Personal Data Policy of the Көпір platform

Version 0.1 of 23 September 2026.

1. General provisions

1.1. This Policy describes what personal data the Көпір platform processes, why, and how it is protected.

1.2. The owner and operator of the personal data database is будет указано при запуске, BIN будет указано при запуске (the Operator).

1.3. This Policy is based on Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 "On personal data and their protection" (the Law).

1.4. The platform operates in test mode. The demo version uses synthetic data.

2. Data we process

2.1. Business representative: name of the organization, name and position of the representative, work contacts (email, phone, Telegram), task descriptions.

2.2. Student team: team name, description, interests, skills, technologies, proposals, contacts.

2.3. Technical data: data the browser stores on the User's device for the platform to work, IP address and server access logs.

2.4. Data for problem discovery (Discover section): if a business connects sources, meeting transcripts, work chat messages and information on application usage are processed. See section 7.

2.5. The platform does not request or use gender, age, ethnicity, religion, health, biometric or other sensitive information.

3. Purposes of processing

• publishing tasks and maintaining the catalog;
• sending and reviewing proposals;
• communication between businesses and student teams;
• recording confirmed milestones and team points;
• operation of the AI assistant;
• security of the platform.

Data is not processed for purposes incompatible with those listed.

4. Legal grounds

4.1. The Operator processes personal data with the consent of the data subject under Articles 7 and 8 of the Law. Consent is given electronically on the platform and may be withdrawn.

4.2. Without consent, data is processed only in the cases provided for by Article 9 of the Law.

4.3. If the data subject is under 18, consent is given by their legal representative.

5. AI assistant and cross-border transfer

5.1. For the AI assistant to work, the texts of tasks, answers and proposals are transferred to providers of artificial intelligence systems: OpenAI, NVIDIA. The providers' servers may be located outside the Republic of Kazakhstan.

5.2. Cross-border transfer is carried out under the rules of Article 16 of the Law.

5.3. To reduce risks, the platform finds personal data in the text and offers to depersonalize it before sending. Please do not include personal data of customers or employees in task descriptions.

6. Storage and retention

6.1. A database containing personal data of citizens of the Republic of Kazakhstan is stored in the territory of the Republic of Kazakhstan in accordance with Article 12 of the Law. The test version does not store real personal data.

6.2. Data is stored until the purposes of processing are achieved or consent is withdrawn, unless the law requires longer storage.

6.3. After that, data is destroyed or depersonalized under Articles 17 and 18 of the Law.

7. Business employees' data in the Discover section

7.1. A business connects sources voluntarily and is responsible for having a legal basis. Before connecting, the business informs its employees and obtains their consent where required.

7.2. A meeting is recorded only with the knowledge of all its participants.

7.3. In transcripts and messages, participants' names are replaced with roles.

7.4. Application usage is collected as application categories and events of moving data between them. The content of windows, documents and the clipboard is not stored.

7.5. The device identifier is replaced with a pseudonym and removed before the data is combined. Findings are made per team per week. A pattern is shown only if at least 5 people contribute to it.

8. Who receives the data

8.1. The card of a published task is visible to all student teams on the platform.

8.2. A proposal and the team profile are visible to the Business representative the proposal is sent to.

8.3. Data is processed by the Operator's service providers: hosting provider Vercel and the AI providers listed in clause 5.1. They act on the Operator's instructions and must keep the data confidential.

8.4. The Operator does not sell personal data and does not share it for advertising.

9. Rights of the data subject

Under Article 24 of the Law, the data subject has the right to:

• know that their data is processed and receive information about it;
• access their data;
• demand that their data be changed or supplemented;
• demand blocking and destruction of the data if the grounds for processing no longer exist;
• withdraw consent to processing;
• appeal the Operator's actions to the authorized body or to court.

Requests are sent to будет указано при запуске. The Operator responds within the periods set by the Law.

10. Data protection

10.1. The Operator takes legal, organizational and technical protection measures in accordance with Article 22 of the Law: restricts access, encrypts connections, stores access keys separately from the program code and keeps event logs.

10.2. In the event of a personal data security breach, the Operator acts as required by law, including notifying the authorized body and the data subjects.

11. Changes to this Policy

The Operator publishes a new version of this Policy on the platform with its number and date. Material changes are communicated to Users by message.

12. Contacts

будет указано при запуске, address будет указано при запуске, email будет указано при запуске.