Qalan Platform Privacy Policy

Last updated: 01.05.2025

This Privacy and Personal Data Processing Policy (the Policy) denes the procedure for

collecting, using, storing, and protecting Users’ personal data of the Qalan digital

educational platform (website and mobile application), as well as other condentiality

matters. The Policy is developed in accordance with the legislation of the Republic of

Kazakhstan, including the Law of the Republic of Kazakhstan “On Personal Data and Their

Protection,” and is not based on the legislation of other countries (GDPR, etc.) unless

explicitly stated otherwise.

(personal data subject) that is collected when the User uses the Platform. Such data may

include: full name, date of birth, contact details (phone, email), performance and learning

data, information about completed transactions, as well as other information classied as

personal by law or by the User.

- Personal data operator – LLP “QALANKZ” (the Platform Administration), which organizes

and carries out the processing of Users’ personal data and determines the purposes and

scope of processing. The Operator’s contact details are provided at the end of this Policy.

- Processing of personal data – any action or set of actions with personal data performed

with or without the use of automated tools, including collection, recording,

systematization, storage, clarication (updating, modication), extraction, use, transfer

- Other data – anonymized information not related to a specic User, collected for

technical, statistical, or other purposes, such as cookies, service performance data. In the

context of this Policy, data processing generally refers to work with personal data; however,

the general condentiality provisions also apply to other data to ensure their security.

This Policy applies to all information about Users that the Administration may receive

during their use of the Platform, including interactions with the website, the application,

support services, oicial Qalan social media pages, etc. Exceptions may include cases

where a specic service publishes a separate privacy policy or notice governing data

processing within that service.

2. Consent to data collection and processing

2.1. The legal basis for processing Users’ personal data is their consent. When registering

an account, the User conrms that they have read this Policy and consents to the

collection and processing of their personal data by checking the corresponding box in the

registration form. Continued use of the Platform after being presented with a notice of an

updated Policy is considered consent to its terms.

Withdrawal of consent may make it impossible to continue providing the Platform’s

In the course of using the Qalan Platform, the Administration may collect the following

categories of data about Users:

information the User voluntarily provides about themselves.

- Learning information: when using the services, the User may enter data related to the

learning process—test results, assignments completed, comments, questions submitted

on the platform. This data is stored to provide the services.

- Support requests: when sending requests or messages to the Administration by email or

via the feedback form, the User may provide their contact details and describe the issue in

detail, which may also include personal information.

3.2. Data collected automatically:

- Technical data: at each visit to the Platform, technical data are automatically collected—

IP address and approximate location based on it, device type and model, browser and

any errors, etc. This data is used to analyze the service performance, identify and x issues,

and protect against network attacks.

the User’s browser) and technologies such as local storage or pixel tags. The User can

Platform’s functionality.

- Analytics data: the Administration may use web analytics services (Google Analytics,

Yandex.Metrika or similar services) that collect anonymized information about User

behavior on the site: navigation between pages, time on site, interactions with interface

elements, etc. This data does not identify a specic person and is used to improve the

service.

- If the User links their account with an account of a teacher / student / parent / legal

proles. Third-party personal data are not disclosed to the student, except for the

3.4. Special categories of data. The Platform does not request from Users information

related to special categories of personal data, such as racial or ethnic origin, political

opinions, religious beliefs, health data, sex life, criminal records. The User should refrain

from posting such information about themselves in their prole or messages on the

Platform. If, as part of the learning process, the User voluntarily discloses any sensitive

information on their own initiative, they do so voluntarily; the Administration will treat it as

condential but strongly recommends avoiding such actions.

3.5. Third-party data. If the User provides personal data of a third party (e.g., provides a

dened, and lawful purposes. The main purposes of processing are:

4.1. Primarily, the data is needed so that the User can use the Platform’s functionality:

- Registration data is used to create an account, authenticate the User upon login, and

restore access if a password is lost.

- Prole data may be used to personalize the service.

- Performance data, test results, and course progress are used to display the User’s

progress, generate recommendations, and inform the teacher / parent / legal

representative (if the prole is linked) about the learner’s results.

- Processing internal messages, comments, and other User activities enables

- Personal data is also used when providing extended access: for example, full name or

payment card data may be transferred to a bank/payment system to complete a

transaction, and purchase history is stored to account for access to extended content.

4.2. Analysis of anonymized and aggregated usage data helps the Administration

matters:

- Resolving technical issues.

- Sending notications about important changes to the Platform’s operation, terms of

service or policy, and security notices.

- In certain cases (with the User’s consent or if it follows from the services provided),

the unsubscribe link in an email or adjusting preferences in their account.

4.4. Personal data is also processed to comply with the laws of the Republic of Kazakhstan:

- Payment data is stored and may be used for accounting, tax reporting, and fullling the

requirements of nancial monitoring authorities.

- In response to an oicial request from competent authorities, the Administration may use

and transfer the necessary data to comply with the law.

- Information necessary to fulll Users’ data protection rights, particularly when the User

legitimate interests of the Operator or third parties:

- Defense in court or other proceedings: in the event of a dispute with a User or a third

party, the Administration has the right to store and provide necessary data as evidence if

needed to establish facts and defend its position under the law.

In all cases, the Administration processes exactly the amount of personal data necessary

5 on retention periods).

5. Storage and protection of personal data

5.1. Users’ personal data is stored no longer than necessary for the purposes of its

processing:

- Account data and prole information are stored for the entire period the User uses the

Platform and are deleted or anonymized at the User’s request (when deleting the account)

or at the Administration’s initiative after a long period of inactivity (subject to notifying the

User).

- Learning data (results, progress) is stored for the entire life of the account to ensure the

anonymized and used for statistical purposes (without reference to identity).

- Data on completed payments and the fact of providing extended access are stored for at

least 5 years or another period provided by accounting and tax legislation.

- Server logs and technical records are generally stored for up to 1 year, unless a longer

transformed into a set that does not allow identication of the subject. If the User has

withdrawn consent or terminated the contract (deleted the account) while a mandatory

retention period has not yet expired, the data may be moved to an archival mode—without

active processing, stored only for purposes required by law.

5.2. The Administration implements necessary organizational and technical measures to

protect Users’ personal data from unlawful or accidental access, destruction, alteration,

information.

such persons are obliged to maintain trade secrecy and condentiality.

- Servers and infrastructure are hosted in secure data centers located in the Republic of

Kazakhstan and compliant with security standards. Regular software updates are carried

out to eliminate known vulnerabilities.

- Protection against malware and unauthorized access is implemented.

- Periodic testing and evaluation of the eectiveness of security measures are conducted.

Measures are improved as necessary, particularly considering technological developments

and emerging threats.

5.3. The Administration guarantees that no Users’ personal data will be sold or otherwise

transferred to third parties for commercial purposes without the Users’ consent. Transfer of

card details) are transferred to the servicing bank/payment gateway. These organizations

are independently responsible for the security of the data transferred to them and use it

exclusively for nancial operations.

of a teacher, the teacher gains access to certain personal data of the student necessary for

the learning process: name, learning results, assignment completion statistics, progress.

The teacher must use this data only for educational purposes and not disclose it to third

about the child’s actions on the Platform. Providing such data to a teacher/parent is carried

processes—for example, messaging services to send notications, cloud hosting services,

provider signs an agreement obliging them to protect the received data and use it strictly

according to the Administration’s instructions, without transferring or disclosing it.

- To law enforcement and government authorities upon receipt of a lawful request made in

accordance with legal requirements; the Administration is obliged to provide the requested

data from what it has. Within the law, the Administration will endeavor to provide the

minimum required information and ensure the legality of the request. The User will be

informed of such a request if permitted by law and if informing is possible without harming

the investigation.

- For rights protection: if the User has violated the Terms of Use or committed unlawful acts

that are under review, the Administration may provide the User’s data in the amount

necessary for case consideration to the aected party or experts, but only if there is a legal

basis and within the dispute resolution procedure.

Kazakhstan. When transferring data abroad, the Administration ensures that the recipient’s

not allow direct identication of Users. Such anonymized aggregate data is not considered

personal and may be used freely; however, the Administration will still require third parties

receiving it not to attempt to de-anonymize the information.

6. User rights regarding personal data

In accordance with the legislation of the Republic of Kazakhstan on personal data, the

User, as a personal data subject, has the following rights:

6.1. Right to obtain information about processing. The User has the right to request from

the Administration information concerning the processing of their personal data:

conrmation of the fact of processing; a list of personal data processed by the Operator;

sources of their receipt; purposes, terms, and methods of processing; the name and

location of the Operator; as well as other information provided for by Article 11 of the Law

“On Personal Data and Their Protection.” Such information is provided upon the User’s

request (see section 7 for the procedure) no later than 5 business days from the date of the

request, unless another period is established by law.

any time on their own through the Personal Account or send the Administration a justied

clause 2.2). In addition, even if another basis for processing exists, the User has the right to

object to further processing of their personal data for marketing purposes or for any other

purpose not required to fulll the contract.

6.4. Right to le requests and complaints. If the User believes that the Administration is

processing their personal data in violation of legal requirements or their lawful rights, they

may le a complaint directly with the Administration or submit a complaint to the

authorized state body for personal data protection (in the Republic of Kazakhstan, this

function is performed by the personal data protection unit under the Ministry of Digital

Development, Innovations and Aerospace Industry, or another body designated by the

government). The User also has the right to protect their rights in court by ling a claim for

the protection of personal data, compensation for damages and moral harm, if any, in

accordance with the law.

data subjects, such as the right to clarication of the consequences of refusing to provide

data, the right to require notifying third parties to whom data was previously transferred

about the deletion or correction of data, etc. The Administration respects all Users’ rights

under the law and is ready, upon request, to provide additional information on the

implementation of specic rights.

LLP “QALANKZ” – Operator of personal data of Users of the Qalan Platform.

Mailing address: 050000, Republic of Kazakhstan, Almaty, 27 Edil Yergozhin St., Oice 41.

Email for personal data inquiries: qalan.education@gmail.com.

7.2. To exercise the rights listed in section 6, the User may send a written request by email

or on paper. The request should indicate:

- The User’s full name (or their representative’s) and contact details for feedback;

- The essence of the request—which right the User wishes to exercise: obtain information,

change/delete data, withdraw consent, etc.;

- A description of the relevant data;

7.4. Following the review of the request, the Administration will provide a written response.

The response will contain the requested information or a description of the measures taken

at the User’s request, or a reasoned refusal if the request is denied, with reasons indicated.

When satisfying requests for changing/deleting data, the Operator will also take steps to

notify third parties to whom the User’s data was previously transferred (if applicable and

possible).

(This section may be issued separately if necessary. The main provisions are provided

below.)

for the following purposes:

- Authentication and session persistence: to keep the User logged in without entering a

password on each page; to remember that the User has already signed in.

- Settings and personalization: saving user preferences (for example, interface language

visit.

with the interface. This helps improve content and functionality.

- Advertising and marketing (if applicable): if the Platform hosts advertising materials or

referral programs, cookies may be used to show more relevant ads or to track the User’s

participation in promotional activities.

8.3. Cookie management. When rst visiting the website, the User may be shown a notice

about the use of cookies with an option to agree or congure them. The User can change

cookie settings at any time via the Platform interface (if implemented) or through their

in which cookies are not retained after closing the window.