1. General Provisions
1.1. This Personal Data Processing Policy is developed in accordance with the Law of the Republic of Kazakhstan
“On Personal Data and Their Protection”.
1.2. Personal Data Operator:
Individual Entrepreneur “Generation Next Academy”, IIN 810503000470.

2. Legal Grounds for Processing
2.1. Personal data is processed on the basis of:
consent of the data subject;
conclusion and execution of the Public Offer agreement.

3. Composition of Personal Data
3.1. The Operator processes only the user’s email address.

4. Data Processing Actions
The following actions may be performed:
collection;
recording;
storage;
use;
updating;
deletion;
destruction.

5. Data Retention Periods
5.1. Personal data is stored:
for the duration of the user’s use of the service;
or until consent is withdrawn and the account is deleted.
5.2. In the event of withdrawal of consent for personal data processing
or deletion of the User’s account,
personal data shall be destroyed within 30 (thirty) calendar days
from the date of receipt of the relevant request.

Destruction of personal data is carried out by irreversible deletion
from the Operator’s information systems.

After destruction of personal data, the Operator shall send the User an electronic confirmation of data destruction to the email address provided during registration.

6. Cross-Border Data Transfer
6.1. When using third-party services (Firebase, Google, RevenueCat), cross-border data transfer may occur.
6.2. Such transfer is carried out in accordance with international data protection standards and RK legislation.
6.3. The Operator applies the following measures to ensure the protection of personal data:
– technical measures: use of secure data transmission channels, encryption tools, and restriction of access to information systems;
– organizational measures: regulation of access to personal data, training of responsible personnel, and monitoring compliance with security requirements;
– access to personal data is granted strictly on a need-to-know basis, limited to the minimum necessary scope.

7. Rights of the Data Subject
The User has the right to:
know about the existence of their personal data;
receive information about processing;
request modification, blocking, or deletion;
withdraw consent to processing.

8. Request Procedure
8.1. All requests regarding personal data processing should be sent to:
📧 gna.ei.team@gmail.com
8.2. Response time — up to 10 business days.

9. Final Provisions
9.1. This Policy is publicly available on the Operator’s Website.
9.2. The Operator may amend this Policy with publication of the updated version.