This Policy defines the procedure for the collection, processing, storage and protection of personal data of users of the website ibridge.kz and clients of iBridge LLP.
1.1.This Privacy Policy (hereinafter referred to as the Policy) has been developed in accordance with the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” No. 94-V of 21 May 2013 and defines the procedure for the processing of personal data that iBridge Limited Liability Partnership receives from users of the website ibridge.kz (hereinafter referred to as the Website) and from clients.
1.2.The personal data operator is iBridge Limited Liability Partnership (hereinafter referred to as the Operator), BIN 210940039932, location: Republic of Kazakhstan, 050051, Almaty city, Medeu district, Dostyk Avenue, building 180.
1.3.Use of the Website, submission of an application through the Website forms, contacting the Operator by telephone, email or messengers, as well as entering into an agreement with the Operator signify the data subject's consent to this Policy.
1.4.Enquiries regarding the processing of personal data are accepted at the email address [email protected].
2.1.Data provided by the data subject:
2.1.1.when completing forms on the Website — name, telephone number, email address, field of interest or educational programme, year or level of education, approximate budget, comment, as well as the URL of the page from which the application was submitted and the language version of the Website;
2.1.2.when completing lead forms on Instagram and Facebook social networks — name, telephone number, email address and answers to form questions;
2.1.3.when contacting by telephone, email and WhatsApp messenger — the content of the enquiry, as well as documents and information provided for the selection of an educational programme and submission of documents to an educational institution, including passport data, information about education and language examination results;
2.1.4.when entering into a service agreement — details of the parties, information about the student and the chosen educational programme, payment information;
2.1.5.when participating in a survey on the quality of services provided — ratings and reviews.
2.2.Data obtained automatically when using the Website:
2.2.1.technical information: IP address, browser and device type, pages visited, date and time of visit, recorded in web server logs;
2.2.2.Google Ads and Meta advertising transition identifiers (gclid, fbclid) and UTM tags of the source of transition, stored in cookies for a period of 90 days;
2.2.3.web analytics data and user session recordings in accordance with Section 6 of this Policy.
2.3.The Operator does not purposefully collect special categories of personal data. Information necessary for submitting documents to an educational institution is processed solely to the extent required by such educational institution.
3.1.Personal data are processed for the following purposes:
3.1.1.consideration of applications, consultation and selection of educational institutions and educational programmes;
3.1.2.conclusion and performance of service agreements, including preparation and submission of documents to educational institutions, support for enrolment and processing of payments;
3.1.3.informing about educational programmes, events and offers of the Operator, including by means of mailings with the option to opt out;
3.1.4.evaluation of the effectiveness of advertising campaigns and improvement of the Website using anonymised and pseudonymised data;
3.1.5.fulfilment of obligations established by the legislation of the Republic of Kazakhstan, including in the field of accounting and taxation.
3.2.The legal grounds for processing are the consent of the data subject, the necessity to perform an agreement to which the data subject is a party, and the requirements of the legislation of the Republic of Kazakhstan.
4.1.The Operator does not sell personal data and does not transfer them to third parties for the marketing purposes of such parties.
4.2.Personal data may be transferred to the extent necessary to achieve the purposes of processing:
4.2.1.to educational institutions and their official representatives — for submission of documents and enrolment, after entering into an agreement with the data subject;
4.2.2.to providers of web analytics, advertising and infrastructure services used by the Operator: Google (Google Tag Manager, Google Analytics, Google Ads), Meta Platforms (Meta Pixel, Conversions API, Instagram and Facebook lead forms), Microsoft Clarity, Yandex (email), Hetzner Online GmbH (hosting, Finland);
4.2.3.to state authorities — in cases and in the manner provided for by the legislation of the Republic of Kazakhstan.
4.3.The aforementioned service providers process data in accordance with their own privacy policies, including outside the Republic of Kazakhstan. The Website servers, application databases and the Operator's CRM systems are located in the territory of the European Union.
5.1.Personal data are stored for the following periods:
5.1.1.data from applications and enquiries for which no agreement was entered into — 3 (three) years from the date of enquiry, upon expiry of which the data are destroyed or anonymised;
5.1.2.agreements and related documents — for the periods established by the legislation of the Republic of Kazakhstan;
5.1.3.cookies with advertising transition identifiers and UTM tags — 90 (ninety) days;
5.1.4.web server logs — for the technically necessary period.
5.2.Upon withdrawal of consent, processing ceases and the data are destroyed, with the exception of data the storage of which is mandatory by virtue of legislation.
6.1.The Website uses cookies and similar technologies necessary for the functioning of the Website, web analytics and advertising.
6.2.The following tools are used on the Website:
6.2.1.Google Tag Manager and Google Analytics 4 — statistics on visits and user behaviour;
6.2.2.Google Ads and Meta Pixel — measurement of advertising effectiveness and display of the Operator's advertising to Website visitors;
6.2.3.Microsoft Clarity — user session recordings and heat maps in anonymised form, with masking of input fields;
6.2.4.the Operator's own cookies — advertising transition identifiers and UTM tags.
6.3.The user has the right to disable cookies in the browser settings, and also to use Google and Meta personalised advertising opt-out tools. When cookies are disabled, certain functions of the Website may be unavailable.
7.1.The data subject has the right to:
7.1.1.obtain information about the fact, purposes and composition of the processing of their personal data;
7.1.2.require amendment and supplementation of personal data where there are grounds;
7.1.3.require blocking or destruction of personal data in cases provided for by legislation;
7.1.4.withdraw consent to the processing of personal data;
7.1.5.opt out of receiving informational mailings via the link in the message or by contacting the Operator.
7.2.Enquiries are sent to the email address [email protected]. The Operator considers enquiries within 10 (ten) working days. To protect personal data from unauthorised access, the Operator has the right to request confirmation of the applicant's identity.
8.1.Personal data of persons who have not reached the age of eighteen are accepted by the Operator exclusively from their parents or other legal representatives and are processed solely for the purposes of selecting an educational programme and submitting documents to an educational institution.
8.2.Upon receipt of information that the personal data of a minor were provided without the participation of a legal representative, the Operator destroys such data upon enquiry to the address [email protected].
9.1.The Operator takes legal, organisational and technical measures to protect personal data from unlawful access, destruction, alteration, blocking, copying and dissemination.
9.2.The exchange of data with the Website and the CRM system is carried out via the secure HTTPS protocol. Access to personal data is provided only to employees of the Operator who need it for the performance of their employment duties, and is protected by means of authentication.
10.1.The processing of personal data is governed by the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” No. 94-V of 21 May 2013 and other acts of the legislation of the Republic of Kazakhstan.
10.2.In the part concerning the storage of data on servers located in the territory of the European Union, the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) apply.
11.1.The Operator has the right to amend this Policy. The new version is published on the Website with an indication of the effective date and version number. Clients with whom the Operator has a current agreement are notified of material changes by email.
11.2.Details of the Operator: iBridge LLP, BIN 210940039932, Republic of Kazakhstan, 050051, Almaty city, Dostyk Avenue, building 180; email [email protected]; telephone +7 (778) 888 06 64.