Privacy Policy

This Privacy Policy for Personal Data in the Use of the Website

Draft: 31st March 2024
Approved by SLT: 1st May 2024
Published: 3rd May 2024

1. General provisions

1. This Privacy Policy for Personal Data in the Use of the Website (hereinafter referred to as the "Policy") establishes the rules for handling information received from visitors and users of the website https://ardingly.edu.kz (hereinafter referred to as the "Website").

2. The processing of personal data and other information, if received from website users, is carried out by Ardingly Astana LLP (hereinafter referred to as the "Operator") in accordance with the requirements of the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" No. 94-V dated 21 May 2013 (hereinafter referred to as the "Law"), the Law of the Republic of Kazakhstan "On Informatization" No. 418-V dated 24 November 2015, and other regulatory legal acts of the Republic of Kazakhstan.

3. The Operator considers the protection of human and citizen rights and freedoms during the processing of personal data as its highest priority and a fundamental condition for conducting its activities.

4. Key Terms Used in the Policy:
1) Personal data – information related to a specific or identifiable subject of personal data (website user), recorded on electronic, paper, and/or other tangible media;
2) Protection of personal data – a set of measures, including legal, organisational, and technical, implemented by the Operator to prevent the dissemination of the user's personal data without their consent and for the purposes established by the Law;
3) Processing of personal data – actions aimed at collecting, storing, modifying, supplementing, using, disseminating, anonymising, blocking, and destroying personal data;
4) Use of personal data – actions with personal data directed towards the realisation of the Operator's activities and objectives;
5) User (subject of personal data) – any visitor to the website whose personal data is applicable;
6) Website (web portal) – a collection of graphical and informational materials, as well as computer programs and databases that ensure their accessibility on the internet at the network address https://ardingly.edu.kz.

5. Other terms used in this Policy shall be interpreted in accordance with the current legislation of the Republic of Kazakhstan.

2. Purpose of Collecting Personal Data from Website Users

6. The purposes of collecting the User’s personal data are:
- to inform the User about the Operator’s activities via email communications;
- to provide the User with access to services, information, and/or materials available on the website.

7. The Operator reserves the right to send notifications to the User regarding new products and services, special offers, and various events. The User can always opt out of receiving such informational messages by sending an email to pr@ardingly.edu.kz with the subject line “Opt-out of notifications about new products, services, and special offers.”

8. Anonymised data collected through internet statistics services is used to gather information about Users’ actions on the website and to improve the quality and content of the website.

3. Ensuring the Protection of Personal Data by the Operator

9. The collection, processing, and protection of personal data are carried out by the Operator in accordance with the legislation of the Republic of Kazakhstan and solely for the purposes specified in this Policy.

10. The dissemination of personal data in publicly accessible sources is permitted only with the User’s consent.

11. The processing of personal data in the form of cross-border transfer is carried out, except in cases stipulated by the Law, only with the User’s consent.

12. The Operator's processing of personal data is limited to achieving specific, pre- determined, and lawful objectives. The processing of personal data that is incompatible with the purposes of their collection is not permitted.

13. The Operator protects the following data that is automatically transmitted when visiting website pages:
- IP address;
- information from cookies;
- browser information;
- access time;
- referrer (previous page address).

14. The Operator hereby informs the User that disabling cookies may result in the inability to access parts of the website requiring authorisation.

4. Procedure for Granting (Withdrawing) User Consent for the Collection and Processing of Personal Data

15. The User grants (or withdraws) consent for the collection and processing of personal data by providing the following information on the website:
1) The User’s surname, first name, and patronymic (if specified in the identity document);
2) The User’s email address;
3) The User’s contact phone number.

5. Confidentiality of personal data

16. The Operator, having access to personal data, ensures its confidentiality by adhering to the requirements to prevent its dissemination without the User's consent. The processing of Users' personal data is carried out by authorised personnel allowed to handle personal data in accordance with the Operator's internal documents. Other individuals are not permitted to process Users' personal data.

17. The Operator processes the User's personal data only if it is filled out and/or submitted by the User independently through special forms available on the website or sent to the Operator via email or telephone communication.

18. By filling out the relevant forms and/or submitting their personal data to the Operator, the User expresses their consent to this Policy. The Operator processes anonymised data about the subject if this is allowed in the User's browser settings (e.g., enabling the saving of cookies, use of JavaScript, and other technologies).

19. The User (subject of personal data) independently makes the decision to provide their personal data and gives consent freely, voluntarily, and in their own interest.

6. User Rights

20. The User of the website has the right to:
1) freely decide whether to provide their personal data necessary for the purposes of collection by the Operator when using the website and to give consent for its processing;
2) know whether the Operator or a third party possesses their personal data;
3) request the Operator to modify or supplement their personal data if there are grounds supported by relevant documents;
4) request the Operator to block their personal data in the event of information about violations of the conditions for collecting and processing personal data;
5) demand from the Operator or a third party the deletion of their personal data collected and processed in violation of the legislation of the Republic of Kazakhstan;
6) withdraw consent for the collection and processing of personal data.

7. Operator’s Rights and Obligations

21. The Operator has the right to collect and process personal data in accordance with the procedures established by the Law and other regulatory legal acts of the Republic of Kazakhstan.

22. The Operator is obliged to:
1) take and observe necessary measures, including legal, organisational, and technical, to protect personal data in accordance with the legislation of the Republic of Kazakhstan;
2) comply with the legislation of the Republic of Kazakhstan on personal data and their protection;
3) provide, upon request of the authorised body, information on the methods and procedures used to ensure compliance with the Law during the review of complaints from individuals and legal entities;
4) take measures to destroy personal data upon achieving the purpose of their collection and processing, as well as in other cases stipulated by the Law and other regulatory acts of the Republic of Kazakhstan;
5) provide evidence of obtaining the user’s consent for the collection and processing of their personal data in cases provided by the legislation of the Republic of Kazakhstan;
6) provide the User with information relating to them within the timeframe established by the legislation of the Republic of Kazakhstan upon their request;
7) in the event of refusal to provide information to the User or their legal representative, provide a reasoned response within the timeframes established by the legislation of the Republic of Kazakhstan;
8) within one working day:
- amend and/or supplement personal data based on relevant documents or destroy them if amendments or supplementation are impossible;
- block personal data related to the User if there is information about violations of processing conditions;
- destroy personal data if their collection or processing violates the legislation of the Republic of Kazakhstan;
- unblock personal data if a violation of processing conditions is not confirmed;
- notify the authorised body of any breach of personal data security, including the contact details of the person responsible for organising personal data processing (if applicable);
9) provide the User or their legal representative free access to their personal data;
10) appoint a person responsible for organising the processing of personal data.

8. Collection, Retention Period, and Use of Personal Data

23. The collection of personal data is carried out by gathering the personal data necessary and sufficient to fulfil the tasks performed by the Operator.

24. The retention period of personal data is determined by the date when the purposes of their collection and processing are achieved, unless otherwise stipulated by the legislation of the Republic of Kazakhstan.

25. The use of personal data is carried out by the Operator solely for the purposes previously stated during their collection.

9. Destruction of Personal Data

26. Personal data is subject to destruction by the Operator in the following cases:
1) upon expiration of the retention period;
2) upon achieving the specific, pre- determined, and lawful purposes of collecting personal data by the Operator;
3) upon withdrawal of consent by the User for the collection and processing of personal data;
4) upon the court decision coming into legal force;
5) in other cases stipulated by the Law and other regulatory legal acts of the Republic of Kazakhstan.

10. Final Provisions

27. The subject may withdraw their consent for the processing of personal data at any time by sending a notification to the Operator via email at pr@ardingly.edu.kz with the subject line “Withdrawal of Consent for the Processing of Personal Data.”

28. The use of the website by the User constitutes unconditional agreement with this Policy. Users expressly consent to the processing of personal data and information obtained in connection with the use of the website in the manner and under the conditions specified in this Policy.

29. If the User does not agree with the terms of this Policy, they must discontinue use of the website.

30. The Operator does not control and is not responsible for third-party websites that the User may access via links available on the website.

31. Any changes to the Operator’s personal data processing policy will be reflected in this document. The website Operator reserves the right to amend this Policy without User consent. Continued use of the website after such changes confirms the User's agreement to these changes.

32. This Policy is effective indefinitely until it is replaced by a new version.

33. The current version of the Policy is freely available online at the following address: https://ardingly.edu.kz/privacy-policy.