Privacy and Personal Data Processing Policy

1. General Provisions

This Privacy and Personal Data Processing Policy (hereinafter referred to as the "Policy") defines the procedure for the collection, processing, storage, transfer, and protection of the personal data of users of the ConsultBuro websites and services, including: consultburo.online, novapolis.club, consultburo.space (the platform), as well as the products Prof.iD, Career DNA, Burnout, ShitCV, Crises, and the Nova Polis game simulation (hereinafter collectively referred to as the "Services").

This Policy is drafted in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and Its Protection", the Law of the Republic of Kazakhstan "On Informatization", the Law of the Republic of Kazakhstan "On Online Platforms and Online Advertising", and other acts of the legislation of the Republic of Kazakhstan.

By using the Services, completing web forms, registering an account, or participating in game sessions, you confirm that you have read this Policy, understand its contents, and consent to the collection and processing of your personal data on the terms set out below. If you do not agree with the terms of this Policy, please refrain from using the Services.

The legislation of the Republic of Kazakhstan shall apply to any relations not governed by this Policy, regardless of the user's country of location.

For users who have indicated the Republic of Kazakhstan as their country of residence or registration, Section 18 of this Policy additionally applies. For persons located in the territory of the European Union and the European Economic Area, Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) additionally applies in accordance with Section 19 of this Policy.

2. Personal Data Operator

The operator of personal data (the owner and holder of the personal data database) is:

• Name: IE «Konsaltburo»
• IIN: 910713050390
• Registered address: Republic of Kazakhstan, city of republican significance Almaty, Medeu district, Samal-2 microdistrict, house 33A, apartment 164
• Address for personal data inquiries: info@consultburo.pro

Person responsible for organizing the processing of personal data: ALEKSANDR TOKTAROV, owner.

3. What Data We Collect

We adhere to the principle of data minimization: we collect only the data necessary for the stated purposes (Article 7 of Law No. 94-V).

3.1. Data from web forms on the websites:

• Nova Polis pre-registration form: name, telephone number, email address, telephone number of a parent/legal representative (optional), number of children, age, school grade, city, preferred method of communication (telephone, WhatsApp, Telegram);
• contact form: name, email address, telephone number, organization name, message text.

3.2. Platform account data (consultburo.space):

• email address, first and last name, role (player, curator, facilitator, administrator), interface language;
• when signing in via Google — profile photo (avatar) and Google account identifier;
• student game profile: year and month of birth, school, grade;
• subscription status and access to programs.

3.3. Data created in the course of using the Services:

• answers to assessment questions and assessment results (VIA, Big Five, Burnout, and others), reflection texts;
• program completion progress and draft answers;
• Nova Polis game data: participation in sessions, guilds, and projects; game decisions; peer assessments by players; facilitator assessments and observations; competency debriefing results;
• resume builder data: information about experience, skills, education, contacts, and (optionally) a photograph;
• correspondence with the curator within the platform, curator's notes on work with the client.

3.4. Technical data:

• cookie files and Google Analytics identifiers (anonymized website visit statistics);
• IP address — used on the server solely for protecting forms from spam (request rate limiting) and is not stored in databases;
• standard technical logs of the hosting and cloud infrastructure.

3.5. Payment data. We do not collect or store bank card data. If payment is made through third-party payment services, the processing of payment data is carried out by those services under their own privacy policies.

3.6. Third-party data. If you provide us with the data of another person (for example, the telephone number of a parent or legal representative), you warrant that you have obtained that person's consent to the transfer of their data to the Operator, and you are responsible for the existence of such consent.

4. Purposes of Collection and Processing

• organizing and conducting Nova Polis game sessions: registration, confirmation of participation, communication via the chosen channel;
• creating and maintaining the account, providing access to the platform and its features;
• conducting assessments and methodologies, generating personal reports and recommendations;
• work of curators and facilitators with users, including the preparation of observations and assessments within game sessions;
• responding to inquiries, technical and informational support;
• informational messages about sessions, programs, and products (with the option to opt out at any time);
• anonymized statistics and analytics for improving the Services;
• compliance with the requirements of the legislation of the Republic of Kazakhstan.

Processing of data for purposes incompatible with the purposes of collection is not permitted (Article 7 of Law No. 94-V).

5. Legal Grounds and Consent

The ground for the processing of personal data is the consent of the data subject or their legal representative (Articles 7 and 8 of Law No. 94-V).

Consent is deemed to be given in a manner that makes it possible to confirm its receipt (Article 8 of Law No. 94-V), namely when you perform one of the following actions:

• clicking the "Sign Up", "Submit Application", or a similar button below a web form containing a notice of consent to this Policy;
• registering an account on the platform (including via Google);
• commencing participation in a game session after reviewing the Policy.

The consent covers: the list of data specified in Section 3; the purposes specified in Section 4; the transfer to third parties and the cross-border transfer specified in Section 7. The consent is valid from the moment it is given until the purposes of processing are achieved or until it is withdrawn in accordance with Section 11.

For users from the Republic of Kazakhstan and the EU/EEA, consent to the processing of personal data is formalized by a separate mark (checkbox) in the respective form. The fact of consent is recorded with the text version, date and time, and the identifier of the user or inquiry. Consent may be withdrawn at any time in accordance with Section 11; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Minor Users

Nova Polis game sessions are intended for participants aged 15 and over. The Services are not intended for persons under 15 years of age, and we do not knowingly collect their personal data.

With respect to users aged 15 to 18, consent to the processing of personal data is given by a legal representative (parent, adoptive parent, guardian, or custodian). By registering a minor for a session or on the platform, you confirm that you are acting with the consent of the legal representative. Providing the contact details of a parent/legal representative in the registration form serves as a means of confirming such consent; the Operator has the right to contact the legal representative for its verification.

If it becomes known that the data of a minor is being processed without the consent of a legal representative, such data will be deleted in accordance with Section 11. The legal representative has the right at any time to request the deletion of the minor's data at info@consultburo.pro.

7. Transfer to Third Parties and Cross-Border Transfer

The Operator does not transfer users' personal data to third parties and does not disclose it, except in the cases described in this Section. We do not sell personal data and do not transfer it to anyone for their own purposes, including marketing.

For the technical operation of the Services, we engage service providers that process data strictly on the Operator's instructions, to the extent necessary for the purposes specified in Section 4: hosting and cloud infrastructure, databases and user authentication, sending service notifications by email, anonymized website traffic analytics, recording of inquiries from web forms. Such processing on instructions does not constitute a transfer to third parties: the providers are not entitled to use the data for their own purposes and are obliged to ensure its protection.

If you have chosen a messenger as your communication channel, communication takes place in accordance with the rules of the respective service, and you provide the data for such contact at your own initiative.

The providers' infrastructure may be located outside the Republic of Kazakhstan; therefore, the use of the Services constitutes your consent to the cross-border transfer of personal data in accordance with Article 16 of Law No. 94-V. The transfer is carried out subject to the application of contractual and technical data protection measures (encryption in transit and at rest, access control).

Disclosure of data to state authorities is possible only in the cases and in the manner expressly provided for by the legislation of the Republic of Kazakhstan.

The list of recipients of the data of users of the Kazakhstan contour is set out in Section 18; the list of processors for EU/EEA users is set out in Section 19. The provisions of this Section on cross-border transfer do not apply to the data of users of the Kazakhstan contour, which is processed within the territory of the Republic of Kazakhstan in accordance with Section 18.

8. Retention Periods and Localization

• platform account data is stored for the duration of the account's validity; upon a deletion request, the account and associated data are deleted after a 7-day waiting period (during which the deletion can be cancelled);
• data from web forms (inquiries, pre-registrations) is stored until the purposes of processing are achieved, but no longer than 24 months from the last interaction, unless a longer period is required by law;
• upon expiry of these periods, the data is deleted or anonymized; anonymized (statistical) data that does not allow a specific person to be identified is not personal data and may be used without limitation of time.

9. Personal Data Protection Measures

In accordance with Article 22 of Law No. 94-V, the Operator applies legal, organizational, and technical protection measures, including:

• transfer of data only via the secure HTTPS protocol;
• user authentication and role-based access control (player, curator, facilitator, administrator) at the level of database security rules;
• access of employees and contractors to data — only to the extent necessary to perform their functions;
• backup and protection tools of the cloud provider;
• appointment of a person responsible for organizing the processing of personal data.

No method of data transfer or storage is absolutely secure. The user is obliged to keep their credentials confidential and is responsible for actions performed with their account as a result of the loss of credentials for reasons beyond the Operator's control.

10. Rights of the Data Subject and the Procedure for Exercising Them

In accordance with Article 24 of Law No. 94-V, you (or your legal representative) have the right to:

• obtain information on whether the Operator holds your personal data, on the purposes, sources, and methods of its collection and processing, the list of data, and the processing periods;
• demand the modification and supplementation of your personal data;
• demand the blocking of data in the event of a violation of the conditions of its collection and processing;
• demand the destruction of data collected or processed in violation of the law;
• withdraw consent to processing in accordance with Section 11;
• appeal the actions (or inaction) of the Operator to the authorized body for the protection of the rights of personal data subjects or to a court.

To exercise your rights, send a request to info@consultburo.pro with the subject line "Personal Data", providing information that allows you to be identified as the data subject. The Operator has the right to request additional information to verify the applicant's identity. A response is provided within no more than 10 (ten) business days from the receipt of the request and confirmation of identity.

11. Withdrawal of Consent and Deletion of Data

You have the right to freely withdraw your consent to the processing of personal data by sending a request to info@consultburo.pro. Withdrawal of consent is not permitted in the cases provided for in paragraph 2 of Article 8 of Law No. 94-V — if this contradicts the legislation of the Republic of Kazakhstan or where there are unfulfilled obligations to the Operator.

Consequences of withdrawal: the Operator ceases processing and deletes the data within a reasonable period; however, the provision of the Services (participation in sessions, access to the platform) becomes impossible. Processing carried out prior to withdrawal remains lawful. Data in anonymized form is not subject to deletion requirements.

You may also delete your platform account yourself through the account settings; deletion is performed automatically after the 7-day waiting period.

12. Cookies and Analytics Technologies

The websites use cookie files and Google Analytics to collect anonymized statistics (traffic, traffic sources, actions on pages). This data does not allow us to identify a specific person without linking it to an account.

You may refuse the collection of analytics by disabling cookies in your browser settings or by installing the official Google Analytics Opt-out add-on. For users from the EU/EEA, analytics cookies are set only after your explicit consent in the cookie banner — see clause F of Section 19.

13. Limitation of Liability

• The Services are of an educational and game (simulation) nature. The results of methodologies, assessments, facilitator observations, and game sessions are informational materials and do not constitute a medical, psychological, or psychotherapeutic service, diagnosis, or professional consultation. Decisions based on them are made by the user (or their legal representative) independently and at their own responsibility;
• The Services are provided "as is". The Operator does not guarantee that the user will achieve any specific career, educational, or other results;
• The work of curators and facilitators within the Prof.iD programs and other Services is of a supportive nature: the curator helps to structure the client's work but does not make decisions for them. The Operator and the curators do not guarantee the achievement of the goals set by the client or the fulfillment of their individual plan. The client bears full responsibility for the implementation of the plan, the decisions made, and their consequences. The Operator and the curators also bear no responsibility for the client's decision to change their professional activity, place of work, or place of study, made during or as a result of working with the platform and the curator, or for any consequences of such a decision;
• The Operator is not responsible for the accuracy of the data provided by the user, nor for the actions of users who have posted the personal data of others without the consent of their owners;
• The Operator is not responsible for the operation of third-party services (Google, Resend, Telegram, WhatsApp, telecommunications operators), failures of which may affect the availability of the Services, nor for force majeure circumstances;
• to the extent permitted by the legislation of the Republic of Kazakhstan, the aggregate liability of the Operator under any claims related to the Services is limited to the amount actually paid by the user to the Operator for the relevant service, and in the absence of payment, no damages are compensated.

14. Breach Notification

Upon detecting a breach of personal data confidentiality, the Operator notifies the authorized body and users in the manner and within the time limits established by the legislation of the Republic of Kazakhstan (including the Law "On Online Platforms and Online Advertising") and takes measures to minimize the consequences.

15. Claim Procedure and Dispute Resolution

Before applying to state authorities or a court, you agree to observe the claim procedure: send a written claim to info@consultburo.pro describing the situation and your demands. The response time for a claim is 10 (ten) business days from its receipt.

If no agreement is reached, disputes are resolved in accordance with the legislation of the Republic of Kazakhstan in the courts at the Operator's location. The substantive and procedural law of the Republic of Kazakhstan applies to this Policy and to the relations of the parties.

16. Amendments to This Policy

The Operator has the right to update the Policy. The new version takes effect from the moment of its publication on this page, unless another date is specified in the version itself. We additionally notify users of material changes on the website or by email. Continued use of the Services after the changes take effect constitutes consent to the new version.

17. Contacts

For all questions related to personal data and this Policy: info@consultburo.pro

Operator: IE «Konsaltburo», IIN: 910713050390, address: Republic of Kazakhstan, city of republican significance Almaty, Medeu district, Samal-2 microdistrict, house 33A, apartment 164.

18. Processing and Storage of Data of Users from the Republic of Kazakhstan

This Section applies to users who have indicated the Republic of Kazakhstan as their country of residence or registration, as well as to other data subjects whose data the Operator reasonably attributes to the Kazakhstan contour. If the region cannot be reliably determined before processing begins, the Operator applies the Kazakhstan contour by default until the information is clarified.

A. Operator, Purpose and Scope of Processing

The operator of personal data is IE «Konsaltburo» (IIN 910713050390, Almaty, Republic of Kazakhstan). Questions about processing, access, rectification, withdrawal of consent, and deletion of data are accepted at info@consultburo.pro with the subject line "Personal Data".

The Operator processes data solely for creating and maintaining the account, providing the Services, completing methodologies and game sessions, generating results and reports, support, performance of the contract, ensuring security, recording consents, complying with legal requirements, and — subject to separate consent — marketing messages.

The Kazakhstan contour includes all personal data that the Operator processes within the Services: account and authentication data, profile and contacts, answers to methodologies, results and reports, messages and inquiries, user files and PDF reports, order and payment status information, consent records, access and security logs, as well as backup and recovery copies of such data. The Operator does not receive or store bank card numbers or other full payment details unless provided for by a separate agreement and by law.

B. Place of Processing and Storage

Personal data of users of the Kazakhstan contour is collected, recorded, systematized, stored, updated, used, blocked, anonymized, and destroyed in the Operator's information systems hosted in Yandex Cloud Kazakhstan within the territory of the Republic of Kazakhstan.

The database, file storage, authentication service, application logs, backups, and recovery tools relating to such data are located within the territory of the Republic of Kazakhstan. For the processing of data of this contour, the Operator does not use Google Firebase, Google Cloud, Google Analytics, Google Sheets / Apps Script, Resend, or any other foreign storage, analytics service, email integration, backup, or logging. Cookie identifiers, IP addresses, and other technical data of users of the Kazakhstan contour are not sent to foreign analytics services.

The technical provider of the cloud infrastructure acts solely on the Operator's instructions and within the scope of a data processing agreement. The Operator ensures access differentiation, logging of actions with data, and other protection measures provided for by the legislation of the Republic of Kazakhstan and internal security rules.

C. Transfer to Third Parties and Outside the Republic of Kazakhstan

The Operator does not transfer data of the Kazakhstan contour outside the Republic of Kazakhstan for the regular operation of the Services. An exception is possible only where an independent legal ground exists and the requirements of the legislation of the Republic of Kazakhstan on cross-border transfer of personal data are observed. In such a case, prior to the transfer, the Operator discloses in the Policy and/or the consent form the recipient, the country of destination, the scope of data, and the purpose and ground of the transfer.

The payment provider processes payment data as an independent operator to the extent necessary to complete the payment; its name, applicable data location, and policy are indicated on the payment page. If a user independently sends a message via an external messenger, such correspondence is governed by the rules of the respective service. This does not change the storage rules for a copy of the message if it was received in the Services.

D. Consent, Withdrawal, and Rights of the Data Subject

Where processing is based on consent, consent is formalized by a separate, non-pre-set action and contains information about the Operator, the purposes, the categories of data, the actions with them, the validity period, the recipients, and the withdrawal procedure. The fact of consent is recorded with the text version, date and time, the identifier of the user/inquiry, and the chosen regional contour.

You have the right to request information about your data, to demand its clarification, supplementation, blocking, or destruction in the cases provided for by the legislation of the Republic of Kazakhstan, and to withdraw consent by sending a request to info@consultburo.pro. Withdrawal does not affect the lawfulness of processing before its receipt and does not terminate processing necessary for the performance of the contract, the retention of mandatory documents, or compliance with legal requirements.

E. Retention Periods

Data is stored no longer than necessary for the purposes of processing, performance of the contract, settlement of claims, and compliance with mandatory retention periods. Upon account deletion or withdrawal of consent, the Operator deletes or anonymizes data for which no other ground for processing remains, including backups upon completion of their established retention cycle. Specific periods are set out in Section 8 of this Policy.

19. Processing of Data of Users from the European Union and the EEA (GDPR)

This Section applies to persons located in the territory of the European Union and the European Economic Area, in addition to the other provisions of the Policy. In the event of any discrepancy between this Section and other provisions of the Policy with respect to such persons, this Section shall prevail.

A. Data Controller

The controller of personal data is IE «Konsaltburo» (IIN 910713050390, Almaty, Kazakhstan). Contact for data processing matters, including GDPR requests: info@consultburo.pro (subject line "GDPR").

B. Legal Grounds for Processing (Art. 6 GDPR)

C. Special Categories of Data (Art. 9 GDPR)

Certain methodologies of the Services (for example, "Burnout", "Crises", meaning-in-life crisis questionnaires, personality questionnaire scales) may generate data relating to health or mental state information.

Such data is processed solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), which is requested by a separate action (a separate mark) before the start of the respective methodology. You may decline to give such consent — in that case the respective methodology will be unavailable, while the other features of the Services remain. Withdrawal of explicit consent results in the deletion of the respective results and does not affect the lawfulness of processing before the withdrawal.

Methodology results are not used to make decisions about your health and are not transferred to third parties for their own purposes.

D. Rights of the Data Subject (Art. 15–22 GDPR)

In addition to the rights listed in Section 10 of the Policy, you have the right to:

• access (Art. 15) — obtain a copy of your data and information about its processing;
• rectification (Art. 16);
• erasure — the "right to be forgotten" (Art. 17), including self-service account deletion in the platform settings (performed automatically after a 7-day waiting period);
• restriction of processing (Art. 18);
• portability (Art. 20) — obtain your data in a structured, machine-readable format; methodology results and materials are available for export as PDF in your account;
• objection to processing based on legitimate interest, as well as to direct marketing (Art. 21);
• not to be subject to decisions based solely on automated processing with significant effects (Art. 22). The Services do not make such decisions: reports of corporate game sessions are advisory in nature and cannot serve as the sole ground for personnel decisions.

The response time for a request is no more than one month (for complex requests — up to two additional months with notification). Requests: info@consultburo.pro, subject line "GDPR". To protect your data, we may request proof of identity.

You have the right to lodge a complaint with the data protection supervisory authority of your country of residence in the EU.

E. Processors and Cross-Border Transfer (Ch. V GDPR)

The controller is located in the Republic of Kazakhstan, and the processors' infrastructure for EU/EEA users may be located outside the EEA. Data transfers are carried out on the basis of appropriate safeguards: EU standard contractual clauses (SCC) with processors or other mechanisms of Chapter V of the GDPR applied by the indicated providers. The Kazakhstan contour described in Section 18 is intended for the data of users from the Republic of Kazakhstan and is not in itself a ground for transferring the data of EU/EEA users to Kazakhstan.

The full up-to-date list of processors is provided upon request to info@consultburo.pro.

F. Cookies and Analytics (ePrivacy + GDPR)

For users from the EU/EEA, analytics cookies (Google Analytics) are set only after your explicit consent in the cookie banner. Necessary technical cookies (session, language selection) are used for the operation of the websites. You may change or withdraw your consent at any time in the cookie banner; until it is implemented — via your browser settings or by request to info@consultburo.pro.

G. Breach Notification

In the event of a personal data breach affecting users from the EU/EEA, we notify the competent supervisory authority within 72 hours where required by Art. 33 GDPR and inform the affected users in accordance with Art. 34 GDPR.

H. Minors (Art. 8 GDPR)

The Services are intended for persons aged 15 and over. For users from the EU/EEA under 16 years of age (or under another threshold established by the law of the respective EU country, but not lower than 13 years), consent to data processing is given or confirmed by a legal representative. The confirmation mechanism is described in Section 6 of the Policy.

I. Retention Periods

The retention periods of Section 8 of the Policy apply. Data processed on the basis of consent is deleted upon its withdrawal, unless there is another legal ground for retention.