Privacy and Personal Data Processing Policy

1. General Provisions

This Privacy and Personal Data Processing Policy (hereinafter referred to as the "Policy") defines the procedure for the collection, processing, storage, transfer, and protection of the personal data of users of the ConsultBuro websites and services, including: consultburo.online, novapolis.club, consultburo.space (the platform), as well as the products Prof.iD, Career DNA, Burnout, ShitCV, Crises, and the Nova Polis game simulation (hereinafter collectively referred to as the "Services").

This Policy is drafted in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and Its Protection", the Law of the Republic of Kazakhstan "On Informatization", the Law of the Republic of Kazakhstan "On Online Platforms and Online Advertising", and other acts of the legislation of the Republic of Kazakhstan.

By using the Services, completing web forms, registering an account, or participating in game sessions, you confirm that you have read this Policy, understand its contents, and consent to the collection and processing of your personal data on the terms set out below. If you do not agree with the terms of this Policy, please refrain from using the Services.

The legislation of the Republic of Kazakhstan shall apply to any relations not governed by this Policy, regardless of the user's country of location.

2. Personal Data Operator

The operator of personal data (the owner and holder of the personal data database) is:

• Name: IE «Konsaltburo»
• IIN: 910713050390
• Registered address: Republic of Kazakhstan, city of republican significance Almaty, Medeu district, Samal-2 microdistrict, house 33A, apartment 164
• Address for personal data inquiries: info@consultburo.pro

Person responsible for organizing the processing of personal data: ALEKSANDR TOKTAROV, owner.

3. What Data We Collect

We adhere to the principle of data minimization: we collect only the data necessary for the stated purposes (Article 7 of Law No. 94-V).

3.1. Data from web forms on the websites:

• Nova Polis pre-registration form: name, telephone number, email address, telephone number of a parent/legal representative (optional), number of children, age, school grade, city, preferred method of communication (telephone, WhatsApp, Telegram);
• contact form: name, email address, telephone number, organization name, message text.

3.2. Platform account data (consultburo.space):

• email address, first and last name, role (player, curator, facilitator, administrator), interface language;
• when signing in via Google — profile photo (avatar) and Google account identifier;
• student game profile: year and month of birth, school, grade;
• subscription status and access to programs.

3.3. Data created in the course of using the Services:

• answers to assessment questions and assessment results (VIA, Big Five, Burnout, and others), reflection texts;
• program completion progress and draft answers;
• Nova Polis game data: participation in sessions, guilds, and projects; game decisions; peer assessments by players; facilitator assessments and observations; competency debriefing results;
• resume builder data: information about experience, skills, education, contacts, and (optionally) a photograph;
• correspondence with the curator within the platform, curator's notes on work with the client.

3.4. Technical data:

• cookie files and Google Analytics identifiers (anonymized website visit statistics);
• IP address — used on the server solely for protecting forms from spam (request rate limiting) and is not stored in databases;
• standard technical logs of the hosting and cloud infrastructure.

3.5. Payment data. We do not collect or store bank card data. If payment is made through third-party payment services, the processing of payment data is carried out by those services under their own privacy policies.

3.6. Third-party data. If you provide us with the data of another person (for example, the telephone number of a parent or legal representative), you warrant that you have obtained that person's consent to the transfer of their data to the Operator, and you are responsible for the existence of such consent.

4. Purposes of Collection and Processing

• organizing and conducting Nova Polis game sessions: registration, confirmation of participation, communication via the chosen channel;
• creating and maintaining the account, providing access to the platform and its features;
• conducting assessments and methodologies, generating personal reports and recommendations;
• work of curators and facilitators with users, including the preparation of observations and assessments within game sessions;
• responding to inquiries, technical and informational support;
• informational messages about sessions, programs, and products (with the option to opt out at any time);
• anonymized statistics and analytics for improving the Services;
• compliance with the requirements of the legislation of the Republic of Kazakhstan.

Processing of data for purposes incompatible with the purposes of collection is not permitted (Article 7 of Law No. 94-V).

5. Legal Grounds and Consent

The ground for the processing of personal data is the consent of the data subject or their legal representative (Articles 7 and 8 of Law No. 94-V).

Consent is deemed to be given in a manner that makes it possible to confirm its receipt (Article 8 of Law No. 94-V), namely when you perform one of the following actions:

• clicking the "Sign Up", "Submit Application", or a similar button below a web form containing a notice of consent to this Policy;
• registering an account on the platform (including via Google);
• commencing participation in a game session after reviewing the Policy.

The consent covers: the list of data specified in Section 3; the purposes specified in Section 4; the transfer to third parties and the cross-border transfer specified in Section 7. The consent is valid from the moment it is given until the purposes of processing are achieved or until it is withdrawn in accordance with Section 11.

6. Minor Users

Nova Polis game sessions are intended for participants aged 15 and over. The Services are not intended for persons under 15 years of age, and we do not knowingly collect their personal data.

With respect to users aged 15 to 18, consent to the processing of personal data is given by a legal representative (parent, adoptive parent, guardian, or custodian). By registering a minor for a session or on the platform, you confirm that you are acting with the consent of the legal representative. Providing the contact details of a parent/legal representative in the registration form serves as a means of confirming such consent; the Operator has the right to contact the legal representative for its verification.

If it becomes known that the data of a minor is being processed without the consent of a legal representative, such data will be deleted in accordance with Section 11. The legal representative has the right at any time to request the deletion of the minor's data at info@consultburo.pro.

7. Transfer to Third Parties and Cross-Border Transfer

The Operator does not transfer users' personal data to third parties and does not disclose it, except in the cases described in this Section. We do not sell personal data and do not transfer it to anyone for their own purposes, including marketing.

For the technical operation of the Services, we engage service providers that process data strictly on the Operator's instructions, to the extent necessary for the purposes specified in Section 4: hosting and cloud infrastructure, databases and user authentication, sending service notifications by email, anonymized website traffic analytics, recording of inquiries from web forms. Such processing on instructions does not constitute a transfer to third parties: the providers are not entitled to use the data for their own purposes and are obliged to ensure its protection.

If you have chosen a messenger as your communication channel, communication takes place in accordance with the rules of the respective service, and you provide the data for such contact at your own initiative.

The providers' infrastructure may be located outside the Republic of Kazakhstan; therefore, the use of the Services constitutes your consent to the cross-border transfer of personal data in accordance with Article 16 of Law No. 94-V. The transfer is carried out subject to the application of contractual and technical data protection measures (encryption in transit and at rest, access control).

Disclosure of data to state authorities is possible only in the cases and in the manner expressly provided for by the legislation of the Republic of Kazakhstan.

8. Retention Periods and Localization

• platform account data is stored for the duration of the account's validity; upon a deletion request, the account and associated data are deleted after a 7-day waiting period (during which the deletion can be cancelled);
• data from web forms (inquiries, pre-registrations) is stored until the purposes of processing are achieved, but no longer than 24 months from the last interaction, unless a longer period is required by law;
• upon expiry of these periods, the data is deleted or anonymized; anonymized (statistical) data that does not allow a specific person to be identified is not personal data and may be used without limitation of time.

9. Personal Data Protection Measures

In accordance with Article 22 of Law No. 94-V, the Operator applies legal, organizational, and technical protection measures, including:

• transfer of data only via the secure HTTPS protocol;
• user authentication and role-based access control (player, curator, facilitator, administrator) at the level of database security rules;
• access of employees and contractors to data — only to the extent necessary to perform their functions;
• backup and protection tools of the cloud provider;
• appointment of a person responsible for organizing the processing of personal data.

No method of data transfer or storage is absolutely secure. The user is obliged to keep their credentials confidential and is responsible for actions performed with their account as a result of the loss of credentials for reasons beyond the Operator's control.

10. Rights of the Data Subject and the Procedure for Exercising Them

In accordance with Article 24 of Law No. 94-V, you (or your legal representative) have the right to:

• obtain information on whether the Operator holds your personal data, on the purposes, sources, and methods of its collection and processing, the list of data, and the processing periods;
• demand the modification and supplementation of your personal data;
• demand the blocking of data in the event of a violation of the conditions of its collection and processing;
• demand the destruction of data collected or processed in violation of the law;
• withdraw consent to processing in accordance with Section 11;
• appeal the actions (or inaction) of the Operator to the authorized body for the protection of the rights of personal data subjects or to a court.

To exercise your rights, send a request to info@consultburo.pro with the subject line "Personal Data", providing information that allows you to be identified as the data subject. The Operator has the right to request additional information to verify the applicant's identity. A response is provided within no more than 10 (ten) business days from the receipt of the request and confirmation of identity.

11. Withdrawal of Consent and Deletion of Data

You have the right to freely withdraw your consent to the processing of personal data by sending a request to info@consultburo.pro. Withdrawal of consent is not permitted in the cases provided for in paragraph 2 of Article 8 of Law No. 94-V — if this contradicts the legislation of the Republic of Kazakhstan or where there are unfulfilled obligations to the Operator.

Consequences of withdrawal: the Operator ceases processing and deletes the data within a reasonable period; however, the provision of the Services (participation in sessions, access to the platform) becomes impossible. Processing carried out prior to withdrawal remains lawful. Data in anonymized form is not subject to deletion requirements.

You may also delete your platform account yourself through the account settings; deletion is performed automatically after the 7-day waiting period.

12. Cookies and Analytics Technologies

The websites use cookie files and Google Analytics to collect anonymized statistics (traffic, traffic sources, actions on pages). This data does not allow us to identify a specific person without linking it to an account.

You may refuse the collection of analytics by disabling cookies in your browser settings or by installing the official Google Analytics Opt-out add-on. Continued use of the websites without disabling cookies is deemed consent to such processing.

13. Limitation of Liability

• The Services are of an educational and game (simulation) nature. The results of methodologies, assessments, facilitator observations, and game sessions are informational materials and do not constitute a medical, psychological, or psychotherapeutic service, diagnosis, or professional consultation. Decisions based on them are made by the user (or their legal representative) independently and at their own responsibility;
• The Services are provided "as is". The Operator does not guarantee that the user will achieve any specific career, educational, or other results;
• The work of curators and facilitators within the Prof.iD programs and other Services is of a supportive nature: the curator helps to structure the client's work but does not make decisions for them. The Operator and the curators do not guarantee the achievement of the goals set by the client or the fulfillment of their individual plan. The client bears full responsibility for the implementation of the plan, the decisions made, and their consequences. The Operator and the curators also bear no responsibility for the client's decision to change their professional activity, place of work, or place of study, made during or as a result of working with the platform and the curator, or for any consequences of such a decision;
• The Operator is not responsible for the accuracy of the data provided by the user, nor for the actions of users who have posted the personal data of others without the consent of their owners;
• The Operator is not responsible for the operation of third-party services (Google, Resend, Telegram, WhatsApp, telecommunications operators), failures of which may affect the availability of the Services, nor for force majeure circumstances;
• to the extent permitted by the legislation of the Republic of Kazakhstan, the aggregate liability of the Operator under any claims related to the Services is limited to the amount actually paid by the user to the Operator for the relevant service, and in the absence of payment, no damages are compensated.

14. Breach Notification

Upon detecting a breach of personal data confidentiality, the Operator notifies the authorized body and users in the manner and within the time limits established by the legislation of the Republic of Kazakhstan (including the Law "On Online Platforms and Online Advertising") and takes measures to minimize the consequences.

15. Claim Procedure and Dispute Resolution

Before applying to state authorities or a court, you agree to observe the claim procedure: send a written claim to info@consultburo.pro describing the situation and your demands. The response time for a claim is 10 (ten) business days from its receipt.

If no agreement is reached, disputes are resolved in accordance with the legislation of the Republic of Kazakhstan in the courts at the Operator's location. The substantive and procedural law of the Republic of Kazakhstan applies to this Policy and to the relations of the parties.

16. Amendments to This Policy

The Operator has the right to update the Policy. The new version takes effect from the moment of its publication on this page, unless another date is specified in the version itself. We additionally notify users of material changes on the website or by email. Continued use of the Services after the changes take effect constitutes consent to the new version.

17. Contacts

For all questions related to personal data and this Policy: info@consultburo.pro

Operator: IE «Konsaltburo», IIN: 910713050390, address: Republic of Kazakhstan, city of republican significance Almaty, Medeu district, Samal-2 microdistrict, house 33A, apartment 164.