of the User’s Personal Data.

8.2. Third parties may process the User’s Personal Data strictly in accordance with the Operator’s instructions and only where they implement security measures comparable to those required under this Policy.

8.3. The Operator applies appropriate security measures to prevent accidental loss, unauthorized use or access, alteration, or disclosure of the User’s Personal Data.

8.4. The Operator restricts access to the User’s Personal Data to those employees, agents, contractors, and other third parties who require such access for business purposes or in accordance with the laws of the Republic of Kazakhstan.

8.5. Access to Information Systems containing Personal Data is protected by a password system. Passwords are created by authorized employees of the Operator and are provided individually to employees who are granted access to Personal Data.

8.6. The Operator has procedures in place to address suspected security breaches concerning Personal Data and will notify the User and relevant supervisory authorities of such breaches when required by the legislation of the Republic of Kazakhstan.

9. Miscellaneous

9.1. This Policy and the legal relations between the User and the Operator arising from its application are governed by the laws of the Republic of Kazakhstan.

9.2. All disputes between the User and the Operator related to this Policy shall be resolved in accordance with the legislation of the Republic of Kazakhstan.

9.3. If any provision of this Policy is found to be invalid for any reason, the validity of the remaining provisions shall not be affected.

9.4. The User undertakes to independently monitor changes to this Policy by reviewing its current version.

10. Operator Contact Information

LLP "Fenomen School"

BIN: 220340023867

Legal address: Republic of Kazakhstan, Almaty, Auezov St., 14A, 5th floor

Email: phenomenon.chess.school@gmail.com